Tech Support Forum - View Single Post

cindyp · 11-04-2008, 09:14 PM

Here's the RSIT log.txt

Logfile of random's system information tool 1.04 (written by random/random)
Run by mike at 2008-11-05 00:22:27
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 22 GB (57%) free of 38 GB
Total RAM: 511 MB (35% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:22:48 AM, on 11/5/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\MICROS~2\GAMECO~1\Common\SWTrayV4.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Program Files\PC Tools AntiVirus\PCTAV.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\mike\Desktop\RSIT.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Trend Micro\HijackThis\mike.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [SideWinderTrayV4] C:\PROGRA~1\MICROS~2\GAMECO~1\Common\SWTrayV4.exe
O4 - HKLM\..\Run: [hcsystray] C:\Program Files\Kuma Games\hcsystray\hc_tray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM
O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: PokerTime Poker - {7220F1C9-B7E0-47a6-A0BD-D5B3940BCC79} - C:\Microgaming\Poker\pokertimeMPP\MPPoker.exe
O9 - Extra button: Doyles Room Poker - {725E77D3-B919-4eef-8EEE-D09DE618B6C1} - C:\Microgaming\Poker\DoylesRoomMPP\MPPoker.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: CarbonPoker - {e4e8c758-34b4-44bb-8ef9-1f0786e81d2d} - C:\Documents and Settings\mike\Start Menu\Programs\CarbonPoker\CarbonPoker.lnk (HKCU)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1144112257468
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/Driver...sysreqlab2.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/.../installer.exe
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Regi...CX/flashax.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - PC Tools Research Pty Ltd - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe
O24 - Desktop Component 0: (no name) - http://www.uogamers.com/forum/images...artakus_bg.gif

--
End of file - 8853 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-09-15 1562960]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SideWinderTrayV4"=C:\PROGRA~1\MICROS~2\GAMECO~1\Common\SWTrayV4.exe [2000-06-02 24650]
"hcsystray"=C:\Program Files\Kuma Games\hcsystray\hc_tray.exe [2006-11-01 30928]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2007-12-05 8523776]
"nwiz"=nwiz.exe /install []
"P17Helper"=Rundll32 P17.dll []
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2007-12-05 81920]
"COMODO Firewall Pro"=C:\Program Files\COMODO\Firewall\cfp.exe [2008-10-30 1797880]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2008-09-06 413696]
"PCTAVApp"=C:\Program Files\PC Tools AntiVirus\PCTAV.exe [2008-09-25 1370000]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
"Aim6"=C:\Program Files\AIM6\aim6.exe [2008-01-03 50528]
"SUPERAntiSpyware"=C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [2008-10-14 1576176]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"=" C:\WINDOWS\system32\guard32.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL [2008-08-25 352256]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-02-15 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-20 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PCTAVSvc]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"RunStartupScriptSync"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"RunStartupScriptSync"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\EA Games\Ultima Online Mondain's Legacy\client.exe"="C:\Program Files\EA Games\Ultima Online Mondain's Legacy\client.exe:*:Enabled:client"
"C:\Program Files\Common Files\AOL\Loader\aolload.exe"="C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\CarbonPoker\client.exe"="C:\Program Files\CarbonPoker\client.exe:*:Enabled:Carbon Poker Client"
"C:\Program Files\Poker.com\client.exe"="C:\Program Files\Poker.com\client.exe:*:Enabled:Poker.com Client"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 2 months======

2008-11-05 00:22:27 ----D---- C:\rsit
2008-11-04 23:38:46 ----A---- C:\WINDOWS\gmer.ini
2008-11-04 23:38:45 ----RA---- C:\WINDOWS\gmer.exe
2008-11-04 23:38:45 ----A---- C:\WINDOWS\gmer_uninstall.cmd
2008-11-04 23:38:45 ----A---- C:\WINDOWS\gmer.dll
2008-11-04 01:39:36 ----A---- C:\WINDOWS\ntbtlog.txt
