melsarose7

Okay, over the last couple of days my friend has noticed her computer coming up with strange pop up msgs and when she ran AVG it found some adware, keeps saying that it has healed them but there are still problems.

I had a look and found that she wasn't running windows firewall or AVG spyware just the single anti-virus program. I know a bit more about pc's than her but even I have no idea where to even start dealing with this.

Below are the files that AVG found:

28-01-08

Adware Generic2.ZTT was found in 3 places
Adware Generic2.XWZ was found in 1 place

29-01-08

Nothing was found.

30-01-08 & 31-01-08

Adware Generic2.XWZ was found in 1 place

How come it's not there on the 29th? I don't understand it but I'm smart enough to know when I need help.

I was able to complete all steps required to follow, below is the first log:

Deckard's System Scanner v20071014.68
Run by r on 2008-01-31 20:17:23
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- Last 1 Restore Point(s) --
1: 2008-01-31 09:44:07 UTC - RP68 - Windows Update


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as r.exe) ---------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:21:46 PM, on 31/01/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16575)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Windows\OEM02Mon.exe
C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Dell Network Assistant\ezi_hnm2.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Windows\System32\mobsync.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
c:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Users\r\Desktop\dss.exe
C:\Windows\system32\SearchFilterHost.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\r.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll (file missing)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe C:\Windows\system32\nvHotkey.dll,Start
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "c:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [DELL Webcam Manager] "C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe" /s
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Free Download Manager] "C:\Program Files\Free Download Manager\fdm.exe" -autorun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Dell Network Assistant.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: QuickSet.lnk = C:\Program Files\Dell\QuickSet\quickset.exe
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send image to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O16 - DPF: {2E4A92AB-F2C0-456A-9935-B715439790D7} (Setup Class) - https://www.opinionsquare.com/Config/CSetup.cab
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - http://www.nanoscan.com/as/cabs/ascstubie.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL,C:\Windows\system32\opai.dll
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: AVG Anti-Spyware Guard - Unknown owner - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: OpinionSquare - OpinionSquare - C:\Windows\system32\opservice.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 13180 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

All drivers whitelisted.


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 OpinionSquare - c:\windows\system32\opservice.exe /service <Not Verified; OpinionSquare; OpinionSquare>
R2 RegSrvc (Intel(R) PROSet/Wireless Registry Service) - c:\program files\intel\wireless\bin\regsrvc.exe <Not Verified; Intel Corporation; Intel(R) PROSet/Wireless Registry Service>
R2 sprtsvc_dellsupportcenter (SupportSoft Sprocket Service (dellsupportcenter)) - c:\program files\dell support center\bin\sprtsvc.exe /service /p dellsupportcenter
R2 systemCheck (SystemWindows) - "c:\windows\system32\systemcheck.exe" <Not Verified; Microsoft Corporation; BIOS Drivers for harddrive>

S2 AVG Anti-Spyware Guard - c:\program files\grisoft\avg anti-spyware 7.5\guard.exe (file missing)
S2 SysCacheDriver - "c:\windows\system32\syssecuritycheck.exe" <Not Verified; Microsoft Corporation; BIOS Drivers for harddrive>
S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe
S3 stllssvr - "c:\program files\common files\surething shared\stllssvr.exe" <Not Verified; MicroVision Development, Inc.; SureThing CD Labeler>


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Files created between 2007-12-31 and 2008-01-31 -----------------------------

