|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| HijackThis Log Help Get Rid Of Malware With Help From Our Analysts. Follow the "First Steps" link at the top right of each page before posting for help. |
 |
|
|
Thread Tools |
07-10-2008, 02:18 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jul 2008
Posts: 5
OS: Windows XP
|
I need help! Included HJT Log
Hi again! This is a log from my other computer. I know there is something on it, cause my Internet Explorer and Mozilla Firefox, keeps popping up with poker sites. So i really need help. I hope you experts can help me.
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:13:41, on 10-07-2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\stsystra.exe C:\Programmer\Java\jre1.6.0_05\bin\jusched.exe C:\Programmer\Creative\SBAudigy\Surround Mixer\CTSysVol.exe C:\WINDOWS\system32\Rundll32.exe C:\Programmer\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Programmer\iTunes\iTunesHelper.exe C:\Programmer\Search Settings\SearchSettings.exe C:\Documents and Settings\Bjarne\winlogon.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\programmer\steam\steam.exe C:\Programmer\Windows Live\Messenger\MsnMsgr.Exe C:\Programmer\Fælles filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Programmer\Skype\Phone\Skype.exe C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Programmer\OpenOffice.org 2.4\program\soffice.exe C:\Programmer\OpenOffice.org 2.4\program\soffice.BIN C:\Programmer\Bonjour\mDNSResponder.exe C:\WINDOWS\System32\tcpsvcs.exe C:\WINDOWS\System32\svchost.exe C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\Programmer\iPod\bin\iPodService.exe C:\WINDOWS\system32\wscntfy.exe C:\Programmer\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe C:\Programmer\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\WINDOWS\System32\svchost.exe C:\Programmer\Skype\Plugin Manager\skypePM.exe C:\Programmer\Internet Explorer\iexplore.exe C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\WINDOWS\Explorer.exe C:\Programmer\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file) O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [ATIPTA] "C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmer\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [CTSysVol] C:\Programmer\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [StartCCC] "C:\Programmer\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmer\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SearchSettings] C:\Programmer\Search Settings\SearchSettings.exe O4 - HKLM\..\Run: [Windows Logon Applicationedc] C:\Documents and Settings\Bjarne\winlogon.exe O4 - HKLM\..\Run: [f019ac5f] rundll32.exe "C:\WINDOWS\system32\koshqdkj.dll",b O4 - HKLM\..\Run: [AVP] "C:\Programmer\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" O4 - HKLM\..\Run: [BMf32a9fc3] Rundll32.exe "C:\WINDOWS\system32\njyoqliw.dll",s O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Steam] "c:\programmer\steam\steam.exe" -silent O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Programmer\Uniblue\RegistryBooster 2\RegistryBooster.exe /S O4 - HKCU\..\Run: [Uniblue Registry Booster] C:\Programmer\Uniblue\Registry Booster\RegistryBooster.exe /S O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJENESTE') O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOKAL TJENESTE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETVÆRKSTJENESTE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Startup: OpenOffice.org 2.4.lnk = C:\Programmer\OpenOffice.org 2.4\program\quickstart.exe O4 - Global Startup: hp psc 1000 series.lnk = ? O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Web Anti-Virus-statistik - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programmer\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Bjarne\Menuen Start\Programmer\IMVU\Run IMVU.lnk O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab O16 - DPF: {5CE72DD0-4695-4D18-A4D3-3367ACD37578} (F-Secure Health Check 1.0) - http://support.f-secure.com/enu/home...fshc/fscax.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/.../en/crlocx.ocx O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FLLESF~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programmer\Fælles filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Programmer\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe O23 - Service: Bonjour-tjeneste (Bonjour Service) - Apple Inc. - C:\Programmer\Bonjour\mDNSResponder.exe O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Programmer\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe -- End of file - 8638 bytes |
|
     
|
|
07-14-2008, 06:39 AM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Dùn Èideann,Scotland.
Posts: 2,478
OS: XP
|
Re: I need help! Included HJT Log
Hello and welcome to TSF
Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.
======= Logs Required C:\Deckard\System Scanner\main.txt C:\Deckard\System Scanner\extra.txt<----Attached |
|
|
|
|
07-26-2008, 05:24 PM
|
#3 (permalink) |
|
Registered User
Join Date: Jul 2008
Posts: 5
OS: Windows XP
|
Re: I need help! Included HJT Log
Hi and thanks. Sorry i've been on vacation. Hope you still will help.
