Winiguard Alert! (help please)

Aelvin · 12-07-2008, 01:15 PM

Yesterday I started getting these popups on my desktop (they appear to be coming from the base of my taskbar, although I'm fairly certain that this is not the case) that say "Winiguard Alert!" in big red letters and talks about how there's an infiltration alert and that my "computer is being attacked from Internet." Whenever this "alert" pops up, it makes a loud sound like a squealing pig which is also quite annoying. Along with this problem, I also get another popup alert every so often that says my computer is low on memory. When I searched for threads concerning this problem, it seemed like the other resolved problem regarding winiguard had the popup about the memory as well, so I think it's safe to assume that the two are related.

Here's the logs requested:

DDS (Version 1.0) - NTFSx86
Run by Justin at 14:29:14.49 on Sun 12/07/2008
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.2046.1199 [GMT -5:00]

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\dlcxcoms.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\PROGRA~1\PHAROS~1\Core\CTskMstr.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\stacsv.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\alg.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Windows\System32\baloon.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\cfrog.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Rainmeter\Rainmeter.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Users\Justin\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.sony.com/vaiopeople
mDefault_Page_URL = hxxp://www.sony.com/vaiopeople
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - c:\program files\aol\aim toolbar 5.0\aoltb.dll
mURLSearchHooks: {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - c:\program files\aol\aim toolbar 5.0\aoltb.dll
dURLSearchHooks: {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - c:\program files\aol\aim toolbar 5.0\aoltb.dll
BHO: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: {333789EA-38B0-43D2-8058-60B749E63FC9} - c:\windows\system32\LinkSave.dll
BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - c:\program files\avg\avg8\avgssie.dll
BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre1.6.0_03\bin\ssv.dll
BHO: {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - c:\program files\aol\aim toolbar 5.0\aoltb.dll
BHO: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: {AE7CD045-E861-484f-8273-0445EE161910} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
TB: {DE9C389F-3316-41A7-809B-AA305ED9D922} - c:\program files\aol\aim toolbar 5.0\aoltb.dll
TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
uRun: [msnmsgr] "c:\program files\msn messenger\msnmsgr.exe" /background
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp
uRun: [RocketDock] "c:\program files\rocketdock\RocketDock.exe"
mRun: [<NO NAME>]
mRun: [DLCXCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCXtime.dll,_RunDLLEntry@16
mRun: [dmrbx.exe] c:\windows\system32\dmrbx.exe
mRun: [dmsxg.exe] c:\windows\system32\dmsxg.exe
mRun: [dmwin.exe] c:\windows\system32\dmwin.exe
mRun: [dmaws.exe] c:\windows\system32\dmaws.exe
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [c:\windows\system32\baloon.exe] c:\windows\system32\baloon.exe
mRun: [c:\windows\system32\cfrog.exe] c:\windows\system32\cfrog.exe
StartupFolder: c:\users\justin\appdata\roaming\micros~1\windows\startm~1\programs\startup\rainme~1.lnk - c:\program files\rainmeter\Rainmeter.exe
mPolicies-system: EnableLUA = 0 (0x0)
IE: &AIM Search - c:\program files\aol\aim toolbar 5.0\resources\en-us\local\search.html
IE: Append to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "c:\program files\fiddler2\Fiddler.exe"
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_03\bin\ssv.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {3369AF0D-62E9-4bda-8103-B4C75499B578} - {DE9C389F-3316-41A7-809B-AA305ED9D922} - c:\program files\aol\aim toolbar 5.0\aoltb.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
IE: {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - c:\program files\fiddler2\Fiddler.exe
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: igfxcui - igfxdev.dll
Notify: VESWinlogon - VESWinlogon.dll
AppInit_DLLs: avgrsstx.dll

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-5-8 97928]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2008-5-8 875288]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-5-8 231704]
R2 dlcx_device;dlcx_device;c:\windows\system32\dlcxcoms.exe -service []
R2 MSSQL$VAIO_VEDB;SQL Server (VAIO_VEDB);"c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe" -sVAIO_VEDB [2007-1-31 28933976]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-4-17 11032]
R3 AvgWfpX;AVG8 Firewall Driver x86;c:\windows\system32\drivers\avgwfpx.sys [2008-5-8 69128]
R3 R5U870FLx86;R5U870 UVC Lower Filter ;c:\windows\system32\drivers\R5U870FLx86.sys [2007-5-1 74240]
R3 R5U870FUx86;R5U870 UVC Upper Filter ;c:\windows\system32\drivers\R5U870FUx86.sys [2007-5-1 43904]
R3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\system32\drivers\SonyImgF.sys [2007-5-1 31104]
R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2007-5-1 807424]
S3 ICScsiSV;Image Converter SCSI Service;c:\program files\sony\image converter 3\ICScsiSV.exe [2007-6-21 75952]
S3 IcVzMonLauncher;IcVzMonLauncher;"c:\program files\sony\image converter 3\IcVzMonLauncher.exe" [2007-6-21 67760]
S3 Image Converter video recording monitor for VAIO Entertainment;Image Converter video recording monitor for VAIO Entertainment;c:\program files\sony\image converter 3\IcVzMon.exe [2007-6-21 43184]
S3 UsbFltr;Razer Copperhead Driver;c:\windows\system32\drivers\copperhd.sys [2007-11-28 11596]
S3 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\sony\vaio media integrated server\UCLS.exe [2007-6-21 745472]
S3 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);"c:\program files\sony\vaio media integrated server\platform\sv_httpd.exe" /service=vaiomediaplatform-ucls-http /regroot="software\sony corporation\vaio media platform\2.0" /regext="\applications\ucls\HTTP" []
S3 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\sony\vaio media integrated server\platform\UPnPFramework.exe [2007-6-21 1089536]

============== File Associations ===============

regfile=regedit.exe "%1" %*
scrfile="%1" %*

=============== Created Last 30 ================

2008-12-07 13:17 <DIR> --d----- C:\!KillBox
2008-12-06 19:53 <DIR> a-d----- c:\programdata\TEMP
2008-12-06 17:24 <DIR> --d----- c:\program files\Lavasoft
2008-12-06 17:08 118,784 a------- c:\windows\system32\baloon.exe
2008-11-21 16:59 <DIR> --d----- c:\program files\uTorrent
2008-11-15 03:39 <DIR> --d----- c:\program files\RocketDock
2008-11-14 14:12 <DIR> --d----- c:\program files\Rainmeter

==================== Find3M ====================

2008-10-31 08:15 86,016 a------- c:\windows\inf\infstor.dat
2008-10-31 08:15 86,016 a------- c:\windows\inf\infpub.dat
2008-10-31 08:15 143,360 a------- c:\windows\inf\infstrng.dat
2008-01-22 10:38 45,880 a------- c:\users\justin\appdata\roaming\nvModes.dat
2007-05-01 17:51 665,600 a------- c:\windows\inf\drvindex.dat
2006-11-02 07:50 174 a--sh--- c:\program files\desktop.ini
2006-11-02 07:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 07:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 07:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 07:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 04:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 04:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 04:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 04:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 14:30:01.20 ===============

**TheBruce1** · 12-08-2008, 05:55 AM

Hello and welcome to TSF

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

========

Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear, a lack of symptoms does not mean that it is no longer present.

Please DO NOT Attach logs to your posts unless you are advised to do so.

=========

P2P

P2P - I see you have P2P software µTorrent installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares and their infections.

References for the risk of these programs are Here,
Here and Here.

===========

Click Start> Control Panel>Programs>Program and Features and uninstall the following programs:

Viewpoint Media Player<---Viewpoint is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 read this article: http://www.clickz.com/news/article.php/3561546

Additional Information Here
and Here

===========

Download Combofix from any of the links below, and save it to your desktop.

Link 1
Link 2
Link 3

**Note: It is important that it is saved directly to your desktop**

--------------------------------------------------------------------

1. Disconnect from the internet.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

--------------------------------------------------------------------

Double click on ComboFix.exe & follow the prompts.

When finished, it will produce a report for you at C:\ComboFix.txt. I'll need to see that in your next reply, along with a new HijackThis log.

=========
Logs Required
C:\Combofix.txt
Hijackthis Log

If there is no response to this post within 72hrs, this thread will be closed.

Aelvin · 12-08-2008, 12:46 PM

ComboFix 08-12-05.03 - Justin 2008-12-08 14:27:36.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.1101 [GMT -5:00]
Running from: c:\users\Justin\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\smp.bat
c:\windows\AppPatch\Custom\{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb
c:\windows\system32\x64

.
((((((((((((((((((((((((( Files Created from 2008-11-08 to 2008-12-08 )))))))))))))))))))))))))))))))
.

2008-12-07 14:35 . 2008-12-07 14:35 250 --a------ c:\windows\gmer.ini
2008-12-07 13:17 . 2008-12-07 13:17 <DIR> d-------- C:\!KillBox
2008-12-06 19:53 . 2008-12-06 19:58 <DIR> d-a------ c:\users\All Users\TEMP
2008-12-06 19:53 . 2008-12-06 19:58 <DIR> d-a------ c:\programdata\TEMP
2008-12-06 17:24 . 2008-12-06 17:24 <DIR> d-------- c:\program files\Lavasoft
2008-12-06 17:08 . 2008-12-06 17:08 118,784 --a------ c:\windows\System32\baloon.exe
2008-11-15 03:39 . 2008-11-15 03:40 <DIR> d-------- c:\program files\RocketDock
2008-11-14 14:12 . 2008-11-14 14:13 <DIR> d-------- c:\program files\Rainmeter

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-07 00:52 --------- d-----w c:\users\Justin\AppData\Roaming\Download Manager
2008-12-06 22:24 --------- d-----w c:\programdata\Lavasoft
2008-12-06 22:20 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-12-05 20:25 --------- d-----w c:\users\Justin\AppData\Roaming\uTorrent
2008-11-25 13:51 --------- d-----w c:\program files\Warcraft III
2008-11-24 18:38 --------- d-----w c:\program files\Dl_cats
2008-11-13 06:10 --------- d-----w c:\program files\World of Warcraft
2008-11-05 02:02 --------- d-----w c:\program files\Yahoo!
2008-10-31 13:32 --------- d-----w c:\programdata\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-31 13:32 --------- d-----w c:\program files\iTunes
2008-10-31 13:31 --------- d-----w c:\program files\iPod
2008-10-31 13:25 --------- d-----w c:\program files\QuickTime
2008-10-31 13:25 --------- d-----w c:\program files\Bonjour
2008-10-31 13:23 --------- d-----w c:\program files\Common Files\Apple
2008-10-31 13:17 --------- d-----w c:\program files\Apple Software Update
2008-01-22 15:38 45,880 ----a-w c:\users\Justin\AppData\Roaming\nvModes.dat
2006-11-02 12:50 174 --sha-w c:\program files\desktop.ini
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
"Aim6"="c:\program files\AIM6\aim6.exe" [2008-03-25 50528]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DLCXCATS"="c:\windows\system32\spool\DRIVERS\W32X86\3\DLCXtime.dll" [2006-10-16 106496]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-27 1261336]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"c:\windows\system32\baloon.exe"="c:\windows\System32\baloon.exe" [2008-12-06 118784]
"c:\windows\system32\cfrog.exe"="c:\windows\System32\cfrog.exe" [2008-12-06 26624]

c:\users\Justin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Rainmeter.lnk - c:\program files\Rainmeter\Rainmeter.exe [2006-01-21 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2007-02-13 17:19 98304 c:\windows\System32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.dvsd"= c:\program files\Common Files\Sony Shared\VideoLib\sonydv.dll