2008-01-31 20:21:07 0 d-------- C:\Program Files\Trend Micro
2008-01-31 19:03:23 0 d-------- C:\ie-spyad_zo
2008-01-31 18:55:42 0 d-------- C:\Program Files\SpywareBlaster
2008-01-31 17:44:29 0 d-------- C:\Program Files\Panda Security
2008-01-28 07:23:58 53248 --a------ C:\Windows\system32\silc_dll.dll
2008-01-28 07:23:58 1358156 --a------ C:\Windows\system32\silc.dat
2008-01-28 07:23:58 926241 --a------ C:\Windows\system32\model.dat
2008-01-28 07:23:58 1523712 --a------ C:\Windows\system32\LDPackage.dll <Not Verified; ; LDPackag Dynamic Link Library>
2008-01-28 07:22:22 286720 --a------ C:\Windows\system32\opxf.dll <Not Verified; OpinionSquare; OpinionSquare>
2008-01-28 07:20:59 712704 --a------ C:\Windows\system32\opph.dll <Not Verified; OpinionSquare; OpinionSquare>
2008-01-28 07:19:34 118784 --a------ C:\Windows\system32\opai.dll <Not Verified; OpinionSquare; OpinionSquare>
2008-01-27 17:09:47 0 d-------- C:\Users\r\Internet stuff
2008-01-19 14:00:50 0 d-------- C:\Users\r\Cooking Recipes
2008-01-17 17:47:13 0 d-------- C:\Program Files\Incomplete
2008-01-17 17:46:46 0 d-------- C:\Users\r\Incomplete
2008-01-17 17:46:19 0 d-------- C:\Program Files\LimeWire
2008-01-08 09:49:45 0 d-------- C:\Users\All Users\Adobe
2008-01-08 09:49:33 0 d-------- C:\Program Files\Common Files\Adobe
2008-01-07 19:58:59 0 dr-h----- C:\$VAULT$.AVG
2008-01-07 19:47:38 0 d-------- C:\Users\All Users\Grisoft
2008-01-07 18:27:28 0 d-------- C:\Users\All Users\Avg7
2008-01-07 00:00:01 0 d-------- C:\Downloads
2008-01-06 12:09:18 0 d-------- C:\UNDEFINED
2008-01-05 15:05:51 0 d-------- C:\My Memory Vault
2008-01-05 15:03:59 0 d-------- C:\Program Files\Creative Memories
2008-01-05 07:53:29 0 d-------- C:\Users\All Users\FreeDownloadManager.ORG
2008-01-05 07:53:29 0 d-------- C:\Program Files\Free Download Manager
2008-01-05 06:48:38 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-01-05 06:46:49 0 d-------- C:\Program Files\MSXML 4.0
2008-01-05 06:42:01 0 dr------- C:\Users\Guest\Searches
2008-01-05 06:41:40 0 dr------- C:\Users\Guest\Contacts
2008-01-05 06:41:19 0 dr------- C:\Users\Guest\Videos
2008-01-05 06:41:19 0 d--hs---- C:\Users\Guest\Templates
2008-01-05 06:41:19 0 d--hs---- C:\Users\Guest\Start Menu
2008-01-05 06:41:19 0 d--hs---- C:\Users\Guest\SendTo
2008-01-05 06:41:19 0 dr------- C:\Users\Guest\Saved Games
2008-01-05 06:41:19 0 d-------- C:\Users\Guest\Roaming
2008-01-05 06:41:19 0 d--hs---- C:\Users\Guest\Recent
2008-01-05 06:41:19 0 d--hs---- C:\Users\Guest\PrintHood
2008-01-05 06:41:19 0 dr------- C:\Users\Guest\Pictures
2008-01-05 06:41:19 524288 --a------ C:\Users\Guest\NTUSER.DAT
2008-01-05 06:41:19 0 d--hs---- C:\Users\Guest\NetHood
2008-01-05 06:41:19 0 d--hs---- C:\Users\Guest\My Documents
2008-01-05 06:41:19 0 dr------- C:\Users\Guest\Music
2008-01-05 06:41:19 0 d--hs---- C:\Users\Guest\Local Settings
2008-01-05 06:41:19 0 dr------- C:\Users\Guest\Links
2008-01-05 06:41:19 0 dr------- C:\Users\Guest\Favorites
2008-01-05 06:41:19 0 dr------- C:\Users\Guest\Downloads
2008-01-05 06:41:19 0 dr------- C:\Users\Guest\Documents
2008-01-05 06:41:19 0 dr------- C:\Users\Guest\Desktop
2008-01-05 06:41:19 0 d--hs---- C:\Users\Guest\Cookies
2008-01-05 06:41:19 0 d--hs---- C:\Users\Guest\Application Data
2008-01-05 06:41:19 0 d--h----- C:\Users\Guest\AppData
2008-01-05 01:15:43 0 -rahs---- C:\MSDOS.SYS
2008-01-05 01:15:43 0 -rahs---- C:\IO.SYS
2008-01-04 15:45:05 0 d-------- C:\Program Files\Microsoft.NET
2008-01-04 15:41:25 0 d-------- C:\Program Files\Microsoft Visual Studio 8
2008-01-04 15:40:15 0 d-------- C:\Users\All Users\Microsoft Help
2008-01-04 15:37:31 0 dr-h----- C:\MSOCache
2008-01-04 15:13:18 0 d-------- C:\Windows\PCHEALTH
2008-01-04 15:13:18 0 d-------- C:\Program Files\MSN Messenger
2008-01-04 15:12:29 0 d-------- C:\Users\All Users\DVD Shrink
2008-01-04 15:12:28 0 d-------- C:\Program Files\DVD Shrink
2008-01-04 15:07:22 0 d-------- C:\Users\All Users\Ahead
2008-01-04 15:04:23 0 d-------- C:\Users\All Users\Nero
2008-01-04 15:04:23 0 d-------- C:\Program Files\Nero
2008-01-04 15:04:23 0 d-------- C:\Program Files\Common Files\Ahead
2008-01-04 14:44:55 0 d-------- C:\Users\r\Movie Program files
2008-01-04 14:44:55 0 d-------- C:\Users\r\Budget
2008-01-04 14:44:55 0 d-------- C:\Users\r\Amanda Pickering
2008-01-04 14:39:53 0 dr------- C:\Users\r\My Videos
2008-01-04 14:39:46 0 d-------- C:\Users\r\My Received Files
2008-01-04 13:35:44 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller
2008-01-04 13:35:35 0 d-------- C:\Program Files\Windows Live
2008-01-04 13:35:04 0 d-------- C:\Users\All Users\WLInstaller