Deckard's System Scanner v20071014.68 Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft Windows XP Professional (build 2600) SP 2.0 Architecture: X86; Language: Other (0406) - see http://preview.tinyurl.com/mhhp6 CPU 0: Intel(R) Pentium(R) 4 CPU 3.00GHz CPU 1: Intel(R) Pentium(R) 4 CPU 3.00GHz Percentage of Memory in Use: 58% Physical Memory (total/avail): 1022.07 MiB / 423.91 MiB Pagefile Memory (total/avail): 2459.24 MiB / 1817.26 MiB Virtual Memory (total/avail): 2047.88 MiB / 1935.02 MiB C: is Fixed (NTFS) - 127.99 GiB total, 32.79 GiB free. D: is Fixed (NTFS) - 74.5 GiB total, 13.97 GiB free. E: is Removable (No Media) F: is Removable (No Media) G: is Removable (No Media) H: is CDROM (CDFS) I: is Removable (No Media) \\.\PHYSICALDRIVE0 - ST3160828AS - 149.01 GiB - 1 partition \PARTITION0 (bootable) - Installable File System - 127.99 GiB - C: \\.\PHYSICALDRIVE1 - ST380013AS - 74.5 GiB - 1 partition \PARTITION0 (bootable) - Installable File System - 74.5 GiB - D: \\.\PHYSICALDRIVE2 - TEAC USB HS-CF Card USB Device \\.\PHYSICALDRIVE4 - TEAC USB HS-MS Card USB Device \\.\PHYSICALDRIVE5 - TEAC USB HS-SD Card USB Device \\.\PHYSICALDRIVE3 - TEAC USB HS-xD/SM USB Device -- Security Center ------------------------------------------------------------- AUOptions is scheduled to auto-install. Windows Internal Firewall is enabled. FW: Kaspersky Internet Security v7.0.0.125 (Kaspersky Lab) Disabled AV: AVG 7.5.526 v7.5.526 (Grisoft) Outdated AV: Kaspersky Internet Security v7.0.0.125 (Kaspersky Lab) Disabled Outdated [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Programmer\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Programmer\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\\Programmer\\Windows Live\\Messenger\\livecall.exe"="C:\\Programmer\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)" [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Programmer\\Grisoft\\AVG7\\avginet.exe"="C:\\Programmer\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe" "C:\\Programmer\\Grisoft\\AVG7\\avgamsvr.exe"="C:\\Programmer\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe" "C:\\Programmer\\Grisoft\\AVG7\\avgcc.exe"="C:\\Programmer\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe" "C:\\Programmer\\Grisoft\\AVG7\\avgemc.exe"="C:\\Programmer\\Grisoft\\AVG7\\avgemc.exe:*:Enabled:avgemc.exe" "C:\\Programmer\\Internet Explorer\\iexplore.exe"="C:\\Programmer\\Internet Explorer\\iexplore.exe:*:Enabled:Internet Explorer" "C:\\Programmer\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Programmer\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\\Programmer\\Windows Live\\Messenger\\livecall.exe"="C:\\Programmer\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)" "C:\\Programmer\\NAMCO BANDAI Games\\Warhammer Mark of Chaos\\Warhammer.exe"="C:\\Programmer\\NAMCO BANDAI Games\\Warhammer Mark of Chaos\\Warhammer.exe:*:Enabled:Warhammer®: Mark of Chaos™" "C:\\Programmer\\Warcraft III\\Warcraft III.exe"="C:\\Programmer\\Warcraft III\\Warcraft III.exe:*:Enabled:Warcraft III" "C:\\Programmer\\Bonjour\\mDNSResponder.exe"="C:\\Programmer\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" "C:\\Programmer\\Steam\\steamapps\\kill_som_times\\garrysmod\\hl2.exe"="C:\\Programmer\\Steam\\steamapps\\kill_som_times\\garrysmod\\hl2.exe:*:Enabled:hl2" "C:\\Programmer\\Steam\\steamapps\\kill_som_times\\counter-strike source\\hl2.exe"="C:\\Programmer\\Steam\\steamapps\\kill_som_times\\counter-strike source\\hl2.exe:*:Enabled:hl2" "C:\\Programmer\\Warcraft III\\War3.exe"="C:\\Programmer\\Warcraft III\\War3.exe:*:Enabled:Warcraft III" "C:\\Programmer\\Steam\\steamapps\\kill_som_times\\team fortress 2\\hl2.exe"="C:\\Programmer\\Steam\\steamapps\\kill_som_times\\team fortress 2\\hl2.exe:*:Enabled:hl2" "C:\\Programmer\\Steam\\steamapps\\kill_som_times\\condition zero\\hl.exe"="C:\\Programmer\\Steam\\steamapps\\kill_som_times\\condition zero\\hl.exe:*:Enabled:Half-Life Launcher" "C:\\Programmer\\uTorrent\\uTorrent.exe"="C:\\Programmer\\uTorrent\\uTorrent.exe:*:Enabled:µTorrent" "C:\\Programmer\\World of Warcraft\\WoW-2.3.0-enGB-downloader.exe"="C:\\Programmer\\World of Warcraft\\WoW-2.3.0-enGB-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\Programmer\\World of Warcraft\\BackgroundDownloader.exe"="C:\\Programmer\\World of Warcraft\\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader" "C:\\Programmer\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Programmer\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger" "C:\\Programmer\\Yahoo!\\Messenger\\YServer.exe"="C:\\Programmer\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server" "C:\\Documents and Settings\\Bjarne\\Skrivebord\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"="C:\\Documents and Settings\\Bjarne\\Skrivebord\\Call of Duty 4 - Modern Warfare\\iw3mp.exe:*:Enabled:iw3mp" "C:\\WINDOWS\\system32\\java.exe"="C:\\WINDOWS\\system32\\java.exe:*:Enabled:Java(TM) Platform SE binary" "C:\\Programmer\\Ankama Games\\DofusArenaBeta2\\DofusArena.exe"="C:\\Programmer\\Ankama Games\\DofusArenaBeta2\\DofusArena.exe:*:Enabled:Dofus Arena Client" "C:\\Programmer\\Warcraft III\\Frozen Throne.exe"="C:\\Programmer\\Warcraft III\\Frozen Throne.exe:*:Enabled:Warcraft III - The Frozen Throne" "C:\\Programmer\\Steam\\steamapps\\common\\trackmania nations forever\\TmForever.exe"="C:\\Programmer\\Steam\\steamapps\\common\\trackmania nations forever\\TmForever.exe:*:Enabled:TmForever" "C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test" "C:\\WINDOWS\\system32\\rundll32.exe"="C:\\WINDOWS\\system32\\rundll32.exe:*:Enabled:Kør en DLL som et program" "C:\\Programmer\\iTunes\\iTunes.exe"="C:\\Programmer\\iTunes\\iTunes.exe:*:Enabled:iTunes" "C:\\Programmer\\LimeWire\\LimeWire.exe"="C:\\Programmer\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "C:\\Documents and Settings\\Bjarne\\Skrivebord\\Warcraft III\\Warcraft III.exe"="C:\\Documents and Settings\\Bjarne\\Skrivebord\\Warcraft III\\Warcraft III.exe:*:Enabled:Warcraft III" "C:\\Programmer\\MAIET\\Gunz\\GunzLauncher.exe"="C:\\Programmer\\MAIET\\Gunz\\GunzLauncher.exe:*:Enabled:GunzLauncher" "C:\\Programmer\\Skype\\Phone\\Skype.exe"="C:\\Programmer\\Skype\\Phone\\Skype.exe:*:Enabled:Skype. Take a deep breath " -- Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\Bjarne\Application Data CLASSPATH=.;C:\Programmer\Java\jre1.6.0_05\lib\ext\QTJava.zip CLIENTNAME=Console CommonProgramFiles=C:\Programmer\F‘lles filer COMPUTERNAME=BJARNE-OY06CWLU ComSpec=C:\WINDOWS\system32\cmd.exe FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Documents and Settings\Bjarne LOGONSERVER=\\BJARNE-OY06CWLU NUMBER_OF_PROCESSORS=2 OS=Windows_NT Path=C:\Programmer\Windows Live\Messenger\;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Programmer\Support Tools\;C:\Programmer\ATI Technologies\ATI Control Panel;C:\Programmer\ATI Technologies\ATI.ACE\Core-Static;C:\Programmer\QuickTime\QTSystem\ PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 3, GenuineIntel PROCESSOR_LEVEL=15 PROCESSOR_REVISION=0403 ProgramFiles=C:\Programmer PROMPT=$P$G QTJAVA=C:\Programmer\Java\jre1.6.0_05\lib\ext\QTJava.zip SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\Bjarne\LOKALE~1\Temp TMP=C:\DOCUME~1\Bjarne\LOKALE~1\Temp USERDOMAIN=BJARNE-OY06CWLU USERNAME=Bjarne USERPROFILE=C:\Documents and Settings\Bjarne windir=C:\WINDOWS -- User Profiles --------------------------------------------------------------- Bjarne (admin) Jacob (admin) -- Add/Remove Programs --------------------------------------------------------- --> "C:\Programmer\Creative\SBAudigy\Program\Setup.exe" /S /U /W --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{32B4B536-4443-42F0-9676-98373BE9114F}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{32B4B536-4443-42F0-9676-98373BE9114F}\setup.exe" -l0x9 /remove --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{34EBD418-B8E6-4E86-89C4-33B72CF5663F}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{34EBD418-B8E6-4E86-89C4-33B72CF5663F}\setup.exe" -l0x9 /remove --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{52338F65-A1C3-4CDC-B733-50051682B297}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{52338F65-A1C3-4CDC-B733-50051682B297}\setup.exe" -l0x9 /remove --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{569A9538-86EC-44C3-8EE4-C68B165F2A75}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{569A9538-86EC-44C3-8EE4-C68B165F2A75}\setup.exe" -l0x9 /remove --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{5B17E626-7885-4FC3-A66A-73548A4F01FD}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{5B17E626-7885-4FC3-A66A-73548A4F01FD}\setup.exe" -l0x9 /remove --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{63A317D0-60A6-43FC-848A-9FE4A53B29CE}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x9 /remove --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{73919E2B-725C-4FAA-8473-45E063A3575F}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{73919E2B-725C-4FAA-8473-45E063A3575F}\setup.exe" -l0x9 /remove --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{84F573D3-0F71-4768-978A-D35310E3FBA6}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{84F573D3-0F71-4768-978A-D35310E3FBA6}\setup.exe" -l0x9 /remove --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{9194237B-7B58-40B4-A739-184AD59531A2}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{9194237B-7B58-40B4-A739-184AD59531A2}\setup.exe" -l0x9 /remove --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{A82F10CB-18B5-4EAC-AEF2-FA49CD565626}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{BD6928A2-9F8F-4AA7-9A3A-FD4A271712EE}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{BD6928A2-9F8F-4AA7-9A3A-FD4A271712EE}\setup.exe" -l0x9 /remove --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{DE4A4C48-2232-4CCB-AD61-490ACD29BA85}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{DE4A4C48-2232-4CCB-AD61-490ACD29BA85}\setup.exe" -l0x9 /remove --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf Absolute Sound Recorder version 3.3.9 --> "C:\Programmer\Absolute Sound Recorder\unins000.exe" ActiveX sikkerhedssoftware --> MsiExec.exe /I{05D5D3AE-BD98-40C6-9ED5-70F54EC42FA9} Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742) --> MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7} Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe Adobe Flash Player Plugin --> C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe Adobe Reader 8.1.2 - Dansk --> MsiExec.exe /I{AC76BA86-7AD7-1030-7B44-A81200000003} Adobe Reader 8.1.2 Security Update 1 (KB403742) --> Apple Mobile Device Support --> MsiExec.exe /I{44734179-8A79-4DEE-BB08-73037F065543} Apple Software Update --> MsiExec.exe /I{02DFF6B1-1654-411C-8D7B-FD6052EF016F} Application Compatibility Toolkit --> MsiExec.exe /X{B4CF72FF-4A3F-44A7-BFF2-31A8E1CC70B6} ATI - Software Uninstall Utility --> C:\Programmer\ATI Technologies\UninstallAll\AtiCimUn.exe ATI Catalyst Control Center --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x5357 ATI Control Panel --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}\setup.exe" ATI Display Driver --> rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean µTorrent --> "C:\Programmer\uTorrent\uTorrent.exe" /UNINSTALL AVG 7.5 --> C:\Programmer\Grisoft\AVG7\setup.exe /UNINSTALL AVG Anti-Spyware 7.5 --> C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe Bonjour --> MsiExec.exe /I{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3} Condition Zero --> "C:\Programmer\Steam\steam.exe" steam://uninstall/80 Counter-Strike: Source --> "C:\Programmer\Steam\steam.exe" steam://uninstall/240 Creative System Information --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{63A317D0-60A6-43FC-848A-9FE4A53B29CE}\setup.exe" -l0x9 /remove Dofus-Arena --> C:\Programmer\Ankama Games\DofusArenaBeta2\uninstall.exe Dofus 1.22.0 --> C:\Programmer\Dofus\uninstall.exe Enclave --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{8AC01A0D-42B6-4A55-AD7A-A545A7AE5364}\Setup.exe" -l0x9 Free Games Offer, Desktop Shortcut --> MsiExec.exe /X{31DABA20-10A1-4746-9D9F-57955B8DFF66} Garmin City Navigator Europe NT 2008 Update --> MsiExec.exe /X{F89078FA-D069-462D-AB34-75483E0A38F1} Garry's Mod --> "C:\Programmer\Steam\steam.exe" steam://uninstall/4000 GIMP 2.4.5 --> "C:\Programmer\GIMP-2.0\setup\unins000.exe" GYLDENDALS DVD leksikon 1.0 --> C:\Programmer\GYLDENDALS DVD leksikon\uninstall.exe Half-Life 2 --> "C:\Programmer\Steam\steam.exe" steam://uninstall/220 Half-Life 2: Episode Two --> "C:\Programmer\Steam\steam.exe" steam://uninstall/420 Heroes of Might and Magic 3 Incl. Mission Pack --> C:\WINDOWS\unvise32.exe C:\Programmer\Heroes of Might and Magic 3\uninstal.log High Definition Audio Driver Package - KB835221 --> C:\WINDOWS\$NtUninstallKB835221WXP$\spuninst\spuninst.exe HijackThis 2.0.2 --> "C:\Programmer\Trend Micro\HijackThis\HijackThis.exe" /uninstall Hotfix for Windows Media Format 11 SDK (KB929399) --> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe" HouseCall 6.6 --> "C:\Documents and Settings\Bjarne\Application Data\HouseCall 6.6\uninstaller.exe" HP Billed-cd --> MsiExec.exe /X{B376402D-58EA-45EA-BD50-DD924EB67A70} HP Photo and Imaging 2.0 - All-in-One --> MsiExec.exe /X{9867A917-5D17-40DE-83BA-BEA5293194B1} HP Photo and Imaging 2.0 - All-in-One Drivers --> MsiExec.exe /X{6ECB39BD-73C2-44DD-B1A0-898207C58D8B} HP Photo and Imaging 2.0 - hp psc 1200 series --> C:\Programmer\Hewlett-Packard\Digital Imaging\{7C8BB31C-E09E-4c7d-BBF1-45E33B467FE1}\Setup\hpzscr01.exe -datfile hposcr02.dat -forcereboot hp psc 1200 series --> MsiExec.exe /X{C900EF06-2E76-49C7-8DB0-41F629B21DC5} IMVU Avatar Chat Software --> C:\Programmer\IMVU\Uninstall.exe Intel(R) PRO Network Connections Drivers --> Prounstl.exe iTunes --> MsiExec.exe /I{585776BC-4BD6-4BD2-A19A-1D6CB44A403B} Java(TM) 6 Update 3 