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk
backup=c:\windows\pss\Adobe Acrobat Synchronizer.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth Manager.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth Manager.lnk
backup=c:\windows\pss\Bluetooth Manager.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=c:\windows\pss\QuickBooks Update Agent.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Run Registration Tool.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Run Registration Tool.lnk
backup=c:\windows\pss\Run Registration Tool.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Justin^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\users\Justin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
--a------ 2006-10-23 01:24 620152 c:\program files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2007-05-11 02:06 40048 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
--a------ 2007-08-12 14:42 2321600 c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
--a------ 2008-03-25 15:21 50528 c:\program files\AIM6\aim6.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
--a------ 2006-11-13 07:32 118784 c:\program files\Apoint\Apoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Copperhead]
--a------ 2005-11-25 10:53 155648 c:\program files\Razer\Copperhead\razerhid.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLCXCATS]
--a------ 2006-10-16 00:31 106496 c:\windows\System32\spool\drivers\w32x86\3\dlcxtime.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dlcxmon.exe]
--a------ 2007-01-12 11:57 292336 c:\program files\Dell Photo AIO Printer 926\dlcxmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer]
--a------ 2006-11-03 17:09 312200 c:\program files\Dell PC Fax\fm3032.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISBMgr.exe]
--a------ 2007-04-16 21:06 321656 c:\program files\Sony\ISB Utility\ISBMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-10-01 17:57 289576 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MemoryCardManager]
--a------ 2006-11-03 17:04 304008 c:\program files\Dell Photo AIO Printer 926\memcard.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 11:54 5674352 c:\program files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2007-04-17 08:10 8429568 c:\windows\System32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2007-04-17 08:10 81920 c:\windows\System32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvSvc]
--a------ 2007-04-17 08:12 86016 c:\windows\System32\nvsvc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickBooks Simple Start]
--a------ 2007-01-30 23:59 371712 c:\program files\Intuit\SimpleStartEntice\entice.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-09-06 14:09 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
--a------ 2006-11-02 07:35 1196032 c:\program files\Windows Sidebar\sidebar.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 c:\program files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VAIO Center Access Bar]
--a------ 2007-03-06 17:22 36864 c:\program files\Sony\VAIO Center Access Bar\VCAB.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VAIOCameraUtility]
--a------ 2007-02-07 21:43 411768 c:\program files\Sony\VAIO Camera Utility\VCUServe.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VAIOSecurity]
--a------ 2007-03-13 19:13 2322432 c:\program files\Sony\VAIO Security Center\VSC.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VAIOSurvey]
--a------ 2006-12-06 19:08 577536 c:\program files\Sony\VAIO Survey\Vista VAIO Survey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive]
--a------ 2006-04-29 08:21 94208 c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
--a------ 2007-05-01 17:40 1006264 c:\program files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowsWelcomeCenter]
--a------ 2006-11-02 07:34 2159104 c:\windows\System32\oobefldr.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{0608AB7B-EE7A-4836-B916-518343A36A60}"= UDP:c:\program files\Sony\LocationFreePlayer\LFPC3\LFPC3.exe:LocationFree Player
"{82E14C05-35B6-413B-89E8-14E6BD23E279}"= TCP:c:\program files\Sony\LocationFreePlayer\LFPC3\LFPC3.exe:LocationFree Player
"{C6F458B8-EAB6-4491-A107-6E46A6B83708}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{73B1E602-10D1-4DD1-8F01-A7DD696DEA4A}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{812B667A-6880-4152-9B02-ABE30A139E7D}"= Disabled:UDP:c:\program files\Sony\VAIO Media 6.0\Vc.exe:[VAIO Media] VAIO Media
"{3A373912-8AC9-4557-90F2-332543F9DDE4}"= Disabled:TCP:c:\program files\Sony\VAIO Media 6.0\Vc.exe:[VAIO Media] VAIO Media
"TCP Query User{08D92976-27AE-4C02-B719-349B995D0E9D}c:\\users\\justin\\desktop\\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe"= UDP:c:\users\justin\desktop\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe:wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe
"UDP Query User{F53A70B2-15AE-47E8-AE7E-BBF64A71E3A4}c:\\users\\justin\\desktop\\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe"= TCP:c:\users\justin\desktop\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe:wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe
"TCP Query User{86E06A6D-5D07-435C-8930-8B12189946B1}c:\\users\\justin\\desktop\\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader(2).exe"= UDP:c:\users\justin\desktop\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader(2).exe:wow-2.1.2.6803-to-0.1.3.6875-enus-downloader(2).exe
"UDP Query User{1004526F-9AB1-497C-9B34-DE9D690812CA}c:\\users\\justin\\desktop\\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader(2).exe"= TCP:c:\users\justin\desktop\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader(2).exe:wow-2.1.2.6803-to-0.1.3.6875-enus-downloader(2).exe
"TCP Query User{3DE8351C-1024-4C14-8949-4B078D79C750}c:\\program files\\world of warcraft\\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe"= UDP:c:\program files\world of warcraft\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe:Blizzard Downloader
"UDP Query User{FFBFD782-8C8B-4080-8A60-4F60833FD4C5}c:\\program files\\world of warcraft\\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe"= TCP:c:\program files\world of warcraft\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe:Blizzard Downloader
"{36C69D1D-0598-4F31-A9D1-7493345D2BAF}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"TCP Query User{0300B31B-5AF4-48A7-BF6F-EBC25072E85F}c:\\program files\\world of warcraft\\wowtest\\wow-0.1.3.6875-to-0.1.3.6888-enus-downloader.exe"= UDP:c:\program files\world of warcraft\wowtest\wow-0.1.3.6875-to-0.1.3.6888-enus-downloader.exe:Blizzard Downloader
"UDP Query User{004F1E74-6765-49B8-8363-314ACDFF26A7}c:\\program files\\world of warcraft\\wowtest\\wow-0.1.3.6875-to-0.1.3.6888-enus-downloader.exe"= TCP:c:\program files\world of warcraft\wowtest\wow-0.1.3.6875-to-0.1.3.6888-enus-downloader.exe:Blizzard Downloader
"TCP Query User{5D9CC07E-CF88-438F-9D7F-09B2987C354A}c:\\program files\\world of warcraft\\wowtest\\wow-0.1.3.6888-to-0.1.3.6898-enus-downloader.exe"= UDP:c:\program files\world of warcraft\wowtest\wow-0.1.3.6888-to-0.1.3.6898-enus-downloader.exe:Blizzard Downloader
"UDP Query User{7CDB8F28-1833-4218-9B77-A1C5A6FB190E}c:\\program files\\world of warcraft\\wowtest\\wow-0.1.3.6888-to-0.1.3.6898-enus-downloader.exe"= TCP:c:\program files\world of warcraft\wowtest\wow-0.1.3.6888-to-0.1.3.6898-enus-downloader.exe:Blizzard Downloader
"TCP Query User{1AC3ED66-92D0-45BC-B7B8-598BE648339D}c:\\program files\\world of warcraft\\wow-2.1.2.6803-to-2.1.3.6898-enus-downloader.exe"= UDP:c:\program files\world of warcraft\wow-2.1.2.6803-to-2.1.3.6898-enus-downloader.exe:Blizzard Downloader
"UDP Query User{FB587FAD-3ADF-417B-859F-08A06FB1A50F}c:\\program files\\world of warcraft\\wow-2.1.2.6803-to-2.1.3.6898-enus-downloader.exe"= TCP:c:\program files\world of warcraft\wow-2.1.2.6803-to-2.1.3.6898-enus-downloader.exe:Blizzard Downloader
"TCP Query User{E01C6FC6-2F36-4586-8165-D6A344FE1117}c:\\program files\\azureus\\azureus.exe"= UDP:c:\program files\azureus\azureus.exe:Azureus
"UDP Query User{9BFCCD98-8924-4771-A3E9-C46FC90AEDAE}c:\\program files\\azureus\\azureus.exe"= TCP:c:\program files\azureus\azureus.exe:Azureus
"TCP Query User{118D2D04-15B7-412E-871B-181A0170CCFD}c:\\program files\\itunes\\itunes.exe"= UDP:c:\program files\itunes\itunes.exe:iTunes
"UDP Query User{89F096D0-8426-4424-B2C1-84F1DB4069DE}c:\\program files\\itunes\\itunes.exe"= TCP:c:\program files\itunes\itunes.exe:iTunes
"{A6E24E50-3021-43F7-A10A-C7585E5B5C22}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{EF64F792-0EDD-4DD6-8E59-FEBAE93E9365}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{F625B838-89BD-4F4E-8793-A443C9B6CE9B}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{ED5DFE32-3CD5-4C07-BFC9-D81274D83AB9}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"TCP Query User{26137782-89C5-4F7E-8300-6AD89978B537}c:\\users\\justin\\desktop\\utorrent.exe"= UDP:c:\users\justin\desktop\utorrent.exe:utorrent.exe
"UDP Query User{E9B4436E-EF20-498B-9BEA-535A1D9A93CB}c:\\users\\justin\\desktop\\utorrent.exe"= TCP:c:\users\justin\desktop\utorrent.exe:utorrent.exe
"TCP Query User{8314B300-B644-4D5F-9ACE-4AC6BF0B79CC}c:\\program files\\world of warcraft\\backgrounddownloader.exe"= UDP:c:\program files\world of warcraft\backgrounddownloader.exe:Blizzard Downloader
"UDP Query User{BB65131F-5C73-40D5-8931-69AACBFDD56D}c:\\program files\\world of warcraft\\backgrounddownloader.exe"= TCP:c:\program files\world of warcraft\backgrounddownloader.exe:Blizzard Downloader
"{B03C65DB-B35D-4849-83B9-72F1E2726B61}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{229249A9-1331-4ADD-A890-078CD8DF2D2C}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"TCP Query User{EB7FE7DE-B343-44C6-B682-AF9EABC3F58E}c:\\program files\\world of warcraft\\wowtest\\wow-0.2.0.7125-to-0.2.0.7153-enus-downloader.exe"= UDP:c:\program files\world of warcraft\wowtest\wow-0.2.0.7125-to-0.2.0.7153-enus-downloader.exe:Blizzard Downloader
"UDP Query User{5DB0E312-699A-42B1-91C8-FB7A0BC5D56F}c:\\program files\\world of warcraft\\wowtest\\wow-0.2.0.7125-to-0.2.0.7153-enus-downloader.exe"= TCP:c:\program files\world of warcraft\wowtest\wow-0.2.0.7125-to-0.2.0.7153-enus-downloader.exe:Blizzard Downloader
"TCP Query User{AC11627A-F033-4709-A2F0-BA7E17175D0D}c:\\program files\\world of warcraft\\wowtest\\wow-0.2.0.7153-to-0.2.0.7175-enus-downloader.exe"= UDP:c:\program files\world of warcraft\wowtest\wow-0.2.0.7153-to-0.2.0.7175-enus-downloader.exe:Blizzard Downloader
"UDP Query User{70B2AF43-633D-4631-BC36-8E2A3DED0D7E}c:\\program files\\world of warcraft\\wowtest\\wow-0.2.0.7153-to-0.2.0.7175-enus-downloader.exe"= TCP:c:\program files\world of warcraft\wowtest\wow-0.2.0.7153-to-0.2.0.7175-enus-downloader.exe:Blizzard Downloader
"TCP Query User{817A81E2-3BB9-41F8-B238-B396744C7182}c:\\program files\\ratajik software\\stationripper\\stationripperconsole.exe"= UDP:c:\program files\ratajik software\stationripper\stationripperconsole.exe:StationRipperConsole
"UDP Query User{790680A8-A037-49CF-9C7F-53D534BB08D4}c:\\program files\\ratajik software\\stationripper\\stationripperconsole.exe"= TCP:c:\program files\ratajik software\stationripper\stationripperconsole.exe:StationRipperConsole
"{67D1E1D5-5C29-4704-9B82-E72341D1B4F4}"= UDP:c:\windows\System32\dlcxcoms.exe:Lexmark Communications System
"{0EFFF62F-CDDB-46E7-94E4-58B350B76BB6}"= TCP:c:\windows\System32\dlcxcoms.exe:Lexmark Communications System
"{AD749CC5-76A8-46CF-8062-311CB7681D0B}"= UDP:c:\program files\Dell Photo AIO Printer 926\dlcxmon.exe:Device Monitor
"{9F13FF35-1CA6-4DF2-9920-FADA786AD5A4}"= TCP:c:\program files\Dell Photo AIO Printer 926\dlcxmon.exe:Device Monitor
"{F9F0BA85-4627-458D-B779-AC8EE5444D66}"= UDP:c:\program files\Dell Photo AIO Printer 926\dlcxaiox.exe:All In One Center
"{4D74D1C1-4A98-4BB6-9232-227BF90EA4EB}"= TCP:c:\program files\Dell Photo AIO Printer 926\dlcxaiox.exe:All In One Center
"TCP Query User{26B5B44A-BFA7-43D0-AD7E-771BE2EFF420}c:\\users\\justin\\desktop\\utorrent.exe"= UDP:c:\users\justin\desktop\utorrent.exe:utorrent.exe
"UDP Query User{949F6867-7EE9-41E7-A9FA-AF57E2F09720}c:\\users\\justin\\desktop\\utorrent.exe"= TCP:c:\users\justin\desktop\utorrent.exe:utorrent.exe
"{A2DC937E-E7AC-416B-B6F7-B95D1FF777A9}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
"{5AEDB973-46D1-4AED-9DA5-0D2EA6D3D54C}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
"{F5B6BF89-C763-488D-B51D-2372A38D2D92}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
"{DAA32EFF-82BA-4393-850F-C2323A028171}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
"{2DE3C301-D550-4289-BE7E-1EF7AAA7E30E}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
"{BCA81B63-3EC4-428C-92DC-4482AAAF274C}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
"{08C7796B-5376-4185-BD8E-D818725FC8A8}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
"{7A4D3884-73F0-4EB1-BE97-88E3736C3FF7}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
"{64540B5B-409C-47B8-8F7F-1F4B0353B005}"= c:\program files\WiFiConnector\NintendoWFCReg.exe:Nintendo Wi-Fi USB Connector
"TCP Query User{F2F018B6-CC36-4628-B308-6B2D87DB43F2}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{42636805-BCA2-4B75-B8C1-204D18EAE61D}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{41A6D261-0ECE-4DBF-9FAB-E01EE55B8998}c:\\users\\justin\\desktop\\sppscript4\\sppscript4\\mirc.exe"= UDP:c:\users\justin\desktop\sppscript4\sppscript4\mirc.exe:mirc.exe
"UDP Query User{D499B443-51B0-44C9-A23C-2D5DBCCD51BB}c:\\users\\justin\\desktop\\sppscript4\\sppscript4\\mirc.exe"= TCP:c:\users\justin\desktop\sppscript4\sppscript4\mirc.exe:mirc.exe
"{C0D64663-74E5-4A00-8524-176D004EF22F}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{22721051-0E70-4F8A-BD8C-825FD8831B8E}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{D5B78781-CAE8-47DD-8F96-83CE3FF1F1EF}"= UDP:c:\program files\AIM6\aim6.exe:AIM
"{47335104-B793-4641-94AA-CC8D9DAB2344}"= TCP:c:\program files\AIM6\aim6.exe:AIM
"{6A122D3D-B91E-4F90-B42D-93041ACDAD38}"= c:\program files\PharosSystems\Core\CTskMstr.exe:Pharos Com Task Master
"{939D3E02-68DA-4F39-A6B5-757C738B0257}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
"{F74CAFE3-A3EB-497E-8978-284DF736FA5D}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe
"TCP Query User{AB808DA8-5733-45E9-BB8C-C81C5250CF16}c:\\program files\\aim6\\aim6.exe"= UDP:c:\program files\aim6\aim6.exe:AIM
"UDP Query User{431E91B4-970B-4CFD-971E-62A6B2DF263F}c:\\program files\\aim6\\aim6.exe"= TCP:c:\program files\aim6\aim6.exe:AIM
"{18F9F074-F13F-446F-BF48-1F0E63D253D6}"= UDP:c:\users\Justin\Desktop\utorrent.exe:µTorrent (TCP-In)
"{1601F81F-AA8E-4573-8415-563CF8D4A58F}"= TCP:c:\users\Justin\Desktop\utorrent.exe:µTorrent (UDP-In)
"{938DCED9-E4F5-437A-8167-31816802AB0D}"= UDP:3724:Blizzard Downloader: 3724
"{EFA4BD4A-862B-40BC-81EE-C49590388F36}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{80E46EC5-6428-44FE-A532-70DC6443D79B}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{FD90F6AD-C493-4E99-A35D-D55E0B86085F}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{23595446-098F-4935-8703-216630DA67CF}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"TCP Query User{9E71F86F-48D8-4415-B055-A0AD7DD41B62}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:µTorrent
"UDP Query User{90C922D9-611A-4867-B1E9-F68D87B5D3CE}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:µTorrent