-- Find3M Report ---------------------------------------------------------------

2008-01-31 20:21:59 0 d-------- C:\Users\r\AppData\Roaming\Free Download Manager
2008-01-31 20:09:53 0 d-------- C:\Users\r\AppData\Roaming\AVG7
2008-01-31 20:09:31 26955 --a------ C:\Users\r\AppData\Roaming\nvModes.001
2008-01-31 20:07:30 12 --a------ C:\Windows\bthservsdp.dat
2008-01-31 05:09:11 26955 --a------ C:\Users\r\AppData\Roaming\nvModes.dat
2008-01-29 18:02:51 0 d-------- C:\Users\r\AppData\Roaming\Roxio
2008-01-28 11:58:28 1282048 -rah----- C:\Windows\system32\systemcheck.exe <Not Verified; Microsoft Corporation; BIOS Drivers for harddrive>
2008-01-28 11:57:28 1355776 -r-h----- C:\Windows\system32\sysSecurityCheck.exe <Not Verified; Microsoft Corporation; BIOS Drivers for harddrive>
2008-01-28 07:16:36 86016 --a------ C:\Windows\system32\opservice.exe <Not Verified; OpinionSquare; OpinionSquare>
2008-01-27 21:19:29 0 d-------- C:\Users\r\AppData\Roaming\LimeWire
2008-01-26 13:23:10 114 --a------ C:\Users\r\AppData\Roaming\wklnhst.dat
2008-01-12 14:27:29 0 d-------- C:\Users\r\AppData\Roaming\CyberLink
2008-01-09 18:45:51 0 d-------- C:\Program Files\Windows Mail
2008-01-09 18:45:50 0 d-------- C:\Program Files\Windows Sidebar
2008-01-08 09:51:35 0 d-------- C:\Users\r\AppData\Roaming\Adobe
2008-01-08 09:49:33 0 d-------- C:\Program Files\Common Files
2008-01-07 20:00:27 0 d-------- C:\Users\r\AppData\Roaming\Template
2008-01-06 12:37:18 0 d-------- C:\Users\r\AppData\Roaming\Ahead
2008-01-05 1502 0 d-------- C:\Users\r\AppData\Roaming\Creative Memories
2008-01-05 00:34:34 0 d-------- C:\Users\r\AppData\Roaming\Intel
2008-01-04 15:48:03 0 d-------- C:\Program Files\Microsoft Works
2008-01-04 15:47:21 0 d-------- C:\Program Files\MSBuild
2008-01-04 15:20:14 0 d-------- C:\Users\r\AppData\Roaming\Google
2008-01-04 14:23:23 0 d-------- C:\Program Files\Dell Network Assistant
2008-01-04 13:21:49 0 d-------- C:\Users\r\AppData\Roaming\Macromedia
2008-01-04 13:17:04 0 d-------- C:\Users\r\AppData\Roaming\Creative
2007-12-27 23:47:55 0 d-------- C:\Program Files\Alwil Software
2007-12-27 23:42:34 0 d-------- C:\Users\r\AppData\Roaming\Identities
2007-12-21 01:30:49 0 d-------- C:\Program Files\DellTPad
2007-12-21 01:26:04 0 d-------- C:\Program Files\Windows Calendar
2007-12-21 01:22:40 0 d-------- C:\Program Files\Windows Defender
2007-12-20 18:12:08 0 d-------- C:\Program Files\Dell
2007-12-20 18:10:49 0 d-------- C:\Program Files\Dell Support Center
2007-12-20 18:10:39 0 d-------- C:\Program Files\Common Files\supportsoft
2007-12-20 18:07:19 0 d-------- C:\Program Files\Google
2007-12-20 18:07:12 0 d-------- C:\Program Files\CyberLink
2007-12-20 1845 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-12-20 18:05:28 0 d-------- C:\Program Files\Roxio
2007-12-20 18:05:14 0 d-------- C:\Program Files\Common Files\Sonic Shared
2007-12-20 18:03:49 0 d-------- C:\Program Files\Common Files\InstallShield
2007-12-20 18:02:59 0 d-------- C:\Program Files\Common Files\SureThing Shared
2007-12-20 18:02:44 0 d-------- C:\Program Files\Common Files\Roxio Shared
2007-12-20 18:00:40 0 d-------- C:\Program Files\WIDCOMM
2007-12-20 18:00:10 76 -r-hs---- C:\Windows\CT4CET.bin
2007-12-20 17:59:50 0 d-------- C:\Program Files\Creative
2007-12-20 17:59:36 0 d-------- C:\Program Files\Common Files\Reallusion
2007-12-20 17:59:14 0 d-------- C:\Program Files\Common Files\Creative
2007-12-20 17:58:59 0 d-------- C:\Program Files\Creative Live! Cam
2007-12-20 17:58:03 0 d-------- C:\Program Files\Intel, Inc
2007-12-20 17:57:29 0 d-------- C:\Program Files\Intel
2007-12-20 17:57:18 0 d-------- C:\Program Files\Broadcom
2007-12-20 17:57:04 0 d-------- C:\Program Files\Digital Line Detect
2007-12-20 17:56:39 0 d-------- C:\Program Files\NetWaiting
2007-12-20 17:56:13 0 d-------- C:\Program Files\Modem Diagnostic Tool
2007-12-20 17:51:13 0 d-------- C:\Program Files\Java
2007-12-20 17:51:13 0 d-------- C:\Program Files\Common Files\Java
2007-12-20 17:38:32 174 --ahs---- C:\Program Files\desktop.ini
2007-12-20 17:36:42 0 d-------- C:\Program Files\CONEXANT
2007-12-20 17:36:26 0 d-------- C:\Program Files\Sigmatel


