Tech Support Forum banner
Status
Not open for further replies.
1 - 17 of 17 Posts

· Registered
Joined
·
97 Posts
Discussion Starter · #1 ·
Hello and thanks in advance for any help I might get. I've been having problems tonight and hopefully I have most of it cleared up. I downloaded Hijackthis and ran it but it wouldn't run. I first had to delete what I think was my major problem, a file in windows called "Ifinst26.exe". After I got rid of it I was able to run Hijackthis and my log is below. Just to let you know, I ran my adware SE Plus and AVG antivirus after this and nothing shows up but I want to be sure I got rid of everything I needed to. Could you please let me know if there is anything Suspicious below. I have followed the steps give in the information post before posting this :wave

Thanks again in advance,
Darryl

Logfile of HijackThis v1.99.1
Scan saved at 7:03:13 PM, on 1/30/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\CyberLink\PowerCinema\PCMService.exe
C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HiJackThis\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [amd_dc_opt] "C:\Program Files\AMD\amd_dc_opt\amd_dc_opt.exe"
O4 - HKLM\..\Run: [LXCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,[email protected]
O4 - HKLM\..\Run: [AVG7_CC] C:\Program Files\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
O4 - HKCU\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15026/CTSUEng.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15028/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9D3347BC-4F7E-44F5-A470-A1224C4D7AB9}: NameServer = 66.38.192.233 66.38.192.231
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxcf_device - Unknown owner - C:\WINDOWS\system32\lxcfcoms.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\Win32\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\RpcSandraSrv.exe
 

· Registered
Joined
·
2,337 Posts
Hello dashingw, and welcome to TSF


Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools,
then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.


Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding.
Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this
webpage would not be available when you're carrying out the fix.



IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER.

----------------------------------------

The fixes we will use are specific to your problems and should only be used for this issue on this machine.

Please only use this topic to reply to. Do not start another thread.
If any other issues arise let me know.

The process is not instant. Please continue to review my answers until I tell you your machine is clear.
Absence of symptoms does not mean that everything is clear. So lets do this to the end!

Please make every effort to reply to my posts in a timely manner. Malware breeds malware and the longer an infection remains on a system, the more
likely additional infections will result.


----------------------------------------

I don't see anything malicious in your log, but we'll have a look around and see if anything is hiding.


----------------------------------------

DOWNLOADS


CLEANUP! version 4.52 – TEMP FILE CLEANING


Please download Cleanup! and install it. You will use this later.

Alternative link Cleanup Alt


*NOTE* Cleanup deletes EVERYTHING out of temporary folders and does not make backups.



AVG Anti-Spyware 7.5



Please download AVG Anti Spyware

Use the link at the bottom of the page under "AVG Anti-Spyware Free for Windows"





  1. Install AVG Anti-Spyware 7.5.
  2. Double-click the icon on Desktop to launch AVG A-S 7.5
  3. On the top of the main screen click Shield
  4. Click the word active to change it to inactive
  5. On the top of the main screen click Update.
  6. Then click on Start Update. The update will start and a progress bar will show the updates being installed.
  7. I also recommend changing the "Update interval" to something more reasonable like 12 hours.


ComboFix



1. Download this file - You MUST save it to your desktop

COMBOFIX




2. Double click combofix.exe & follow the prompts.

3. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

----------------------------------------

SAFE MODE RE-BOOT

Please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Use the up arrow key to highlight Safe Mode and press Enter.
5) Login with your usual account. Make sure to close any open browsers.

----------------------------------------

RUNNING SCANNERS


Cleanup

Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).
Set the program up as follows:

Click "Options..."
Move the arrow down to "Custom CleanUp!"
Put a check next to the following (Make sure nothing else is checked!):
  • Empty Recycle Bins
  • Delete Cookies
  • Delete Prefetch files (if present)
  • Cleanup! All Users
  • Click on the Temporary Files tab and uncheck the box for Scan drives for files matching if it’s checked.
Click OK
Press the CleanUp! button to start the program and DO NOT reboot when prompted.


AVG Anti-Spyware 7.5

  • Run AVG A-s with it's updated definitions: (...it's important that all windows must be closed)
    This scan can take quite a while to run, so be prepared.
  • Click Scanner
  • Click on the Scan tab
  • Click Complete System Scan to begin scanning.



  • When the scan is complete click Recommended Action and change it to Quarantine (1),
  • If not click Recommended Action and choose Quarantine from the popup menu. (2)
  • At the bottom of the window click on the Apply all Actions button. (3)

When done, click the Save Scan Report button. (4) then click Save Report As and save it to your desktop.

IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.



Note: DO NOT USE the computer while AVG A/S is scanning. If Explorer or the Control Panel are opened some malware types will
reinfect your system or will not be cleaned properly.

----------------------------------------

SYSTEM RE-BOOT

Reboot into Normal Mode.

----------------------------------------


ON-LINE SCANS

Perform an online scan with Internet Explorer with Panda ActiveScan

  1. Click on
    located at the bottom of the page.
  2. A "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
  3. Enter your e-mail address, country, and state & click "Free Online Scan" * The download of the 8 MB Panda's ActiveX control will take place *

Begin the scan by selecting

  • If it finds any malware, it will offer you a report.
  • Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
  • Click on
    then click

* You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
* Turn off the real time scanner of any existing antivirus program while performing the online scan


----------------------------------------

FOLLOW-UP

Please return and post these items in the order listed:

c:\combofix.txt
AVG A/S
Panda scan
A new HJT log run in Normal Mode


Please note: In order to properly see what is on your system, all HJT logs must be run in the normal mode

Please let me know how your system is behaving.
 

· Registered
Joined
·
97 Posts
Discussion Starter · #3 ·
Hello and thank you for helping me :eek:)

I am downloading the things you mentioned, I am on a really really sloooow dial up so it's going to take a bit and I have to get to bed as I work at 5:00AM

I will definately follow through with this and will post all findings/logs tomorrow night sometime around 6pm after work.

Thanks again for your help and will get back soon!!

Darryl
 

· Registered
Joined
·
97 Posts
Discussion Starter · #4 ·
Hi Again Fred,

I did everything you asked, 2 malware/viruses came up when scanning with AVG Spyware. Kind of curious seeing as how my Lavasoft Professional SE didn't catch it. I guess I didn't spend my money as wisely as I thought:rolleyes:

My System seems to be running fine!!!

Here are my results and thank you again....:pray:

Combo-Fix
"Owner" - 07-01-31 4:06:30 Service Pack 2
ComboFix 07.01.30 - Running from: "C:\Documents and Settings\Owner\Desktop"

((((((((((((((((((((((((((((((( Files Created from 2006-12-31 to 2007-01-31 ))))))))))))))))))))))))))))))))))


