Tech Support Forum banner
Cancel

popups, slow compuer, keyboard tweakig out

Jump to Latest Follow
Status
Not open for further replies.
1 - 1 of 1 Posts
N

· Registered
Joined
·
1 Posts
Discussion Starter · #1 ·
ok,im running vista an ive poked around this site and thrown every log-creating softwear yall got here.. so this is what icme out with

hijack this log-
Logfile of HijackThis v1.99.1
Scan saved at 11:47:16 PM, on 5/21/2008
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
C:\Program Files\Toshiba\SmoothView\SmoothView.exe
C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Toshiba\ConfigFree\NDSTray.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\nick\AppData\Local\Google\Update\1.1.25.0\GoogleUpdate.exe
C:\Windows\System32\rundll32.exe
C:\Users\nick\AppData\Local\YouTube\Uploader\youtubeuploader.exe
C:\Program Files\Synaptics\SynTP\SynToshiba.exe
C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\WerCon.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\Explorer.exe
C:\Users\nick\Desktop\Hijack This\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshibadirect.com/dpdstart
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Users\nick\AppData\Local\Google\Update\1.1.25.0\GoogleUpdate.exe" /lang en
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\nick\AppData\Local\Temp\opnnklKb.dll,c
O4 - Startup: YouTube Uploader.lnk = AppData\Local\YouTube\Uploader\youtubeuploader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://pcpitstop.com/mhLbl.cab
O16 - DPF: {A30FBBDC-FA29-4606-8565-14AADCCA6708} (Rite Aid One Hour Photo Online Control) - https://photos.riteaid.com/control/RiteAidOneHourPhotoOnline.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: pinger - Unknown owner - C:\TOSHIBA\IVP\ISM\pinger.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

combofix log
ComboFix 08-05-21.2 - nick 2008-05-21 23:39:14.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.242 [GMT -7:00]
Running from: C:\Users\nick\Desktop\Hijack This\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-04-22 to 2008-05-22 )))))))))))))))))))))))))))))))
.

2008-05-21 23:19 . 2008-05-21 23:19 <DIR> d-------- C:\Deckard
2008-05-21 23:05 . 2008-05-21 23:05 <DIR> d-------- C:\Users\All Users\TEMP
2008-05-21 23:05 . 2008-05-21 23:05 <DIR> d-------- C:\ProgramData\TEMP
2008-05-21 23:03 . 2008-05-21 23:03 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-05-21 23:03 . 2005-08-25 18:18 118,784 --a------ C:\Windows\System32\MSSTDFMT.DLL
2008-05-21 20:48 . 2008-05-21 20:49 <DIR> d-------- C:\Program Files\Panda Security
2008-05-20 15:12 . 2008-05-21 19:51 <DIR> dr-h----- C:\$VAULT$.AVG
2008-05-06 20:41 . 2008-05-06 20:41 <DIR> d-------- C:\Users\nick\AppData\Roaming\DivX
2008-04-27 13:35 . 2008-04-27 13:35 <DIR> d-------- C:\Program Files\DivX
2008-04-25 23:03 . 2008-04-26 11:40 <DIR> d-------- C:\tmp
2008-04-25 22:29 . 2008-04-25 22:29 <DIR> d-------- C:\Program Files\Blender Foundation