2008-10-24 20:59:15 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2008-10-19 17:21:44 ----D---- C:\Documents and Settings\mike\Application Data\PC Tools
2008-10-19 17:20:44 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2008-10-19 17:20:26 ----D---- C:\Program Files\Common Files\PC Tools
2008-10-19 17:20:17 ----D---- C:\Program Files\PC Tools AntiVirus
2008-10-19 17:20:17 ----D---- C:\Documents and Settings\All Users\Application Data\PC Tools
2008-10-19 16:23:00 ----D---- C:\Program Files\Lavasoft
2008-10-19 16:22:59 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-10-14 20:34:52 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2008-10-14 20:34:40 ----HDC---- C:\WINDOWS\$NtUninstallKB956391$
2008-10-14 20:34:23 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$
2008-10-14 20:33:17 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$
2008-10-14 20:32:55 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$
2008-09-20 19:28:42 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2008-09-20 08:08:34 ----D---- C:\Documents and Settings\All Users\Application Data\Google
2008-09-20 08:04:35 ----D---- C:\WINDOWS\Prefetch
2008-09-20 02:57:19 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2008-09-20 02:57:04 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2008-09-20 02:56:50 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2008-09-20 02:56:36 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
2008-09-20 02:56:23 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2008-09-20 02:56:09 ----HDC---- C:\WINDOWS\$NtUninstallKB951376$
2008-09-20 02:55:51 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2008-09-20 02:55:37 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2008-09-20 02:55:23 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2008-09-20 02:55:07 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2008-09-20 02:54:54 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
2008-09-20 02:49:10 ----D---- C:\WINDOWS\system32\scripting
2008-09-20 02:49:09 ----D---- C:\WINDOWS\l2schemas
2008-09-20 02:49:07 ----D---- C:\WINDOWS\system32\en
2008-09-20 02:49:06 ----D---- C:\WINDOWS\system32\bits
2008-09-20 02:45:01 ----D---- C:\WINDOWS\ServicePackFiles
2008-09-20 02:36:30 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2008-09-20 02:36:27 ----D---- C:\WINDOWS\EHome
2008-09-20 01:56:51 ----N---- C:\WINDOWS\system32\wmphoto.dll
2008-09-20 01:56:49 ----N---- C:\WINDOWS\system32\wlanapi.dll
2008-09-20 01:56:46 ----N---- C:\WINDOWS\system32\windowscodecsext.dll
2008-09-20 01:56:45 ----N---- C:\WINDOWS\system32\windowscodecs.dll
2008-09-20 01:56:18 ----N---- C:\WINDOWS\system32\tspkg.dll
2008-09-20 01:56:18 ----N---- C:\WINDOWS\system32\tsgqec.dll
2008-09-20 01:56:11 ----N---- C:\WINDOWS\system32\spupdwxp.exe
2008-09-20 01:56:08 ----A---- C:\WINDOWS\system32\spdwnwxp.exe
2008-09-20 01:56:06 ----N---- C:\WINDOWS\system32\slserv.exe
2008-09-20 01:56:06 ----N---- C:\WINDOWS\system32\slrundll.exe
2008-09-20 01:56:06 ----N---- C:\WINDOWS\system32\slgen.dll
2008-09-20 01:56:06 ----N---- C:\WINDOWS\system32\slextspk.dll
2008-09-20 01:56:06 ----N---- C:\WINDOWS\system32\slcoinst.dll
2008-09-20 01:56:06 ----N---- C:\WINDOWS\slrundll.exe
2008-09-20 01:56:01 ----N---- C:\WINDOWS\system32\setupn.exe
2008-09-20 01:55:58 ----N---- C:\WINDOWS\system32\s3gnb.dll
2008-09-20 01:55:57 ----N---- C:\WINDOWS\system32\rhttpaa.dll
2008-09-20 01:55:54 ----N---- C:\WINDOWS\system32\rasqec.dll
2008-09-20 01:55:53 ----N---- C:\WINDOWS\system32\qutil.dll
2008-09-20 01:55:49 ----N---- C:\WINDOWS\system32\qcliprov.dll
2008-09-20 01:55:49 ----N---- C:\WINDOWS\system32\qagentrt.dll
2008-09-20 01:55:49 ----N---- C:\WINDOWS\system32\qagent.dll
2008-09-20 01:55:46 ----N---- C:\WINDOWS\system32\photometadatahandler.dll
2008-09-20 01:55:43 ----N---- C:\WINDOWS\system32\onex.dll
2008-09-20 01:55:30 ----N---- C:\WINDOWS\system32\napstat.exe
2008-09-20 01:55:30 ----N---- C:\WINDOWS\system32\napmontr.dll
2008-09-20 01:55:30 ----N---- C:\WINDOWS\system32\napipsec.dll
2008-09-20 01:55:29 ----N---- C:\WINDOWS\system32\mtxparhd.dll
2008-09-20 01:55:29 ----N---- C:\WINDOWS\system32\msxml6r.dll
2008-09-20 01:55:28 ----N---- C:\WINDOWS\system32\msxml6.dll
2008-09-20 01:55:25 ----N---- C:\WINDOWS\system32\msshavmsg.dll
2008-09-20 01:55:25 ----N---- C:\WINDOWS\system32\mssha.dll
2008-09-20 01:55:09 ----N---- C:\WINDOWS\system32\mmcperf.exe