2007-01-31 03:52 <DIR> d-------- C:\WINDOWS\LastGood
2007-01-31 03:46 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-01-30 22:28 76,560 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2007-01-30 22:09 <DIR> d-------- C:\DOCUME~1\Owner\.housecall6.6
2007-01-30 22:07 <DIR> d-------- C:\WINDOWS\Sun
2007-01-30 22:07 <DIR> d-------- C:\DOCUME~1\Owner\Application Data\Sun
2007-01-30 22:03 <DIR> d-------- C:\Program Files\Java
2007-01-30 21:36 <DIR> d-------- C:\Program Files\Common Files\Java
2007-01-30 19:02 <DIR> d-------- C:\Program Files\HiJackThis
2007-01-30 06:02 <DIR> d-------- C:\DOCUME~1\LOCALS~1\Application Data\CyberLink
2007-01-30 03:35 89,088 --------- C:\WINDOWS\system32\atl71.dll
2007-01-30 03:35 1,047,552 --------- C:\WINDOWS\system32\MFC71u.dll
2007-01-28 18:55 5,504 --------- C:\WINDOWS\system32\drivers\imagedrv.sys
2007-01-28 18:55 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll
2007-01-28 18:55 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll
2007-01-28 18:55 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll
2007-01-28 18:55 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2007-01-28 18:55 125,184 --------- C:\WINDOWS\system32\drivers\imagesrv.sys
2007-01-28 18:55 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2007-01-28 18:55 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll
2007-01-28 18:55 <DIR> d-------- C:\Program Files\Common Files\Ahead
2007-01-28 18:55 <DIR> d-------- C:\Program Files\Ahead
2007-01-28 15:51 9 --a------ C:\WINDOWS\Syskernel12.dll
2007-01-28 15:48 <DIR> d-------- C:\Program Files\CoolMP3Splitter
2007-01-28 14:15 <DIR> d-------- C:\Program Files\WinAVI MP4 Converter
2007-01-27 13:40 41,160 --a------ C:\WINDOWS\system32\drivers\AnyDVD.sys
2007-01-27 13:40 15,440 --a------ C:\WINDOWS\system32\drivers\ElbyCDIO.sys
2007-01-27 13:40 11,984 --a------ C:\WINDOWS\system32\drivers\RegKill.sys
2007-01-25 17:23 <DIR> d-------- C:\WINDOWS\system32\URTTEMP
2007-01-24 20:09 <DIR> d-------- C:\Program Files\Microsoft Hardware
2007-01-24 19:36 <DIR> d-------- C:\Program Files\ATI Multimedia
2007-01-23 19:41 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\nView_Profiles
2007-01-23 19:35 208,896 --ah----- C:\WINDOWS\system32\nvudisp.exe
2007-01-23 19:35 208,896 --a------ C:\WINDOWS\system32\nvunrm.exe
2007-01-23 19:35 109,568 --ah----- C:\WINDOWS\system32\drivers\nvtcp.sys
2007-01-23 19:35 <DIR> d-------- C:\WINDOWS\nview
2007-01-23 19:33 208,896 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2007-01-22 19:38 <DIR> d-------- C:\Program Files\SnapStream Media
2007-01-22 19:38 <DIR> d-------- C:\Program Files\Common Files\SnapStream
2007-01-21 18:53 <DIR> d-------- C:\WINDOWS\NV560876.TMP
2007-01-21 15:19 <DIR> d-------- C:\WINDOWS\system32\QuickTime
2007-01-21 15:17 <DIR> d-------- C:\Program Files\iPod
2007-01-21 08:51 <DIR> d-------- C:\Program Files\MediaMonkey
2007-01-21 01:55 <DIR> d-------- C:\WMSDK
2007-01-21 01:48 <DIR> d--h----- C:\42158af281bde7e035a31c
2007-01-21 01:47 <DIR> d--h----- C:\3ba68e330d38840b88451d92
2007-01-20 17:05 <DIR> d-------- C:\Trash
2007-01-20 10:27 <DIR> d-------- C:\Program Files\Easy Video Splitter
2007-01-18 16:22 <DIR> d-------- C:\Program Files\AutoGK
2007-01-16 18:42 <DIR> d-------- C:\NVIDIA
2007-01-16 16:08 <DIR> d-------- C:\Program Files\VirtualDub
2007-01-13 16:45 <DIR> d-------- C:\Temp
2007-01-12 18:49 <DIR> dr--s---- C:\WINDOWS\assembly
2007-01-12 18:48 <DIR> d--h----- C:\WINDOWS\Microsoft.NET
2007-01-11 17:22 <DIR> d-------- C:\DOCUME~1\Owner\Application Data\DVD Catalyst
2007-01-11 11:34 81,920 --a------ C:\WINDOWS\system32\ElbyCDIO.dll
2007-01-10 20:15 <DIR> d--h----- C:\WINDOWS\ie7updates
2007-01-07 14:39 44,032 --------- C:\WINDOWS\system32\CTSVCCDA.EXE
2007-01-07 14:39 25,088 --------- C:\WINDOWS\system32\CTSVCCTL.EXE
2007-01-02 17:01 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\Elaborate Bytes
2006-12-31 17:32 5,728 --a------ C:\WINDOWS\system32\drivers\WmVirHid.sys
2006-12-31 17:32 44,288 --a------ C:\WINDOWS\system32\drivers\WmXlCore.sys
2006-12-31 17:32 21,216 --a------ C:\WINDOWS\system32\drivers\WmFilter.sys
2006-12-31 17:32 10,144 --a------ C:\WINDOWS\system32\drivers\WmBEnum.sys
2006-12-31 17:32 <DIR> d-------- C:\Program Files\Logitech
2006-12-31 17:32 <DIR> d-------- C:\Program Files\Common Files\Logitech


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-01-31 03:46 -------- d-------- C:\Program Files\grisoft
2007-01-30 19:19 -------- d-------- C:\DOCUME~1\Owner\Application Data\avg7
2007-01-30 18:56 -------- d--h----- C:\Program Files\installshield installation information
2007-01-30 17:50 -------- d-------- C:\Program Files\dc++
2007-01-30 16:29 -------- d-------- C:\Program Files\registry mechanic
2007-01-30 06:06 -------- d-------- C:\Program Files\cyberlink
2007-01-30 03:44 -------- d-------- C:\DOCUME~1\Owner\Application Data\cyberlink
2007-01-29 20:07 -------- d-------- C:\Program Files\lx_cats
2007-01-27 19:16 -------- d-------- C:\DOCUME~1\Owner\Application Data\dvdcss
2007-01-26 21:49 548 --a------ C:\DOCUME~1\Owner\Application Data\autogk.ini
2007-01-24 19:30 -------- d-------- C:\Program Files\ati technologies
2007-01-24 11:26 43520 --a------ C:\WINDOWS\system32\cmdlineext03.dll
2007-01-21 15:20 -------- d-------- C:\Program Files\quicktime
2007-01-21 01:48 -------- d-------- C:\Program Files\windows media connect 2
2007-01-20 10:31 -------- d-------- C:\Program Files\videoredoplus
2007-01-20 08:12 18432 --a------ C:\WINDOWS\system32\drivers\avgmfx86.sys
2007-01-19 08:27 839936 --a------ C:\WINDOWS\system32\drivers\avg7core.sys
2007-01-19 08:27 27776 --a------ C:\WINDOWS\system32\drivers\avg7rsxp.sys
2007-01-18 16:22 43602 --a------ C:\WINDOWS\system32\xvid-uninstall.exe
2007-01-18 16:22 -------- d-------- C:\Program Files\avisynth 2.5
2007-01-16 16:28 -------- d-------- C:\Program Files\expressit s.e. 2.1
2007-01-12 18:34 -------- d-------- C:\Program Files\xilisoft
2007-01-12 18:33 -------- d-------- C:\Program Files\cyberlink dvd solution
2007-01-12 18:31 -------- d-------- C:\Program Files\slysoft
2007-01-07 14:44 -------- d-------- C:\DOCUME~1\Owner\Application Data\creative
2007-01-07 14:41 -------- d--h----- C:\Program Files\creative installation information
2007-01-07 14:40 -------- d-------- C:\Program Files\creative
2007-01-03 18:15 133 ---hs---- C:\DOCUME~1\Owner\Application Data\.zreglib
2006-12-30 15:17 -------- d-------- C:\DOCUME~1\Owner\Application Data\lavasoft
2006-12-30 15:16 -------- d-------- C:\Program Files\lavasoft
2006-12-29 17:53 -------- d-------- C:\Program Files\k-lite codec pack
2006-12-29 17:48 -------- d-------- C:\Program Files\real alternative
2006-12-29 15:56 499712 --a------ C:\WINDOWS\system32\msvcp71.dll
2006-12-29 15:56 -------- d---s---- C:\DOCUME~1\Owner\Application Data\microsoft
2006-12-24 08:21 -------- d-------- C:\Program Files\media player classic
2006-12-24 08:21 -------- d-------- C:\DOCUME~1\Owner\Application Data\real
2006-12-24 07:25 -------- d-------- C:\Program Files\polderbits
2006-12-24 07:17 34528 --a------ C:\WINDOWS\system32\drivers\Pcouffin.sys
2006-12-24 07:17 -------- d-------- C:\Program Files\321studios
2006-12-22 19:51 -------- d-------- C:\Program Files\gabest
2006-12-19 18:36 -------- d-------- C:\Program Files\yahoo!
2006-12-19 18:25 -------- d-------- C:\Program Files\aod
2006-12-19 18:19 -------- d-------- C:\Program Files\illiminable
2006-12-18 17:30 -------- d-------- C:\Program Files\audible
2006-12-18 17:25 -------- d-------- C:\Program Files\Common Files\creative
2006-12-17 20:25 -------- d-------- C:\DOCUME~1\Owner\Application Data\slysoft
2006-12-16 21:20 483712 --a------ C:\WINDOWS\system32\drivers\atinavrr.sys
2006-12-14 19:23 -------- d-------- C:\DOCUME~1\Owner\Application Data\mytavi
2006-12-13 18:41 11984 --a------ C:\WINDOWS\system32\drivers\ElbyDelay.sys
2006-12-13 16:04 4960 --a------ C:\WINDOWS\system32\drivers\avgtdi.sys
2006-12-13 16:04 4224 --a------ C:\WINDOWS\system32\drivers\avg7rsw.sys
2006-12-13 16:04 3968 --a------ C:\WINDOWS\system32\drivers\avgclean.sys
2006-12-12 16:33 -------- d-------- C:\Program Files\xvid
2006-12-12 16:33 -------- d-------- C:\Program Files\lame mp3 codec
2006-12-12 16:32 -------- d-------- C:\Program Files\tavi
2006-12-12 16:32 -------- d-------- C:\Program Files\ac3filter
2006-12-12 16:31 -------- d-------- C:\Program Files\Common Files\installshield
2006-12-08 07:50 217088 --a------ C:\WINDOWS\system32\xvidvfw.dll
2006-12-08 07:47 1159168 --a------ C:\WINDOWS\system32\xvidcore.dll
2006-12-02 11:58 -------- d-------- C:\DOCUME~1\Owner\Application Data\google
2006-11-22 18:58 57344 --ah----- C:\WINDOWS\wnmhindr.exe
2006-11-22 18:58 24576 --a------ C:\WINDOWS\system32\nmh040a.dll
2006-11-22 18:57 724992 --ah----- C:\WINDOWS\iun6002.exe
2006-11-11 14:57 3082 --a------ C:\WINDOWS\system32\affv11300p2now.sys
2006-11-08 12:36 198144 --------- C:\WINDOWS\system32\_psisdecd.dll
2006-11-08 00:13 679424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-11-07 21:03 6049280 --------- C:\WINDOWS\system32\ieframe.dll
2006-11-07 21:03 50688 --------- C:\WINDOWS\system32\msfeedsbs.dll
2006-11-07 21:03 458752 --------- C:\WINDOWS\system32\msfeeds.dll
2006-11-07 21:03 413696 --a------ C:\WINDOWS\system32\vbscript.dll
2006-11-07 21:03 231424 --a------ C:\WINDOWS\system32\webcheck.dll
2006-11-07 21:03 180736 --------- C:\WINDOWS\system32\ieui.dll
2006-11-07 21:03 156160 --a------ C:\WINDOWS\system32\msls31.dll
2006-11-07 03:27 382976 --a------ C:\WINDOWS\system32\iedkcs32.dll
2006-11-07 03:27 229376 --a------ C:\WINDOWS\system32\ieaksie.dll
2006-11-07 03:26 71680 --a------ C:\WINDOWS\system32\admparse.dll
2006-11-07 03:26 55296 --a------ C:\WINDOWS\system32\iesetup.dll
2006-11-07 03:26 54784 --a------ C:\WINDOWS\system32\ie4uinit.exe
2006-11-07 03:26 43008 --a------ C:\WINDOWS\system32\iernonce.dll
2006-11-07 03:26 152064 --a------ C:\WINDOWS\system32\ieakeng.dll
2006-11-07 03:26 13312 --a------ C:\WINDOWS\system32\ieudinit.exe
2006-11-07 03:26 123904 --a------ C:\WINDOWS\system32\advpack.dll
2006-11-07 03:25 161792 --a------ C:\WINDOWS\system32\ieakui.dll
2006-11-04 14:14 1245696 --a------ C:\WINDOWS\system32\msxml4.dll
2006-10-26 07:00 62 --ahs---- C:\DOCUME~1\Owner\Application Data\desktop.ini