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-22 02:51 --------- d-----w C:\Users\nick\AppData\Roaming\AVG7
2008-05-21 01:01 --------- d-----w C:\Users\nick\AppData\Roaming\LimeWire
2008-05-14 10:01 --------- d-----w C:\Program Files\Windows Mail
2008-05-10 19:06 --------- d-----w C:\Program Files\Free FLV Converter
2008-04-27 20:14 --------- d-----w C:\Program Files\LimeWire
2008-04-24 06:45 172 ----a-w C:\Users\nick\AppData\Roaming\wklnhst.dat
2008-04-16 03:48 --------- d-----w C:\Program Files\LiveSwif
2008-04-11 15:48 --------- d-----w C:\Program Files\Axis Communications
2008-04-05 23:45 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-04 05:06 --------- d-----w C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor
2008-03-31 21:25 831,488 ----a-w C:\Windows\System32\divx_xx0a.dll
2008-03-31 21:25 823,296 ----a-w C:\Windows\System32\divx_xx0c.dll
2008-03-31 21:25 823,296 ----a-w C:\Windows\System32\divx_xx07.dll
2008-03-31 21:25 802,816 ----a-w C:\Windows\System32\divx_xx11.dll
2008-03-31 21:25 682,496 ----a-w C:\Windows\System32\DivX.dll
2008-03-31 21:25 161,096 ----a-w C:\Windows\System32\DivXCodecVersionChecker.exe
2008-03-30 20:40 --------- d-----w C:\Users\nick\AppData\Roaming\fretsonfire
2008-03-30 20:36 --------- d-----w C:\Program Files\Frets on Fire
2008-03-24 19:10 --------- d-----w C:\Users\nick\AppData\Roaming\Ulead Systems
2008-03-22 21:31 --------- d-----w C:\ProgramData\Microsoft Help
2008-03-22 21:09 --------- d-----w C:\Users\nick\AppData\Roaming\Template
2008-03-22 15:43 53,768 ----a-w C:\Windows\system32\drivers\avgwfp.sys
2008-03-21 20:30 524,288 ----a-w C:\Windows\System32\DivXsm.exe
2008-03-21 20:30 3,596,288 ----a-w C:\Windows\System32\qt-dx331.dll
2008-03-21 20:28 81,920 ----a-w C:\Windows\System32\dpl100.dll
2008-03-21 20:28 12,288 ----a-w C:\Windows\System32\DivXWMPExtType.dll
2008-03-13 01:17 9,216 ----a-w C:\Windows\System32\avgwlntf.dll
2008-03-06 11:17 704,000 ----a-w C:\Windows\System32\PhotoScreensaver.scr
2008-03-06 11:17 67,584 ----a-w C:\Windows\System32\wlanhlp.dll
2008-03-06 11:17 542,720 ----a-w C:\Windows\System32\sysmain.dll
2008-03-06 11:17 502,784 ----a-w C:\Windows\System32\wlansvc.dll
2008-03-06 11:17 47,104 ----a-w C:\Windows\System32\wlanapi.dll
2008-03-06 11:17 299,008 ----a-w C:\Windows\System32\wlansec.dll
2008-03-06 11:17 289,280 ----a-w C:\Windows\System32\wlanmsm.dll
2008-03-06 11:17 24,064 ----a-w C:\Windows\System32\wtsapi32.dll
2008-03-06 11:17 2,923,520 ----a-w C:\Windows\explorer.exe
2008-03-06 11:17 194,560 ----a-w C:\Windows\System32\WebClnt.dll
2008-03-06 11:11 8,147,968 ----a-w C:\Windows\System32\wmploc.DLL
2008-03-06 11:11 7,680 ----a-w C:\Windows\System32\spwmp.dll
2008-03-06 11:11 4,096 ----a-w C:\Windows\System32\dxmasf.dll
2008-03-06 11:11 356,864 ----a-w C:\Windows\System32\MediaMetadataHandler.dll
2008-03-06 11:11 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe
2008-03-06 11:11 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe
2008-03-06 11:09 24,064 ----a-w C:\Windows\System32\netcfg.exe
2008-03-06 11:09 22,016 ----a-w C:\Windows\System32\netiougc.exe
2008-03-06 11:09 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll
2008-03-06 11:08 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL
2008-03-06 11:08 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-03-06 11:08 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-03-06 11:08 4,247,552 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll
2008-03-06 11:08 223,232 ----a-w C:\Windows\System32\WMASF.DLL
2008-03-06 11:08 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
2008-03-06 11:08 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-03-06 11:08 2,048 ----a-w C:\Windows\System32\asferror.dll
2008-03-06 11:08 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-03-06 11:08 1,686,528 ----a-w C:\Windows\System32\gameux.dll
2008-03-06 11:08 1,327,104 ----a-w C:\Windows\System32\quartz.dll
2008-03-06 11:07 84,480 ----a-w C:\Windows\System32\INETRES.dll
2008-03-06 11:07 737,792 ----a-w C:\Windows\System32\inetcomm.dll
2008-03-06 11:07 11,776 ----a-w C:\Windows\System32\sbunattend.exe
2008-03-06 11:05 788,992 ----a-w C:\Windows\System32\rpcrt4.dll
2008-03-06 11:04 2,048 ----a-w C:\Windows\System32\tzres.dll
2008-03-06 11:02 1,244,672 ----a-w C:\Windows\System32\mcmde.dll
2008-03-06 02:59 53,080 ----a-w C:\Windows\System32\wuauclt.exe
2008-03-06 02:59 43,352 ----a-w C:\Windows\System32\wups2.dll
2008-03-06 02:59 1,524,224 ----a-w C:\Windows\System32\wucltux.dll
2008-03-06 02:58 80,896 ----a-w C:\Windows\System32\wudriver.dll
2008-03-06 02:58 549,720 ----a-w C:\Windows\System32\wuapi.dll
2008-03-06 02:58 33,624 ----a-w C:\Windows\System32\wups.dll
2008-03-06 02:58 1,712,984 ----a-w C:\Windows\System32\wuaueng.dll
2008-03-06 02:57 31,232 ----a-w C:\Windows\System32\wuapp.exe
2008-03-06 02:57 163,000 ----a-w C:\Windows\System32\wuwebv.dll
2008-02-29 06:51 19,000 ----a-w C:\Windows\System32\kd1394.dll
2008-02-29 06:39 40,960 ----a-w C:\Windows\System32\srclient.dll
2008-02-29 06:39 371,712 ----a-w C:\Windows\System32\srcore.dll
2008-02-29 06:38 313,856 ----a-w C:\Windows\System32\rstrui.exe
2008-02-29 06:38 16,384 ----a-w C:\Windows\System32\srdelayed.exe
2008-02-29 06:35 6,656 ----a-w C:\Windows\System32\kbd106n.dll
2008-02-29 06:34 7,168 ----a-w C:\Windows\System32\f3ahvoas.dll
2008-02-29 04:16 2,027,008 ----a-w C:\Windows\System32\win32k.sys
2007-11-28 22:52 1,663,036 ----a-w C:\Users\nick\LineRider_beta.exe
2007-11-06 23:32 174 --sha-w C:\Program Files\desktop.ini
2003-08-05 18:41 53,248 ----a-w C:\Windows\inf\ap561.exe
2002-11-26 23:24 32,768 ----a-w C:\Windows\inf\Remove561.exe
2002-11-22 22:56 118,784 ----a-w C:\Windows\inf\ShowBmp.exe
2002-10-30 01:07 36,864 ----a-w C:\Windows\inf\Setup8a.exe
2002-10-01 21:43 119,798 ----a-w C:\Windows\inf\spca561.sys
.