2008-09-20 01:55:09 ----N---- C:\WINDOWS\system32\mmcfxcommon.dll
2008-09-20 01:55:09 ----N---- C:\WINDOWS\system32\mmcex.dll
2008-09-20 01:55:09 ----N---- C:\WINDOWS\system32\microsoft.managementconsole.dll
2008-09-20 01:55:07 ----N---- C:\WINDOWS\system32\mdmxsdk.dll
2008-09-20 01:54:55 ----N---- C:\WINDOWS\system32\l2gpstore.dll
2008-09-20 01:54:54 ----N---- C:\WINDOWS\system32\kmsvc.dll
2008-09-20 01:54:54 ----N---- C:\WINDOWS\system32\kbdpash.dll
2008-09-20 01:54:54 ----N---- C:\WINDOWS\system32\kbdnepr.dll
2008-09-20 01:54:54 ----N---- C:\WINDOWS\system32\kbdiultn.dll
2008-09-20 01:54:54 ----N---- C:\WINDOWS\system32\kbdbhc.dll
2008-09-20 01:54:51 ----N---- C:\WINDOWS\system32\ir50_qcx.dll
2008-09-20 01:54:51 ----N---- C:\WINDOWS\system32\ir50_qc.dll
2008-09-20 01:54:51 ----N---- C:\WINDOWS\system32\ir50_32.dll
2008-09-20 01:54:41 ----N---- C:\WINDOWS\system32\hsfcisp2.dll
2008-09-20 01:54:35 ----N---- C:\WINDOWS\system32\faxpatch.exe
2008-09-20 01:54:35 ----A---- C:\WINDOWS\002776_.tmp
2008-09-20 01:54:32 ----N---- C:\WINDOWS\system32\eapsvc.dll
2008-09-20 01:54:32 ----N---- C:\WINDOWS\system32\eapqec.dll
2008-09-20 01:54:32 ----N---- C:\WINDOWS\system32\eappprxy.dll
2008-09-20 01:54:32 ----N---- C:\WINDOWS\system32\eapphost.dll
2008-09-20 01:54:32 ----N---- C:\WINDOWS\system32\eappgnui.dll
2008-09-20 01:54:32 ----N---- C:\WINDOWS\system32\eappcfg.dll
2008-09-20 01:54:32 ----N---- C:\WINDOWS\system32\eapp3hst.dll
2008-09-20 01:54:32 ----N---- C:\WINDOWS\system32\eapolqec.dll
2008-09-20 01:54:30 ----N---- C:\WINDOWS\system32\dot3ui.dll
2008-09-20 01:54:30 ----N---- C:\WINDOWS\system32\dot3svc.dll
2008-09-20 01:54:30 ----N---- C:\WINDOWS\system32\dot3msm.dll
2008-09-20 01:54:30 ----N---- C:\WINDOWS\system32\dot3gpclnt.dll
2008-09-20 01:54:30 ----N---- C:\WINDOWS\system32\dot3dlg.dll
2008-09-20 01:54:29 ----N---- C:\WINDOWS\system32\dot3cfg.dll
2008-09-20 01:54:29 ----N---- C:\WINDOWS\system32\dot3api.dll
2008-09-20 01:54:28 ----N---- C:\WINDOWS\system32\dimsroam.dll
2008-09-20 01:54:28 ----N---- C:\WINDOWS\system32\dimsntfy.dll
2008-09-20 01:54:27 ----N---- C:\WINDOWS\system32\dhcpqec.dll
2008-09-20 01:54:24 ----N---- C:\WINDOWS\system32\credssp.dll
2008-09-20 01:54:17 ----N---- C:\WINDOWS\system32\bitsprx4.dll
2008-09-20 01:54:17 ----N---- C:\WINDOWS\system32\azroles.dll
2008-09-20 01:54:15 ----N---- C:\WINDOWS\system32\ativvaxx.dll
2008-09-20 01:54:15 ----N---- C:\WINDOWS\system32\ativtmxx.dll
2008-09-20 01:54:14 ----N---- C:\WINDOWS\system32\ati3duag.dll
2008-09-20 01:54:14 ----N---- C:\WINDOWS\system32\ati3d1ag.dll
2008-09-20 01:54:14 ----N---- C:\WINDOWS\system32\ati2dvag.dll
2008-09-20 01:54:14 ----N---- C:\WINDOWS\system32\ati2dvaa.dll
2008-09-20 01:54:14 ----N---- C:\WINDOWS\system32\ati2cqag.dll
2008-09-20 01:54:08 ----N---- C:\WINDOWS\system32\aaclient.dll
2008-09-14 20:34:29 ----D---- C:\Program Files\Common Files\Apple
2008-09-14 20:34:12 ----D---- C:\Program Files\QuickTime
2008-09-14 20:32:25 ----D---- C:\Program Files\Apple Software Update
2008-09-10 07:36:31 ----HDC---- C:\WINDOWS\$NtUninstallKB938464_0$

======List of files/folders modified in the last 2 months======

2008-11-05 00:21:01 ----D---- C:\WINDOWS
2008-11-04 23:38:45 ----D---- C:\WINDOWS\system32\drivers
2008-11-04 22:53:53 ----D---- C:\WINDOWS\TEMP
2008-11-04 22:46:39 ----A---- C:\WINDOWS\SchedLgU.Txt
2008-11-04 01:40:59 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-04 00:57:31 ----D---- C:\WINDOWS\system32\CatRoot2
2008-11-03 00:56:46 ----AD---- C:\Program Files
2008-11-03 00:08:24 ----D---- C:\Program Files\Spybot - Search & Destroy
2008-11-02 09:01:07 ----D---- C:\WINDOWS\system32
2008-11-02 09:01:07 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-10-30 22:40:33 ----A---- C:\WINDOWS\system32\guard32.dll
2008-10-29 00:08:16 ----D---- C:\WINDOWS\Minidump
2008-10-24 20:59:24 ----HD---- C:\WINDOWS\inf
2008-10-24 20:59:17 ----RSHDC---- C:\WINDOWS\system32\dllcache
2008-10-24 20:58:35 ----HD---- C:\WINDOWS\$hf_mig$
2008-10-19 17:20:26 ----D---- C:\Program Files\Common Files
2008-10-19 16:24:17 ----SHD---- C:\WINDOWS\Installer
2008-10-19 16:22:28 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2008-10-19 10:07:50 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-19 08:24:31 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-10-19 00:25:17 ----D---- C:\Program Files\Yahoo!