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"PowerBar"=""
"AWMON"="\"C:\\Program Files\\Lavasoft\\Ad-Aware SE Professional\\Ad-Watch.exe\""
"AnyDVD"="C:\\Program Files\\SlySoft\\AnyDVD\\AnyDVD.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"RTHDCPL"="RTHDCPL.EXE"
"Alcmtr"="ALCMTR.EXE"
"amd_dc_opt"="\"C:\\Program Files\\AMD\\amd_dc_opt\\amd_dc_opt.exe\""
"LXCFCATS"="rundll32 C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\LXCFtime.dll,[email protected]"
"AVG7_CC"="C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe /STARTUP"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"PCMService"="\"C:\\Program Files\\CyberLink\\PowerCinema\\PCMService.exe\""
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_03\\bin\\jusched.exe"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Resume Beyond TV Installation.lnk]
"backup"="C:\\WINDOWS\\pss\\Resume Beyond TV Installation.lnkCommon Startup"
"location"="Common Startup"
"item"="Resume Beyond TV Installation"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKCU"
"command"=""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgw.exe /RUNONCE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgw.exe /RUNONCE"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"


[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0

*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_AVG_ANTI-SPYWARE_DRIVER
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_AVG_ANTI-SPYWARE_GUARD
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_TMCOMM


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Check Updates for Windows Live Toolbar.job

Completion time: 07-01-31 4:08:38


AVG Spyware Scan

AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 5:48:38 AM 1/31/2007

+ Scan result:



C:\System Volume Information\_restore{E737DBD8-2CAD-42E2-9DC6-5129CFED29DB}\RP28\A0007930.exe -> Adware.WinAD : No action taken.
C:\System Volume Information\_restore{E737DBD8-2CAD-42E2-9DC6-5129CFED29DB}\RP28\A0007932.exe -> Adware.WinAD : No action taken.
C:\System Volume Information\_restore{E737DBD8-2CAD-42E2-9DC6-5129CFED29DB}\RP198\A0088381.exe -> Hijacker.Befins.b : No action taken.
C:\System Volume Information\_restore{E737DBD8-2CAD-42E2-9DC6-5129CFED29DB}\RP56\A0014187.exe -> Hijacker.Befins.b : No action taken.
C:\System Volume Information\_restore{E737DBD8-2CAD-42E2-9DC6-5129CFED29DB}\RP56\A0014196.exe -> Hijacker.Befins.b : No action taken.
G:\System Volume Information\_restore{E737DBD8-2CAD-42E2-9DC6-5129CFED29DB}\RP163\A0076876.exe -> Hijacker.Befins.b : No action taken.
G:\System Volume Information\_restore{E737DBD8-2CAD-42E2-9DC6-5129CFED29DB}\RP198\A0088435.exe -> Hijacker.Befins.b : No action taken.
C:\System Volume Information\_restore{E737DBD8-2CAD-42E2-9DC6-5129CFED29DB}\RP31\A0008705.exe -> Trojan.Delf.li : No action taken.


::Report end

P.S - I did quarantine these I just saved it before and not after. Noticed you said to do the opposite but that was after the fact!!


Nothing found with PandaScan Scan

Logfile of HijackThis v1.99.1
Scan saved at 6:58:00 PM, on 1/31/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\CyberLink\PowerCinema\PCMService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\AVENGINE.EXE
C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.EXE
c:\program files\panda software\panda antivirus 2007\WebProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe
C:\Program Files\HiJackThis\HijackThis.exe
C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
C:\WINDOWS\system32\wuauclt.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [amd_dc_opt] "C:\Program Files\AMD\amd_dc_opt\amd_dc_opt.exe"
O4 - HKLM\..\Run: [LXCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,[email protected]
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [LanzarL2007] "C:\DOCUME~1\Owner\LOCALS~1\Temp\{E8C9CBB8-21E3-470E-B4DF-C51AB7C962B5}\{D1DA2BA7-2592-4036-9BB2-DCCABDE8DC1A}\..\..\L2007tmp\Setup.exe" /SETUP:"/l0x0009"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.EXE" /s
O4 - HKLM\..\RunOnce: [BorraT2006TMP] cmd /C RD /s/q "C:\DOCUME~1\Owner\LOCALS~1\Temp\L2007tmp\"
O4 - HKCU\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15026/CTSUEng.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15028/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9D3347BC-4F7E-44F5-A470-A1224C4D7AB9}: NameServer = 66.38.192.231 66.38.192.233
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxcf_device - Unknown owner - C:\WINDOWS\system32\lxcfcoms.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\Win32\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\RpcSandraSrv.exe
 

· Registered
Joined
·
2,337 Posts
Navigate to these two files, click properties let me know what they are:

C:\42158af281bde7e035a31c
C:\3ba68e330d38840b88451d92



Delete this file:

C:\WINDOWS\iun6002.exe
 

· Registered
Joined
·
97 Posts
Discussion Starter · #6 ·
Hi Fred,

I deleted the iun6002.exe.

The two items you had me look at each hold an update folder and inside each is a Windows Service Pack Setup file and a .dll file.

Both Windows Service Pack Setup files are the same version 6.2.29.0

Never new why these were there and wether I was supposed to install them or not ??

Also, I downloaded a file lastnight call AltoMP3Gold to tryout and convert some audio, but when I ran the setup file nothing really happened except the c: Command prompt screen flashed quickly and then dissappered. I always scan files I download before openeing them and there didn’t seem to be anything wrong with it so I just dismissed is and decided to delete the setup application. But I can’t, it says another program may be using it or something. Even when I reboot and then go stright to the setup application again it won’t let me delete it. I looked in task manager and the Task Bar and there is nothing new there. Any ideas ??

I have included and new combofix report and Hijack this just incase…

Thanks Fred,
Darryl

Logfile of HijackThis v1.99.1
Scan saved at 4:29:40 PM, on 2/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\CyberLink\PowerCinema\PCMService.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Program Files\HiJackThis\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [amd_dc_opt] "C:\Program Files\AMD\amd_dc_opt\amd_dc_opt.exe"
O4 - HKLM\..\Run: [LXCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,[email protected]
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\Program Files\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKCU\..\Run: [PowerBar] "C:\Program Files\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe" /AtBootTime
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15026/CTSUEng.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15028/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9D3347BC-4F7E-44F5-A470-A1224C4D7AB9}: NameServer = 66.38.192.231 66.38.192.233
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxcf_device - Unknown owner - C:\WINDOWS\system32\lxcfcoms.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\Win32\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\RpcSandraSrv.exe





"Owner" - 07-02-02 16:18:38 Service Pack 2
ComboFix 07.01.30 - Running from: "C:\Documents and Settings\Owner\Desktop"

((((((((((((((((((((((((((((((( Files Created from 2007-01-02 to 2007-02-02 ))))))))))))))))))))))))))))))))))