------- Sigcheck -------

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2007-05-18 04:43 430080]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 05:35 125440]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]
"Google Update"="C:\Users\nick\AppData\Local\Google\Update\1.1.25.0\GoogleUpdate.exe" [2008-04-15 21:59 51184]
"cmds"="C:\Users\nick\AppData\Local\Temp\opnnklKb.dll" [2008-05-20 15:18 319360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2007-09-20 12:07 141848]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2007-09-20 12:07 154136]
"Persistence"="C:\Windows\system32\igfxpers.exe" [2007-09-20 12:07 129560]
"TPwrMain"="C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE" [2007-03-29 11:39 411192]
"SmoothView"="C:\Program Files\Toshiba\SmoothView\SmoothView.exe" [2007-06-15 22:01 448080]
"00TCrdMain"="C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe" [2007-05-22 17:32 538744]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-11-06 14:24 1006264]
"RtHDVCpl"="RtHDVCpl.exe" [2007-04-25 12:14 4444160 C:\Windows\RtHDVCpl.exe]
"SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [2007-08-15 16:31 102400]
"NDSTray.exe"="NDSTray.exe" []
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-16 21:00 579584]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 02:25 6731312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-03-12 18:16 219136]

C:\Users\nick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
YouTube Uploader.lnk - C:\Users\nick\AppData\Local\YouTube\Uploader\youtubeuploader.exe [2007-11-09 13:33:08 71152]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
avgwlntf.dll 2008-03-12 18:17 9216 C:\Windows\System32\avgwlntf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\vio\dvacm.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{F7E9882B-CF5A-4D27-8296-0BB9FE3BA782}"= C:\Program Files\Common Files\Mcafee\MNA\McNaSvc.exe:McAfee Network Agent
"{2697B969-6621-4BC5-A993-362FA8FF62C8}"= Disabled:C:\Program Files\Common Files\Mcafee\MNA\McNaSvc.exe:McAfee Network Agent
"{9C1032FF-3F8E-46D1-8E6C-0F2F19CA6530}"= TCP:67:DHCP Discovery Service
"{38F8A755-3E1F-43D4-9141-376233BCC8C6}"= Disabled:UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{9FD94F2D-D752-449C-B466-07D3BB0B4517}"= Disabled:TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{6F923BFA-3054-4578-92A6-40BC3B2BB490}"= Disabled:TCP:67:0.0.0.0:DHCP Discovery Service
"{4C73B9D7-BB56-4FDA-A2F5-05608039AD9C}"= Disabled:UDP:C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe:pure Networks Platform Service
"{DAFC417C-4304-4C28-950F-58421EED0D38}"= Disabled:TCP:C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe:pure Networks Platform Service
"{6B08EC32-E09A-4134-9C2C-7C15E7759389}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{B297BF4D-17AA-4A64-97DE-BE5F3735C93D}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{A6FCF81E-26DC-494A-AE15-B74581E3FD2F}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{ADD5CBC4-29E1-4220-94E9-3A144D42B29B}C:\\program files\\limewire\\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{71CA7FEC-ABF4-439A-AB38-6B6A014E2A65}C:\\program files\\limewire\\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire
"TCP Query User{7D8A06DC-552B-4B33-817B-610CA16236A2}C:\\program files\\halo trial\\halo.exe"= UDP:C:\program files\halo trial\halo.exe:Halo
"UDP Query User{734C8B94-4866-4B4B-B1FF-47A7DD399557}C:\\program files\\halo trial\\halo.exe"= TCP:C:\program files\halo trial\halo.exe:Halo
"TCP Query User{46CB91D8-DB17-4F5F-A40D-B2694A1C5BCD}C:\\program files\\halo trial\\halo.exe"= UDP:C:\program files\halo trial\halo.exe:Halo
"UDP Query User{BB330AEB-201B-4FE0-96DB-38B6EBE54819}C:\\program files\\halo trial\\halo.exe"= TCP:C:\program files\halo trial\halo.exe:Halo

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\TOSHIBA\\ivp\\NetInt\\Netint.exe"= C:\TOSHIBA\ivp\NetInt\Netint.exe:*:Enabled:NIE - Toshiba Software Upgrades Engine
"C:\\TOSHIBA\\Ivp\\ISM\\pinger.exe"= C:\TOSHIBA\Ivp\ISM\pinger.exe:*:Enabled:Toshiba Software Upgrades Pinger

R0 tos_sps32;TOSHIBA tos_sps32 Service;C:\Windows\system32\DRIVERS\tos_sps32.sys [2007-09-19 11:59]
R2 pinger;pinger;C:\TOSHIBA\IVP\ISM\pinger.exe [2007-01-25 19:47]
R2 TNaviSrv;TOSHIBA Navi Support Service;C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe [2007-09-19 12:01]
R2 TOSHIBA Bluetooth Service;TOSHIBA Bluetooth Service;C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe [2007-02-25 22:55]
R3 AvgWFP;AVG7 Firewall Driver x86;C:\Windows\system32\Drivers\avgwfp.sys [2008-03-22 08:43]
R3 FwLnk;FwLnk Driver;C:\Windows\system32\DRIVERS\FwLnk.sys [2006-11-19 23:11]
R3 igfx;igfx;C:\Windows\system32\DRIVERS\igdkmd32.sys [2007-09-13 16:23]
R3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;C:\Windows\system32\DRIVERS\RTL8187B.sys [2007-06-01 14:07]
R3 tdcmdpst;TOSHIBA Writing Engine Filter Driver;C:\Windows\system32\DRIVERS\tdcmdpst.sys [2006-10-18 12:50]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2007-01-09 11:00]
S4 KR10I;KR10I;C:\Windows\system32\drivers\kr10i.sys [2006-11-08 23:32]
S4 KR10N;KR10N;C:\Windows\system32\drivers\kr10n.sys [2006-11-08 23:31]
S4 KR3NPXP;KR3NPXP;C:\Windows\system32\drivers\kr3npxp.sys [2006-09-27 05:06]

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2008-05-22 06:27:33 C:\Windows\Tasks\User_Feed_Synchronization-{F1EEB4A6-97BF-46AC-B33D-83FDF2629D22}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-21 23:44:22
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
TOSCDSPD = C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe?/i?????e??o| ??? [email protected]?O?X?O?p?