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-05-08 97928]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-05-08 875288]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-05-08 231704]
R2 dlcx_device;dlcx_device;c:\windows\system32\dlcxcoms.exe -service []
R2 MSSQL$VAIO_VEDB;SQL Server (VAIO_VEDB);"c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sVAIO_VEDB [2007-01-31 28933976]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-04-17 11032]
R3 AvgWfpX;AVG8 Firewall Driver x86;c:\windows\system32\Drivers\avgwfpx.sys [2008-05-08 69128]
R3 R5U870FLx86;R5U870 UVC Lower Filter ;c:\windows\system32\Drivers\R5U870FLx86.sys [2007-05-01 74240]
R3 R5U870FUx86;R5U870 UVC Upper Filter ;c:\windows\system32\Drivers\R5U870FUx86.sys [2007-05-01 43904]
R3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\system32\DRIVERS\SonyImgF.sys [2007-05-01 31104]
R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2007-05-01 807424]
S3 ICScsiSV;Image Converter SCSI Service;c:\program files\Sony\Image Converter 3\ICScsiSV.exe [2007-06-21 75952]
S3 IcVzMonLauncher;IcVzMonLauncher;"c:\program files\Sony\Image Converter 3\IcVzMonLauncher.exe" [2007-06-21 67760]
S3 Image Converter video recording monitor for VAIO Entertainment;Image Converter video recording monitor for VAIO Entertainment;c:\program files\Sony\Image Converter 3\IcVzMon.exe [2007-06-21 43184]
S3 UsbFltr;Razer Copperhead Driver;c:\windows\system32\drivers\copperhd.sys [2007-11-28 11596]
S3 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\Sony\VAIO Media Integrated Server\UCLS.exe [2007-06-21 745472]
S3 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);"c:\program files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-UCLS-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Applications\UCLS\HTTP" []
S3 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [2007-06-21 1089536]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d7e4ea70-2045-11dc-b2cc-806e6f6e6963}]
\shell\AutoRun\command - H:\Installer.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e967de7c-60c6-11dc-afe9-0013a9c1e175}]
\shell\AutoRun\command - I:\LaunchU3.exe

*Newly Created Service* - CATCHME
*Newly Created Service* - GMER
*Newly Created Service* - PROCEXP90
.
- - - - ORPHANS REMOVED - - - -

BHO-{333789EA-38B0-43D2-8058-60B749E63FC9} - c:\windows\system32\LinkSave.dll
HKLM-Run-dmrbx.exe - c:\windows\system32\dmrbx.exe
HKLM-Run-dmsxg.exe - c:\windows\system32\dmsxg.exe
HKLM-Run-dmwin.exe - c:\windows\system32\dmwin.exe
HKLM-Run-dmaws.exe - c:\windows\system32\dmaws.exe
MSConfigStartUp-Corel Photo Downloader - c:\program files\Corel\Corel Snapfire\Corel PhotoDownloader.exe
MSConfigStartUp-HotKeysCmds - c:\windows\system32\hkcmd.exe
MSConfigStartUp-IgfxTray - c:\windows\system32\igfxtray.exe
MSConfigStartUp-NapsterShell - c:\program files\Napster\napster.exe
MSConfigStartUp-Persistence - c:\windows\system32\igfxpers.exe
MSConfigStartUp-Yahoo! Pager - c:\program files\Yahoo!\Messenger\YahooMessenger.exe

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.sony.com/vaiopeople
uInternet Settings,ProxyOverride = *.local
IE: &AIM Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FireFox -: Profile - c:\users\Justin\AppData\Roaming\Mozilla\Firefox\Profiles\rt2sdwg4.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://search.aol.com/aolcom/search?invocationType=tbff50ie7&query=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://en-US.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
FF -: plugin - c:\program files\DivX\DivX Content Uploader\npUpload.dll
FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF -: plugin - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-08 14:30:55
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLCXCATS = rundll32 c:\windows\system32\spool\DRIVERS\W32X86\3\DLCXtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(776)
c:\windows\system32\avgrsstx.dll

- - - - - - - > 'lsass.exe'(700)
c:\windows\system32\avgrsstx.dll
.
Completion time: 2008-12-08 14:32:31
ComboFix-quarantined-files.txt 2008-12-08 19:32:19

Pre-Run: 22,572,273,664 bytes free
Post-Run: 23,678,414,848 bytes free

320

DDS (Version 1.0) - NTFSx86
Run by Justin at 14:37:42.42 on Mon 12/08/2008
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.2046.1157 [GMT -5:00]

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\dlcxcoms.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\PROGRA~1\PHAROS~1\Core\CTskMstr.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\stacsv.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\alg.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\cfrog.exe
C:\Program Files\Rainmeter\Rainmeter.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\Explorer.exe
C:\Users\Justin\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.sony.com/vaiopeople
uInternet Settings,ProxyOverride = *.local
BHO: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - c:\program files\avg\avg8\avgssie.dll
BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre1.6.0_03\bin\ssv.dll
BHO: {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - c:\program files\aol\aim toolbar 5.0\aoltb.dll
BHO: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: {AE7CD045-E861-484f-8273-0445EE161910} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
TB: {DE9C389F-3316-41A7-809B-AA305ED9D922} - c:\program files\aol\aim toolbar 5.0\aoltb.dll
TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
uRun: [msnmsgr] "c:\program files\msn messenger\msnmsgr.exe" /background
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp
uRun: [RocketDock] "c:\program files\rocketdock\RocketDock.exe"
mRun: [DLCXCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCXtime.dll,_RunDLLEntry@16
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [c:\windows\system32\baloon.exe] c:\windows\system32\baloon.exe
mRun: [c:\windows\system32\cfrog.exe] c:\windows\system32\cfrog.exe
StartupFolder: c:\users\justin\appdata\roaming\micros~1\windows\startm~1\programs\startup\rainme~1.lnk - c:\program files\rainmeter\Rainmeter.exe
mPolicies-system: EnableLUA = 0 (0x0)
IE: &AIM Search - c:\program files\aol\aim toolbar 5.0\resources\en-us\local\search.html
IE: Append to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "c:\program files\fiddler2\Fiddler.exe"
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_03\bin\ssv.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {3369AF0D-62E9-4bda-8103-B4C75499B578} - {DE9C389F-3316-41A7-809B-AA305ED9D922} - c:\program files\aol\aim toolbar 5.0\aoltb.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
IE: {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - c:\program files\fiddler2\Fiddler.exe
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: igfxcui - igfxdev.dll
Notify: VESWinlogon - VESWinlogon.dll
AppInit_DLLs: avgrsstx.dll

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-5-8 97928]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2008-5-8 875288]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-5-8 231704]
R2 dlcx_device;dlcx_device;c:\windows\system32\dlcxcoms.exe -service []
R2 MSSQL$VAIO_VEDB;SQL Server (VAIO_VEDB);"c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe" -sVAIO_VEDB [2007-1-31 28933976]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-4-17 11032]
R3 AvgWfpX;AVG8 Firewall Driver x86;c:\windows\system32\drivers\avgwfpx.sys [2008-5-8 69128]
R3 R5U870FLx86;R5U870 UVC Lower Filter ;c:\windows\system32\drivers\R5U870FLx86.sys [2007-5-1 74240]
R3 R5U870FUx86;R5U870 UVC Upper Filter ;c:\windows\system32\drivers\R5U870FUx86.sys [2007-5-1 43904]
R3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\system32\drivers\SonyImgF.sys [2007-5-1 31104]
R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2007-5-1 807424]
S3 ICScsiSV;Image Converter SCSI Service;c:\program files\sony\image converter 3\ICScsiSV.exe [2007-6-21 75952]
S3 IcVzMonLauncher;IcVzMonLauncher;"c:\program files\sony\image converter 3\IcVzMonLauncher.exe" [2007-6-21 67760]
S3 Image Converter video recording monitor for VAIO Entertainment;Image Converter video recording monitor for VAIO Entertainment;c:\program files\sony\image converter 3\IcVzMon.exe [2007-6-21 43184]
S3 UsbFltr;Razer Copperhead Driver;c:\windows\system32\drivers\copperhd.sys [2007-11-28 11596]
S3 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\sony\vaio media integrated server\UCLS.exe [2007-6-21 745472]
S3 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);"c:\program files\sony\vaio media integrated server\platform\sv_httpd.exe" /service=vaiomediaplatform-ucls-http /regroot="software\sony corporation\vaio media platform\2.0" /regext="\applications\ucls\HTTP" []
S3 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\sony\vaio media integrated server\platform\UPnPFramework.exe [2007-6-21 1089536]

=============== Created Last 30 ================

2008-12-08 14:26 161,792 a------- c:\windows\SWREG.exe
2008-12-08 14:26 98,816 a------- c:\windows\sed.exe
2008-12-08 14:26 <DIR> --d----- C:\ComboFix
2008-12-07 14:35 250 a------- c:\windows\gmer.ini
2008-12-07 13:17 <DIR> --d----- C:\!KillBox
2008-12-06 19:53 <DIR> a-d----- c:\programdata\TEMP
2008-12-06 17:24 <DIR> --d----- c:\program files\Lavasoft
2008-12-06 17:08 118,784 a------- c:\windows\system32\baloon.exe
2008-11-15 03:39 <DIR> --d----- c:\program files\RocketDock
2008-11-14 14:12 <DIR> --d----- c:\program files\Rainmeter

==================== Find3M ====================

2008-10-31 08:15 86,016 a------- c:\windows\inf\infstor.dat
2008-10-31 08:15 86,016 a------- c:\windows\inf\infpub.dat
2008-10-31 08:15 143,360 a------- c:\windows\inf\infstrng.dat
2008-01-22 10:38 45,880 a------- c:\users\justin\appdata\roaming\nvModes.dat
2007-05-01 17:51 665,600 a------- c:\windows\inf\drvindex.dat
2006-11-02 07:50 174 a--sh--- c:\program files\desktop.ini
2006-11-02 07:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 07:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 07:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 07:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 04:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 04:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 04:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 04:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 14:38:14.79 ===============

Aelvin · 12-08-2008, 01:24 PM

I apologize, I may have included the incorrect logs...
You ask for a HijackThis log, and without asking I posted the new DDS log... is this correct? Or should I download HijackThis and produce a log for you?
Also, the attached log file is the ComboFix log... I saved a copy to the desktop and posted that instead of the default name/filepath that you requested in your post.
If any of this is incorrect, I apologize ahead of time :o

**TheBruce1** · 12-08-2008, 03:45 PM

Hello again

Do NOT attach logs to you posts, simply copy/paste them into your reply

========

Open notepad and copy/paste the text in the quotebox below into it:

Quote:

http://www.techsupportforum.com/security-center/hijackthis-log-help/321191-winiguard-alert-help-please.html

Collect::
c:\windows\System32\baloon.exe
c:\windows\system32\cfrog.exe

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"c:\windows\system32\baloon.exe"=-
"c:\windows\system32\cfrog.exe"=-

Save this as CFscript

Refering to the picture above, drag CFscript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis.

Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file(s).

=========

JAVA OUTDATED

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
Scroll down to where it says "Java Runtime Environment (JRE) 6 Update 11. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
Click the "Download" button to the right.
Select the Windows platform from the dropdown menu.
Read the License Agreement and then check the box that says: "Accept License Agreement". Click on Continue.The page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u11-windows-i586-p.exe to install the newest version.

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH Checked
  - Applications and Applets
    Trace and Log Files
- Click OK on Delete Temporary Files Window
  Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
- Click OK to leave the Temporary Files Window
- Click OK to leave the Java Control Panel.

========

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Click Accept, when prompted to download and install the program files and database of malware definitions.

Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.
Click the Save Report As... button.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

**Note**

This animation will guide you through the process:

To optimize scanning time and produce a more sensible report for review:

Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

==========

Run DDS again and post that log in your reply.

===========
Logs Required
C:\Combofix.txt
Kaspersky Scan Report
DDS.txt

How is your system running now.

Aelvin · 12-08-2008, 08:51 PM

Thank you very much! You really helped me out, as those popups were becoming extremely annoying. I appreciate your time and effort... As far as how my computer is running, it appears to be running fine (at least without those fake alerts and such). Here are the requested logs:

DDS (Version 1.0) - NTFSx86
Run by Justin at 22:21:28.67 on Mon 12/08/2008
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.2046.1257 [GMT -5:00]

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\dlcxcoms.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\PROGRA~1\PHAROS~1\Core\CTskMstr.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\stacsv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Rainmeter\Rainmeter.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe
C:\Windows\system32\WUDFHost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Windows\System32\alg.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Ventrilo\Ventrilo.exe
C:\Users\Justin\Desktop\dds.scr
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.sony.com/vaiopeople
uInternet Settings,ProxyOverride = *.local
BHO: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - c:\program files\avg\avg8\avgssie.dll
BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll
BHO: {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - c:\program files\aol\aim toolbar 5.0\aoltb.dll
BHO: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: {AE7CD045-E861-484f-8273-0445EE161910} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
TB: {DE9C389F-3316-41A7-809B-AA305ED9D922} - c:\program files\aol\aim toolbar 5.0\aoltb.dll
TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
uRun: [msnmsgr] "c:\program files\msn messenger\msnmsgr.exe" /background
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp
uRun: [RocketDock] "c:\program files\rocketdock\RocketDock.exe"
mRun: [DLCXCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCXtime.dll,_RunDLLEntry@16
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
StartupFolder: c:\users\justin\appdata\roaming\micros~1\windows\startm~1\programs\startup\rainme~1.lnk - c:\program files\rainmeter\Rainmeter.exe
mPolicies-system: EnableLUA = 0 (0x0)
IE: &AIM Search - c:\program files\aol\aim toolbar 5.0\resources\en-us\local\search.html
IE: Append to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "c:\program files\fiddler2\Fiddler.exe"
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {3369AF0D-62E9-4bda-8103-B4C75499B578} - {DE9C389F-3316-41A7-809B-AA305ED9D922} - c:\program files\aol\aim toolbar 5.0\aoltb.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
IE: {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - c:\program files\fiddler2\Fiddler.exe
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: igfxcui - igfxdev.dll
Notify: VESWinlogon - VESWinlogon.dll
AppInit_DLLs: avgrsstx.dll