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030} Java(TM) 6 Update 5 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050} Kaspersky Internet Security 7.0 --> MsiExec.exe /I{C774410D-3EF9-4DE7-AC01-332613163ECF} Kaspersky Internet Security 7.0 --> MsiExec.exe /I{C774410D-3EF9-4DE7-AC01-332613163ECF} Lunia --> "C:\cdcgames\lunia\uninstall.exe" Macromedia Flash MX --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{3BE480ED-E17A-431A-981C-5C2EDDBCD3BF}\Setup.exe" -l0x9 UNINSTALL MAGGI --> C:\WINDOWS\uninst.exe -fC:\Programmer\SOLLAB\MAGGI\DeIsL1.isu -cC:\Programmer\SOLLAB\MAGGI\_ISREG32.DLL MapleStory --> MsiExec.exe /I{92F1DEA6-C1D0-44DC-9A94-FC2DD0BD7BD1} Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe" Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe" Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7} Microsoft Word 2000 SR-1 --> MsiExec.exe /I{00170406-78E1-11D2-B60F-006097C998E7} MobMap 1.58 --> "C:\Programmer\MobMapUpdater\unins000.exe" Mozilla Firefox (2.0.0.15) --> C:\PROGRA~1\Mozilla Firefox\uninstall\helper.exe Opdatering til Windows XP (KB894391) --> "C:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe" Opdatering til Windows XP (KB898461) --> "C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe" Opdatering til Windows XP (KB900485) --> "C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe" Opdatering til Windows XP (KB908531) --> "C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe" Opdatering til Windows XP (KB910437) --> "C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe" Opdatering til Windows XP (KB911280) --> "C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe" Opdatering til Windows XP (KB916595) --> "C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe" Opdatering til Windows XP (KB920872) --> "C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe" Opdatering til Windows XP (KB922582) --> "C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe" Opdatering til Windows XP (KB927891) --> "C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe" Opdatering til Windows XP (KB930916) --> "C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe" Opdatering til Windows XP (KB936357) --> "C:\WINDOWS\$NtUninstallKB936357$\spuninst\spuninst.exe" Opdatering til Windows XP (KB938828) --> "C:\WINDOWS\$NtUninstallKB938828$\spuninst\spuninst.exe" Opdatering til Windows XP (KB942763) --> "C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe" Opdatering til Windows XP (KB942840) --> "C:\WINDOWS\$NtUninstallKB942840$\spuninst\spuninst.exe" OpenOffice.org 2.4 --> MsiExec.exe /I{52F4279C-AA45-4AD7-A9B9-885B1A9E84F6} Paint.NET v3.30 --> MsiExec.exe /X{FF09A6A1-4DE5-467D-AA26-EF18C0EA4DAB} QuickTime --> MsiExec.exe /I{1838C5A2-AB32-4145-85C1-BB9B8DFA24CD} Safari --> MsiExec.exe /I{F0E8F94D-6E68-4B35-92DF-3AA6DC6A6768} Search Settings 1.2 --> MsiExec.exe /X{D0C73318-7B4A-4D16-A0C4-3B83F075EA88} SigmaTel Audio --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}\setup.exe" -l0x9 -remove -removeonly Sikkerhedsopdatering til Windows XP (KB890046) --> "C:\WINDOWS\$NtUninstallKB890046$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB893756) --> "C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB896358) --> "C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB896423) --> "C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB896428) --> "C:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB899587) --> "C:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB899591) --> "C:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB900725) --> "C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB901017) --> "C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB901190) --> "C:\WINDOWS\$NtUninstallKB901190$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB901214) --> "C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB902400) --> "C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB905414) --> "C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB905749) --> "C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB908519) --> "C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB911562) --> "C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB911927) --> "C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB913580) --> "C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB914388) --> "C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB914389) --> "C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB917344) --> "C:\WINDOWS\$NtUninstallKB917344$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB918118) --> "C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB918439) --> "C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB919007) --> "C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB920213) --> "C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB920670) --> "C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB920683) --> "C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB920685) --> "C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB922819) --> "C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB923191) --> "C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB923414) --> "C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB923689) --> "C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB923980) --> "C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB924270) --> "C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB924496) --> "C:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB924667) --> "C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB925902) --> "C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB926255) --> "C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB926436) --> "C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB927779) --> "C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB927802) --> "C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB928255) --> "C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB928843) --> "C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB929123) --> "C:\WINDOWS\$NtUninstallKB929123$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB930178) --> "C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB931261) --> "C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB931784) --> "C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB932168) --> "C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB933729) --> "C:\WINDOWS\$NtUninstallKB933729$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB935839) --> "C:\WINDOWS\$NtUninstallKB935839$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB935840) --> "C:\WINDOWS\$NtUninstallKB935840$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB936021) --> "C:\WINDOWS\$NtUninstallKB936021$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB937894) --> "C:\WINDOWS\$NtUninstallKB937894$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB938127) --> "C:\WINDOWS\$NtUninstallKB938127$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB938829) --> "C:\WINDOWS\$NtUninstallKB938829$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB941202) --> "C:\WINDOWS\$NtUninstallKB941202$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB941568) --> "C:\WINDOWS\$NtUninstallKB941568$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB941569) --> "C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB941644) --> "C:\WINDOWS\$NtUninstallKB941644$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB941693) --> "C:\WINDOWS\$NtUninstallKB941693$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB943055) --> "C:\WINDOWS\$NtUninstallKB943055$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB943460) --> "C:\WINDOWS\$NtUninstallKB943460$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB943485) --> "C:\WINDOWS\$NtUninstallKB943485$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB944338) --> "C:\WINDOWS\$NtUninstallKB944338$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB944533) --> "C:\WINDOWS\$NtUninstallKB944533$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB944653) --> "C:\WINDOWS\$NtUninstallKB944653$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB945553) --> "C:\WINDOWS\$NtUninstallKB945553$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB946026) --> "C:\WINDOWS\$NtUninstallKB946026$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB947864) --> "C:\WINDOWS\$NtUninstallKB947864$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB948590) --> "C:\WINDOWS\$NtUninstallKB948590$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB948881) --> "C:\WINDOWS\$NtUninstallKB948881$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB950749) --> "C:\WINDOWS\$NtUninstallKB950749$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB950759) --> "C:\WINDOWS\$NtUninstallKB950759$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB950760) --> "C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB950762) --> "C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB951376-v2) --> "C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB951376) --> "C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe" Sikkerhedsopdatering til Windows XP (KB951698) --> "C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe" SIW version 1.73 --> "C:\Programmer\SIW\unins000.exe" Skype™ 3.6 --> MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82} Sound Blaster Audigy --> RunDll32 C:\PROGRA~1\FLLESF~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programmer\InstallShield Installation Information\{1B1DDAD2-C704-49F8-8FC2-18DAAD9A87C5}\SETUP.EXE" -l0x9 /remove SpeechRedist --> MsiExec.exe /X{8795CBED-55E2-4693-9F14-84EC446935BE} Steam --> MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3} Team Fortress 2 --> "C:\Programmer\Steam\steam.exe" steam://uninstall/440 Tilmeldingsassistent til Windows Live --> MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986} TrackMania Nations Forever --> "C:\Programmer\Steam\steam.exe" steam://uninstall/11020 Unreal Tournament 2004 --> C:\UT2004\System\Setup.exe uninstall "UT2004" UT2004 Editor's Choice Edition Mod Installer --> MsiExec.exe /I{88D5B052-13BF-44FE-8C17-AC416B323BFE} Wakfu --> C:\Programmer\Wakfu\uninstall.exe Warhammer Mark of Chaos --> C:\Programmer\InstallShield Installation Information\{5F374D5D-DB43-4263-9C29-BAB2C93FEFE6}\Setup.exe -runfromtemp -l0x0009 -removeonly Windows Live installer --> MsiExec.exe /X{38092A00-F9C8-420F-B5CB-C56F89F94B12} Windows Live Messenger --> MsiExec.exe /X{1EDF0646-14CE-46FE-8785-9E12E29686DF} Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe" Windows Support Tools --> MsiExec.exe /I{8398B542-3CC4-44D9-83DF-696CCE70124B} WinRAR archiver --> C:\Programmer\WinRAR\uninstall.exe World of Warcraft --> C:\Programmer\Fælles filer\Blizzard Entertainment\World of Warcraft\Uninstall.exe -- Application Event Log ------------------------------------------------------- Event Record #/Type1632 / Error Event Submitted/Written: 07/27/2008 02:20:41 AM Event ID/Source: 1002 / Application Hang Event Description: Stoppet program iexplore.exe, version 6.0.2900.2180, stoppet modul hungapp, version 0.0.0.0, stoppet adresse 0x00000000. Event Record #/Type1610 / Success Event Submitted/Written: 07/27/2008 02:07:35 AM Event ID/Source: 12001 / usnjsvc Event Description: The Messenger Sharing USN Journal Reader service started successfully. Event Record #/Type1588 / Error Event Submitted/Written: 07/11/2008 10:31:33 AM Event ID/Source: 1000 / Application Error Event Description: Fejlagtigt program iexplore.exe, version 6.0.2900.2180, fejlagtigt modul unknown, version 0.0.0.0, fejlagtig adresse 0x0152155f. Mediespecifik hændelse behandles for [iexplore.exe!ws!] Event Record #/Type1587 / Error Event Submitted/Written: 07/11/2008 10:29:59 AM Event ID/Source: 1000 / Application Error Event Description: Fejlagtigt program firefox.exe, version 1.8.20080.62306, fejlagtigt modul unknown, version 0.0.0.0, fejlagtig adresse 0x01ce1557. Mediespecifik hændelse behandles for [firefox.exe!ws!] Event Record #/Type1578 / Error Event Submitted/Written: 07/11/2008 08:46:36 AM Event ID/Source: 1015 / Winlogon Event Description: En kritisk systemproces, C:\WINDOWS\system32\lsass.exe, mislykkedes med statuskoden c0000005. Computeren skal genstartes. -- Security Event Log ---------------------------------------------------------- No Errors/Warnings found. -- System Event Log ------------------------------------------------------------ Event Record #/Type12349 / Error Event Submitted/Written: 07/27/2008 02:05:50 AM Event ID/Source: 7 / Cdrom Event Description: Enheden \Device\CdRom0 havde en fejlbehæftet blok. Event Record #/Type12345 / Warning Event Submitted/Written: 07/27/2008 02:04:19 AM Event ID/Source: 1003 / Dhcp Event Description: Computeren kunne ikke forny sin adresse fra netværket (fra DHCP-serveren) for netværkskortet med netværksadressen 00123FB6FA2B. Der opstod følgende fejl: %%121. Computeren vil fortsat forsøge at få tildelt en adresse fra netværksadresseserveren (DHCP). Event Record #/Type12328 / Error Event Submitted/Written: 07/27/2008 01:59:37 AM / 07/27/2008 01:59:56 AM Event ID/Source: 12294 / ati2mtag Event Description: CRT invalid display type Event Record #/Type12311 / Error Event Submitted/Written: 07/26/2008 11:57:04 PM / 07/26/2008 11:57:28 PM Event ID/Source: 12294 / ati2mtag Event Description: CRT invalid display type Event Record #/Type12310 / Error Event Submitted/Written: 07/26/2008 11:57:00 PM / 07/26/2008 11:57:28 PM Event ID/Source: 7 / Cdrom Event Description: Enheden \Device\CdRom0 havde en fejlbehæftet blok. -- End of Deckard's System Scanner: finished at 2008-07-27 02:21:08 ------------ |
|
|
|
|
07-27-2008, 01:06 PM
|
#5 (permalink) |
|
Registered User
Join Date: Jul 2008
Posts: 5
OS: Windows XP
|
Re: I need help! Included HJT Log
Oh i thight it was in my other post <.< Here it is.