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\Windows\Explorer.exe
-> C:\Users\nick\AppData\Local\Temp\opnnklKb.dll
.
Completion time: 2008-05-21 23:46:23
ComboFix-quarantined-files.txt 2008-05-22 06:45:36

Pre-Run: 78,866,837,504 bytes free
Post-Run: 78,850,166,784 bytes free

208 --- E O F --- 2008-05-16 10:03:00


the weird panda log
;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-05-21 22:59:12
PROTECTIONS: 1
MALWARE: 39
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
AVG 7.5.524 7.5.524 Yes Yes
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
00145807 Cookie/Linksynergy TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
00167744 Cookie/GoStats TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
00167749 Cookie/Toplist TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
00169287 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
00170559 Cookie/Com.com TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
00171633 Cookie/Cgi-bin TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
00173520 Cookie/Bluestreak TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\n[email protected][2].txt
00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
00207862 Cookie/did-it TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
00293517 Cookie/AdDynamix TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
01196325 Cookie/Enhance TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
01606636 Cookie/Adserver TrackingCookie No 0 Yes No C:\Users\nick\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
02983935 Spyware/Virtumonde Spyware No 1 Yes No C:\Users\nick\AppData\Local\Temp\rdmvluwh.dll
02983935 Spyware/Virtumonde Spyware No 1 Yes No C:\Users\nick\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3HJB9FRM\kb456456[2]
02983935 Spyware/Virtumonde Spyware No 1 Yes No C:\Users\nick\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3HJB9FRM\kb456456[1]
02983935 Spyware/Virtumonde Spyware Yes 2 Yes No C:\USERS\NICK\APPDATA\LOCAL\TEMP\DWPMLDWH.DLL
02983940 Spyware/Virtumonde Spyware Yes 2 Yes No C:\USERS\NICK\APPDATA\LOCAL\TEMP\OPNNKLKB.DLL
02984008 Adware/WinSpywareProtect Adware No 0 Yes No C:\USERS\NICK\APPDATA\LOCAL\TEMP\OPNLKHHG.DLL
02984008 Adware/WinSpywareProtect Adware No 0 Yes No C:\Users\nick\AppData\Local\Temp\tmp0001338d
;===================================================================================================================================================================================
SUSPECTS
Sent Location �TmG��
3
;===================================================================================================================================================================================
;===================================================================================================================================================================================
VULNERABILITIES
Id Severity Description �TmG��
3
;===================================================================================================================================================================================
184379 MEDIUM MS08-001 �TmG��
3
182048 HIGH MS07-069 �TmG��
3
176382 HIGH MS07-057 �TmG��
3
;===================================================================================================================================================================================

and the 2 deckard ones (main and extra)

Deckard's System Scanner v20071014.68
Run by nick on 2008-05-21 23:20:27
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- Last 5 Restore Point(s) --
13: 2008-05-20 20:58:21 UTC - RP200 - Windows Update
12: 2008-05-16 10:00:41 UTC - RP199 - Windows Update
11: 2008-05-16 04:46:15 UTC - RP198 - Windows Update
10: 2008-05-14 10:00:53 UTC - RP197 - Windows Update
9: 2008-05-14 02:08:17 UTC - RP196 - Windows Update


-- First Restore Point --
1: 2008-04-27 19:19:37 UTC - RP188 - Scheduled Checkpoint


Backed up registry hives.
Performed disk cleanup.

Percentage of Memory in Use: 80% (more than 75%).
Total Physical Memory: 1014 MiB (1024 MiB recommended).


-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-05-21 23:24:59
Platform: Windows Vista (6.00.6000)
MSIE: Internet Explorer (7.00.6000.16386)
Boot mode: Normal

Running processes:
C:\Windows\System32\dwm.exe
C:\Windows\System32\taskeng.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
C:\Program Files\Toshiba\SmoothView\SmoothView.exe
C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Toshiba\ConfigFree\NDSTray.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\nick\AppData\Local\Google\Update\1.1.25.0\GoogleUpdate.exe
C:\Windows\System32\rundll32.exe
C:\Users\nick\AppData\Local\YouTube\Uploader\youtubeuploader.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Synaptics\SynTP\SynToshiba.exe
C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe
C:\Windows\System32\wbem\unsecapp.exe
C:\Windows\explorer.exe
C:\Windows\System32\wercon.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\microsoft shared\Windows Live\WLLoginProxy.exe
C:\Windows\System32\Macromed\Flash\FlashUtil9e.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\System32\dllhost.exe
C:\Windows\System32\taskeng.exe
C:\Windows\System32\igfxsrvc.exe
C:\Users\nick\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K2KF4UYL\dss[1].exe
C:\Windows\System32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshibadirect.com/dpdstart
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Users\nick\AppData\Local\Google\Update\1.1.25.0\GoogleUpdate.exe" /lang en
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\nick\AppData\Local\Temp\opnlkhhG.dll,#1
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\nick\AppData\Local\Temp\opnnklKb.dll,c
O4 - HKCU\..\Run: [90d30e58] rundll32.exe "C:\Users\nick\AppData\Local\Temp\dwpmldwh.dll",b
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: YouTube Uploader.lnk = C:\Users\nick\AppData\Local\YouTube\Uploader\youtubeuploader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://pcpitstop.com/mhLbl.cab
O16 - DPF: {A30FBBDC-FA29-4606-8565-14AADCCA6708} (Rite Aid One Hour Photo Online Control) - https://photos.riteaid.com/control/RiteAidOneHourPhotoOnline.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O20 - Winlogon Notify: avgwlntf - C:\Windows\system32\avgwlntf.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\System32\agrsmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgemc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: pinger - Unknown owner - C:\TOSHIBA\IVP\ISM\pinger.exe
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\System32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe


--
End of file - 9403 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

S3 CnxTrLan (Cayman 3300 Series USB Network Adapter Driver) - c:\windows\system32\drivers\cnxtrlan.sys <Not Verified; Conexant; Conexant USB Network Device>
S3 CnxTrUsb (Cayman 3300 Series USB Network Interface Device Driver) - c:\windows\system32\drivers\cnxtrusb.sys <Not Verified; Conexant; Conexant USB Network Device>
S4 KR3NPXP - c:\windows\system32\drivers\kr3npxp.sys <Not Verified; TOSHIBA CORPORATION; TOSHIBA RAID>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 CFSvcs (ConfigFree Service) - c:\program files\toshiba\configfree\cfsvcs.exe <Not Verified; TOSHIBA CORPORATION; ConfigFree(TM)>
R2 TNaviSrv (TOSHIBA Navi Support Service) - c:\program files\toshiba\toshiba dvd player\tnavisrv.exe <Not Verified; TOSHIBA Corporation; TOSHIBA DVD Player>
R2 TODDSrv (TOSHIBA Optical Disc Drive Service) - c:\windows\system32\toddsrv.exe <Not Verified; TOSHIBA Corporation; TDCSrv Application>


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Scheduled Tasks -------------------------------------------------------------

2008-05-21 23:12:33 420 --ah----- C:\Windows\Tasks\User_Feed_Synchronization-{F1EEB4A6-97BF-46AC-B33D-83FDF2629D22}.job


-- Files created between 2008-04-21 and 2008-05-21 -----------------------------

2008-05-21 23:05:50 0 d-------- C:\Users\All Users\TEMP
2008-05-21 23:03:19 118784 --a------ C:\Windows\system32\MSSTDFMT.DLL <Not Verified; Microsoft Corporation; MSSTDFMT Object Library>
2008-05-21 23:03:19 0 d-------- C:\Program Files\SpywareBlaster
2008-05-21 20:48:35 0 d-------- C:\Program Files\Panda Security
2008-05-20 15:12:52 0 dr-h----- C:\$VAULT$.AVG
2008-05-10 12:24:39 101888 --a------ C:\Windows\system32\VB6STKIT.DLL <Not Verified; Microsoft Corporation; Microsoft® Visual Basic for Windows>
2008-05-10 12:24:39 119568 --a------ C:\Windows\system32\VB6FR.DLL <Not Verified; Microsoft Corporation; Environnement Visual Basic>
2008-05-10 12:24:39 9728 --a------ C:\Windows\system32\PCCLPFR.DLL <Not Verified; Microsoft Corporation; PicClip>
2008-05-10 12:24:39 141312 --a------ C:\Windows\system32\MSCMCFR.DLL <Not Verified; Microsoft Corporation; COMCTL>
2008-05-10 12:24:38 15360 --a------ C:\Windows\system32\inetfr.DLL <Not Verified; Microsoft Corporation; DLL du contrôle Microsoft Internet Transfer>
2008-05-10 12:24:38 32768 --a------ C:\Windows\system32\CMDLGFR.DLL <Not Verified; Microsoft Corporation; CMDIALOG>
2008-04-27 13:35:47 0 d-------- C:\Program Files\DivX
2008-04-25 23:03:41 0 d-------- C:\tmp
2008-04-25 22:29:20 0 d-------- C:\Program Files\Blender Foundation


-- Find3M Report ---------------------------------------------------------------

2008-05-21 19:51:27 0 d-------- C:\Users\nick\AppData\Roaming\AVG7
2008-05-20 18:01:12 0 d-------- C:\Users\nick\AppData\Roaming\LimeWire
2008-05-14 03:01:49 0 d-------- C:\Program Files\Windows Mail
2008-05-10 12:06:43 0 d-------- C:\Program Files\Free FLV Converter
2008-05-06 20:41:52 0 d-------- C:\Users\nick\AppData\Roaming\DivX
2008-04-27 13:14:52 0 d-------- C:\Program Files\LimeWire
2008-04-23 23:45:44 172 --a------ C:\Users\nick\AppData\Roaming\wklnhst.dat
2008-04-16 21:47:42 152064 --a------ C:\Windows\snap.dat
2008-04-15 20:48:04 0 d-------- C:\Program Files\LiveSwif
2008-04-11 08:48:21 0 d-------- C:\Program Files\Axis Communications
2008-04-05 16:45:31 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-04-03 22:06:53 0 d-------- C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor
2008-04-01 20:36:07 0 d-------- C:\Users\nick\AppData\Roaming\Adobe
2008-03-31 14:25:48 823296 --a------ C:\Windows\system32\divx_xx0c.dll <Not Verified; DivX, Inc.; DivX®>
2008-03-31 14:25:48 823296 --a------ C:\Windows\system32\divx_xx07.dll <Not Verified; DivX, Inc.; DivX®>
2008-03-31 14:25:46 802816 --a------ C:\Windows\system32\divx_xx11.dll <Not Verified; DivX, Inc.; DivX?>
2008-03-31 14:25:46 831488 --a------ C:\Windows\system32\divx_xx0a.dll
2008-03-31 14:25:46 682496 --a------ C:\Windows\system32\DivX.dll <Not Verified; DivX, Inc.; DivX®>
2008-03-30 13:40:34 0 d-------- C:\Users\nick\AppData\Roaming\fretsonfire
2008-03-30 13:36:04 0 d-------- C:\Program Files\Frets on Fire
2008-03-24 12:10:59 0 d-------- C:\Users\nick\AppData\Roaming\Ulead Systems
2008-03-22 14:31:14 0 d-------- C:\Program Files\Common Files
2008-03-22 14:09:23 0 d-------- C:\Users\nick\AppData\Roaming\Template
2008-03-21 13:30:08 3596288 --a------ C:\Windows\system32\qt-dx331.dll
2008-03-21 13:28:54 81920 --a------ C:\Windows\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100>
2008-03-21 13:28:20 12288 --a------ C:\Windows\system32\DivXWMPExtType.dll
2008-03-05 18:09:55 24064 --a------ C:\Users\nick\AppData\Roaming\UserTile.png