2007-02-01 21:34 <DIR> d--h----- C:\WINDOWS\PIF
2007-02-01 21:06 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\Application Data\TEMP
2007-02-01 19:45 <DIR> d-------- C:\DOCUME~1\Owner\Application Data\VideoReDoPlus
2007-02-01 19:06 <DIR> d-------- C:\DOCUME~1\Owner\Application Data\River Past G3
2007-02-01 19:00 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\River Past G3
2007-02-01 17:59 <DIR> d-------- C:\Program Files\GoldEsel
2007-02-01 17:57 5,504 --------- C:\WINDOWS\system32\drivers\imagedrv.sys
2007-02-01 17:57 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll
2007-02-01 17:57 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll
2007-02-01 17:57 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll
2007-02-01 17:57 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2007-02-01 17:57 125,184 --------- C:\WINDOWS\system32\drivers\imagesrv.sys
2007-02-01 17:57 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2007-02-01 17:57 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll
2007-01-31 19:19 839,936 --a------ C:\WINDOWS\system32\drivers\avg7core.sys
2007-01-31 19:19 4,960 --a------ C:\WINDOWS\system32\drivers\avgtdi.sys
2007-01-31 19:19 4,224 --a------ C:\WINDOWS\system32\drivers\avg7rsw.sys
2007-01-31 19:19 3,968 --a------ C:\WINDOWS\system32\drivers\avgclean.sys
2007-01-31 19:19 27,776 --a------ C:\WINDOWS\system32\drivers\avg7rsxp.sys
2007-01-31 19:19 18,432 --a------ C:\WINDOWS\system32\drivers\avgmfx86.sys
2007-01-31 19:19 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\Grisoft
2007-01-31 19:06 609 --a------ C:\Combo.bat
2007-01-31 17:25 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-01-31 12:25 <DIR> d-------- C:\BOARDMAKER
2007-01-30 22:28 76,560 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2007-01-30 22:09 <DIR> d-------- C:\DOCUME~1\Owner\.housecall6.6
2007-01-30 22:07 <DIR> d-------- C:\WINDOWS\Sun
2007-01-30 22:07 <DIR> d-------- C:\DOCUME~1\Owner\Application Data\Sun
2007-01-30 19:02 <DIR> d-------- C:\Program Files\HiJackThis
2007-01-30 06:02 <DIR> d-------- C:\DOCUME~1\LOCALS~1\Application Data\CyberLink
2007-01-30 03:35 89,088 --------- C:\WINDOWS\system32\atl71.dll
2007-01-30 03:35 1,047,552 --------- C:\WINDOWS\system32\MFC71u.dll
2007-01-28 18:55 <DIR> d-------- C:\Program Files\Common Files\Ahead
2007-01-28 18:55 <DIR> d-------- C:\Program Files\Ahead
2007-01-28 15:51 9 --a------ C:\WINDOWS\Syskernel12.dll
2007-01-28 15:48 <DIR> d-------- C:\Program Files\CoolMP3Splitter
2007-01-28 14:15 <DIR> d-------- C:\Program Files\WinAVI MP4 Converter
2007-01-27 13:40 41,160 --a------ C:\WINDOWS\system32\drivers\AnyDVD.sys
2007-01-27 13:40 15,440 --a------ C:\WINDOWS\system32\drivers\ElbyCDIO.sys
2007-01-27 13:40 11,984 --a------ C:\WINDOWS\system32\drivers\RegKill.sys
2007-01-25 17:23 <DIR> d-------- C:\WINDOWS\system32\URTTEMP
2007-01-24 19:36 <DIR> d-------- C:\Program Files\ATI Multimedia
2007-01-23 19:41 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\nView_Profiles
2007-01-23 19:35 208,896 --ah----- C:\WINDOWS\system32\nvudisp.exe
2007-01-23 19:35 208,896 --a------ C:\WINDOWS\system32\nvunrm.exe
2007-01-23 19:35 109,568 --ah----- C:\WINDOWS\system32\drivers\nvtcp.sys
2007-01-23 19:35 <DIR> d-------- C:\WINDOWS\nview
2007-01-23 19:33 208,896 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2007-01-21 18:53 <DIR> d-------- C:\WINDOWS\NV560876.TMP
2007-01-21 15:19 <DIR> d-------- C:\WINDOWS\system32\QuickTime
2007-01-21 15:17 <DIR> d-------- C:\Program Files\iPod
2007-01-21 08:51 <DIR> d-------- C:\Program Files\MediaMonkey
2007-01-21 01:55 <DIR> d-------- C:\WMSDK
2007-01-21 01:48 <DIR> d--h----- C:\42158af281bde7e035a31c
2007-01-21 01:47 <DIR> d--h----- C:\3ba68e330d38840b88451d92
2007-01-20 17:05 <DIR> d-------- C:\Trash
2007-01-20 10:27 <DIR> d-------- C:\Program Files\Easy Video Splitter
2007-01-18 16:22 <DIR> d-------- C:\Program Files\AutoGK
2007-01-16 18:42 <DIR> d-------- C:\NVIDIA
2007-01-16 16:08 <DIR> d-------- C:\Program Files\VirtualDub
2007-01-13 16:45 <DIR> d-------- C:\Temp
2007-01-12 18:49 <DIR> dr--s---- C:\WINDOWS\assembly
2007-01-12 18:48 <DIR> d--h----- C:\WINDOWS\Microsoft.NET
2007-01-11 17:22 <DIR> d-------- C:\DOCUME~1\Owner\Application Data\DVD Catalyst
2007-01-11 11:34 81,920 --a------ C:\WINDOWS\system32\ElbyCDIO.dll
2007-01-10 20:15 <DIR> d--h----- C:\WINDOWS\ie7updates
2007-01-07 14:39 44,032 --------- C:\WINDOWS\system32\CTSVCCDA.EXE
2007-01-07 14:39 25,088 --------- C:\WINDOWS\system32\CTSVCCTL.EXE
2007-01-02 17:01 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\Elaborate Bytes


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-02-02 16:05 -------- d-------- C:\DOCUME~1\Owner\Application Data\avg7
2007-02-02 05:47 -------- d-------- C:\Program Files\dc++
2007-02-01 21:39 -------- d-------- C:\Program Files\registry mechanic
2007-02-01 21:13 -------- d-------- C:\Program Files\videoredoplus
2007-02-01 19:02 -------- d-------- C:\Program Files\audible
2007-02-01 17:59 -------- d--h----- C:\Program Files\installshield installation information
2007-02-01 17:59 -------- d-------- C:\Program Files\lx_cats
2007-01-31 19:15 -------- d-------- C:\Program Files\google
2007-01-31 19:04 -------- d-------- C:\Program Files\cyberlink dvd solution
2007-01-31 18:38 -------- d-------- C:\Program Files\windows live toolbar
2007-01-31 16:00 -------- d---s---- C:\DOCUME~1\Owner\Application Data\microsoft
2007-01-31 03:46 -------- d-------- C:\Program Files\grisoft
2007-01-30 06:06 -------- d-------- C:\Program Files\cyberlink
2007-01-30 03:44 -------- d-------- C:\DOCUME~1\Owner\Application Data\cyberlink
2007-01-27 19:16 -------- d-------- C:\DOCUME~1\Owner\Application Data\dvdcss
2007-01-26 21:49 548 --a------ C:\DOCUME~1\Owner\Application Data\autogk.ini
2007-01-24 19:30 -------- d-------- C:\Program Files\ati technologies
2007-01-24 11:26 43520 --a------ C:\WINDOWS\system32\cmdlineext03.dll
2007-01-21 15:20 -------- d-------- C:\Program Files\quicktime
2007-01-21 01:48 -------- d-------- C:\Program Files\windows media connect 2
2007-01-18 16:22 43602 --a------ C:\WINDOWS\system32\xvid-uninstall.exe
2007-01-18 16:22 -------- d-------- C:\Program Files\avisynth 2.5
2007-01-16 16:28 -------- d-------- C:\Program Files\expressit s.e. 2.1
2007-01-12 18:34 -------- d-------- C:\Program Files\xilisoft
2007-01-12 18:31 -------- d-------- C:\Program Files\slysoft
2007-01-07 14:44 -------- d-------- C:\DOCUME~1\Owner\Application Data\creative
2007-01-07 14:41 -------- d--h----- C:\Program Files\creative installation information
2007-01-07 14:40 -------- d-------- C:\Program Files\creative
2007-01-03 18:15 133 ---hs---- C:\DOCUME~1\Owner\Application Data\.zreglib
2006-12-31 17:32 -------- d-------- C:\Program Files\logitech
2006-12-31 17:32 -------- d-------- C:\Program Files\Common Files\logitech
2006-12-30 15:17 -------- d-------- C:\DOCUME~1\Owner\Application Data\lavasoft
2006-12-30 15:16 -------- d-------- C:\Program Files\lavasoft
2006-12-29 17:53 -------- d-------- C:\Program Files\k-lite codec pack
2006-12-29 17:48 -------- d-------- C:\Program Files\real alternative
2006-12-29 15:56 499712 --a------ C:\WINDOWS\system32\msvcp71.dll
2006-12-24 08:21 -------- d-------- C:\Program Files\media player classic
2006-12-24 08:21 -------- d-------- C:\DOCUME~1\Owner\Application Data\real
2006-12-22 19:51 -------- d-------- C:\Program Files\gabest
2006-12-19 18:25 -------- d-------- C:\Program Files\aod
2006-12-19 18:19 -------- d-------- C:\Program Files\illiminable
2006-12-18 17:25 -------- d-------- C:\Program Files\Common Files\creative
2006-12-17 20:25 -------- d-------- C:\DOCUME~1\Owner\Application Data\slysoft
2006-12-16 21:20 483712 --a------ C:\WINDOWS\system32\drivers\atinavrr.sys
2006-12-14 19:23 -------- d-------- C:\DOCUME~1\Owner\Application Data\mytavi
2006-12-13 18:41 11984 --a------ C:\WINDOWS\system32\drivers\ElbyDelay.sys
2006-12-12 16:33 -------- d-------- C:\Program Files\xvid
2006-12-12 16:33 -------- d-------- C:\Program Files\lame mp3 codec
2006-12-12 16:32 -------- d-------- C:\Program Files\tavi
2006-12-12 16:32 -------- d-------- C:\Program Files\ac3filter
2006-12-12 16:31 -------- d-------- C:\Program Files\Common Files\installshield
2006-12-08 07:50 217088 --a------ C:\WINDOWS\system32\xvidvfw.dll
2006-12-08 07:47 1159168 --a------ C:\WINDOWS\system32\xvidcore.dll
2006-12-02 11:58 -------- d-------- C:\DOCUME~1\Owner\Application Data\google
2006-11-22 18:58 57344 --ah----- C:\WINDOWS\wnmhindr.exe
2006-11-22 18:58 24576 --a------ C:\WINDOWS\system32\nmh040a.dll
2006-11-11 14:57 3082 --a------ C:\WINDOWS\system32\affv11300p2now.sys
2006-11-08 12:36 198144 --------- C:\WINDOWS\system32\_psisdecd.dll
2006-11-08 00:13 679424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-11-07 21:03 6049280 --------- C:\WINDOWS\system32\ieframe.dll
2006-11-07 21:03 50688 --------- C:\WINDOWS\system32\msfeedsbs.dll
2006-11-07 21:03 458752 --------- C:\WINDOWS\system32\msfeeds.dll
2006-11-07 21:03 413696 --a------ C:\WINDOWS\system32\vbscript.dll
2006-11-07 21:03 231424 --a------ C:\WINDOWS\system32\webcheck.dll
2006-11-07 21:03 180736 --------- C:\WINDOWS\system32\ieui.dll
2006-11-07 21:03 156160 --a------ C:\WINDOWS\system32\msls31.dll
2006-11-07 03:27 382976 --a------ C:\WINDOWS\system32\iedkcs32.dll
2006-11-07 03:27 229376 --a------ C:\WINDOWS\system32\ieaksie.dll
2006-11-07 03:26 71680 --a------ C:\WINDOWS\system32\admparse.dll
2006-11-07 03:26 55296 --a------ C:\WINDOWS\system32\iesetup.dll
2006-11-07 03:26 54784 --a------ C:\WINDOWS\system32\ie4uinit.exe
2006-11-07 03:26 43008 --a------ C:\WINDOWS\system32\iernonce.dll
2006-11-07 03:26 152064 --a------ C:\WINDOWS\system32\ieakeng.dll
2006-11-07 03:26 13312 --a------ C:\WINDOWS\system32\ieudinit.exe
2006-11-07 03:26 123904 --a------ C:\WINDOWS\system32\advpack.dll
2006-11-07 03:25 161792 --a------ C:\WINDOWS\system32\ieakui.dll
2006-11-04 14:14 1245696 --a------ C:\WINDOWS\system32\msxml4.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"AWMON"="\"C:\\Program Files\\Lavasoft\\Ad-Aware SE Professional\\Ad-Watch.exe\""
"AnyDVD"="C:\\Program Files\\SlySoft\\AnyDVD\\AnyDVD.exe"
"PowerBar"="\"C:\\Program Files\\CyberLink DVD Solution\\Multimedia Launcher\\PowerBar.exe\" /AtBootTime"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"RTHDCPL"="RTHDCPL.EXE"
"Alcmtr"="ALCMTR.EXE"
"amd_dc_opt"="\"C:\\Program Files\\AMD\\amd_dc_opt\\amd_dc_opt.exe\""
"LXCFCATS"="rundll32 C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\LXCFtime.dll,[email protected]"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"NvMediaCenter"="RunDLL32.exe NvMCTray.dll,NvTaskbarInit"
"PCMService"="\"C:\\Program Files\\CyberLink\\PowerCinema\\PCMService.exe\""
"AVG7_CC"="C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe /STARTUP"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKCU"
"command"=""
"inimapping"="0"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgw.exe /RUNONCE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgw.exe /RUNONCE"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"