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-5-8 97928]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2008-5-8 875288]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-5-8 231704]
R2 dlcx_device;dlcx_device;c:\windows\system32\dlcxcoms.exe -service []
R2 MSSQL$VAIO_VEDB;SQL Server (VAIO_VEDB);"c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe" -sVAIO_VEDB [2007-1-31 28933976]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-4-17 11032]
R3 AvgWfpX;AVG8 Firewall Driver x86;c:\windows\system32\drivers\avgwfpx.sys [2008-5-8 69128]
R3 R5U870FLx86;R5U870 UVC Lower Filter ;c:\windows\system32\drivers\R5U870FLx86.sys [2007-5-1 74240]
R3 R5U870FUx86;R5U870 UVC Upper Filter ;c:\windows\system32\drivers\R5U870FUx86.sys [2007-5-1 43904]
R3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\system32\drivers\SonyImgF.sys [2007-5-1 31104]
R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2007-5-1 807424]
S3 ICScsiSV;Image Converter SCSI Service;c:\program files\sony\image converter 3\ICScsiSV.exe [2007-6-21 75952]
S3 IcVzMonLauncher;IcVzMonLauncher;"c:\program files\sony\image converter 3\IcVzMonLauncher.exe" [2007-6-21 67760]
S3 Image Converter video recording monitor for VAIO Entertainment;Image Converter video recording monitor for VAIO Entertainment;c:\program files\sony\image converter 3\IcVzMon.exe [2007-6-21 43184]
S3 UsbFltr;Razer Copperhead Driver;c:\windows\system32\drivers\copperhd.sys [2007-11-28 11596]
S3 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\sony\vaio media integrated server\UCLS.exe [2007-6-21 745472]
S3 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);"c:\program files\sony\vaio media integrated server\platform\sv_httpd.exe" /service=vaiomediaplatform-ucls-http /regroot="software\sony corporation\vaio media platform\2.0" /regext="\applications\ucls\HTTP" []
S3 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\sony\vaio media integrated server\platform\UPnPFramework.exe [2007-6-21 1089536]

=============== Created Last 30 ================

2008-12-08 18:38 410,984 a------- c:\windows\system32\deploytk.dll
2008-12-08 18:35 <DIR> --d----- c:\users\justin\.SunDownloadManager
2008-12-08 18:24 <DIR> --d----- C:\ComboFix
2008-12-08 14:26 161,792 a------- c:\windows\SWREG.exe
2008-12-08 14:26 98,816 a------- c:\windows\sed.exe
2008-12-07 14:35 250 a------- c:\windows\gmer.ini
2008-12-07 13:17 <DIR> --d----- C:\!KillBox
2008-12-06 19:53 <DIR> a-d----- c:\programdata\TEMP
2008-12-06 17:24 <DIR> --d----- c:\program files\Lavasoft
2008-11-15 03:39 <DIR> --d----- c:\program files\RocketDock
2008-11-14 14:12 <DIR> --d----- c:\program files\Rainmeter

==================== Find3M ====================

2008-10-31 08:15 86,016 a------- c:\windows\inf\infstor.dat
2008-10-31 08:15 86,016 a------- c:\windows\inf\infpub.dat
2008-10-31 08:15 143,360 a------- c:\windows\inf\infstrng.dat
2008-01-22 10:38 45,880 a------- c:\users\justin\appdata\roaming\nvModes.dat
2007-05-01 17:51 665,600 a------- c:\windows\inf\drvindex.dat
2006-11-02 07:50 174 a--sh--- c:\program files\desktop.ini
2006-11-02 07:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 07:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 07:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 07:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 04:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 04:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 04:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 04:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 22:22:18.94 ===============

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Monday, December 8, 2008
Operating System: Microsoft Windows Vista Home Premium Edition, 32-bit (build 6000)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Monday, December 08, 2008 21:57:06
Records in database: 1444669
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
H:\

Scan statistics:
Files scanned: 164163
Threat name: 0
Infected objects: 0
Suspicious objects: 0
Duration of the scan: 02:42:02

No malware has been detected. The scan area is clean.

The selected area was scanned.

ComboFix 08-12-05.03 - Justin 2008-12-08 18:27:01.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.1133 [GMT -5:00]
Running from: c:\users\Justin\Desktop\ComboFix.exe
Command switches used :: c:\users\Justin\Desktop\CFscript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\System32\baloon.exe
c:\windows\system32\cfrog.exe

.
((((((((((((((((((((((((( Files Created from 2008-11-08 to 2008-12-08 )))))))))))))))))))))))))))))))
.

2008-12-07 14:35 . 2008-12-07 14:35 250 --a------ c:\windows\gmer.ini
2008-12-07 13:17 . 2008-12-07 13:17 <DIR> d-------- C:\!KillBox
2008-12-06 19:53 . 2008-12-06 19:58 <DIR> d-a------ c:\users\All Users\TEMP
2008-12-06 19:53 . 2008-12-06 19:58 <DIR> d-a------ c:\programdata\TEMP
2008-12-06 17:24 . 2008-12-06 17:24 <DIR> d-------- c:\program files\Lavasoft
2008-11-15 03:39 . 2008-11-15 03:40 <DIR> d-------- c:\program files\RocketDock
2008-11-14 14:12 . 2008-11-14 14:13 <DIR> d-------- c:\program files\Rainmeter

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-07 00:52 --------- d-----w c:\users\Justin\AppData\Roaming\Download Manager
2008-12-06 22:24 --------- d-----w c:\programdata\Lavasoft
2008-12-06 22:20 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-12-05 20:25 --------- d-----w c:\users\Justin\AppData\Roaming\uTorrent
2008-11-25 13:51 --------- d-----w c:\program files\Warcraft III
2008-11-24 18:38 --------- d-----w c:\program files\Dl_cats
2008-11-13 06:10 --------- d-----w c:\program files\World of Warcraft
2008-11-05 02:02 --------- d-----w c:\program files\Yahoo!
2008-10-31 13:32 --------- d-----w c:\programdata\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-31 13:32 --------- d-----w c:\program files\iTunes
2008-10-31 13:31 --------- d-----w c:\program files\iPod
2008-10-31 13:25 --------- d-----w c:\program files\QuickTime
2008-10-31 13:25 --------- d-----w c:\program files\Bonjour
2008-10-31 13:23 --------- d-----w c:\program files\Common Files\Apple
2008-10-31 13:17 --------- d-----w c:\program files\Apple Software Update
2008-01-22 15:38 45,880 ----a-w c:\users\Justin\AppData\Roaming\nvModes.dat
2006-11-02 12:50 174 --sha-w c:\program files\desktop.ini
.

((((((((((((((((((((((((((((( snapshot@2008-12-08_14.31.49.45 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-12-07 17:50:55 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-12-08 19:31:19 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
"Aim6"="c:\program files\AIM6\aim6.exe" [2008-03-25 50528]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DLCXCATS"="c:\windows\system32\spool\DRIVERS\W32X86\3\DLCXtime.dll" [2006-10-16 106496]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-27 1261336]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]

c:\users\Justin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Rainmeter.lnk - c:\program files\Rainmeter\Rainmeter.exe [2006-01-21 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2007-02-13 17:19 98304 c:\windows\System32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.dvsd"= c:\program files\Common Files\Sony Shared\VideoLib\sonydv.dll