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{377C180E-6F0E-4D4C-980F-F45BD3D40CF4}]
c:\PROGRA~1\mcafee\msk\mcapbho.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [21/12/2007 01:22 AM]
"ECenter"="C:\Dell\E-Center\EULALauncher.exe" [25/05/2007 04:03 PM]
"Apoint"="C:\Program Files\DellTPad\Apoint.exe" [24/09/2007 07:27 PM]
"OEM02Mon.exe"="C:\Windows\OEM02Mon.exe" [29/08/2007 03:54 PM]
"SigmatelSysTrayApp"="C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe" [08/09/2007 04:23 AM]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [25/06/2007 07:13 PM]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [25/06/2007 07:13 PM]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [25/06/2007 07:13 PM]
"NVHotkey"="C:\Windows\system32\nvHotkey.dll" [25/06/2007 07:13 PM]
"Windows Mobile Device Center"="%windir%\WindowsMobile\wmdc.exe" []
"SunJavaUpdateSched"="c:\Program Files\Java\jre1.6.0\bin\jusched.exe" [20/12/2007 05:51 PM]
"DELL Webcam Manager"="C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe" [27/07/2007 06:43 PM]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [03/10/2006 01:37 PM]
"@"="" []
"RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [05/11/2006 01:22 PM]
"PCMService"="C:\Program Files\Dell\MediaDirect\PCMService.exe" [16/04/2007 06:10 PM]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [20/12/2007 06:07 PM]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" []
"dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [09/10/2007 08:57 PM]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [01/03/2007 03:57 PM]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [24/08/2007 07:00 AM]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [08/01/2008 06:17 PM]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [10/10/2007 07:51 PM]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [11/06/2007 07:25 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [09/10/2007 08:56 PM]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [02/11/2006 10:35 PM]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [19/01/2007 12:54 PM]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [16/05/2007 09:27 AM]
"Free Download Manager"="C:\Program Files\Free Download Manager\fdm.exe" [31/12/2007 11:05 PM]
"WindowsWelcomeCenter"="oobefldr.dll,ShowWelcomeCenter" []
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [02/11/2006 10:36 PM]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [3/11/2006 7:55:50 PM]
Dell Network Assistant.lnk - C:\Windows\Installer\{0240BDFB-2995-4A3F-8C96-18D41282B716}\Icon0240BDFB3.exe [20/12/2007 637 PM]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [20/12/2007 5:57:04 PM]
QuickSet.lnk - C:\Program Files\Dell\QuickSet\quickset.exe [20/07/2007 8:13:26 PM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
avgwlntf.dll 07/01/2008 07:47 PM 9216 C:\Windows\System32\avgwlntf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL,C:\Windows\system32\opai.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]
@="IEEE 1394 Bus host controllers"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]
@="SBP2 IEEE 1394 Devices"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]
@="SecurityDevices"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc EMDMgmt TabletInputService wlansvc WPDBusEnum
bthsvcs BthServ
WindowsMobile wcescomm rapimgr
LocalServiceRestricted WcesComm RapiMgr


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
C:\Windows\system32\unregmp2.exe /ShowWMP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
%SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI



-- End of Deckard's System Scanner: finished at 2008-01-31 20:22:37 ------------

Attached Files

extra.txt (22.1 KB, 0 views)