2008-10-15 10:34:24 ----A---- C:\WINDOWS\system32\netapi32.dll
2008-10-14 23:49:36 ----D---- C:\WINDOWS\Debug
2008-10-14 20:57:17 ----D---- C:\Program Files\SUPERAntiSpyware
2008-10-14 20:36:08 ----D---- C:\Program Files\Internet Explorer
2008-10-14 20:33:38 ----D---- C:\WINDOWS\ie7updates
2008-10-12 22:42:14 ----D---- C:\Program Files\CarbonPoker
2008-10-07 13:19:40 ----A---- C:\WINDOWS\system32\MRT.exe
2008-10-03 22:01:56 ----D---- C:\Documents and Settings\mike\Application Data\Microgaming
2008-10-03 11:41:15 ----A---- C:\WINDOWS\system32\ieframe.dll
2008-09-23 20:50:57 ----D---- C:\Program Files\Bodog Poker
2008-09-20 19:24:13 ----D---- C:\Program Files\Google
2008-09-20 08:10:44 ----D---- C:\Documents and Settings\mike\Application Data\Google
2008-09-20 08:08:36 ----D---- C:\WINDOWS\system32\Adobe
2008-09-20 08:04:11 ----D---- C:\WINDOWS\system32\wbem
2008-09-20 08:04:11 ----D---- C:\WINDOWS\system32\Setup
2008-09-20 08:04:11 ----D---- C:\WINDOWS\AppPatch
2008-09-20 08:04:10 ----RSD---- C:\WINDOWS\Fonts
2008-09-20 08:03:27 ----D---- C:\WINDOWS\security
2008-09-20 02:58:53 ----D---- C:\WINDOWS\system32\CatRoot
2008-09-20 02:55:09 ----D---- C:\Program Files\Messenger
2008-09-20 02:49:53 ----D---- C:\WINDOWS\WinSxS
2008-09-20 02:49:39 ----D---- C:\WINDOWS\network diagnostic
2008-09-20 02:49:38 ----D---- C:\WINDOWS\ime
2008-09-20 02:49:38 ----D---- C:\WINDOWS\Help
2008-09-20 02:49:12 ----D---- C:\WINDOWS\system32\usmt
2008-09-20 02:49:12 ----D---- C:\WINDOWS\system32\en-US
2008-09-20 02:49:06 ----D---- C:\WINDOWS\PeerNet
2008-09-20 02:49:06 ----D---- C:\Program Files\Movie Maker
2008-09-20 02:44:52 ----D---- C:\WINDOWS\system32\Restore
2008-09-20 02:44:52 ----D---- C:\WINDOWS\system32\npp
2008-09-20 02:44:49 ----D---- C:\WINDOWS\msagent
2008-09-20 02:44:47 ----D---- C:\WINDOWS\srchasst
2008-09-20 02:44:46 ----D---- C:\Program Files\NetMeeting
2008-09-20 02:44:44 ----D---- C:\WINDOWS\system32\Com
2008-09-20 02:44:40 ----D---- C:\Program Files\Windows NT
2008-09-20 02:44:40 ----D---- C:\Program Files\Windows Media Player
2008-09-20 02:44:39 ----D---- C:\Program Files\Outlook Express
2008-09-20 02:44:35 ----D---- C:\Program Files\Common Files\System
2008-09-20 02:44:07 ----D---- C:\WINDOWS\system32\oobe
2008-09-20 02:44:05 ----D---- C:\WINDOWS\system
2008-09-20 02:39:49 ----D---- C:\WINDOWS\system32\ReinstallBackups
2008-09-14 20:34:08 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-09-07 10:55:47 ----D---- C:\Program Files\TruePoker

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK7;AMD K7 Processor Driver; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2008-04-13 37760]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver; C:\WINDOWS\System32\DRIVERS\cmdguard.sys [2008-10-30 99856]
R1 cmdHlp;COMODO Firewall Pro Helper Driver; C:\WINDOWS\System32\DRIVERS\cmdhlp.sys [2008-10-30 31504]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys []
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2007-03-01 28352]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-04 12032]
R2 AVFilter;AVFilter; C:\WINDOWS\system32\drivers\AVFilter.sys [2008-02-12 21904]
R3 AVHook;AVHook; C:\WINDOWS\system32\drivers\AVHook.sys [2007-12-06 28568]
R3 AVRec;AVRec; C:\WINDOWS\system32\drivers\AVRec.sys [2007-12-06 21912]
R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys [2005-01-10 138752]
R3 GcKernel;Microsoft SideWinder Value Add - Filter Driver; C:\WINDOWS\system32\DRIVERS\GcKernel.sys [2008-04-13 59136]
R3 HIDSwvd;Microsoft SideWinder Virtual HID Device Mini-Driver; C:\WINDOWS\system32\DRIVERS\HIDSwvd.sys [2001-08-17 2688]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2007-12-05 7435392]
R3 ossrv;Creative OS Services Driver; C:\WINDOWS\system32\DRIVERS\ctoss2k.sys [2005-01-10 106496]
R3 P17;SB Live! 24-bit; C:\WINDOWS\system32\drivers\P17.sys [2007-06-15 1127936]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
R3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS []
R3 scrcap;scrcap; C:\WINDOWS\system32\DRIVERS\scrcap.sys [2006-09-27 9006]
R3 SISNIC;SiS PCI Fast Ethernet Adapter Driver; C:\WINDOWS\system32\DRIVERS\sisnic.sys [2004-08-03 32768]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
S3 gmer;gmer; C:\WINDOWS\System32\DRIVERS\gmer.sys [2008-11-04 85969]
S3 TVICHW32;TVICHW32; \??\C:\WINDOWS\system32\DRIVERS\TVICHW32.SYS []
S3 vgadrv;vgadrv; C:\WINDOWS\system32\DRIVERS\vgadrv.sys [2006-06-10 8078]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-10-19 611664]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2007-07-24 229376]
R2 cmdAgent;COMODO Firewall Pro Helper Service; C:\Program Files\COMODO\Firewall\cmdagent.exe [2008-10-30 614136]
R2 Creative Service for CDROM Access;Creative Service for CDROM Access; C:\WINDOWS\system32\CTsvcCDA.exe [1999-12-12 44032]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2007-12-05 155716]
R2 PCTAVSvc;PC Tools AntiVirus Engine; C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe [2008-09-23 995520]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