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk
backup=c:\windows\pss\Adobe Acrobat Synchronizer.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth Manager.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth Manager.lnk
backup=c:\windows\pss\Bluetooth Manager.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=c:\windows\pss\QuickBooks Update Agent.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Run Registration Tool.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Run Registration Tool.lnk
backup=c:\windows\pss\Run Registration Tool.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Justin^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\users\Justin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
--a------ 2006-10-23 01:24 620152 c:\program files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2007-05-11 02:06 40048 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
--a------ 2007-08-12 14:42 2321600 c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
--a------ 2008-03-25 15:21 50528 c:\program files\AIM6\aim6.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
--a------ 2006-11-13 07:32 118784 c:\program files\Apoint\Apoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Copperhead]
--a------ 2005-11-25 10:53 155648 c:\program files\Razer\Copperhead\razerhid.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLCXCATS]
--a------ 2006-10-16 00:31 106496 c:\windows\System32\spool\drivers\w32x86\3\dlcxtime.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dlcxmon.exe]
--a------ 2007-01-12 11:57 292336 c:\program files\Dell Photo AIO Printer 926\dlcxmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer]
--a------ 2006-11-03 17:09 312200 c:\program files\Dell PC Fax\fm3032.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISBMgr.exe]
--a------ 2007-04-16 21:06 321656 c:\program files\Sony\ISB Utility\ISBMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-10-01 17:57 289576 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MemoryCardManager]
--a------ 2006-11-03 17:04 304008 c:\program files\Dell Photo AIO Printer 926\memcard.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 11:54 5674352 c:\program files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2007-04-17 08:10 8429568 c:\windows\System32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2007-04-17 08:10 81920 c:\windows\System32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvSvc]
--a------ 2007-04-17 08:12 86016 c:\windows\System32\nvsvc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickBooks Simple Start]
--a------ 2007-01-30 23:59 371712 c:\program files\Intuit\SimpleStartEntice\entice.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-09-06 14:09 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
--a------ 2006-11-02 07:35 1196032 c:\program files\Windows Sidebar\sidebar.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 c:\program files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VAIO Center Access Bar]
--a------ 2007-03-06 17:22 36864 c:\program files\Sony\VAIO Center Access Bar\VCAB.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VAIOCameraUtility]
--a------ 2007-02-07 21:43 411768 c:\program files\Sony\VAIO Camera Utility\VCUServe.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VAIOSecurity]
--a------ 2007-03-13 19:13 2322432 c:\program files\Sony\VAIO Security Center\VSC.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VAIOSurvey]
--a------ 2006-12-06 19:08 577536 c:\program files\Sony\VAIO Survey\Vista VAIO Survey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive]
--a------ 2006-04-29 08:21 94208 c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
--a------ 2007-05-01 17:40 1006264 c:\program files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowsWelcomeCenter]
--a------ 2006-11-02 07:34 2159104 c:\windows\System32\oobefldr.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{0608AB7B-EE7A-4836-B916-518343A36A60}"= UDP:c:\program files\Sony\LocationFreePlayer\LFPC3\LFPC3.exe:LocationFree Player
"{82E14C05-35B6-413B-89E8-14E6BD23E279}"= TCP:c:\program files\Sony\LocationFreePlayer\LFPC3\LFPC3.exe:LocationFree Player
"{C6F458B8-EAB6-4491-A107-6E46A6B83708}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{73B1E602-10D1-4DD1-8F01-A7DD696DEA4A}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{812B667A-6880-4152-9B02-ABE30A139E7D}"= Disabled:UDP:c:\program files\Sony\VAIO Media 6.0\Vc.exe:[VAIO Media] VAIO Media
"{3A373912-8AC9-4557-90F2-332543F9DDE4}"= Disabled:TCP:c:\program files\Sony\VAIO Media 6.0\Vc.exe:[VAIO Media] VAIO Media
"TCP Query User{08D92976-27AE-4C02-B719-349B995D0E9D}c:\\users\\justin\\desktop\\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe"= UDP:c:\users\justin\desktop\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe:wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe
"UDP Query User{F53A70B2-15AE-47E8-AE7E-BBF64A71E3A4}c:\\users\\justin\\desktop\\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe"= TCP:c:\users\justin\desktop\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe:wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe
"TCP Query User{86E06A6D-5D07-435C-8930-8B12189946B1}c:\\users\\justin\\desktop\\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader(2).exe"= UDP:c:\users\justin\desktop\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader(2).exe:wow-2.1.2.6803-to-0.1.3.6875-enus-downloader(2).exe
"UDP Query User{1004526F-9AB1-497C-9B34-DE9D690812CA}c:\\users\\justin\\desktop\\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader(2).exe"= TCP:c:\users\justin\desktop\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader(2).exe:wow-2.1.2.6803-to-0.1.3.6875-enus-downloader(2).exe
"TCP Query User{3DE8351C-1024-4C14-8949-4B078D79C750}c:\\program files\\world of warcraft\\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe"= UDP:c:\program files\world of warcraft\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe:Blizzard Downloader
"UDP Query User{FFBFD782-8C8B-4080-8A60-4F60833FD4C5}c:\\program files\\world of warcraft\\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe"= TCP:c:\program files\world of warcraft\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe:Blizzard Downloader
"{36C69D1D-0598-4F31-A9D1-7493345D2BAF}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"TCP Query User{0300B31B-5AF4-48A7-BF6F-EBC25072E85F}c:\\program files\\world of warcraft\\wowtest\\wow-0.1.3.6875-to-0.1.3.6888-enus-downloader.exe"= UDP:c:\program files\world of warcraft\wowtest\wow-0.1.3.6875-to-0.1.3.6888-enus-downloader.exe:Blizzard Downloader
"UDP Query User{004F1E74-6765-49B8-8363-314ACDFF26A7}c:\\program files\\world of warcraft\\wowtest\\wow-0.1.3.6875-to-0.1.3.6888-enus-downloader.exe"= TCP:c:\program files\world of warcraft\wowtest\wow-0.1.3.6875-to-0.1.3.6888-enus-downloader.exe:Blizzard Downloader
"TCP Query User{5D9CC07E-CF88-438F-9D7F-09B2987C354A}c:\\program files\\world of warcraft\\wowtest\\wow-0.1.3.6888-to-0.1.3.6898-enus-downloader.exe"= UDP:c:\program files\world of warcraft\wowtest\wow-0.1.3.6888-to-0.1.3.6898-enus-downloader.exe:Blizzard Downloader
"UDP Query User{7CDB8F28-1833-4218-9B77-A1C5A6FB190E}c:\\program files\\world of warcraft\\wowtest\\wow-0.1.3.6888-to-0.1.3.6898-enus-downloader.exe"= TCP:c:\program files\world of warcraft\wowtest\wow-0.1.3.6888-to-0.1.3.6898-enus-downloader.exe:Blizzard Downloader
"TCP Query User{1AC3ED66-92D0-45BC-B7B8-598BE648339D}c:\\program files\\world of warcraft\\wow-2.1.2.6803-to-2.1.3.6898-enus-downloader.exe"= UDP:c:\program files\world of warcraft\wow-2.1.2.6803-to-2.1.3.6898-enus-downloader.exe:Blizzard Downloader
"UDP Query User{FB587FAD-3ADF-417B-859F-08A06FB1A50F}c:\\program files\\world of warcraft\\wow-2.1.2.6803-to-2.1.3.6898-enus-downloader.exe"= TCP:c:\program files\world of warcraft\wow-2.1.2.6803-to-2.1.3.6898-enus-downloader.exe:Blizzard Downloader
"TCP Query User{E01C6FC6-2F36-4586-8165-D6A344FE1117}c:\\program files\\azureus\\azureus.exe"= UDP:c:\program files\azureus\azureus.exe:Azureus
"UDP Query User{9BFCCD98-8924-4771-A3E9-C46FC90AEDAE}c:\\program files\\azureus\\azureus.exe"= TCP:c:\program files\azureus\azureus.exe:Azureus
"TCP Query User{118D2D04-15B7-412E-871B-181A0170CCFD}c:\\program files\\itunes\\itunes.exe"= UDP:c:\program files\itunes\itunes.exe:iTunes
"UDP Query User{89F096D0-8426-4424-B2C1-84F1DB4069DE}c:\\program files\\itunes\\itunes.exe"= TCP:c:\program files\itunes\itunes.exe:iTunes
"{A6E24E50-3021-43F7-A10A-C7585E5B5C22}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{EF64F792-0EDD-4DD6-8E59-FEBAE93E9365}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{F625B838-89BD-4F4E-8793-A443C9B6CE9B}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{ED5DFE32-3CD5-4C07-BFC9-D81274D83AB9}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"TCP Query User{26137782-89C5-4F7E-8300-6AD89978B537}c:\\users\\justin\\desktop\\utorrent.exe"= UDP:c:\users\justin\desktop\utorrent.exe:utorrent.exe
"UDP Query User{E9B4436E-EF20-498B-9BEA-535A1D9A93CB}c:\\users\\justin\\desktop\\utorrent.exe"= TCP:c:\users\justin\desktop\utorrent.exe:utorrent.exe
"TCP Query User{8314B300-B644-4D5F-9ACE-4AC6BF0B79CC}c:\\program files\\world of warcraft\\backgrounddownloader.exe"= UDP:c:\program files\world of warcraft\backgrounddownloader.exe:Blizzard Downloader
"UDP Query User{BB65131F-5C73-40D5-8931-69AACBFDD56D}c:\\program files\\world of warcraft\\backgrounddownloader.exe"= TCP:c:\program files\world of warcraft\backgrounddownloader.exe:Blizzard Downloader
"{B03C65DB-B35D-4849-83B9-72F1E2726B61}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{229249A9-1331-4ADD-A890-078CD8DF2D2C}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"TCP Query User{EB7FE7DE-B343-44C6-B682-AF9EABC3F58E}c:\\program files\\world of warcraft\\wowtest\\wow-0.2.0.7125-to-0.2.0.7153-enus-downloader.exe"= UDP:c:\program files\world of warcraft\wowtest\wow-0.2.0.7125-to-0.2.0.7153-enus-downloader.exe:Blizzard Downloader
"UDP Query User{5DB0E312-699A-42B1-91C8-FB7A0BC5D56F}c:\\program files\\world of warcraft\\wowtest\\wow-0.2.0.7125-to-0.2.0.7153-enus-downloader.exe"= TCP:c:\program files\world of warcraft\wowtest\wow-0.2.0.7125-to-0.2.0.7153-enus-downloader.exe:Blizzard Downloader
"TCP Query User{AC11627A-F033-4709-A2F0-BA7E17175D0D}c:\\program files\\world of warcraft\\wowtest\\wow-0.2.0.7153-to-0.2.0.7175-enus-downloader.exe"= UDP:c:\program files\world of warcraft\wowtest\wow-0.2.0.7153-to-0.2.0.7175-enus-downloader.exe:Blizzard Downloader
"UDP Query User{70B2AF43-633D-4631-BC36-8E2A3DED0D7E}c:\\program files\\world of warcraft\\wowtest\\wow-0.2.0.7153-to-0.2.0.7175-enus-downloader.exe"= TCP:c:\program files\world of warcraft\wowtest\wow-0.2.0.7153-to-0.2.0.7175-enus-downloader.exe:Blizzard Downloader
"TCP Query User{817A81E2-3BB9-41F8-B238-B396744C7182}c:\\program files\\ratajik software\\stationripper\\stationripperconsole.exe"= UDP:c:\program files\ratajik software\stationripper\stationripperconsole.exe:StationRipperConsole
"UDP Query User{790680A8-A037-49CF-9C7F-53D534BB08D4}c:\\program files\\ratajik software\\stationripper\\stationripperconsole.exe"= TCP:c:\program files\ratajik software\stationripper\stationripperconsole.exe:StationRipperConsole
"{67D1E1D5-5C29-4704-9B82-E72341D1B4F4}"= UDP:c:\windows\System32\dlcxcoms.exe:Lexmark Communications System
"{0EFFF62F-CDDB-46E7-94E4-58B350B76BB6}"= TCP:c:\windows\System32\dlcxcoms.exe:Lexmark Communications System
"{AD749CC5-76A8-46CF-8062-311CB7681D0B}"= UDP:c:\program files\Dell Photo AIO Printer 926\dlcxmon.exe:Device Monitor
"{9F13FF35-1CA6-4DF2-9920-FADA786AD5A4}"= TCP:c:\program files\Dell Photo AIO Printer 926\dlcxmon.exe:Device Monitor
"{F9F0BA85-4627-458D-B779-AC8EE5444D66}"= UDP:c:\program files\Dell Photo AIO Printer 926\dlcxaiox.exe:All In One Center
"{4D74D1C1-4A98-4BB6-9232-227BF90EA4EB}"= TCP:c:\program files\Dell Photo AIO Printer 926\dlcxaiox.exe:All In One Center
"TCP Query User{26B5B44A-BFA7-43D0-AD7E-771BE2EFF420}c:\\users\\justin\\desktop\\utorrent.exe"= UDP:c:\users\justin\desktop\utorrent.exe:utorrent.exe
"UDP Query User{949F6867-7EE9-41E7-A9FA-AF57E2F09720}c:\\users\\justin\\desktop\\utorrent.exe"= TCP:c:\users\justin\desktop\utorrent.exe:utorrent.exe
"{A2DC937E-E7AC-416B-B6F7-B95D1FF777A9}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
"{5AEDB973-46D1-4AED-9DA5-0D2EA6D3D54C}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
"{F5B6BF89-C763-488D-B51D-2372A38D2D92}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
"{DAA32EFF-82BA-4393-850F-C2323A028171}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
"{2DE3C301-D550-4289-BE7E-1EF7AAA7E30E}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
"{BCA81B63-3EC4-428C-92DC-4482AAAF274C}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
"{08C7796B-5376-4185-BD8E-D818725FC8A8}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
"{7A4D3884-73F0-4EB1-BE97-88E3736C3FF7}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
"{64540B5B-409C-47B8-8F7F-1F4B0353B005}"= c:\program files\WiFiConnector\NintendoWFCReg.exe:Nintendo Wi-Fi USB Connector
"TCP Query User{F2F018B6-CC36-4628-B308-6B2D87DB43F2}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{42636805-BCA2-4B75-B8C1-204D18EAE61D}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{41A6D261-0ECE-4DBF-9FAB-E01EE55B8998}c:\\users\\justin\\desktop\\sppscript4\\sppscript4\\mirc.exe"= UDP:c:\users\justin\desktop\sppscript4\sppscript4\mirc.exe:mirc.exe
"UDP Query User{D499B443-51B0-44C9-A23C-2D5DBCCD51BB}c:\\users\\justin\\desktop\\sppscript4\\sppscript4\\mirc.exe"= TCP:c:\users\justin\desktop\sppscript4\sppscript4\mirc.exe:mirc.exe
"{C0D64663-74E5-4A00-8524-176D004EF22F}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{22721051-0E70-4F8A-BD8C-825FD8831B8E}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{D5B78781-CAE8-47DD-8F96-83CE3FF1F1EF}"= UDP:c:\program files\AIM6\aim6.exe:AIM
"{47335104-B793-4641-94AA-CC8D9DAB2344}"= TCP:c:\program files\AIM6\aim6.exe:AIM
"{6A122D3D-B91E-4F90-B42D-93041ACDAD38}"= c:\program files\PharosSystems\Core\CTskMstr.exe:Pharos Com Task Master
"{939D3E02-68DA-4F39-A6B5-757C738B0257}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
"{F74CAFE3-A3EB-497E-8978-284DF736FA5D}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe
"TCP Query User{AB808DA8-5733-45E9-BB8C-C81C5250CF16}c:\\program files\\aim6\\aim6.exe"= UDP:c:\program files\aim6\aim6.exe:AIM
"UDP Query User{431E91B4-970B-4CFD-971E-62A6B2DF263F}c:\\program files\\aim6\\aim6.exe"= TCP:c:\program files\aim6\aim6.exe:AIM
"{18F9F074-F13F-446F-BF48-1F0E63D253D6}"= UDP:c:\users\Justin\Desktop\utorrent.exe:µTorrent (TCP-In)
"{1601F81F-AA8E-4573-8415-563CF8D4A58F}"= TCP:c:\users\Justin\Desktop\utorrent.exe:µTorrent (UDP-In)
"{938DCED9-E4F5-437A-8167-31816802AB0D}"= UDP:3724:Blizzard Downloader: 3724
"{EFA4BD4A-862B-40BC-81EE-C49590388F36}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{80E46EC5-6428-44FE-A532-70DC6443D79B}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{FD90F6AD-C493-4E99-A35D-D55E0B86085F}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{23595446-098F-4935-8703-216630DA67CF}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"TCP Query User{9E71F86F-48D8-4415-B055-A0AD7DD41B62}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:µTorrent
"UDP Query User{90C922D9-611A-4867-B1E9-F68D87B5D3CE}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:µTorrent

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-05-08 97928]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-05-08 875288]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-05-08 231704]
R2 dlcx_device;dlcx_device;c:\windows\system32\dlcxcoms.exe -service []
R2 MSSQL$VAIO_VEDB;SQL Server (VAIO_VEDB);"c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sVAIO_VEDB [2007-01-31 28933976]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-04-17 11032]
R3 AvgWfpX;AVG8 Firewall Driver x86;c:\windows\system32\Drivers\avgwfpx.sys [2008-05-08 69128]
R3 R5U870FLx86;R5U870 UVC Lower Filter ;c:\windows\system32\Drivers\R5U870FLx86.sys [2007-05-01 74240]
R3 R5U870FUx86;R5U870 UVC Upper Filter ;c:\windows\system32\Drivers\R5U870FUx86.sys [2007-05-01 43904]
R3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\system32\DRIVERS\SonyImgF.sys [2007-05-01 31104]
R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2007-05-01 807424]
S3 ICScsiSV;Image Converter SCSI Service;c:\program files\Sony\Image Converter 3\ICScsiSV.exe [2007-06-21 75952]
S3 IcVzMonLauncher;IcVzMonLauncher;"c:\program files\Sony\Image Converter 3\IcVzMonLauncher.exe" [2007-06-21 67760]
S3 Image Converter video recording monitor for VAIO Entertainment;Image Converter video recording monitor for VAIO Entertainment;c:\program files\Sony\Image Converter 3\IcVzMon.exe [2007-06-21 43184]
S3 UsbFltr;Razer Copperhead Driver;c:\windows\system32\drivers\copperhd.sys [2007-11-28 11596]
S3 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\Sony\VAIO Media Integrated Server\UCLS.exe [2007-06-21 745472]
S3 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);"c:\program files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-UCLS-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Applications\UCLS\HTTP" []
S3 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [2007-06-21 1089536]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d7e4ea70-2045-11dc-b2cc-806e6f6e6963}]
\shell\AutoRun\command - H:\Installer.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e967de7c-60c6-11dc-afe9-0013a9c1e175}]
\shell\AutoRun\command - I:\LaunchU3.exe

*Newly Created Service* - CATCHME
*Newly Created Service* - GMER
*Newly Created Service* - PROCEXP90
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-c:\windows\system32\baloon.exe - c:\windows\System32\baloon.exe
HKLM-Run-c:\windows\system32\cfrog.exe - c:\windows\System32\cfrog.exe

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.sony.com/vaiopeople
uInternet Settings,ProxyOverride = *.local
IE: &AIM Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FireFox -: Profile - c:\users\Justin\AppData\Roaming\Mozilla\Firefox\Profiles\rt2sdwg4.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://search.aol.com/aolcom/search?invocationType=tbff50ie7&query=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://en-US.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
FF -: plugin - c:\program files\DivX\DivX Content Uploader\npUpload.dll
FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF -: plugin - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-08 18:29:17
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLCXCATS = rundll32 c:\windows\system32\spool\DRIVERS\W32X86\3\DLCXtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(776)
c:\windows\system32\avgrsstx.dll

- - - - - - - > 'lsass.exe'(700)
c:\windows\system32\avgrsstx.dll
.
Completion time: 2008-12-08 18:30:48
ComboFix-quarantined-files.txt 2008-12-08 23:30:45
ComboFix2.txt 2008-12-08 19:32:33

Pre-Run: 23,554,097,152 bytes free
Post-Run: 23,321,837,568 bytes free

314

**TheBruce1** · 12-09-2008, 04:52 AM

Hello again

When Combofix finished did it not ask you to upload a file to Bleeping Computer, follow instructions below for uploading the file.

Please locate this file:

C:\QooBox\Quarantine\[4]-Submit_2008-xx-xx@xx.xx.zip

Upload to this website:

http://www.bleepingcomputer.com/subm....php?channel=4

Include this link into your submission:

http://www.techsupportforum.com/security-center/hijackthis-log-help/321191-winiguard-alert-help-please.html

Let me know when the file has been uploaded.

Aelvin · 12-09-2008, 11:12 AM

Alright, the file has been uploaded.

And yes, it did ask me to upload it when combofix finished... Sorry about that =/ when I submitted it during the actual process I forgot 2 things: 1) to inform you I submitted it... and 2) to include the link to the forum/thread that requested it.

Once again, I appreciate your help in this matter.

**TheBruce1** · 12-09-2008, 03:01 PM

Hello again

File uploaded successfully, thank you.

If there are no further issues, continue below.

========

Delete DDS from your desktop.

Click Start>Run and type or copy/paste the following command then hit enter to uninstall gmer.

%systemroot%\gmer_uninstall.cmd

==========

Well done, your logs are clean.

Click start>run>type(or copy/paste command into run box):

ComboFix /u

Click ok.

=============

Clear IE6 cookies

*Open IE and click Tools
*Click on Internet Options
*Click on General Tab
*Click on Delte Temp Files & Cookies buttons.