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\Windows\system32\igfxtray.exe" [09/20/2007 12:07 PM]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [09/20/2007 12:07 PM]
"Persistence"="C:\Windows\system32\igfxpers.exe" [09/20/2007 12:07 PM]
"TPwrMain"="C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE" [03/29/2007 11:39 AM]
"SmoothView"="C:\Program Files\Toshiba\SmoothView\SmoothView.exe" [06/15/2007 10:01 PM]
"00TCrdMain"="C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe" [05/22/2007 05:32 PM]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [11/06/2007 02:24 PM]
"RtHDVCpl"="RtHDVCpl.exe" [04/25/2007 12:14 PM C:\Windows\RtHDVCpl.exe]
"SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [08/15/2007 04:31 PM]
"NDSTray.exe"="NDSTray.exe" []
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [04/16/2008 09:00 PM]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [06/11/2007 02:25 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [05/18/2007 04:43 AM]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [11/02/2006 05:35 AM]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [10/18/2007 12:34 PM]
"Google Update"="C:\Users\nick\AppData\Local\Google\Update\1.1.25.0\GoogleUpdate.exe" [04/15/2008 09:59 PM]
"MSServer"="C:\Users\nick\AppData\Local\Temp\opnlkhhG.dll,#1" []
"cmds"="C:\Users\nick\AppData\Local\Temp\opnnklKb.dll,c" []
"90d30e58"="C:\Users\nick\AppData\Local\Temp\dwpmldwh.dll,b" []

C:\Users\nick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
YouTube Uploader.lnk - C:\Users\nick\AppData\Local\YouTube\Uploader\youtubeuploader.exe [11/9/2007 1:33:08 PM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
avgwlntf.dll 03/12/2008 06:17 PM 9216 C:\Windows\System32\avgwlntf.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]
@="IEEE 1394 Bus host controllers"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]
@="SBP2 IEEE 1394 Devices"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]
@="SecurityDevices"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc EMDMgmt TabletInputService wlansvc WPDBusEnum


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
C:\Windows\system32\unregmp2.exe /ShowWMP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
%SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI



-- End of Deckard's System Scanner: finished at 2008-05-21 23:27:16 ------------
Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft® Windows Vista™ Home Premium (build 6000)
Architecture: X86; Language: English

CPU 0: Intel(R) Pentium(R) Dual CPU T2330 @ 1.60GHz
Percentage of Memory in Use: 83%
Physical Memory (total/avail): 1013.81 MiB / 168.73 MiB
Pagefile Memory (total/avail): 2280.25 MiB / 565.28 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1915.82 MiB

C: is Fixed (NTFS) - 110.32 GiB total, 73.61 GiB free.
D: is CDROM (No Media)

\\.\PHYSICALDRIVE0 - Hitachi HTS542512K9SA00 ATA Device - 111.79 GiB - 2 partitions
\PARTITION0 - Unknown - 1500 MiB
\PARTITION1 (bootable) - Installable File System - 110.32 GiB - C:



-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is enabled.

AV: AVG 7.5.524 v7.5.524 (Grisoft)
AS: AVG Anti-Spyware v7, 5, 1, 43 (GRISOFT s.r.o.) Disabled Outdated
AS: Windows Defender v1.1.1505.0 (Microsoft Corporation)

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\\TOSHIBA\\ivp\\NetInt\\Netint.exe"="C:\\TOSHIBA\\ivp\\NetInt\\Netint.exe:*:Enabled:NIE - Toshiba Software Upgrades Engine"
"C:\\TOSHIBA\\Ivp\\ISM\\pinger.exe"="C:\\TOSHIBA\\Ivp\\ISM\\pinger.exe:*:Enabled:Toshiba Software Upgrades Pinger"


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\nick\AppData\Roaming
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=NICK-PC
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\nick
LOCALAPPDATA=C:\Users\nick\AppData\Local
LOGONSERVER=\\NICK-PC
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 15 Stepping 13, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0f0d
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
PROMPT=$P$G
PUBLIC=C:\Users\Public
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\nick\AppData\Local\Temp
TMP=C:\Users\nick\AppData\Local\Temp
USERDOMAIN=nick-PC
USERNAME=nick
USERPROFILE=C:\Users\nick
windir=C:\Windows