R2 WMDM PMSP Service;WMDM PMSP Service; C:\WINDOWS\system32\MsPMSPSv.exe [2000-06-26 53520]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-03 69632]

-----------------EOF-----------------

11-04-2008, 09:14 PM	#4 (permalink)
cindyp Registered User Join Date: Aug 2007 Posts: 11 OS: xp	Re: HJT log Here's the RSIT log.txt Logfile of random's system information tool 1.04 (written by random/random) Run by mike at 2008-11-05 00:22:27 Microsoft Windows XP Home Edition Service Pack 3 System drive C: has 22 GB (57%) free of 38 GB Total RAM: 511 MB (35% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:22:48 AM, on 11/5/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\COMODO\Firewall\cmdagent.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\MICROS~2\GAMECO~1\Common\SWTrayV4.exe C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\COMODO\Firewall\cfp.exe C:\Program Files\PC Tools AntiVirus\PCTAV.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\mike\Desktop\RSIT.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program Files\Trend Micro\HijackThis\mike.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = .local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O4 - HKLM\..\Run: [SideWinderTrayV4] C:\PROGRA~1\MICROS~2\GAMECO~1\Common\SWTrayV4.exe O4 - HKLM\..\Run: [hcsystray] C:\Program Files\Kuma Games\hcsystray\hc_tray.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user') O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll O9 - Extra button: PokerTime Poker - {7220F1C9-B7E0-47a6-A0BD-D5B3940BCC79} - C:\Microgaming\Poker\pokertimeMPP\MPPoker.exe O9 - Extra button: Doyles Room Poker - {725E77D3-B919-4eef-8EEE-D09DE618B6C1} - C:\Microgaming\Poker\DoylesRoomMPP\MPPoker.exe O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: CarbonPoker - {e4e8c758-34b4-44bb-8ef9-1f0786e81d2d} - C:\Documents and Settings\mike\Start Menu\Programs\CarbonPoker\CarbonPoker.lnk (HKCU) O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/pcpitstop/PCPitStop.CAB O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1144112257468 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/Driver...sysreqlab2.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/.../installer.exe O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Regi...CX/flashax.cab O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - PC Tools Research Pty Ltd - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe O24 - Desktop Component 0: (no name) - http://www.uogamers.com/forum/images...artakus_bg.gif -- End of file - 8853 bytes ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}] Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-09-15 1562960] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "SideWinderTrayV4"=C:\PROGRA~1\MICROS~2\GAMECO~1\Common\SWTrayV4.exe [2000-06-02 24650] "hcsystray"=C:\Program Files\Kuma Games\hcsystray\hc_tray.exe [2006-11-01 30928] "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2007-12-05 8523776] "nwiz"=nwiz.exe /install [] "P17Helper"=Rundll32 P17.dll [] "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792] "NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2007-12-05 81920] "COMODO Firewall Pro"=C:\Program Files\COMODO\Firewall\cfp.exe [2008-10-30 1797880] "QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2008-09-06 413696] "PCTAVApp"=C:\Program Files\PC Tools AntiVirus\PCTAV.exe [2008-09-25 1370000] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360] "Aim6"=C:\Program Files\AIM6\aim6.exe [2008-01-03 50528] "SUPERAntiSpyware"=C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [2008-10-14 1576176] "SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2008-09-16 1833296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLS"=" C:\WINDOWS\system32\guard32.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL [2008-08-25 352256] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon] C:\WINDOWS\system32\WgaLogon.dll [2007-02-15 236928] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-20 77824] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PCTAVSvc] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] "RunStartupScriptSync"=1 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "RunStartupScriptSync"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveAutoRun"= "NoDriveTypeAutoRun"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\Program Files\EA Games\Ultima Online Mondain's Legacy\client.exe"="C:\Program Files\EA Games\Ultima Online Mondain's Legacy\client.exe::Enabled:client" "C:\Program Files\Common Files\AOL\Loader\aolload.exe"="C:\Program Files\Common Files\AOL\Loader\aolload.exe::Enabled:AOL Loader" "C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe::Enabled:Bonjour" "C:\Program Files\CarbonPoker\client.exe"="C:\Program Files\CarbonPoker\client.exe::Enabled:Carbon Poker Client" "C:\Program Files\Poker.com\client.exe"="C:\Program Files\Poker.com\client.exe::Enabled:Poker.com