Clear IE7 cookies

*On the Internet Explorer 7 Tools menu, click Internet Options. The Internet Options box should open to the General tab.
*On the General tab, in the Browsing History, click the Delete button. This will delete all the files that are currently stored in your cache [that includes cookies too].
*Click OK, and then click OK again.

Clear Firefox cookies/cache

• Select "Tools"
• Select "Options".
• Select "Privacy".
• In "Settings" window put the check mark for Cookies,Cache,Browsing history and any others you want.
• Click OK.
• In Private area click "Clear Now".

-------------------------------------------------------------------------------------------

MICROSOFT UPDATES

1.Click Start,Run, type sysdm.cpl, and then press OK.
2.Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended).

Microsoft updates are released every second Tuesday of each month,what is called "Patch Tuesday".

------------------------------------------------------------------------------------------

Useful Information and Programs to keep you safe.

TrendProtect is a FREE browser plug-in that helps you avoid Web pages with unwanted content and hidden threats. TrendProtect rates the current page and pages listed in Google, MSN, and Yahoo search results. You can use the rating to decide if you want to visit or avoid a given Web page. To rate Web pages, TrendProtect refers to an extensive database that covers the following information for billions of Web pages:

* Content category
* Phishing scam detection
* Site reputation
* Page reputation

WOT Free helps you avoid disingenuous Internet content by allowing you to learn from others' experiences. WOT shows you website reputations on your browser, telling you how much other users trust a website. This helps you make better decisions while browsing and avoid phishing, malware, and other types of fraud. Reputations can also be added to web search results, Gmail, Wikipedia, and other selected sites.

WOT reputations are computed mainly from user testimonies. Sharing your knowledge with others is just a click away, without ever having to leave the site. We also collect data from hundreds of other sources (including PhishTank) to quickly warn you of emerging threats. Currently, WOT knows over 12 million websites.
Note:Only compatible with Firefox 1.5 and higher.

--------------------------------------------------------------------------------------

Alternate Browsers
Try the following free alternate browsers rather than Internet Explorer
Avant
Firefox
Opera
K-Meleon

------------------------------------------------------------------------------------------

Free Antispyware Products
SuperAntiSpyware
Malwarebytes ' Anti-Malware

SpywareBlaster to help prevent spyware from installing in the first place.

Install & update SpywareBlaster with the latest definitions.
After you have updated, click the button - enable protection for all unprotected items

------------------------------------------------------------------

The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file.

If your having trouble downloading & extracting,see link below for guidance:
http://www.mvps.org/winhelp2002/hosts2.htm

Once you have extracted the host file,double click on it and a new window will open.

Double-click on mvps.batand follow the prompts

---------------------------------------------------------------

Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here:
Using Winpatrol to protect your computer.

----------------------------------------

SnoopFree is a programme that informs you when another programme is wanting to log your keystrokes or read your screen.Only for XP users.

Update all these programs regularly. Without regular updates you will not be protected when new malicious programs are released.

==============================================

Secunia PSI is a programme that will alert you to vulnerabilities and outdated programs you have installed, such as Java, Flash Player and many more.

It can also alert you if you have not installed the latest patches from Microsoft.

==============================================

Also, please take a look at this well written article:

PC Safety and Security--What Do I Need?

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Please reply to this thread once more, as we may mark this as resolved, thanks.

Aelvin · 12-09-2008, 05:01 PM

Thank you very much for your help.... Everything seems to be running and in order!

**TheBruce1** · 12-10-2008, 04:18 AM

Safe surfing

12-08-2008, 05:55 AM	#2 (permalink)
TheBruce1 Moderator, Analyst, Security Team Join Date: Oct 2006 Location: Dùn Èideann,Scotland. Posts: 5,093 OS: XP	Re: Winiguard Alert! (help please) Hello and welcome to TSF Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. ======== Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear, a lack of symptoms does not mean that it is no longer present. Please DO NOT Attach logs to your posts unless you are advised to do so. ========= P2P P2P - I see you have P2P software µTorrent installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares and their infections. References for the risk of these programs are Here, Here and Here. =========== Click Start> Control Panel>Programs>Program and Features and uninstall the following programs: Viewpoint Media Player<---Viewpoint is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 read this article: http://www.clickz.com/news/article.php/3561546 Additional Information Here and Here =========== Download Combofix from any of the links below, and save it to your desktop. Link 1 Link 2 Link 3 Note: It is important that it is saved directly to your desktop -------------------------------------------------------------------- 1. Disconnect from the internet. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. -------------------------------------------------------------------- Double click on ComboFix.exe & follow the prompts. When finished, it will produce a report for you at C:\ComboFix.txt. I'll need to see that in your next reply, along with a new HijackThis log. ========= Logs Required C:\Combofix.txt Hijackthis Log If there is no response to this post within 72hrs, this thread will be closed. __________________ Member of ASAP since 2007 Member of UNITE since 2008 Notice to BT customers BT to dump Phorm, see Here for more information. No DPI If we have helped you in anyway, please consider Donating

12-08-2008, 01:24 PM	#4 (permalink)
Aelvin Registered User Join Date: Dec 2008 Posts: 6 OS: vista	Re: Winiguard Alert! (help please) I apologize, I may have included the incorrect logs... You ask for a HijackThis log, and without asking I posted the new DDS log... is this correct? Or should I download HijackThis and produce a log for you? Also, the attached log file is the ComboFix log... I saved a copy to the desktop and posted that instead of the default name/filepath that you requested in your post. If any of this is incorrect, I apologize ahead of time :o