-- User Profiles ---------------------------------------------------------------

nick


-- Add/Remove Programs ---------------------------------------------------------

--> "C:\Program Files\InstallShield Installation Information\{A644254B-92F6-4970-8635-AB0775371E72}\setup.exe" --u:{A644254B-92F6-4970-8635-AB0775371E72}
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{622E6F16-0904-49B6-BBE1-4CC836314CCF}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{697AFC77-F318-4CD4-BF16-F50F4C1072DA}\setup.exe" -l0x9
7-Zip 4.57 --> "C:\Program Files\7-Zip\Uninstall.exe"
Adobe Flash Player ActiveX --> C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8.1.0 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81000000003}
Adobe Shockwave Player --> C:\Windows\System32\Macromed\SHOCKW~1\UNWISE.EXE C:\Windows\System32\Macromed\SHOCKW~1\Install.log
AVG 7.5 --> C:\Program Files\Grisoft\AVG7\setup.exe /UNINSTALL
AVG Anti-Spyware 7.5 --> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe
AXIS Media Control Embedded --> C:\Program Files\Axis Communications\AXIS Media Control Embedded\setup.exe setup.rem remove
AXIS Media Control Embedded Installer --> MsiExec.exe /I{FD727056-F0C4-4811-9688-9EBF450D22C4}
Blender (remove only) --> "C:\Program Files\Blender Foundation\Blender\uninstall.exe"
Bluetooth Stack for Windows by Toshiba --> MsiExec.exe /X{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}
Bontago --> C:\Program Files\Bontago\Uninstall.exe
Cayman 3300 Series USB Network Adapter --> C:\Program Files\Netopia\Cayman 3300 Series USB Network\CnxUnist.exe -w7 Netopia\Cayman 3300 Series USB Network
CD/DVD Drive Acoustic Silencer --> C:\Program Files\InstallShield Installation Information\{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}\setup.exe -runfromtemp -l0x0009 -removeonly
DivX Codec --> C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DVD MovieFactory for TOSHIBA --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F214EAA4-A069-4BAF-9DA4-4DB8BEEDE485}\setup.exe" -l0x9
Frets On Fire --> "C:\Program Files\Frets on Fire\Uninstall.exe"
Google Toolbar for Internet Explorer --> MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Toolbar for Internet Explorer --> regsvr32 /u /s "c:\program files\google\googletoolbar1.dll"
InstantStorm 1.5 --> "C:\Program Files\InstantStorm\unins000.exe"
Intel(R) Graphics Media Accelerator Driver --> C:\Windows\system32\igxpun.exe -uninstall
Java(TM) 6 Update 2 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
LimeWire 4.16.7 --> "C:\Program Files\LimeWire\uninstall.exe"
Linksys Wireless-G PCI Adapter --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4DDC3BED-CC68-44AA-B435-D727B620CA5B}\setup.exe" -l0x9
LiveSwif lite 2.1 (Remove only) --> "C:\Program Files\LiveSwif\LiveSwif lite 2.1\Uninst.exe"
Macromedia Extension Manager --> MsiExec.exe /I{5546CDB5-2CE2-498B-B059-5B3BF81FC41F}
Macromedia Fireworks 8 --> MsiExec.exe /I{4C24A8C1-7CFA-4650-AF15-732F5BD7B46D}
Macromedia Flash 8 --> MsiExec.exe /I{2BD5C305-1B27-4D41-B690-7A61172D2FEB}
Macromedia Flash 8 Video Encoder --> MsiExec.exe /X{8BF2C401-02CE-424D-BC26-6C4F9FB446B6}
Macromedia Flash Player 8 --> MsiExec.exe /X{885A63EA-382B-4DD4-A755-14809B8557D6}
Macromedia Flash Player 8 Plugin --> MsiExec.exe /X{91057632-CA70-413C-B628-2D3CDBBB906B}
Marvell Miniport Driver --> MsiExec.exe /X{C950420B-4182-49EA-850A-A6A2ABF06C6B}
Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Works --> MsiExec.exe /I{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}
MSXML 4.0 SP2 (KB927978) --> MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181) --> MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833) --> MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
Next Generation Visualisations --> MsiExec.exe /I{2E376AD9-5C49-4F7D-A0BA-6A44E8FA5A3B}
Nick's_Worms --> "C:\Windows\Nick's_Worms Uninstaller\unins000.exe"
nicksbubbles --> "C:\Windows\nicksbubbles Uninstaller\unins000.exe"
Panda ActiveScan 2.0 --> C:\Program Files\Panda Security\ActiveScan 2.0\as2uninst.exe
Philips PC Camera --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F48C6EA5-3B43-11D6-86A6-0050BA0259A2}\driver.exe" -l0x9 -removeonly
PLAYSTATION(R)Network Downloader --> MsiExec.exe /X{BC4CA8FA-41D2-4B81-8680-E9B7573D6500}
Project64 1.6 --> MsiExec.exe /X{9559F7CA-5E34-4237-A2D9-D856464AD727}
Realtek High Definition Audio Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\setup.exe" -l0x9 -removeonly
REALTEK RTL8187B Wireless LAN Driver --> C:\Program Files\InstallShield Installation Information\{7095FD27-37F0-4750-9DE8-D37DC0043706}\Install.exe -uninst -l0x9
Security Update for CAPICOM (KB931906) --> MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906) --> MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
snake_by_nick --> "C:\Windows\snake_by_nick Uninstaller\unins001.exe"
SpywareBlaster 4.0 --> "C:\Program Files\SpywareBlaster\unins000.exe"
Synaptics Pointing Device Driver --> rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
Texas Instruments PCIxx21/x515/xx12 drivers. --> C:\Program Files\InstallShield Installation Information\{DB780B85-B4B5-4864-A49C-9B706B169C93}\setup.exe -runfromtemp -l0x0409
TOSHIBA Assist --> C:\Program Files\InstallShield Installation Information\{12B3A009-A080-4619-9A2A-C6DB151D8D67}\setup.exe -runfromtemp -l0x0009 -removeonly
TOSHIBA ConfigFree --> C:\Program Files\InstallShield Installation Information\{78C6A78A-8B03-48C8-A47C-78BA1FCA2307}\setup.exe -runfromtemp -l0x0009 uninstall -removeonly
TOSHIBA Disc Creator --> MsiExec.exe /X{5DA0E02F-970B-424B-BF41-513A5018E4C0}
TOSHIBA DVD PLAYER --> C:\Program Files\InstallShield Installation Information\{6C5F3BDC-0A1B-4436-A696-5939629D5C31}\setup.exe -runfromtemp -l0x0009 -ADDREMOVE -removeonly
TOSHIBA Extended Tiles for Windows Mobility Center --> C:\Program Files\InstallShield Installation Information\{617C36FD-0CBE-4600-84B2-441CEB12FADF}\setup.exe -runfromtemp -l0x0409
TOSHIBA Hardware Setup --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BFC85CDC-BD7C-4FDD-9507-8D74B5A79404}\setup.exe" -l0x9
Toshiba Registration --> MsiExec.exe /I{C53D16CC-E56F-47B8-906E-70AAF8EABB4F}
TOSHIBA SD Memory Utilities --> MsiExec.exe /X{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}
TOSHIBA Software Modem --> Tosmreg -U
TOSHIBA Software Upgrades --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{425A2BC2-AA64-4107-9C29-484245BBEA05}\setup.exe" -l0x9 -removeonly
TOSHIBA Speech System Applications --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EE033C1F-443E-41EC-A0E2-559B539A4E4D}\Setup.exe" -l0x9
TOSHIBA Speech System SR Engine(U.S.) Version1.0 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{008D69EB-70FF-46AB-9C75-924620DF191A}\Setup.exe" -l0x9 UNINSTALL
TOSHIBA Speech System TTS Engine(U.S.) Version1.0 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3FBF6F99-8EC6-41B4-8527-0A32241B5496}\Setup.exe" -l0x9
TOSHIBA Supervisor Password --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2BDF38E0-1A7F-4220-B4B7-118DD45E5E13}\setup.exe" -l0x9
TOSHIBA Value Added Package --> C:\Program Files\InstallShield Installation Information\{FEDD27A0-B306-45EF-BF58-B527406B42C8}\setup.exe -runfromtemp -l0x0409
Windows Live installer --> MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}
Windows Live Messenger --> MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0}
Windows Live Sign-in Assistant --> MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
Windows Media Encoder 9 Series --> msiexec.exe /I {E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
Windows Media Encoder 9 Series --> MsiExec.exe /I{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
YouTube Uploader --> MsiExec.exe /X{171818BA-E0AD-313D-B45A-1BC9D77ADA86}