[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0



Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Check Updates for Windows Live Toolbar.job

Completion time: 07-02-02 16:19:56
C:\ComboFix2.txt ... 07-01-31 19:12
 

· Registered
Joined
·
2,337 Posts
AltoMP3Gold appears to be a legit program, but I don't see it in ComboFix or HJT. Let's see if we can find out where it's
hiding on your system


----------------------------------------

Create an uninstall list:
  • Open HiJackThis
  • Click on the configure button on the bottom right
  • Click on the tab "Misc Tools"
  • Click on the Box that says "Open Uninstall Manager"
  • Click on the button "Save list"
  • Copy and past the List from the notepad file into your post

----------------------------------------


SYSTEM REPAIR ENGINEER

Please download this tool >http://www.kztechs.com/sreng/sreng2.zip]System Repair Engineer



  • Extract it to it's own folder & double click SREng.exe to run it

  • Select 'Smart Scan' & tick "Verify Digital Signatures"

  • Click on the [Scan] button

  • When finished, click on the [Save Reports] button & save the log to Desktop

  • Attach the log in your next reply. Dont post it


Note: You may have to rename SREngLog.log to SREngLog.txt before attaching
 

· Registered
Joined
·
97 Posts
Discussion Starter · #8 ·
Hi Fred,

Can I use the delete button in the uninstall to get rid of “Beyond TV DVD Burning Foundation” I don’t use this program because it doesn’t work with my system and even though it has been uninstalled, bits and pieces keep popping up like here ??

It wouldn't let me upload the Sreng even though I renamed it but I posted it all open at the bottom

Here we go…… and thanks again and agian and again !!!!

Uninstall List

AC3Filter (remove only)
ACDSee 9 Photo Manager
Ad-Aware SE Professional
Adobe Acrobat 5.0
AMD Dual-Core Optimizer
AnyDVD
AOpen FM56-PX Controllerless PCI Modem
ATI - Software Uninstall Utility
ATI Parental Control
AudibleManager
Auto Gordian Knot 2.40
AVG 7.5
AviSynth 2.5
Beyond TV DVD Burning Foundation
Boardmaker version 5
CleanUp!
CloneDVD2
Cool MP3 Splitter
Creative MediaSource 5
Creative Removable Disk Manager
Creative System Information
Creative ZEN Vision W
DC++ 0.667
Dscaler DirectShow Deinterlace Filter
DVD Ripper Platinum 4
DVD Solution
Easy Video Splitter 1.28
exPressit S.E. 2.1
Hotfix for Windows Media Format SDK (KB902344)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
InCD
iPod for Windows 2005-03-23
iTunes
K-Lite Mega Codec Pack 1.31
Lame ACM MP3 Codec
Lexmark 730 Series
Logitech Gaming Software
Media Transfer Protocol Porting Kit
MediaMonkey 2.5
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB886903)
Microsoft .NET Framework 2.0
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 2000 Premium
Microsoft User-Mode Driver Framework Feature Pack 1.0
MSN Messenger 7.5
MSXML 4.0 SP2 (KB927978)
Multimedia Launcher
Nero 6 Ultra Edition
NVIDIA Drivers
Panda ActiveScan
PowerCinema
PowerDVD
PowerProducer
Project64 1.6
QuickTime
Realtek High Definition Audio Driver
Registry Mechanic 5.2
SC Ver 2.57
Security Update for Microsoft .NET Framework 2.0 (KB917283)
Security Update for Microsoft .NET Framework 2.0 (KB922770)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB926255)
SiSoftware Sandra Lite 2007.SP1 (Win64/32/CE)
SnagIt 8
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB910437)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
VideoReDo/Plus Version 2.5.4.507
VobSub v2.23 (Remove Only)
Windows Defender
Windows Driver Package - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Live Toolbar
Windows Live Toolbar
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Format SDK Hotfix - KB891122
Windows Media Player 10 Hotfix - KB895316
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix - KB886185
XviD MPEG4 Video Codec (remove only)
ZENcast Organizer


Code:
2007-02-03,09:48:11

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows XP Home Edition Service Pack 2 (Build 2600)
 - Administrative User - Completed Functions Allowed

Follow item(s) have been choosed:
    All Boot Items (Including Registry, Startup Folders, Services and so on)
    Browser Add-ons
    Runing Processes (Including process model information)
    File Associations
    Winsock Provider
    Autorun.Inf
    HOSTS File


Boot Items
Registry
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <AWMON><"C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe">  [N/A]
    <PowerBar><"C:\Program Files\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe" /AtBootTime>  [Cyberlink, Corp.]
    <AnyDVD><C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe>  [SlySoft, Inc.]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <RTHDCPL><RTHDCPL.EXE>  [(Verified)Realtek Semiconductor Corp.]
    <Alcmtr><ALCMTR.EXE>  [(Verified)Realtek Semiconductor Corp.]
    <amd_dc_opt><"C:\Program Files\AMD\amd_dc_opt\amd_dc_opt.exe">  [N/A]
    <LXCFCATS><rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,[email protected]>  [(Verified)]
    <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [(Verified)NVIDIA Corporation]
    <nwiz><nwiz.exe /install>  [N/A]
    <NvMediaCenter><RunDLL32.exe NvMCTray.dll,NvTaskbarInit>  [(Verified)NVIDIA Corporation]
    <PCMService><"C:\Program Files\CyberLink\PowerCinema\PCMService.exe">  [CyberLink Corp.]
    <AVG7_CC><C:\Program Files\Grisoft\AVG7\avgcc.exe /STARTUP>  [GRISOFT, s.r.o.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}><C:\PROGRA~1\WIFD1F~1\MpShHook.dll>  [(Verified)Microsoft Corporation]