12-08-2008, 08:51 PM	#6 (permalink)
Aelvin Registered User Join Date: Dec 2008 Posts: 6 OS: vista	Re: Winiguard Alert! (help please) Thank you very much! You really helped me out, as those popups were becoming extremely annoying. I appreciate your time and effort... As far as how my computer is running, it appears to be running fine (at least without those fake alerts and such). Here are the requested logs: DDS (Version 1.0) - NTFSx86 Run by Justin at 22:21:28.67 on Mon 12/08/2008 Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.2046.1257 [GMT -5:00] ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\dlcxcoms.exe C:\Windows\Explorer.EXE C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe C:\PROGRA~1\PHAROS~1\Core\CTskMstr.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\stacsv.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\AIM6\aim6.exe C:\Program Files\RocketDock\RocketDock.exe C:\Program Files\Sony\VAIO Event Service\VESMgr.exe C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe C:\Program Files\Rainmeter\Rainmeter.exe C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\DRIVERS\xaudio.exe C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe C:\Windows\system32\WUDFHost.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\Sony\VAIO Power Management\SPMgr.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\Windows\system32\taskeng.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe C:\Windows\System32\alg.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\AIM6\aolsoftware.exe C:\Windows\system32\wuauclt.exe C:\Program Files\Ventrilo\Ventrilo.exe C:\Users\Justin\Desktop\dds.scr C:\Windows\system32\conime.exe C:\Windows\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uStart Page = hxxp://www.sony.com/vaiopeople uInternet Settings,ProxyOverride = .local BHO: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - c:\program files\avg\avg8\avgssie.dll BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll BHO: {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - c:\program files\aol\aim toolbar 5.0\aoltb.dll BHO: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: {AE7CD045-E861-484f-8273-0445EE161910} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll TB: {DE9C389F-3316-41A7-809B-AA305ED9D922} - c:\program files\aol\aim toolbar 5.0\aoltb.dll TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll uRun: [msnmsgr] "c:\program files\msn messenger\msnmsgr.exe" /background uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp uRun: [RocketDock] "c:\program files\rocketdock\RocketDock.exe" mRun: [DLCXCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCXtime.dll,_RunDLLEntry@16 mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" StartupFolder: c:\users\justin\appdata\roaming\micros~1\windows\startm~1\programs\startup\rainme~1.lnk - c:\program files\rainmeter\Rainmeter.exe mPolicies-system: EnableLUA = 0 (0x0) IE: &AIM Search - c:\program files\aol\aim toolbar 5.0\resources\en-us\local\search.html IE: Append to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000 IE: {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "c:\program files\fiddler2\Fiddler.exe" IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll IE: {3369AF0D-62E9-4bda-8103-B4C75499B578} - {DE9C389F-3316-41A7-809B-AA305ED9D922} - c:\program files\aol\aim toolbar 5.0\aoltb.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL IE: {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - c:\program files\fiddler2\Fiddler.exe Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll Notify: igfxcui - igfxdev.dll Notify: VESWinlogon - VESWinlogon.dll AppInit_DLLs: avgrsstx.dll ============= SERVICES / DRIVERS =============== R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-5-8 97928] R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2008-5-8 875288] R2 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-5-8 231704] R2 dlcx_device;dlcx_device;c:\windows\system32\dlcxcoms.exe -service [] R2 MSSQL$VAIO_VEDB;SQL Server (VAIO_VEDB);"c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe" -sVAIO_VEDB [2007-1-31 28933976] R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-4-17 11032] R3 AvgWfpX;AVG8 Firewall Driver x86;c:\windows\system32\drivers\avgwfpx.sys [2008-5-8 69128] R3 R5U870FLx86;R5U870 UVC Lower Filter ;c:\windows\system32\drivers\R5U870FLx86.sys [2007-5-1 74240] R3 R5U870FUx86;R5U870 UVC Upper Filter ;c:\windows\system32\drivers\R5U870FUx86.sys [2007-5-1 43904] R3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\system32\drivers\SonyImgF.sys [2007-5-1 31104] R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2007-5-1 807424] S3 ICScsiSV;Image Converter SCSI Service;c:\program files\sony\image converter 3\ICScsiSV.exe [2007-6-21 75952] S3 IcVzMonLauncher;IcVzMonLauncher;"c:\program files\sony\image converter 3\IcVzMonLauncher.exe" [2007-6-21 67760] S3 Image Converter video recording monitor for VAIO Entertainment;Image Converter video recording monitor for VAIO Entertainment;c:\program files\sony\image converter 3\IcVzMon.exe [2007-6-21 43184] S3 UsbFltr;Razer Copperhead Driver;c:\windows\system32\drivers\copperhd.sys [2007-11-28 11596] S3 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\sony\vaio media integrated server\UCLS.exe [2007-6-21 745472] S3 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);"c:\program files\sony\vaio media integrated server\platform\sv_httpd.exe" /service=vaiomediaplatform-ucls-http /regroot="software\sony corporation\vaio media platform\2.0" /regext="\applications\ucls\HTTP" [] S3 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\sony\vaio media integrated server\platform\UPnPFramework.exe [2007-6-21 1089536] =============== Created Last 30 ================ 2008-12-08 18:38 410,984 a------- c:\windows\system32\deploytk.dll 2008-12-08 18:35 <DIR> --d----- c:\users\justin\.SunDownloadManager 2008-12-08 18:24 <DIR> --d----- C:\ComboFix 2008-12-08 14:26 161,792 a------- c:\windows\SWREG.exe 2008-12-08 14:26 98,816 a------- c:\windows\sed.exe 2008-12-07 14:35 250 a------- c:\windows\gmer.ini 2008-12-07 13:17 <DIR> --d----- C:\!KillBox 2008-12-06 19:53 <DIR> a-d----- c:\programdata\TEMP 2008-12-06 17:24 <DIR> --d----- c:\program files\Lavasoft 2008-11-15 03:39 <DIR> --d----- c:\program files\RocketDock 2008-11-14 14:12 <DIR> --d----- c:\program files\Rainmeter ==================== Find3M ==================== 2008-10-31 08:15 86,016 a------- c:\windows\inf\infstor.dat 2008-10-31 08:15 86,016 a------- c:\windows\inf\infpub.dat 2008-10-31 08:15 143,360 a------- c:\windows\inf\infstrng.dat 2008-01-22 10:38 45,880 a------- c:\users\justin\appdata\roaming\nvModes.dat 2007-05-01 17:51 665,600 a------- c:\windows\inf\drvindex.dat 2006-11-02 07:50 174 a--sh--- c:\program files\desktop.ini 2006-11-02 07:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat 2006-11-02 07:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat 2006-11-02 07:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat 2006-11-02 07:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat 2006-11-02 04:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat 2006-11-02 04:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat 2006-11-02 04:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat 2006-11-02 04:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat ============= FINISH: 22:22:18.94 =============== -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Monday, December 8, 2008 Operating System: Microsoft Windows Vista Home Premium Edition, 32-bit (build 6000) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Monday, December 08, 2008 21:57:06 Records in database: 1444669 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ H:\ Scan statistics: Files scanned: 164163 Threat name: 0 Infected objects: 0 Suspicious objects: 0 Duration of the scan: 02:42:02 No malware has been detected. The scan area is clean. The selected area was scanned. ComboFix 08-12-05.03 - Justin 2008-12-08 18:27:01.2 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.1133 [GMT -5:00] Running from: c:\users\Justin\Desktop\ComboFix.exe Command switches used :: c:\users\Justin\Desktop\CFscript.txt Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\System32\baloon.exe c:\windows\system32\cfrog.exe . ((((((((((((((((((((((((( Files Created from 2008-11-08 to 2008-12-08 ))))))))))))))))))))))))))))))) . 2008-12-07 14:35 . 2008-12-07 14:35 250 --a------ c:\windows\gmer.ini 2008-12-07 13:17 . 2008-12-07 13:17 <DIR> d-------- C:\!KillBox 2008-12-06 19:53 . 2008-12-06 19:58 <DIR> d-a------ c:\users\All Users\TEMP 2008-12-06 19:53 . 2008-12-06 19:58 <DIR> d-a------ c:\programdata\TEMP 2008-12-06 17:24 . 2008-12-06 17:24 <DIR> d-------- c:\program files\Lavasoft 2008-11-15 03:39 . 2008-11-15 03:40 <DIR> d-------- c:\program files\RocketDock 2008-11-14 14:12 . 2008-11-14 14:13 <DIR> d-------- c:\program files\Rainmeter . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-07 00:52 --------- d-----w c:\users\Justin\AppData\Roaming\Download Manager 2008-12-06 22:24 --------- d-----w c:\programdata\Lavasoft 2008-12-06 22:20 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2008-12-05 20:25 --------- d-----w c:\users\Justin\AppData\Roaming\uTorrent 2008-11-25 13:51 --------- d-----w c:\program files\Warcraft III 2008-11-24 18:38 --------- d-----w c:\program files\Dl_cats 2008-11-13 06:10 --------- d-----w c:\program files\World of Warcraft 2008-11-05 02:02 --------- d-----w c:\program files\Yahoo! 2008-10-31 13:32 --------- d-----w c:\programdata\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-10-31 13:32 --------- d-----w c:\program files\iTunes 2008-10-31 13:31 --------- d-----w c:\program files\iPod 2008-10-31 13:25 --------- d-----w c:\program files\QuickTime 2008-10-31 13:25 --------- d-----w c:\program files\Bonjour 2008-10-31 13:23 --------- d-----w c:\program files\Common Files\Apple 2008-10-31 13:17 --------- d-----w c:\program files\Apple Software Update 2008-01-22 15:38 45,880 ----a-w c:\users\Justin\AppData\Roaming\nvModes.dat 2006-11-02 12:50 174 --sha-w c:\program files\desktop.ini . ((((((((((((((((((((((((((((( snapshot@2008-12-08_14.31.49.45 ))))))))))))))))))))))))))))))))))))))))) . - 2008-12-07 17:50:55 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT + 2008-12-08 19:31:19 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728] "Aim6"="c:\program files\AIM6\aim6.exe" [2008-03-25 50528] "RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DLCXCATS"="c:\windows\system32\spool\DRIVERS\W32X86\3\DLCXtime.dll" [2006-10-16 106496] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-27 1261336] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576] c:\users\Justin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Rainmeter.lnk - c:\program files\Rainmeter\Rainmeter.exe [2006-01-21 118784] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon] 2007-02-13 17:19 98304 c:\windows\System32\VESWinlogon.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.dvsd"= c:\program files\Common Files\Sony Shared\VideoLib\sonydv.dll [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk backup=c:\windows\pss\Adobe Acrobat Synchronizer.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth Manager.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth Manager.lnk backup=c:\windows\pss\Bluetooth Manager.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk backup=c:\windows\pss\QuickBooks Update Agent.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Run Registration Tool.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Run Registration Tool.lnk backup=c:\windows\pss\Run Registration Tool.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^Users^Justin^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk] path=c:\users\Justin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup backupExtension=.Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0] --a------ 2006-10-23 01:24 620152 c:\program files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2007-05-11 02:06 40048 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater] --a------ 2007-08-12 14:42 2321600 c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6] --a------ 2008-03-25 15:21 50528 c:\program files\AIM6\aim6.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint] --a------ 2006-11-13 07:32 118784 c:\program files\Apoint\Apoint.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Copperhead] --a------ 2005-11-25 10:53 155648 c:\program files\Razer\Copperhead\razerhid.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLCXCATS] --a------ 2006-10-16 00:31 106496 c:\windows\System32\spool\drivers\w32x86\3\dlcxtime.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dlcxmon.exe] --a------ 2007-01-12 11:57 292336 c:\program files\Dell Photo AIO Printer 926\dlcxmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer] --a------ 2006-11-03 17:09 312200 c:\program files\Dell PC Fax\fm3032.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISBMgr.exe] --a------ 2007-04-16 21:06 321656 c:\program files\Sony\ISB Utility\ISBMgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-10-01 17:57 289576 c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MemoryCardManager] --a------ 2006-11-03 17:04 304008 c:\program files\Dell Photo AIO Printer 926\memcard.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] --a------ 2007-01-19 11:54 5674352 c:\program files\MSN Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2007-04-17 08:10 8429568 c:\windows\System32\nvcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2007-04-17 08:10 81920 c:\windows\System32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvSvc] --a------ 2007-04-17 08:12 86016 c:\windows\System32\nvsvc.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickBooks Simple Start] --a------ 2007-01-30 23:59 371712 c:\program files\Intuit\SimpleStartEntice\entice.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-09-06 14:09 413696 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar] --a------ 2006-11-02 07:35 1196032 c:\program files\Windows Sidebar\sidebar.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-09-25 01:11 132496 c:\program files\Java\jre1.6.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VAIO Center Access Bar] --a------ 2007-03-06 17:22 36864 c:\program files\Sony\VAIO Center Access Bar\VCAB.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VAIOCameraUtility] --a------ 2007-02-07 21:43 411768 c:\program files\Sony\VAIO Camera Utility\VCUServe.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VAIOSecurity] --a------ 2007-03-13 19:13 2322432 c:\program files\Sony\VAIO Security Center\VSC.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VAIOSurvey] --a------ 2006-12-06 19:08 577536 c:\program files\Sony\VAIO Survey\Vista VAIO Survey.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive] --a------ 2006-04-29 08:21 94208 c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender] --a------ 2007-05-01 17:40 1006264 c:\program files\Windows Defender\MSASCui.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowsWelcomeCenter] --a------ 2006-11-02 07:34 2159104 c:\windows\System32\oobefldr.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{0608AB7B-EE7A-4836-B916-518343A36A60}"= UDP:c:\program files\Sony\LocationFreePlayer\LFPC3\LFPC3.exe:LocationFree Player "{82E14C05-35B6-413B-89E8-14E6BD23E279}"= TCP:c:\program files\Sony\LocationFreePlayer\LFPC3\LFPC3.exe:LocationFree Player "{C6F458B8-EAB6-4491-A107-6E46A6B83708}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{73B1E602-10D1-4DD1-8F01-A7DD696DEA4A}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{812B667A-6880-4152-9B02-ABE30A139E7D}"= Disabled:UDP:c:\program files\Sony\VAIO Media 6.0\Vc.exe:[VAIO Media] VAIO Media "{3A373912-8AC9-4557-90F2-332543F9DDE4}"= Disabled:TCP:c:\program files\Sony\VAIO Media 6.0\Vc.exe:[VAIO Media] VAIO Media "TCP Query User{08D92976-27AE-4C02-B719-349B995D0E9D}c:\\users\\justin\\desktop\\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe"= UDP:c:\users\justin\desktop\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe:wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe "UDP Query User{F53A70B2-15AE-47E8-AE7E-BBF64A71E3A4}c:\\users\\justin\\desktop\\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe"= TCP:c:\users\justin\desktop\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe:wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe "TCP Query User{86E06A6D-5D07-435C-8930-8B12189946B1}c:\\users\\justin\\desktop\\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader(2).exe"= UDP:c:\users\justin\desktop\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader(2).exe:wow-2.1.2.6803-to-0.1.3.6875-enus-downloader(2).exe "UDP Query User{1004526F-9AB1-497C-9B34-DE9D690812CA}c:\\users\\justin\\desktop\\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader(2).exe"= TCP:c:\users\justin\desktop\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader(2).exe:wow-2.1.2.6803-to-0.1.3.6875-enus-downloader(2).exe "TCP Query User{3DE8351C-1024-4C14-8949-4B078D79C750}c:\\program files\\world of warcraft\\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe"= UDP:c:\program files\world of warcraft\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe:Blizzard Downloader "UDP Query User{FFBFD782-8C8B-4080-8A60-4F60833FD4C5}c:\\program files\\world of warcraft\\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe"= TCP:c:\program files\world of warcraft\wow-2.1.2.6803-to-0.1.3.6875-enus-downloader.exe:Blizzard Downloader "{36C69D1D-0598-4F31-A9D1-7493345D2BAF}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone) "TCP Query User{0300B31B-5AF4-48A7-BF6F-EBC25072E85F}c:\\program files\\world of warcraft\\wowtest\\wow-0.1.3.6875-to-0.1.3.6888-enus-downloader.exe"= UDP:c:\program files\world of warcraft\wowtest\wow-0.1.3.6875-to-0.1.3.6888-enus-downloader.exe:Blizzard Downloader "UDP Query User{004F1E74-6765-49B8-8363-314ACDFF26A7}c:\\program files\\world of warcraft\\wowtest\\wow-0.1.3.6875-to-0.1.3.6888-enus-downloader.exe"= TCP:c:\program files\world of warcraft\wowtest\wow-0.1.3.6875-to-0.1.3.6888-enus-downloader.exe:Blizzard Downloader "TCP Query User{5D9CC07E-CF88-438F-9D7F-09B2987C354A}c:\\program files\\world of warcraft\\wowtest\\wow-0.1.3.6888-to-0.1.3.6898-enus-downloader.exe"= UDP:c:\program files\world of warcraft\wowtest\wow-0.1.3.6888-to-0.1.3.6898-enus-downloader.exe:Blizzard Downloader "UDP Query User{7CDB8F28-1833-4218-9B77-A1C5A6FB190E}c:\\program files\\world of warcraft\\wowtest\\wow-0.1.3.6888-to-0.1.3.6898-enus-downloader.exe"= TCP:c:\program files\world of warcraft\wowtest\wow-0.1.3.6888-to-0.1.3.6898-enus-downloader.exe:Blizzard Downloader "TCP Query User{1AC3ED66-92D0-45BC-B7B8-598BE648339D}c:\\program files\\world of warcraft\\wow-2.1.2.6803-to-2.1.3.6898-enus-downloader.exe"= UDP:c:\program files\world of warcraft\wow-2.1.2.6803-to-2.1.3.6898-enus-downloader.exe:Blizzard Downloader "UDP Query User{FB587FAD-3ADF-417B-859F-08A06FB1A50F}c:\\program files\\world of warcraft\\wow-2.1.2.6803-to-2.1.3.6898-enus-downloader.exe"= TCP:c:\program files\world of warcraft\wow-2.1.2.6803-to-2.1.3.6898-enus-downloader.exe:Blizzard Downloader "TCP Query User{E01C6FC6-2F36-4586-8165-D6A344FE1117}c:\\program files\\azureus\\azureus.exe"= UDP:c:\program files\azureus\azureus.exe:Azureus "UDP Query User{9BFCCD98-8924-4771-A3E9-C46FC90AEDAE}c:\\program files\\azureus\\azureus.exe"= TCP:c:\program files\azureus\azureus.exe:Azureus "TCP Query User{118D2D04-15B7-412E-871B-181A0170CCFD}c:\\program files\\itunes\\itunes.exe"= UDP:c:\program files\itunes\itunes.exe:iTunes "UDP Query User{89F096D0-8426-4424-B2C1-84F1DB4069DE}c:\\program files\\itunes\\itunes.exe"= TCP:c:\program files\itunes\itunes.exe:iTunes "{A6E24E50-3021-43F7-A10A-C7585E5B5C22}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server "{EF64F792-0EDD-4DD6-8E59-FEBAE93E9365}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server "{F625B838-89BD-4F4E-8793-A443C9B6CE9B}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger "{ED5DFE32-3CD5-4C07-BFC9-D81274D83AB9}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger "TCP Query User{26137782-89C5-4F7E-8300-6AD89978B537}c:\\users\\justin\\desktop\\utorrent.exe"= UDP:c:\users\justin\desktop\utorrent.exe:utorrent.exe "UDP Query User{E9B4436E-EF20-498B-9BEA-535A1D9A93CB}c:\\users\\justin\\desktop\\utorrent.exe"= TCP:c:\users\justin\desktop\utorrent.exe:utorrent.exe "TCP Query User{8314B300-B644-4D5F-9ACE-4AC6BF0B79CC}c:\\program files\\world of warcraft\\backgrounddownloader.exe"= UDP:c:\program files\world of warcraft\backgrounddownloader.exe:Blizzard Downloader "UDP Query User{BB65131F-5C73-40D5-8931-69AACBFDD56D}c:\\program files\\world of warcraft\\backgrounddownloader.exe"= TCP:c:\program files\world of warcraft\backgrounddownloader.exe:Blizzard Downloader "{B03C65DB-B35D-4849-83B9-72F1E2726B61}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader "{229249A9-1331-4ADD-A890-078CD8DF2D2C}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader "TCP Query User{EB7FE7DE-B343-44C6-B682-AF9EABC3F58E}c:\\program files\\world of warcraft\\wowtest\\wow-0.2.0.7125-to-0.2.0.7153-enus-downloader.exe"= UDP:c:\program files\world of warcraft\wowtest\wow-0.2.0.7125-to-0.2.0.7153-enus-downloader.exe:Blizzard Downloader "UDP Query User{5DB0E312-699A-42B1-91C8-FB7A0BC5D56F}c:\\program files\\world of warcraft\\wowtest\\wow-0.2.0.7125-to-0.2.0.7153-enus-downloader.exe"= TCP:c:\program files\world of warcraft\wowtest\wow-0.2.0.7125-to-0.2.0.7153-enus-downloader.exe:Blizzard Downloader "TCP Query User{AC11627A-F033-4709-A2F0-BA7E17175D0D}c:\\program files\\world of warcraft\\wowtest\\wow-0.2.0.7153-to-0.2.0.7175-enus-downloader.exe"= UDP:c:\program files\world of warcraft\wowtest\wow-0.2.0.7153-to-0.2.0.7175-enus-downloader.exe:Blizzard Downloader "UDP Query User{70B2AF43-633D-4631-BC36-8E2A3DED0D7E}c:\\program files\\world of warcraft\\wowtest\\wow-0.2.0.7153-to-0.2.0.7175-enus-downloader.exe"= TCP:c:\program files\world of warcraft\wowtest\wow-0.2.0.7153-to-0.2.0.7175-enus-downloader.exe:Blizzard Downloader "TCP Query User{817A81E2-3BB9-41F8-B238-B396744C7182}c:\\program files\\ratajik software\\stationripper\\stationripperconsole.exe"= UDP:c:\program files\ratajik software\stationripper\stationripperconsole.exe:StationRipperConsole "UDP Query User{790680A8-A037-49CF-9C7F-53D534BB08D4}c:\\program files\\ratajik software\\stationripper\\stationripperconsole.exe"= TCP:c:\program files\ratajik software\stationripper\stationripperconsole.exe:StationRipperConsole "{67D1E1D5-5C29-4704-9B82-E72341D1B4F4}"= UDP:c:\windows\System32\dlcxcoms.exe:Lexmark Communications System "{0EFFF62F-CDDB-46E7-94E4-58B350B76BB6}"= TCP:c:\windows\System32\dlcxcoms.exe:Lexmark Communications System "{AD749CC5-76A8-46CF-8062-311CB7681D0B}"= UDP:c:\program files\Dell Photo AIO Printer 926\dlcxmon.exe:Device Monitor "{9F13FF35-1CA6-4DF2-9920-FADA786AD5A4}"= TCP:c:\program files\Dell Photo AIO Printer 926\dlcxmon.exe:Device Monitor "{F9F0BA85-4627-458D-B779-AC8EE5444D66}"= UDP:c:\program files\Dell Photo AIO Printer 926\dlcxaiox.exe:All In One Center "{4D74D1C1-4A98-4BB6-9232-227BF90EA4EB}"= TCP:c:\program files\Dell Photo AIO Printer 926\dlcxaiox.exe:All In One Center "TCP Query User{26B5B44A-BFA7-43D0-AD7E-771BE2EFF420}c:\\users\\justin\\desktop\\utorrent.exe"= UDP:c:\users\justin\desktop\utorrent.exe:utorrent.exe "UDP Query User{949F6867-7EE9-41E7-A9FA-AF57E2F09720}c:\\users\\justin\\desktop\\utorrent.exe"= TCP:c:\users\justin\desktop\utorrent.exe:utorrent.exe "{A2DC937E-E7AC-416B-B6F7-B95D1FF777A9}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main "{5AEDB973-46D1-4AED-9DA5-0D2EA6D3D54C}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main "{F5B6BF89-C763-488D-B51D-2372A38D2D92}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD "{DAA32EFF-82BA-4393-850F-C2323A028171}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD "{2DE3C301-D550-4289-BE7E-1EF7AAA7E30E}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater "{BCA81B63-3EC4-428C-92DC-4482AAAF274C}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater "{08C7796B-5376-4185-BD8E-D818725FC8A8}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server "{7A4D3884-73F0-4EB1-BE97-88E3736C3FF7}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server "{64540B5B-409C-47B8-8F7F-1F4B0353B005}"= c:\program files\WiFiConnector\NintendoWFCReg.exe:Nintendo Wi-Fi USB Connector "TCP Query User{F2F018B6-CC36-4628-B308-6B2D87DB43F2}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox "UDP Query User{42636805-BCA2-4B75-B8C1-204D18EAE61D}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox "TCP Query User{41A6D261-0ECE-4DBF-9FAB-E01EE55B8998}c:\\users\\justin\\desktop\\sppscript4\\sppscript4\\mirc.exe"= UDP:c:\users\justin\desktop\sppscript4\sppscript4\mirc.exe:mirc.exe "UDP Query User{D499B443-51B0-44C9-A23C-2D5DBCCD51BB}c:\\users\\justin\\desktop\\sppscript4\\sppscript4\\mirc.exe"= TCP:c:\users\justin\desktop\sppscript4\sppscript4\mirc.exe:mirc.exe "{C0D64663-74E5-4A00-8524-176D004EF22F}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader "{22721051-0E70-4F8A-BD8C-825FD8831B8E}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader "{D5B78781-CAE8-47DD-8F96-83CE3FF1F1EF}"= UDP:c:\program files\AIM6\aim6.exe:AIM "{47335104-B793-4641-94AA-CC8D9DAB2344}"= TCP:c:\program files\AIM6\aim6.exe:AIM "{6A122D3D-B91E-4F90-B42D-93041ACDAD38}"= c:\program files\PharosSystems\Core\CTskMstr.exe:Pharos Com Task Master "{939D3E02-68DA-4F39-A6B5-757C738B0257}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe "{F74CAFE3-A3EB-497E-8978-284DF736FA5D}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe "TCP Query User{AB808DA8-5733-45E9-BB8C-C81C5250CF16}c:\\program files\\aim6\\aim6.exe"= UDP:c:\program files\aim6\aim6.exe:AIM "UDP Query User{431E91B4-970B-4CFD-971E-62A6B2DF263F}c:\\program files\\aim6\\aim6.exe"= TCP:c:\program files\aim6\aim6.exe:AIM "{18F9F074-F13F-446F-BF48-1F0E63D253D6}"= UDP:c:\users\Justin\Desktop\utorrent.exe:µTorrent (TCP-In) "{1601F81F-AA8E-4573-8415-563CF8D4A58F}"= TCP:c:\users\Justin\Desktop\utorrent.exe:µTorrent (UDP-In) "{938DCED9-E4F5-437A-8167-31816802AB0D}"= UDP:3724:Blizzard Downloader: 3724 "{EFA4BD4A-862B-40BC-81EE-C49590388F36}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{80E46EC5-6428-44FE-A532-70DC6443D79B}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{FD90F6AD-C493-4E99-A35D-D55E0B86085F}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes "{23595446-098F-4935-8703-216630DA67CF}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes "TCP Query User{9E71F86F-48D8-4415-B055-A0AD7DD41B62}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:µTorrent "UDP Query User{90C922D9-611A-4867-B1E9-F68D87B5D3CE}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:µTorrent [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System] "DFSR-1"= RPort=5722\|UDP:%SystemRoot%\system32\svchost.exe\|Svc=DFSR:Allow inbound TCP traffic\| [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile] "EnableFirewall"= 0 (0x0) R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-05-08 97928] R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-05-08 875288] R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-05-08 231704] R2 dlcx_device;dlcx_device;c:\windows\system32\dlcxcoms.exe -service [] R2 MSSQL$VAIO_VEDB;SQL Server (VAIO_VEDB);"c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sVAIO_VEDB [2007-01-31 28933976] R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-04-17 11032] R3 AvgWfpX;AVG8 Firewall Driver x86;c:\windows\system32\Drivers\avgwfpx.sys [2008-05-08 69128] R3 R5U870FLx86;R5U870 UVC Lower Filter ;c:\windows\system32\Drivers\R5U870FLx86.sys [2007-05-01 74240] R3 R5U870FUx86;R5U870 UVC Upper Filter ;c:\windows\system32\Drivers\R5U870FUx86.sys [2007-05-01 43904] R3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\system32\DRIVERS\SonyImgF.sys [2007-05-01 31104] R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2007-05-01 807424] S3 ICScsiSV;Image Converter SCSI Service;c:\program files\Sony\Image Converter 3\ICScsiSV.exe [2007-06-21 75952] S3 IcVzMonLauncher;IcVzMonLauncher;"c:\program files\Sony\Image Converter 3\IcVzMonLauncher.exe" [2007-06-21 67760] S3 Image Converter video recording monitor for VAIO Entertainment;Image Converter video recording monitor for VAIO Entertainment;c:\program files\Sony\Image Converter 3\IcVzMon.exe [2007-06-21 43184] S3 UsbFltr;Razer Copperhead Driver;c:\windows\system32\drivers\copperhd.sys [2007-11-28 11596] S3 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\Sony\VAIO Media Integrated Server\UCLS.exe [2007-06-21 745472] S3 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);"c:\program files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-UCLS-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Applications\UCLS\HTTP" [] S3 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [2007-06-21 1089536] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d7e4ea70-2045-11dc-b2cc-806e6f6e6963}] \shell\AutoRun\command - H:\Installer.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e967de7c-60c6-11dc-afe9-0013a9c1e175}] \shell\AutoRun\command - I:\LaunchU3.exe Newly Created Service - CATCHME Newly Created Service - GMER Newly Created Service - PROCEXP90 . - - - - ORPHANS REMOVED - - - - HKLM-Run-c:\windows\system32\baloon.exe - c:\windows\System32\baloon.exe HKLM-Run-c:\windows\system32\cfrog.exe - c:\windows\System32\cfrog.exe . ------- Supplementary Scan ------- . uStart Page = hxxp://www.sony.com/vaiopeople uInternet Settings,ProxyOverride = .local IE: &AIM Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 FireFox -: Profile - c:\users\Justin\AppData\Roaming\Mozilla\Firefox\Profiles\rt2sdwg4.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://search.aol.com/aolcom/search?invocationType=tbff50ie7&query= FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://en-US.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official FF -: plugin - c:\program files\DivX\DivX Content Uploader\npUpload.dll FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll FF -: plugin - c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll FF -: plugin - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll . *********************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-08 18:29:17 Windows 6.0.6000 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run DLCXCATS = rundll32 c:\windows\system32\spool\DRIVERS\W32X86\3\DLCXtime.dll,_RunDLLEntry@16??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(776) c:\windows\system32\avgrsstx.dll - - - - - - - > 'lsass.exe'(700) c:\windows\system32\avgrsstx.dll . Completion time: 2008-12-08 18:30:48 ComboFix-quarantined-files.txt 2008-12-08 23:30:45 ComboFix2.txt 2008-12-08 19:32:33 Pre-Run: 23,554,097,152 bytes free Post-Run: 23,321,837,568 bytes free 314