Client" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe::Enabled:@xpsp3res.dll,-20000" "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe::enabled:@xpsp2res.dll,-22019" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe::Enabled:@xpsp3res.dll,-20000" "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe::enabled:@xpsp2res.dll,-22019" ======List of files/folders created in the last 2 months====== 2008-11-05 00:22:27 ----D---- C:\rsit 2008-11-04 23:38:46 ----A---- C:\WINDOWS\gmer.ini 2008-11-04 23:38:45 ----RA---- C:\WINDOWS\gmer.exe 2008-11-04 23:38:45 ----A---- C:\WINDOWS\gmer_uninstall.cmd 2008-11-04 23:38:45 ----A---- C:\WINDOWS\gmer.dll 2008-11-04 01:39:36 ----A---- C:\WINDOWS\ntbtlog.txt 2008-10-24 20:59:15 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$ 2008-10-19 17:21:44 ----D---- C:\Documents and Settings\mike\Application Data\PC Tools 2008-10-19 17:20:44 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP 2008-10-19 17:20:26 ----D---- C:\Program Files\Common Files\PC Tools 2008-10-19 17:20:17 ----D---- C:\Program Files\PC Tools AntiVirus 2008-10-19 17:20:17 ----D---- C:\Documents and Settings\All Users\Application Data\PC Tools 2008-10-19 16:23:00 ----D---- C:\Program Files\Lavasoft 2008-10-19 16:22:59 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-10-14 20:34:52 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$ 2008-10-14 20:34:40 ----HDC---- C:\WINDOWS\$NtUninstallKB956391$ 2008-10-14 20:34:23 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$ 2008-10-14 20:33:17 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$ 2008-10-14 20:32:55 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$ 2008-09-20 19:28:42 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$ 2008-09-20 08:08:34 ----D---- C:\Documents and Settings\All Users\Application Data\Google 2008-09-20 08:04:35 ----D---- C:\WINDOWS\Prefetch 2008-09-20 02:57:19 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$ 2008-09-20 02:57:04 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$ 2008-09-20 02:56:50 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$ 2008-09-20 02:56:36 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$ 2008-09-20 02:56:23 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$ 2008-09-20 02:56:09 ----HDC---- C:\WINDOWS\$NtUninstallKB951376$ 2008-09-20 02:55:51 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$ 2008-09-20 02:55:37 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$ 2008-09-20 02:55:23 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$ 2008-09-20 02:55:07 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$ 2008-09-20 02:54:54 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$ 2008-09-20 02:49:10 ----D---- C:\WINDOWS\system32\scripting 2008-09-20 02:49:09 ----D---- C:\WINDOWS\l2schemas 2008-09-20 02:49:07 ----D---- C:\WINDOWS\system32\en 2008-09-20 02:49:06 ----D---- C:\WINDOWS\system32\bits 2008-09-20 02:45:01 ----D---- C:\WINDOWS\ServicePackFiles 2008-09-20 02:36:30 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$ 2008-09-20 02:36:27 ----D---- C:\WINDOWS\EHome 2008-09-20 01:56:51 ----N---- C:\WINDOWS\system32\wmphoto.dll 2008-09-20 01:56:49 ----N---- C:\WINDOWS\system32\wlanapi.dll 2008-09-20 01:56:46 ----N---- C:\WINDOWS\system32\windowscodecsext.dll 2008-09-20 01:56:45 ----N---- C:\WINDOWS\system32\windowscodecs.dll 2008-09-20 01:56:18 ----N---- C:\WINDOWS\system32\tspkg.dll 2008-09-20 01:56:18 ----N---- C:\WINDOWS\system32\tsgqec.dll 2008-09-20 01:56:11 ----N---- C:\WINDOWS\system32\spupdwxp.exe 2008-09-20 01:56:08 ----A---- C:\WINDOWS\system32\spdwnwxp.exe 2008-09-20 01:56:06 ----N---- C:\WINDOWS\system32\slserv.exe 2008-09-20 01:56:06 ----N---- C:\WINDOWS\system32\slrundll.exe 2008-09-20 01:56:06 ----N---- C:\WINDOWS\system32\slgen.dll 2008-09-20 01:56:06 ----N---- C:\WINDOWS\system32\slextspk.dll 2008-09-20 01:56:06 ----N---- C:\WINDOWS\system32\slcoinst.dll 2008-09-20 01:56:06 ----N---- C:\WINDOWS\slrundll.exe 2008-09-20 01:56:01 ----N---- C:\WINDOWS\system32\setupn.exe 2008-09-20 01:55:58 ----N---- C:\WINDOWS\system32\s3gnb.dll 2008-09-20 01:55:57 ----N---- C:\WINDOWS\system32\rhttpaa.dll 2008-09-20 01:55:54 ----N---- C:\WINDOWS\system32\rasqec.dll 2008-09-20 01:55:53 ----N---- C:\WINDOWS\system32\qutil.dll 2008-09-20 01:55:49 ----N---- C:\WINDOWS\system32\qcliprov.dll 2008-09-20 01:55:49 ----N---- C:\WINDOWS\system32\qagentrt.dll 2008-09-20 01:55:49 ----N---- C:\WINDOWS\system32\qagent.dll 2008-09-20 01:55:46 ----N---- C:\WINDOWS\system32\photometadatahandler.dll 2008-09-20 01:55:43 ----N---- C:\WINDOWS\system32\onex.dll 2008-09-20 01:55:30 ----N---- C:\WINDOWS\system32\napstat.exe 2008-09-20 01:55:30 ----N---- C:\WINDOWS\system32\napmontr.dll 2008-09-20 01:55:30 ----N---- C:\WINDOWS\system32\napipsec.dll 2008-09-20 01:55:29 ----N---- C:\WINDOWS\system32\mtxparhd.dll 2008-09-20 01:55:29 ----N---- C:\WINDOWS\system32\msxml6r.dll 2008-09-20 01:55:28 ----N---- C:\WINDOWS\system32\msxml6.dll 2008-09-20 01:55:25 ----N---- C:\WINDOWS\system32\msshavmsg.dll 2008-09-20 01:55:25 ----N---- C:\WINDOWS\system32\mssha.dll 2008-09-20 01:55:09 ----N---- C:\WINDOWS\system32\mmcperf.exe 2008-09-20 01:55:09 ----N---- C:\WINDOWS\system32\mmcfxcommon.dll 2008-09-20 01:55:09 ----N---- C:\WINDOWS\system32\mmcex.dll 2008-09-20 01:55:09 ----N---- C:\WINDOWS\system32\microsoft.managementconsole.dll 2008-09-20 01:55:07 ----N---- C:\WINDOWS\system32\mdmxsdk.dll 2008-09-20 01:54:55 ----N---- C:\WINDOWS\system32\l2gpstore.dll 2008-09-20 01:54:54 ----N---- C:\WINDOWS\system32\kmsvc.dll 2008-09-20 01:54:54 ----N---- C:\WINDOWS\system32\kbdpash.dll 2008-09-20 01:54:54 ----N---- C:\WINDOWS\system32\kbdnepr.dll 2008-09-20 01:54:54 ----N---- C:\WINDOWS\system32\kbdiultn.dll 2008-09-20 01:54:54 ----N---- C:\WINDOWS\system32\kbdbhc.dll 2008-09-20 01:54:51 ----N---- C:\WINDOWS\system32\ir50_qcx.dll 2008-09-20 01:54:51 ----N---- C:\WINDOWS\system32\ir50_qc.dll 2008-09-20 01:54:51 ----N---- C:\WINDOWS\system32\ir50_32.dll 2008-09-20 01:54:41 ----N---- C:\WINDOWS\system32\hsfcisp2.dll 2008-09-20 01:54:35 ----N---- C:\WINDOWS\system32\faxpatch.exe 2008-09-20 01:54:35 ----A---- C:\WINDOWS\002776_.tmp 2008-09-20 01:54:32 ----N---- C:\WINDOWS\system32\eapsvc.dll 2008-09-20 01:54:32 ----N---- C:\WINDOWS\system32\eapqec.dll 2008-09-20 01:54:32 ----N---- C:\WINDOWS\system32\eappprxy.dll 2008-09-20 01:54:32 ----N---- C:\WINDOWS\system32\eapphost.dll 2008-09-20 01:54:32 ----N---- C:\WINDOWS\system32\eappgnui.dll 2008-09-20 01:54:32 ----N---- C:\WINDOWS\system32\eappcfg.dll 2008-09-20 01:54:32 ----N---- C:\WINDOWS\system32\eapp3hst.dll 2008-09-20 01:54:32 ----N---- C:\WINDOWS\system32\eapolqec.dll 2008-09-20 01:54:30 ----N---- C:\WINDOWS\system32\dot3ui.dll 2008-09-20 01:54:30 ----N---- C:\WINDOWS\system32\dot3svc.dll 2008-09-20 01:54:30 ----N---- C:\WINDOWS\system32\dot3msm.dll 2008-09-20 01:54:30 ----N---- C:\WINDOWS\system32\dot3gpclnt.dll 2008-09-20 01:54:30 ----N---- C:\WINDOWS\system32\dot3dlg.dll 2008-09-20 01:54:29 ----N---- C:\WINDOWS\system32\dot3cfg.dll 2008-09-20 01:54:29 ----N---- C:\WINDOWS\system32\dot3api.dll 2008-09-20 01:54:28 ----N---- C:\WINDOWS\system32\dimsroam.dll 2008-09-20 01:54:28 ----N---- C:\WINDOWS\system32\dimsntfy.dll 2008-09-20 01:54:27 ----N---- C:\WINDOWS\system32\dhcpqec.dll 2008-09-20 01:54:24 ----N---- C:\WINDOWS\system32\credssp.dll 2008-09-20 01:54:17 ----N---- C:\WINDOWS\system32\bitsprx4.dll 2008-09-20 01:54:17 ----N---- C:\WINDOWS\system32\azroles.dll 2008-09-20 01:54:15 ----N---- C:\WINDOWS\system32\ativvaxx.dll 2008-09-20 01:54:15 ----N---- C:\WINDOWS\system32\ativtmxx.dll 2008-09-20 01:54:14 ----N---- C:\WINDOWS\system32\ati3duag.dll 2008-09-20 01:54:14 ----N---- C:\WINDOWS\system32\ati3d1ag.dll 2008-09-20 01:54:14 ----N---- C:\WINDOWS\system32\ati2dvag.dll 2008-09-20 01:54:14 ----N---- C:\WINDOWS\system32\ati2dvaa.dll 2008-09-20 01:54:14 ----N---- C:\WINDOWS\system32\ati2cqag.dll 2008-09-20 01:54:08 ----N---- C:\WINDOWS\system32\aaclient.dll 2008-09-14 20:34:29 ----D---- C:\Program Files\Common Files\Apple 2008-09-14 20:34:12 ----D---- C:\Program Files\QuickTime 2008-09-14 20:32:25 ----D---- C:\Program Files\Apple Software Update 2008-09-10 07:36:31 ----HDC---- C:\WINDOWS\$NtUninstallKB938464_0$ ======List of files/folders modified in the last 2 months====== 2008-11-05 00:21:01 ----D---- C:\WINDOWS 2008-11-04 23:38:45 ----D---- C:\WINDOWS\system32\drivers 2008-11-04 22:53:53 ----D---- C:\WINDOWS\TEMP 2008-11-04 22:46:39 ----A---- C:\WINDOWS\SchedLgU.Txt 2008-11-04 01:40:59 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-11-04 00:57:31 ----D---- C:\WINDOWS\system32\CatRoot2 2008-11-03 00:56:46 ----AD---- C:\Program Files 2008-11-03 00:08:24 ----D---- C:\Program Files\Spybot - Search & Destroy 2008-11-02 09:01:07 ----D---- C:\WINDOWS\system32 2008-11-02 09:01:07 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI 2008-10-30 22:40:33 ----A---- C:\WINDOWS\system32\guard32.dll 2008-10-29 00:08:16 ----D---- C:\WINDOWS\Minidump 2008-10-24 20:59:24 ----HD---- C:\WINDOWS\inf 2008-10-24 20:59:17 ----RSHDC---- C:\WINDOWS\system32\dllcache 2008-10-24 20:58:35 ----HD---- C:\WINDOWS\$hf_mig$ 2008-10-19 17:20:26 ----D---- C:\Program Files\Common Files 2008-10-19 16:24:17 ----SHD---- C:\WINDOWS\Installer 2008-10-19 16:22:28 ----D---- C:\Program Files\Common Files\Wise Installation Wizard 2008-10-19 10:07:50 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2008-10-19 08:24:31 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft 2008-10-19 00:25:17 ----D---- C:\Program Files\Yahoo! 