==================================
Startup Folders
[Microsoft Office]
  <C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk --> C:\PROGRA~1\MICROS~2\Office\OSA9.EXE [Microsoft Corporation]><N>

==================================
Services
[Application Management / AppMgmt][Stopped/Manual Start]
  <C:\WINDOWS\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\appmgmts.dll><N/A>
[AVG7 Alert Manager Server / Avg7Alrt][Running/Auto Start]
  <C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe><GRISOFT, s.r.o.>
[AVG7 Update Service / Avg7UpdSvc][Running/Auto Start]
  <C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe><GRISOFT, s.r.o.>
[AVG E-mail Scanner / AVGEMS][Running/Auto Start]
  <C:\PROGRA~1\Grisoft\AVG7\avgemc.exe><GRISOFT, s.r.o.>
[Indexing Service / CiSvc][Stopped/Manual Start]
  <C:\WINDOWS\system32\cisvc.exe><N/A>
[CyberLink Background Capture Service (CBCS) / CLCapSvc][Running/Auto Start]
  <"C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe"><>
[CyberLink Task Scheduler (CTS) / CLSched][Running/Auto Start]
  <"C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe"><>
[Creative Service for CDROM Access / Creative Service for CDROM Access][Running/Auto Start]
  <C:\WINDOWS\system32\CTsvcCDA.exe><Creative Technology Ltd>
[InCD Helper / InCDsrv][Running/Auto Start]
  <C:\Program Files\Ahead\InCD\InCDsrv.exe><Nero AG>
[iPod Service / iPodService][Stopped/Manual Start]
  <"C:\Program Files\iPod\bin\iPodService.exe"><Apple Computer, Inc.>
[lxcf_device / lxcf_device][Stopped/Manual Start]
  <C:\WINDOWS\system32\lxcfcoms.exe -service><>
[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
  <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Cyberlink RichVideo Service(CRVS) / RichVideo][Running/Auto Start]
  <"C:\Program Files\CyberLink\Shared Files\RichVideo.exe"><>
[Sandra Data Service / SandraDataSrv][Stopped/Manual Start]
  <C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\Win32\RpcDataSrv.exe><SiSoftware>
[Sandra Service / SandraTheSrv][Stopped/Manual Start]
  <C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\RpcSandraSrv.exe><SiSoftware>

==================================
Drivers
[a347bus / a347bus][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\a347bus.sys><>
[a347scsi / a347scsi][Running/Boot Start]
  <\SystemRoot\System32\Drivers\a347scsi.sys><>
[AMD Processor Driver / AmdK8][Running/System Start]
  <system32\DRIVERS\AmdK8.sys><Advanced Micro Devices>
[AMD Special Tools Driver / AmdTools][Running/Manual Start]
  <system32\DRIVERS\AmdTools.sys><AMD, Inc.>
[AnyDVD / AnyDVD][Running/Manual Start]
  <System32\Drivers\AnyDVD.sys><SlySoft, Inc.>
[Aspi32 / Aspi32][Running/Auto Start]
  <System32\drivers\aspi32.sys><Adaptec>
[Standard IDE/ESDI Hard Disk Controller / atapi][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\atapi.sys><N/A>
[ATI Remote Wonder II / ATI Remote Wonder II][Stopped/Manual Start]
  <system32\drivers\ATIRWVD.SYS><N/A>
[ATI Unified AVStream service / ATIAVPCI][Running/Manual Start]
  <system32\DRIVERS\atinavrr.sys><ATI Technologies Inc.>
[AVG7 Kernel / Avg7Core][Running/System Start]
  <\SystemRoot\System32\Drivers\avg7core.sys><GRISOFT, s.r.o.>
[AVG7 Wrap Driver / Avg7RsW][Running/System Start]
  <\SystemRoot\System32\Drivers\avg7rsw.sys><GRISOFT, s.r.o.>
[AVG7 Resident Driver XP / Avg7RsXP][Running/System Start]
  <\SystemRoot\System32\Drivers\avg7rsxp.sys><GRISOFT, s.r.o.>
[AVG7 Clean Driver / AvgClean][Running/System Start]
  <\SystemRoot\System32\Drivers\avgclean.sys><GRISOFT, s.r.o.>
[AVG Network Redirector / AvgTdi][Running/Auto Start]
  <\SystemRoot\System32\Drivers\avgtdi.sys><GRISOFT, s.r.o.>
[EFAINIT2 / EFAINIT2][Stopped/Auto Start]
  <System32\Drivers\efainit2.sys><USTC>
[EFAW / EFAW][Stopped/Auto Start]
  <System32\Drivers\efaw.sys><N/A>
[ElbyCDIO Driver / ElbyCDIO][Running/Auto Start]
  <System32\Drivers\ElbyCDIO.sys><Elaborate Bytes AG>
[ElbyDelay / ElbyDelay][Stopped/Manual Start]
  <System32\Drivers\ElbyDelay.sys><Elaborate Bytes AG>
[GEAR CDRom Filter / GEARAspiWDM][Stopped/Manual Start]
  <SYSTEM32\DRIVERS\GEARAspiWDM.sys><GEAR Software Inc.>
[GMSIPCI / GMSIPCI][Stopped/Manual Start]
  <\??\F:\INSTALL\GMSIPCI.SYS><N/A>
[Microsoft UAA Bus Driver for High Definition Audio / HDAudBus][Running/Manual Start]
  <system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[InCDPass / InCDPass][Running/System Start]
  <System32\DRIVERS\InCDPass.sys><Nero AG>
[Service for Realtek HD Audio (WDM) / IntcAzAudAddService][Running/Manual Start]
  <system32\drivers\RtkHDAud.sys><Realtek Semiconductor Corp.>
[Microsoft IntelliPoint Features driver / IPFilter][Stopped/Manual Start]
  <system32\DRIVERS\IPFilter.sys><N/A>
[mdmxsdk / mdmxsdk][Running/Auto Start]
  <system32\DRIVERS\mdmxsdk.sys><Conexant>
[nv / nv][Running/Manual Start]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[NVIDIA nForce Networking Controller Driver / NVENETFD][Stopped/Manual Start]
  <system32\DRIVERS\NVENETFD.sys><NVIDIA Corporation>
[NVIDIA Network Bus Enumerator / nvnetbus][Running/Manual Start]
  <system32\DRIVERS\nvnetbus.sys><NVIDIA Corporation>
[Low level access layer for CD devices / Pcouffin][Stopped/Manual Start]
  <System32\Drivers\Pcouffin.sys><N/A>
[Padus ASPI Shell / pfc][Stopped/Manual Start]
  <system32\drivers\pfc.sys><Padus, Inc.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[PxHelp20 / PxHelp20][Running/Boot Start]
  <\SystemRoot\System32\Drivers\PxHelp20.sys><Sonic Solutions>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[tmcomm / tmcomm][Running/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\tmcomm.sys><Trend Micro Inc.>
[Winachcf / Winachcf][Running/Manual Start]
  <system32\DRIVERS\winachcf.sys><Conexant>
[Logitech Virtual Bus Enumerator Driver / WmBEnum][Running/Manual Start]
  <system32\drivers\WmBEnum.sys><Logitech Inc.>
[Logitech WingMan HID Filter Driver / WmFilter][Stopped/Manual Start]
  <system32\drivers\WmFilter.sys><Logitech Inc.>
[Logitech Virtual Hid Device Driver / WmVirHid][Stopped/Manual Start]
  <system32\drivers\WmVirHid.sys><Logitech Inc.>
[Logitech WingMan Translation Layer Driver / WmXlCore][Running/Manual Start]
  <system32\drivers\WmXlCore.sys><Logitech Inc.>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
  <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[X10 USB Wireless Transceiver / XUIF][Running/Manual Start]
  <System32\Drivers\x10ufx2.sys><X10 Wireless Technology, Inc.>