12-09-2008, 04:52 AM	#7 (permalink)
TheBruce1 Moderator, Analyst, Security Team Join Date: Oct 2006 Location: Dùn Èideann,Scotland. Posts: 5,093 OS: XP	Re: Winiguard Alert! (help please) Hello again When Combofix finished did it not ask you to upload a file to Bleeping Computer, follow instructions below for uploading the file. Please locate this file: C:\QooBox\Quarantine\[4]-Submit_2008-xx-xx@xx.xx.zip Upload to this website: http://www.bleepingcomputer.com/subm....php?channel=4 Include this link into your submission: http://www.techsupportforum.com/security-center/hijackthis-log-help/321191-winiguard-alert-help-please.html Let me know when the file has been uploaded. __________________ Member of ASAP since 2007 Member of UNITE since 2008 Notice to BT customers BT to dump Phorm, see Here for more information. No DPI If we have helped you in anyway, please consider Donating

12-09-2008, 11:12 AM	#8 (permalink)
Aelvin Registered User Join Date: Dec 2008 Posts: 6 OS: vista	Re: Winiguard Alert! (help please) Alright, the file has been uploaded. And yes, it did ask me to upload it when combofix finished... Sorry about that =/ when I submitted it during the actual process I forgot 2 things: 1) to inform you I submitted it... and 2) to include the link to the forum/thread that requested it. Once again, I appreciate your help in this matter.

12-09-2008, 03:01 PM	#9 (permalink)
TheBruce1 Moderator, Analyst, Security Team Join Date: Oct 2006 Location: Dùn Èideann,Scotland. Posts: 5,093 OS: XP	Re: Winiguard Alert! (help please) Hello again File uploaded successfully, thank you. If there are no further issues, continue below. ======== Delete DDS from your desktop. Click Start>Run and type or copy/paste the following command then hit enter to uninstall gmer. %systemroot%\gmer_uninstall.cmd ========== Well done, your logs are clean. Click start>run>type(or copy/paste command into run box): ComboFix /u Click ok. ============= Clear IE6 cookies Open IE and click Tools* Click on Internet Options* Click on General Tab* Click on Delte Temp Files* & Cookies buttons. Clear IE7 cookies On the Internet Explorer 7 Tools menu, click Internet Options. The Internet Options box should open to the General tab. On the General tab, in the Browsing History, click the Delete button. This will delete all the files that are currently stored in your cache [that includes cookies too]. Click OK, and then click OK again. Clear Firefox cookies/cache* • Select "Tools" • Select "Options". • Select "Privacy". • In "Settings" window put the check mark for Cookies,Cache,Browsing history and any others you want. • Click OK. • In Private area click "Clear Now". ------------------------------------------------------------------------------------------- MICROSOFT UPDATES 1.Click Start,Run, type sysdm.cpl, and then press OK. 2.Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended). Microsoft updates are released every second Tuesday of each month,what is called "Patch Tuesday". ------------------------------------------------------------------------------------------ Useful Information and Programs to keep you safe. TrendProtect is a FREE browser plug-in that helps you avoid Web pages with unwanted content and hidden threats. TrendProtect rates the current page and pages listed in Google, MSN, and Yahoo search results. You can use the rating to decide if you want to visit or avoid a given Web page. To rate Web pages, TrendProtect refers to an extensive database that covers the following information for billions of Web pages: * Content category * Phishing scam detection * Site reputation * Page reputation WOT Free helps you avoid disingenuous Internet content by allowing you to learn from others' experiences. WOT shows you website reputations on your browser, telling you how much other users trust a website. This helps you make better decisions while browsing and avoid phishing, malware, and other types of fraud. Reputations can also be added to web search results, Gmail, Wikipedia, and other selected sites. WOT reputations are computed mainly from user testimonies. Sharing your knowledge with others is just a click away, without ever having to leave the site. We also collect data from hundreds of other sources (including PhishTank) to quickly warn you of emerging threats. Currently, WOT knows over 12 million websites. Note:Only compatible with Firefox 1.5 and higher. -------------------------------------------------------------------------------------- Alternate Browsers Try the following free alternate browsers rather than Internet Explorer Avant Firefox Opera K-Meleon ------------------------------------------------------------------------------------------ Free Antispyware Products SuperAntiSpyware Malwarebytes ' Anti-Malware SpywareBlaster to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items ------------------------------------------------------------------ The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file. If your having trouble downloading & extracting,see link below for guidance: http://www.mvps.org/winhelp2002/hosts2.htm Once you have extracted the host file,double click on it and a new window will open. Double-click on mvps.batand follow the prompts --------------------------------------------------------------- Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here: Using Winpatrol to protect your computer. ---------------------------------------- SnoopFree is a programme that informs you when another programme is wanting to log your keystrokes or read your screen.Only for XP users. Update all these programs regularly. Without regular updates you will not be protected when new malicious programs are released. ============================================== Secunia PSI is a programme that will alert you to vulnerabilities and outdated programs you have installed, such as Java, Flash Player and many more. It can also alert you if you have not installed the latest patches from Microsoft. ============================================== Also, please take a look at this well written article: PC Safety and Security--What Do I Need? Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them. Please reply to this thread once more, as we may mark this as resolved, thanks. __________________ Member of ASAP since 2007 Member of UNITE since 2008 Notice to BT customers BT to dump Phorm, see Here for more information. No DPI If we have helped you in anyway, please consider Donating**

12-09-2008, 05:01 PM	#10 (permalink)
Aelvin Registered User Join Date: Dec 2008 Posts: 6 OS: vista	Re: Winiguard Alert! (help please) Thank you very much for your help.... Everything seems to be running and in order!

12-10-2008, 04:18 AM	#11 (permalink)
TheBruce1 Moderator, Analyst, Security Team Join Date: Oct 2006 Location: Dùn Èideann,Scotland. Posts: 5,093 OS: XP	Re: Winiguard Alert! (help please) Safe surfing __________________ Member of ASAP since 2007 Member of UNITE since 2008 Notice to BT customers BT to dump Phorm, see Here for more information. No DPI If we have helped you in anyway, please consider Donating