2008-10-15 10:34:24 ----A---- C:\WINDOWS\system32\netapi32.dll 2008-10-14 23:49:36 ----D---- C:\WINDOWS\Debug 2008-10-14 20:57:17 ----D---- C:\Program Files\SUPERAntiSpyware 2008-10-14 20:36:08 ----D---- C:\Program Files\Internet Explorer 2008-10-14 20:33:38 ----D---- C:\WINDOWS\ie7updates 2008-10-12 22:42:14 ----D---- C:\Program Files\CarbonPoker 2008-10-07 13:19:40 ----A---- C:\WINDOWS\system32\MRT.exe 2008-10-03 22:01:56 ----D---- C:\Documents and Settings\mike\Application Data\Microgaming 2008-10-03 11:41:15 ----A---- C:\WINDOWS\system32\ieframe.dll 2008-09-23 20:50:57 ----D---- C:\Program Files\Bodog Poker 2008-09-20 19:24:13 ----D---- C:\Program Files\Google 2008-09-20 08:10:44 ----D---- C:\Documents and Settings\mike\Application Data\Google 2008-09-20 08:08:36 ----D---- C:\WINDOWS\system32\Adobe 2008-09-20 08:04:11 ----D---- C:\WINDOWS\system32\wbem 2008-09-20 08:04:11 ----D---- C:\WINDOWS\system32\Setup 2008-09-20 08:04:11 ----D---- C:\WINDOWS\AppPatch 2008-09-20 08:04:10 ----RSD---- C:\WINDOWS\Fonts 2008-09-20 08:03:27 ----D---- C:\WINDOWS\security 2008-09-20 02:58:53 ----D---- C:\WINDOWS\system32\CatRoot 2008-09-20 02:55:09 ----D---- C:\Program Files\Messenger 2008-09-20 02:49:53 ----D---- C:\WINDOWS\WinSxS 2008-09-20 02:49:39 ----D---- C:\WINDOWS\network diagnostic 2008-09-20 02:49:38 ----D---- C:\WINDOWS\ime 2008-09-20 02:49:38 ----D---- C:\WINDOWS\Help 2008-09-20 02:49:12 ----D---- C:\WINDOWS\system32\usmt 2008-09-20 02:49:12 ----D---- C:\WINDOWS\system32\en-US 2008-09-20 02:49:06 ----D---- C:\WINDOWS\PeerNet 2008-09-20 02:49:06 ----D---- C:\Program Files\Movie Maker 2008-09-20 02:44:52 ----D---- C:\WINDOWS\system32\Restore 2008-09-20 02:44:52 ----D---- C:\WINDOWS\system32\npp 2008-09-20 02:44:49 ----D---- C:\WINDOWS\msagent 2008-09-20 02:44:47 ----D---- C:\WINDOWS\srchasst 2008-09-20 02:44:46 ----D---- C:\Program Files\NetMeeting 2008-09-20 02:44:44 ----D---- C:\WINDOWS\system32\Com 2008-09-20 02:44:40 ----D---- C:\Program Files\Windows NT 2008-09-20 02:44:40 ----D---- C:\Program Files\Windows Media Player 2008-09-20 02:44:39 ----D---- C:\Program Files\Outlook Express 2008-09-20 02:44:35 ----D---- C:\Program Files\Common Files\System 2008-09-20 02:44:07 ----D---- C:\WINDOWS\system32\oobe 2008-09-20 02:44:05 ----D---- C:\WINDOWS\system 2008-09-20 02:39:49 ----D---- C:\WINDOWS\system32\ReinstallBackups 2008-09-14 20:34:08 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-09-07 10:55:47 ----D---- C:\Program Files\TruePoker ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 AmdK7;AMD K7 Processor Driver; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2008-04-13 37760] R1 cmdGuard;COMODO Firewall Pro Sandbox Driver; C:\WINDOWS\System32\DRIVERS\cmdguard.sys [2008-10-30 99856] R1 cmdHlp;COMODO Firewall Pro Helper Driver; C:\WINDOWS\System32\DRIVERS\cmdhlp.sys [2008-10-30 31504] R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592] R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [] R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys [] R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2007-03-01 28352] R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-04 12032] R2 AVFilter;AVFilter; C:\WINDOWS\system32\drivers\AVFilter.sys [2008-02-12 21904] R3 AVHook;AVHook; C:\WINDOWS\system32\drivers\AVHook.sys [2007-12-06 28568] R3 AVRec;AVRec; C:\WINDOWS\system32\drivers\AVRec.sys [2007-12-06 21912] R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys [2005-01-10 138752] R3 GcKernel;Microsoft SideWinder Value Add - Filter Driver; C:\WINDOWS\system32\DRIVERS\GcKernel.sys [2008-04-13 59136] R3 HIDSwvd;Microsoft SideWinder Virtual HID Device Mini-Driver; C:\WINDOWS\system32\DRIVERS\HIDSwvd.sys [2001-08-17 2688] R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368] R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2007-12-05 7435392] R3 ossrv;Creative OS Services Driver; C:\WINDOWS\system32\DRIVERS\ctoss2k.sys [2005-01-10 106496] R3 P17;SB Live! 24-bit; C:\WINDOWS\system32\drivers\P17.sys [2007-06-15 1127936] R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992] R3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS [] R3 scrcap;scrcap; C:\WINDOWS\system32\DRIVERS\scrcap.sys [2006-09-27 9006] R3 SISNIC;SiS PCI Fast Ethernet Adapter Driver; C:\WINDOWS\system32\DRIVERS\sisnic.sys [2004-08-03 32768] R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208] R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520] R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152] S3 gmer;gmer; C:\WINDOWS\System32\DRIVERS\gmer.sys [2008-11-04 85969] S3 TVICHW32;TVICHW32; \??\C:\WINDOWS\system32\DRIVERS\TVICHW32.SYS [] S3 vgadrv;vgadrv; C:\WINDOWS\system32\DRIVERS\vgadrv.sys [2006-06-10 8078] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-10-19 611664] R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2007-07-24 229376] R2 cmdAgent;COMODO Firewall Pro Helper Service; C:\Program Files\COMODO\Firewall\cmdagent.exe [2008-10-30 614136] R2 Creative Service for CDROM Access;Creative Service for CDROM Access; C:\WINDOWS\system32\CTsvcCDA.exe [1999-12-12 44032] R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2007-12-05 155716] R2 PCTAVSvc;PC Tools AntiVirus Engine; C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe [2008-09-23 995520] R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912] R2 WMDM PMSP Service;WMDM PMSP Service; C:\WINDOWS\system32\MsPMSPSv.exe [2000-06-26 53520] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144] S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-03 69632] -----------------EOF----------------- Last edited by cindyp; 11-04-2008 at 09:17 PM.