==================================
Browser Add-ons
[HelperObject Class]
  {00C6482D-C502-44C8-8409-FCE54AD9C208} <C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll, TechSmith Corporation>
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx, >
[Windows Live Toolbar Helper]
  {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} <C:\Program Files\Windows Live Toolbar\msntb.dll, Microsoft Corporation>
[]
  {e2e2dd38-d088-4134-82b7-f2ba38496583} <%windir%\Network Diagnostic\xpnetdiag.exe, N/A>
[SnagIt]
  {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} <C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll, TechSmith Corporation>
[Windows Live Toolbar]
  {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} <C:\Program Files\Windows Live Toolbar\msntb.dll, Microsoft Corporation>
[Creative Software AutoUpdate]
  {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} <C:\WINDOWS\DOWNLO~1\CTSUEng.ocx, Creative Technology Ltd>
[Symantec RuFSI Utility Class]
  {644E432F-49D3-41A1-8DD5-E099162EEEC5} <C:\WINDOWS\Downloaded Program Files\rufsi.dll, Symantec Corporation>
[ActiveScan Installer Class]
  {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} <C:\WINDOWS\Downloaded Program Files\asinst.dll, Panda Software>
[Creative Software AutoUpdate Support Package]
  {F6ACF75C-C32C-447B-9BEF-46B766368D29} <C:\WINDOWS\DOWNLO~1\CTPID.ocx, Creative Technology Ltd>
[Microsoft Office Spreadsheet 9.0]
  {0002E510-0000-0000-C000-000000000046} <C:\PROGRA~1\MICROS~2\Office\MSOWC.DLL, N/A>
[Microsoft Outlook 8.0 Object Library]
  {0006F033-0000-0000-C000-000000000046} <, N/A>
[Microsoft Outlook]
  {0006F03A-0000-0000-C000-000000000046} <, N/A>
[HelperObject Class]
  {00C6482D-C502-44C8-8409-FCE54AD9C208} <C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll, TechSmith Corporation>
[Yahoo! Toolbar Helper]
  {02478D38-C3F9-4EFB-9B51-7695ECA05670} <, N/A>
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx, >
[Creative Software AutoUpdate]
  {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} <C:\WINDOWS\DOWNLO~1\CTSUEng.ocx, Creative Technology Ltd>
[Windows Genuine Advantage Validation Tool]
  {17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\legitcheckcontrol.dll, Microsoft Corporation>
[Windows Media Player]
  {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
  {25336920-03F9-11CF-8FD0-00AA00686F13} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[XML DOM Document]
  {2933BF90-7B36-11D2-B20E-00C04F983E60} <C:\WINDOWS\system32\MSXML3.DLL, Microsoft Corporation>
[DHTML Edit Control Safe for Scripting for IE5]
  {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[QuickTime Object]
  {4063BE15-3B08-470D-A0D5-B37161CFFD69} <blank, N/A>
[XML Document]
  {48123BC4-99D9-11D1-A6B3-00C04FD91555} <C:\WINDOWS\system32\MSXML3.DLL, Microsoft Corporation>
[Reporte Class]
  {4A2A4430-3967-4461-94C7-BD95C419F3CF} <C:\WINDOWS\system32\ActiveScan\ascontrol.dll, Panda Software>
[]
  {4F07F79F-087F-42CF-8B36-7A88D06088E9} <"C:\PROGRA~1\MSNMES~1\msgsc.dll", N/A>
[Shell Name Space]
  {55136805-B2DE-11D1-B9F2-00A0C98BC547} <C:\WINDOWS\system32\ieframe.dll, Microsoft Corporation>
[WUWebControl Class]
  {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[Symantec RuFSI Utility Class]
  {644E432F-49D3-41A1-8DD5-E099162EEEC5} <C:\WINDOWS\Downloaded Program Files\rufsi.dll, Symantec Corporation>
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Seleccion Class]
  {6CEC0297-FAFB-41FB-97EA-77E3081B1DFE} <C:\WINDOWS\system32\ActiveScan\ascontrol.dll, Panda Software>
[ControlConexion Class]
  {6FDCDD41-6C97-4A3B-9E6D-0144B66A1CE4} <C:\WINDOWS\system32\ActiveScan\ascontrol.dll, Panda Software>
[Microsoft Web Browser]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\ieframe.dll, Microsoft Corporation>
[SnagIt]
  {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} <C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll, TechSmith Corporation>
[ST]
  {9394EDE7-C8B5-483E-8773-474BF36AF6E4} <C:\Program Files\Windows Live Toolbar\stmain.dll, Microsoft Corporation>
[Panda ActiveScan]
  {96567F65-E04C-4611-AF29-7CDEA6FA6A84} <C:\WINDOWS\system32\ACTIVE~1\as.dll, Panda Software>
[ActiveScan Installer Class]
  {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} <C:\WINDOWS\Downloaded Program Files\asinst.dll, Panda Software>
[RDS.DataSpace]
  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Windows Live Toolbar]
  {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} <C:\Program Files\Windows Live Toolbar\msntb.dll, Microsoft Corporation>
[Windows Live Toolbar Helper]
  {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} <C:\Program Files\Windows Live Toolbar\msntb.dll, Microsoft Corporation>
[Symantec RuFSI File information Class]
  {C2FCEF4E-ACE9-11D3-BEBD-00105AA9B6AE} <C:\WINDOWS\Downloaded Program Files\rufsi.dll, Symantec Corporation>
[Symantec RuFSI Registry Information Class]
  {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} <C:\WINDOWS\Downloaded Program Files\rufsi.dll, Symantec Corporation>
[Adobe Acrobat Control for ActiveX]
  {CA8A9780-280D-11CF-A24D-444553540000} <C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\ActiveX\pdf.ocx, Adobe Systems Incorporated>
[AUDIO__MID Moniker Class]
  {CD3AFA74-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
  {CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
  {CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Msxml]
  {CFC399AF-D876-11D0-9C10-00C04FC99C8E} <C:\WINDOWS\system32\MSXML3.DLL, Microsoft Corporation>
[RealPlayer G2 Control]
  {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\Program Files\TAVI\MyTAVI\Flash9.ocx, Adobe Systems, Inc.>
[Microsoft Agent Control 2.0]
  {D45FD31B-5C6E-11D1-9EC1-00C04FD7081F} <C:\WINDOWS\msagent\agentctl.dll, Microsoft Corporation>
[XML HTTP Request]
  {ED8C108E-4349-11D2-91A4-00C04F7969E8} <C:\WINDOWS\system32\MSXML3.DLL, Microsoft Corporation>
[Yahoo! Toolbar]
  {EF99BD32-C1FB-11D2-892F-0090271D4F88} <, N/A>
[XML DOM Document 3.0]
  {F5078F32-C551-11D3-89B9-0000F81FE221} <C:\WINDOWS\system32\MSXML3.DLL, Microsoft Corporation>
[Creative Software AutoUpdate Support Package]
  {F6ACF75C-C32C-447B-9BEF-46B766368D29} <C:\WINDOWS\DOWNLO~1\CTPID.ocx, Creative Technology Ltd>
[XML DOM Document]
  {F6D90F11-9C73-11D3-B32E-00C04F990BB4} <C:\WINDOWS\system32\MSXML3.DLL, Microsoft Corporation>
[XML HTTP]
  {F6D90F16-9C73-11D3-B32E-00C04F990BB4} <C:\WINDOWS\system32\MSXML3.DLL, Microsoft Corporation>