Deckard's System Scanner v20071014.68 Run by Bjarne on 2008-07-27 22:05:04 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as Bjarne.exe) ---------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:05:06, on 27-07-2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\stsystra.exe C:\Programmer\Java\jre1.6.0_05\bin\jusched.exe C:\Programmer\Creative\SBAudigy\Surround Mixer\CTSysVol.exe C:\WINDOWS\system32\Rundll32.exe C:\Programmer\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Programmer\iTunes\iTunesHelper.exe C:\Programmer\Search Settings\SearchSettings.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Programmer\OpenOffice.org 2.4\program\soffice.exe C:\Programmer\OpenOffice.org 2.4\program\soffice.BIN C:\Programmer\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Programmer\Fælles filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Programmer\Bonjour\mDNSResponder.exe C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\WINDOWS\System32\tcpsvcs.exe C:\WINDOWS\System32\svchost.exe C:\Programmer\iPod\bin\iPodService.exe C:\Programmer\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\PROGRA~1\Mozilla Firefox\firefox.exe C:\Programmer\Windows Live\Messenger\usnsvc.exe C:\Programmer\Internet Explorer\iexplore.exe C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\WINDOWS\system32\msiexec.exe C:\WINDOWS\system32\wuauclt.exe C:\Programmer\Windows Live\installer\WLSetupSvc.exe C:\WINDOWS\notepad.exe C:\Documents and Settings\Bjarne\Skrivebord\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Bjarne.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file) O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: (no name) - {605BA61C-6840-495A-843F-538E9F47C096} - C:\WINDOWS\system32\ddcaWnnO.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Hjælp til tilmelding til Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: {4a207240-26f3-9e39-bc64-a36b58204139} - {93140285-b63a-46cb-93e9-3f62042702a4} - C:\WINDOWS\system32\chwoqt.dll O2 - BHO: (no name) - {D0A48538-8CA4-4145-BDFC-1C2C9406C107} - C:\WINDOWS\system32\iiffDWmL.dll (file missing) O2 - BHO: (no name) - {E91C2855-AC7E-4ED9-B488-0F78FAE8AD2D} - C:\WINDOWS\system32\urqRLDVP.dll (file missing) O2 - BHO: (no name) - {FF332D6F-D61F-48F0-B623-311B078ED47E} - C:\WINDOWS\system32\xxyvtUNG.dll (file missing) O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [ATIPTA] "C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmer\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [CTSysVol] C:\Programmer\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [StartCCC] "C:\Programmer\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmer\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SearchSettings] C:\Programmer\Search Settings\SearchSettings.exe O4 - HKLM\..\Run: [Windows Logon Applicationedc] C:\Documents and Settings\Bjarne\winlogon.exe O4 - HKLM\..\Run: [AVP] "C:\Programmer\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" O4 - HKLM\..\Run: [f019ac5f] rundll32.exe "C:\WINDOWS\system32\ciqnkgjs.dll",b O4 - HKLM\..\Run: [BMf32a9fc3] Rundll32.exe "C:\WINDOWS\system32\rakixoik.dll",s O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Steam] "c:\programmer\steam\steam.exe" -silent O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Programmer\Uniblue\RegistryBooster 2\RegistryBooster.exe /S O4 - HKCU\..\Run: [Uniblue Registry Booster] C:\Programmer\Uniblue\Registry Booster\RegistryBooster.exe /S O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJENESTE') O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOKAL TJENESTE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETVÆRKSTJENESTE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Startup: OpenOffice.org 2.4.lnk = C:\Programmer\OpenOffice.org 2.4\program\quickstart.exe O4 - Global Startup: hp psc 1000 series.lnk = ? O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Web Anti-Virus-statistik - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programmer\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Bjarne\Menuen Start\Programmer\IMVU\Run IMVU.lnk O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab O16 - DPF: {5CE72DD0-4695-4D18-A4D3-3367ACD37578} (F-Secure Health Check 1.0) - http://support.f-secure.com/enu/home...fshc/fscax.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/.../en/crlocx.ocx O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FLLESF~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll O20 - Winlogon Notify: urqRLDVP - urqRLDVP.dll (file missing) O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programmer\Fælles filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Programmer\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe O23 - Service: Bonjour-tjeneste (Bonjour Service) - Apple Inc. - C:\Programmer\Bonjour\mDNSResponder.exe O23 - Service: Convar task manager (ctm) - Convar Deutschland GmbH - C:\Programmer\Convar\TaskManager\ctm.exe O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Programmer\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe -- End of file - 9770 bytes -- Files created between 2008-06-27 and 2008-07-27 ----------------------------- 2008-07-27 21:23:27 0 d-------- C:\Programmer\Data Doctor Recovery Memory Card (Demo) 2008-07-27 15:08:05 95744 --a------ C:\WINDOWS\system32\msxml4r.dll <Not Verified; Microsoft Corporation; Microsoft(R) MSXML 4.0 SP1> 2008-07-27 15:08:05 44544 --a------ C:\WINDOWS\system32\Gif89.dll <Not Verified; ; Gif89 Module> 2008-07-27 15:08:04 1230336 --a------ C:\WINDOWS\system32\msxml4.dll <Not Verified; Microsoft Corporation; Microsoft(R) MSXML 4.0 SP 1> 2008-07-27 15:08:04 118784 --a------ C:\WINDOWS\system32\DartWeb.dll <Not Verified; Dart Communications; PowerTCP© Tools> 2008-07-27 15:08:04 217088 --a------ C:\WINDOWS\system32\DartSock.dll <Not Verified; Dart Communications; PowerTCP© Tools> 2008-07-27 15:08:03 0 d-------- C:\Programmer\Convar 2008-07-27 09:51:31 354 ---hs---- C:\WINDOWS\system32\sjgknqic.ini2 2008-07-27 02:09:24 83968 --a------ C:\WINDOWS\system32\ciqnkgjs.dll 2008-07-27 02:07:10 101888 --a------ C:\WINDOWS\system32\chwoqt.dll 2008-07-27 02:07:08 101888 --a------ C:\WINDOWS\system32\noakxqec.dll 2008-07-27 02  42 93184 --a------ C:\WINDOWS\system32\rakixoik.dll2008-07-11 12:30:07 0 d-------- C:\Programmer\Wakfu 2008-07-11 10:27:39 450201 --ahs---- C:\WINDOWS\system32\GNUtvyxx.ini2 2008-07-11 09:39:44 0 d-------- C:\Documents and Settings\Bjarne\Application Data\HouseCall 6.6 2008-07-11 08:44:42 0 d-------- C:\Documents and Settings\Jacob\Application Data\ATI 2008-07-10 23:12:50 0 d-------- C:\Programmer\Trend Micro 2008-07-10 22:26:18 96559 --a------ C:\WINDOWS\system32\drivers\klin.dat 2008-07-10 22:26:18 87855 --a------ C:\WINDOWS\system32\drivers\klick.dat 2008-07-10 22:25:04 0 d-------- C:\Programmer\Kaspersky Lab 2008-07-10 22:25:04 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-07-10 22:24:40 27680 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2008-07-10 22:24:40 8789792 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-07-10 22:23:11 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files 2008-07-10 16:33:45 101376 --a------ C:\WINDOWS\system32\pxumutrq.dll 2008-07-10 16:33:45 101376 --a------ C:\WINDOWS\system32\kehslz.dll 2008-07-09 15:15:05 55088 --ahs---- C:\WINDOWS\system32\OnnWacdd.ini2 2008-07-08 22:15:40 52248 --ahs---- C:\WINDOWS\system32\LmWDffii.ini2 2008-07-08 22:10:38 0 d-------- C:\WINDOWS\system32\olixds18 2008-07-08 22:10:38 0 d-------- C:\Temp 2008-07-08 21:34:52 0 d-------- C:\Programmer\MAIET 2008-07-02 16:54:39 0 d-------- C:\Documents and Settings\Bjarne\Application Data\Hewlett-Packard 2008-07-02 16:51:11 82380 --a------ C:\WINDOWS\system32\drivers\AFS2K.SYS <Not Verified; Oak Technology Inc.; AFS> 2008-07-02 16:47:40 0 d-------- C:\Programmer\Fælles filer\Hewlett-Packard 2008-07-02 16:46:03 0 d-------- C:\Programmer\Hewlett-Packard 2008-07-02 16:45:33 16622 -----n--- C:\WINDOWS\hpomdl01.dat 2008-07-02 16:45:33 20725 -----n--- C:\WINDOWS\hpoins01.dat 2008-06-30 16:09:16 0 d-------- C:\UT2004 2008-06-29 20:54:04 0 d-------- C:\Documents and Settings\Bjarne\Application Data\Search Settings 2008-06-29 20:51:19 0 d-------- C:\WINDOWS\system32\appmgmt 2008-06-29 20:49:38 0 d-------- C:\Programmer\Search Settings 2008-06-29 20:49:23 0 d-------- C:\Programmer\Dealio 2008-06-29 20:49:03 101888 --a------ C:\WINDOWS\system32\VB6STKIT.DLL <Not Verified; Microsoft Corporation; Microsoft® Visual Basic pour Windows> 2008-06-29 20:49:03 119568 --a------ C:\WINDOWS\system32\VB6FR.DLL <Not Verified; Microsoft Corporation; Environnement Visual Basic> 2008-06-29 20:49:03 21504 --a------ C:\WINDOWS\system32\TABCTFR.DLL <Not Verified; Microsoft Corporation; Bibliothèque d'objets TabCtl32> 2008-06-29 20:49:03 141312 --a------ C:\WINDOWS\system32\MSCMCFR.DLL <Not Verified; Microsoft Corporation; COMCTL> 2008-06-29 20:49:03 59904 --a------ C:\WINDOWS\system32\Mscc2fr.dll <Not Verified; Microsoft Corporation; Bibliothèque d'objets de Microsoft Common Controls 2> 2008-06-29 20:49:03 15360 --a------ C:\WINDOWS\system32\inetfr.DLL <Not Verified; Microsoft Corporation; DLL du contrôle Microsoft Internet Transfer> 2008-06-29 20:49:03 32768 --a------ C:\WINDOWS\system32\CMDLGFR.DLL <Not Verified; Microsoft Corporation; CMDIALOG> 2008-06-29 20:49:02 0 d-------- C:\Programmer\Free Audio Pack 2008-06-29 20:46:58 0 d-------- C:\Programmer\Free WMA to MP3 Converter -- Find3M Report --------------------------------------------------------------- 2008-07-27 22:01:26 0 d-------- C:\Documents and Settings\Bjarne\Application Data\Skype 2008-07-27 15:10:55 0 d-------- C:\Documents and Settings\Bjarne\Application Data\OpenOffice.org2 2008-07-27 15:10:02 0 d-------- C:\Programmer\Steam 2008-07-27 15:08:03 0 d--h----- C:\Programmer\InstallShield Installation Information 2008-07-27 09:52:10 0 d-------- C:\Documents and Settings\Bjarne\Application Data\skypePM 2008-07-27 08:00:09 0 d-------- C:\Documents and Settings\Bjarne\Application Data\AVG7 2008-07-27 02:59:33 0 d-------- C:\Documents and Settings\Bjarne\Application Data\IMVU 2008-07-09 21:22:13 0 d-------- C:\Documents and Settings\Bjarne\Application Data\LimeWire 2008-07-07 15:41:00 0 d-------- C:\Programmer\Warcraft III <WARCRA~1> 2008-07-02 16:43:36 0 d-------- C:\Programmer\Fælles filer 2008-06-13 12:27:39 0 d-------- C:\Programmer\World of Warcraft 2008-06-08 09:29:33 0 d-------- C:\Documents and Settings\Bjarne\Application Data\Apple Computer 2008-06-04 21:21:26 0 d-------- C:\Programmer\IMVU 2008-05-30 20:56:21 0 d-------- C:\Documents and Settings\Bjarne\Application Data\gtk-2.0 2008-05-30 20:54:30 0 d-------- C:\Programmer\GIMP-2.0 -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{605BA61C-6840-495A-843F-538E9F47C096}] C:\WINDOWS\system32\ddcaWnnO.