-- Application Event Log -------------------------------------------------------

Event Record #/Type2190 / Error
Event Submitted/Written: 05/20/2008 07:48:18 PM
Event ID/Source: 5007 / WerSvc
Event Description:
The target file for the Windows Feedback Platform (a DLL file containing the list of problems on this computer that require additional data collection for diagnosis) could not be parsed. The error code was 8014FFF9.

Event Record #/Type2183 / Success
Event Submitted/Written: 05/20/2008 07:41:01 PM
Event ID/Source: 5617 / WinMgmt
Event Description:


Event Record #/Type2182 / Success
Event Submitted/Written: 05/20/2008 07:40:56 PM
Event ID/Source: 5615 / WinMgmt
Event Description:


Event Record #/Type2177 / Success
Event Submitted/Written: 05/20/2008 07:40:27 PM
Event ID/Source: 902 / Software Licensing Service
Event Description:
The Software Licensing service has started.

Event Record #/Type2169 / Error
Event Submitted/Written: 05/20/2008 06:59:15 PM
Event ID/Source: 1000 / Application Error
Event Description:
Faulting application Explorer.EXE, version 6.0.6000.16549, time stamp 0x46d230c5, faulting module rdmvluwh.dll, version 0.0.0.0, time stamp 0x48219e78, exception code 0xc0000005, fault offset 0x000032a9,
process id 0x7c8, application start time 0xExplorer.EXE0.



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type19829 / Warning
Event Submitted/Written: 05/21/2008 11:25:33 PM
Event ID/Source: 3004 / WinDefend
Event Description:
%nick-PC27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %nick-PC27 can't undo changes that you allow.

For more information please see the following:
%nick-PC275

Scan ID: {1AD715D5-5E6C-4020-9E58-C4481CBEDD8E}

User: nick-PC\nick

Name: %nick-PC271

ID: %nick-PC272

Severity ID: %nick-PC273

Category ID: %nick-PC274

Path Found: %nick-PC276

Alert Type: %nick-PC278

Detection Type: 1.1.1505.02

Event Record #/Type19828 / Warning
Event Submitted/Written: 05/21/2008 11:25:33 PM
Event ID/Source: 3004 / WinDefend
Event Description:
%nick-PC27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %nick-PC27 can't undo changes that you allow.

For more information please see the following:
%nick-PC275

Scan ID: {851D422B-3F93-4F5A-81AA-A71D86C203D0}

User: nick-PC\nick

Name: %nick-PC271

ID: %nick-PC272

Severity ID: %nick-PC273

Category ID: %nick-PC274

Path Found: %nick-PC276

Alert Type: %nick-PC278

Detection Type: 1.1.1505.02

Event Record #/Type19823 / Warning
Event Submitted/Written: 05/21/2008 11:20:39 PM
Event ID/Source: 1002 / WinDefend
Event Description:
%nick-PC27 scan has been stopped before completion.

Scan ID: {44D61BFF-AD8C-4FDC-851B-68C1D87895E2}

Scan Type: %nick-PC01

Scan Parameters: %nick-PC09

User: nick-PC\nick

Event Record #/Type19820 / Error
Event Submitted/Written: 05/21/2008 10:25:09 PM
Event ID/Source: 8003 / bowser
Event Description:
The master browser has received a server announcement from the computer O2Y9Q3
that believes that it is the master browser for the domain on transport NetBT_Tcpip_{DBCEC8C8-8DDA-4014-B428-FED0EEFC40F.
The master browser is stopping or an election is being forced.

Event Record #/Type19818 / Error
Event Submitted/Written: 05/21/2008 10:23:12 PM
Event ID/Source: 8003 / bowser
Event Description:
The master browser has received a server announcement from the computer O2Y9Q3
that believes that it is the master browser for the domain on transport NetBT_Tcpip_{DBCEC8C8-8DDA-4014-B428-FED0EEFC40F.
The master browser is stopping or an election is being forced.



-- End of Deckard's System Scanner: finished at 2008-05-21 23:27:16 ------------


there ya have it, ihope you guyscan solve my proble (hope i provided enough info...)
 
1 - 1 of 1 Posts
Status
Not open for further replies.
About this Discussion
0 Replies
1 Participant
Last post:
nvmsocool
Tech Support Forum
A forum community dedicated to tech experts and enthusiasts. Come join the discussion about articles, computer security, Mac, Microsoft, Linux, hardware, networking, gaming, reviews, accessories, and more!
Full Forum Listing
Explore Our Forums
Windows XP Support Windows 7 , Windows Vista Support Motherboards, Bios|UEFI & CPU Networking Support Laptop Support
Top