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{93140285-b63a-46cb-93e9-3f62042702a4}] 27-07-2008 02:07 101888 --a------ C:\WINDOWS\system32\chwoqt.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D0A48538-8CA4-4145-BDFC-1C2C9406C107}] C:\WINDOWS\system32\iiffDWmL.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E91C2855-AC7E-4ED9-B488-0F78FAE8AD2D}] C:\WINDOWS\system32\urqRLDVP.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FF332D6F-D61F-48F0-B623-311B078ED47E}] C:\WINDOWS\system32\xxyvtUNG.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [28-06-2008 09:50] "!AVG Anti-Spyware"="C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [11-06-2007 11:25] "ATIPTA"="C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe" [05-08-2005 22:05] "SigmatelSysTrayApp"="stsystra.exe" [22-03-2005 19:20 C:\WINDOWS\stsystra.exe] "SunJavaUpdateSched"="C:\Programmer\Java\jre1.6.0_05\bin\jusched.exe" [22-02-2008 05:25] "Adobe Reader Speed Launcher"="C:\Programmer\Adobe\Reader 8.0\Reader\Reader_sl.exe" [11-01-2008 23:16] "CTSysVol"="C:\Programmer\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [15-02-2005 17:10] "P17Helper"="P17.dll" [03-05-2005 13:38 C:\WINDOWS\system32\P17.dll] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [11-05-2000 02:00] "StartCCC"="C:\Programmer\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [21-01-2008 12:17] "QuickTime Task"="C:\Programmer\QuickTime\qttask.exe" [28-03-2008 23:37] "iTunesHelper"="C:\Programmer\iTunes\iTunesHelper.exe" [30-03-2008 10:36] "SearchSettings"="C:\Programmer\Search Settings\SearchSettings.exe" [12-06-2008 16:57] "Windows Logon Applicationedc"="C:\Documents and Settings\Bjarne\winlogon.exe" [] "AVP"="C:\Programmer\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [28-06-2007 11:51] "f019ac5f"="C:\WINDOWS\system32\ciqnkgjs.dll" [27-07-2008 02:09] "BMf32a9fc3"="C:\WINDOWS\system32\rakixoik.dll" [27-07-2008 02:06] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [26-08-2004 18:53] "Steam"="c:\programmer\steam\steam.exe" [28-03-2008 10:12] "MsnMsgr"="C:\Programmer\Windows Live\Messenger\MsnMsgr.exe" [] "Uniblue RegistryBooster 2"="C:\Programmer\Uniblue\RegistryBooster 2\RegistryBooster.exe" [] "Uniblue Registry Booster"="C:\Programmer\Uniblue\Registry Booster\RegistryBooster.exe" [] "Skype"="C:\Programmer\Skype\Phone\Skype.exe" [06-02-2008 19:37] C:\Documents and Settings\Bjarne\Menuen Start\Programmer\Start\ OpenOffice.org 2.4.lnk - C:\Programmer\OpenOffice.org 2.4\program\quickstart.exe [16-03-2008 17:54:44] C:\Documents and Settings\All Users\Menuen Start\Programmer\Start\ hp psc 1000 series.lnk - C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [02-12-2002 21:08:34] hpoddt01.exe.lnk - C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [02-12-2002 20:56:10] Microsoft Office.lnk - C:\Programmer\Microsoft Office\Office\OSA9.EXE [21-01-2000 09:15:54] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{E91C2855-AC7E-4ED9-B488-0F78FAE8AD2D}"= C:\WINDOWS\system32\urqRLDVP.dll [ ] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqRLDVP] urqRLDVP.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\xxyvtUNG [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d7d543db-1449-11dd-86c9-00123fb6fa2b}] AutoRun\command- J:\setupSNK.exe *Newly Created Service* - CTM *Newly Created Service* - WLSETUPSVC -- End of Deckard's System Scanner: finished at 2008-07-27 22:05:35 ------------ |
|
|
|
|
07-27-2008, 02:20 PM
|
#6 (permalink) | |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Dùn Èideann,Scotland.
Posts: 2,478
OS: XP
|
Re: I need help! Included HJT Log
Hello again Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. ======== Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear, a lack of symptoms does not mean that it is no longer present. Please Do Not Attach logs to your posts unless you are advised to do so. ======== Please print out or copy this page to Notepad in order to assist you when carrying out the following instructions. ========= Quote:
========== P2P P2P - I see you have P2P software uTorrent installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares and their infections. References for the risk of these programs are Here, Here and Here. ========== Download SDFix and save it to your Desktop. Double click SDFix.exe and it will extract the files to %systemdrive% (Drive that contains the Windows Directory, typically C:SDFix) Please then reboot your computer in Safe Mode by doing the following :
============ Please visit this webpage for instructions for downloading and running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console f |