==================================
Running Processes
[PID: 452][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 500][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 524][\??\C:\WINDOWS\SYSTEM32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\SYSTEM32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 568][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 580][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 736][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 808][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 848][C:\Program Files\Windows Defender\MsMpEng.exe]  [Microsoft Corporation, 1.1.1593.0]
    [C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]
    [C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\MSVCP80.dll]  [Microsoft Corporation, 8.00.50727.42]
    [C:\WINDOWS\SYSTEM32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 908][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\System32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 956][C:\Program Files\Ahead\InCD\InCDsrv.exe]  [Nero AG, 4, 3, 18, 0]
    [C:\Program Files\Common Files\Ahead\Lib\DriveLocker.dll]  [Ahead Software AG, 1, 0, 0, 17]
    [C:\Program Files\Ahead\InCD\incdshx.dll]  [Nero AG, 4, 3, 18, 0]
    [C:\WINDOWS\SYSTEM32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1056][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1128][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1160][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1292][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp.050610-1527)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\lxcflmpm.DLL]  [, 1.154.7.0]
    [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\lxcfPP5C.dll]  [Lexmark International, Inc., 2.15.111.13]
[PID: 1396][C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe]  [GRISOFT, s.r.o., 7.5.0.435]
    [C:\PROGRA~1\Grisoft\AVG7\avgklib.dll]  [GRISOFT, s.r.o., 7.5.0.434]
    [C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\PROGRA~1\Grisoft\AVG7\avglog.dll]  [GRISOFT, s.r.o., 7.5.0.429]
    [C:\WINDOWS\SYSTEM32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Grisoft\AVG7\avgcfg.dll]  [GRISOFT, s.r.o., 7.5.0.436]
    [C:\Program Files\Grisoft\AVG7\avglng.dll]  [GRISOFT, s.r.o., 7.5.0.429]
    [C:\Program Files\Grisoft\AVG7\avgamint.dll]  [GRISOFT, s.r.o., 7.5.0.435]
    [C:\Program Files\Grisoft\AVG7\avgamsps.dll]  [GRISOFT, s.r.o., 7.5.0.407]
[PID: 1428][C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe]  [GRISOFT, s.r.o., 7.5.0.420]
    [C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\WINDOWS\SYSTEM32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1460][C:\PROGRA~1\Grisoft\AVG7\avgemc.exe]  [GRISOFT, s.r.o., 7.5.0.434]
    [C:\PROGRA~1\Grisoft\AVG7\libsasl.dll]  [GRISOFT, s.r.o., 7.5.0.407]
    [C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\SYSTEM32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Grisoft\AVG7\avgcfg.dll]  [GRISOFT, s.r.o., 7.5.0.436]
    [C:\Program Files\Grisoft\AVG7\avgklib.dll]  [GRISOFT, s.r.o., 7.5.0.434]
    [C:\PROGRA~1\Grisoft\AVG7\avglog.dll]  [GRISOFT, s.r.o., 7.5.0.429]
    [C:\Program Files\Grisoft\AVG7\avglng.dll]  [GRISOFT, s.r.o., 7.5.0.429]
    [C:\Program Files\Grisoft\AVG7\avgscan.dll]  [GRISOFT, s.r.o., 7.5.0.440]
    [C:\Program Files\Grisoft\AVG7\avgunarc.dll]  [GRISOFT, s.r.o., 7.5.0.434]
    [C:\PROGRA~1\Grisoft\AVG7\saslcrammd5.dll]  [GRISOFT, s.r.o., 7.5.0.407]
    [C:\PROGRA~1\Grisoft\AVG7\sasldigestmd5.dll]  [GRISOFT, s.r.o., 7.5.0.407]
    [C:\PROGRA~1\Grisoft\AVG7\sasllogin.dll]  [GRISOFT, s.r.o., 7.5.0.407]
    [C:\PROGRA~1\Grisoft\AVG7\saslplain.dll]  [GRISOFT, s.r.o., 7.5.0.407]
    [C:\Program Files\Grisoft\AVG7\avgmail.dll]  [GRISOFT, s.r.o., 7.5.0.429]
    [C:\PROGRA~1\Grisoft\AVG7\avgemcps.dll]  [GRISOFT, s.r.o., 7.5.0.420]
[PID: 1476][C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe]  [, 5.00.3506]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapEngine.dll]  [, 5.00.3506]
    [C:\Program Files\CyberLink\PowerCinema\Kernel\TV\PCMRRec4.dll]  [CyberLink Corp., 4.01.3426]
    [C:\WINDOWS\system32\msdmo.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\devenum.dll]  [N/A, N/A]
    [C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvcps.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\quartz.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\qcap.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\atinpprr.ax]  [ATI Technologies Inc., 6.14.10.225]
[PID: 1496][C:\WINDOWS\system32\CTsvcCDA.exe]  [Creative Technology Ltd, 1.0.1.0]
[PID: 1548][C:\WINDOWS\system32\nvsvc32.exe]  [NVIDIA Corporation, 6.14.10.9371]
    [C:\WINDOWS\system32\nvapi.dll]  [N/A, N/A]
    [C:\WINDOWS\SYSTEM32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1568][C:\Program Files\CyberLink\Shared Files\RichVideo.exe]  [, 2.0.0705  ]
    [C:\WINDOWS\SYSTEM32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 444][C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe]  [, 5.00.3506]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvcps.dll]  [N/A, N/A]
    [C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSchMgr.dll]  [, 5.00.3506]
    [C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLTinyDB.dll]  [N/A, 1.00.0706]
[PID: 180][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\System32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1904][C:\WINDOWS\RTHDCPL.EXE]  [Realtek Semiconductor Corp., 2.0.5.9]
    [C:\WINDOWS\SYSTEM32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2108][C:\Program Files\CyberLink\PowerCinema\PCMService.exe]  [CyberLink Corp., 5, 0, 0, 0]
    [C:\Program Files\CyberLink\PowerCinema\MFC71.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\Program Files\CyberLink\PowerCinema\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\Program Files\CyberLink\PowerCinema\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\CyberLink\PowerCinema\Kernel\Common\CLRCEngine3.dll]  [CyberLink Corp., 5.00.2201]
    [C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapX.dll]  [Cyberlink, 5.00.3508]
    [C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLAuMixer.dll]  [CyberLink Corp., 1.00.1128 ]
    [C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSchMgr.dll]  [, 5.00.3506]
    [C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvcps.dll]  [N/A, N/A]
    [C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapEngine.dll]  [, 5.00.3506]
    [C:\Program Files\CyberLink\PowerCinema\Kernel\TV\PCMRRec4.dll]  [CyberLink Corp., 4.01.3426]
    [C:\WINDOWS\system32\msdmo.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\devenum.dll]  [N/A, N/A]
    [C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLTinyDB.dll]  [N/A, 1.00.0706]
    [C:\Program Files\CyberLink\PowerCinema\Kernel\DV\PCMDV_dvrecorder.dll]  [CyberLink corporate, 3, 0, 3, 3]
    [C:\Program Files\CyberLink\PowerCinema\Kernel\DV\PCMDV_dvinf.dll]  [CyberLink, 3, 0, 9, 13]
    [C:\WINDOWS\system32\quartz.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\qcap.dll]  [N/A, N/A]
[PID: 2116][C:\Program Files\Grisoft\AVG7\avgcc.exe]  [GRISOFT, s.r.o., 7.5.0.438]
    [C:\Program Files\Grisoft\AVG7\AvgTMgr.dll]  [GRISOFT, s.r.o., 7.5.0.430]
    [C:\Program Files\Grisoft\AVG7\AvgCtrl.dll]  [GRISOFT, s.r.o., 7.5.0.429]
    [C:\WINDOWS\system32\MFC71.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\Program Files\Grisoft\AVG7\AvgAbout.dll]  [GRISOFT, s.r.o., 7.5.0.434]
    [C:\Program Files\Grisoft\AVG7\AvgTest.dll]  [GRISOFT, s.r.o., 7.5.0.436]
    [C:\Program Files\Grisoft\AVG7\AvgTRes.dll]  [GRISOFT, s.r.o., 7.5.0.437]
    [C:\Program Files\Grisoft\AVG7\AvgSet.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Grisoft\AVG7\avglog.dll]  [GRISOFT, s.r.o., 7.5.0.429]
    [C:\Program Files\Grisoft\AVG7\avgcfg.dll]  [GRISOFT, s.r.o., 7.5.0.436]
    [C:\Program Files\Grisoft\AVG7\avgklib.dll]  [GRISOFT, s.r.o., 7.5.0.434]
    [C:\Program Files\Grisoft\AVG7\avglng.dll]  [GRISOFT, s.r.o., 7.5.0.429]
    [C:\Program Files\Grisoft\AVG7\AVGRES.DLL]  [N/A, N/A]
    [C:\Program Files\Grisoft\AVG7\avgcckrn.dll]  [GRISOFT, s.r.o., 7.5.0.435]
    [C:\Program Files\Grisoft\AVG7\avgvault.dll]  [GRISOFT, s.r.o., 7.5.0.439]
    [C:\Program Files\Grisoft\AVG7\avgrep.dll]  [GRISOFT, s.r.o., 7.5.0.407]
    [C:\Program Files\Grisoft\AVG7\avgunarc.dll]  [GRISOFT, s.r.o., 7.5.0.434]
    [C:\PROGRA~1\Grisoft\AVG7\avgemsui.dll]  [GRISOFT, s.r.o., 7.5.0.434]
    [C:\PROGRA~1\Grisoft\AVG7\avgemcps.dll]  [GRISOFT, s.r.o., 7.5.0.420]
[PID: 2124][C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe]  [Lavasoft Sweden, 3.1.2.17]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2140][C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe]  [SlySoft, Inc., 6.1.1.3]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\SlySoft\AnyDVD\AnyDialog.dll]  [SlySoft, Inc., 6.1.1.2]
    [C:\WINDOWS\system32\ElbyCDIO.dll]  [Elaborate Bytes AG, 6, 0, 5, 3]
[PID: 3008][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll]  [TechSmith Corporation, 1.0.1]
    [C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]
    [C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx]  [, 1, 0, 0, 1]
    [C:\Program Files\Windows Live Toolbar\en-us\mtbres.dll.mui]  [Microsoft Corporation, 03.01.0000.0072]
    [C:\Program Files\Windows Live Toolbar\mtbres.dll]  [Microsoft Corporation, 03.01.0000.0072]
    [C:\Program Files\TAVI\MyTAVI\Flash9.ocx]  [Adobe Systems, Inc., 9,0,16,0]
    [C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\MSVCP80.dll]  [Microsoft Corporation, 8.00.50727.42]
[PID: 656][C:\WINDOWS\explorer.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\PROGRA~1\Creative\SHARED~1\CtCmeCtx.dll]  [Creative Technology Ltd, 1.0.1.0]
    [C:\Program Files\Grisoft\AVG7\avgse.dll]  [GRISOFT, s.r.o., 7.5.0.409]
    [C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\Program Files\winrar\rarext.dll]  [N/A, N/A]
    [C:\Program Files\TechSmith\SnagIt 8\SnagItShellExt.dll]  [TechSmith Corporation, 1.0.2.0]
    [C:\Program Files\TechSmith\SnagIt 8\MFC80.DLL]  [Microsoft Corporation, 8.00.50727.42]
    [C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]
    [C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\MSVCP80.dll]  [Microsoft Corporation, 8.00.50727.42]
    [C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx]  [, 1, 0, 0, 1]
    [C:\WINDOWS\system32\nvcpl.dll]  [NVIDIA Corporation, 6.14.10.9371]
    [C:\Program Files\Ahead\InCD\incdshx.dll]  [Nero AG, 4, 3, 18, 0]
    [C:\WINDOWS\system32\nvshell.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\CmdLineExt03.dll]  [N/A, N/A]
[PID: 3964][C:\Program Files\System Repair Engine\SREng.EXE]  [Smallfrogs Studio, 2.3.13.690]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2052][C:\WINDOWS\system32\wbem\wmiprvse.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]

==================================
File Associations
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock Provider
N/A

==================================
Autorun.Inf
N/A

==================================
HOSTS File
127.0.0.1       localhost

==================================
API HOOK
N/A

==================================
 

· Registered
Joined
·
97 Posts
Discussion Starter · #10 ·
Hi Fred,

That file is sitting in a Temporary folder I use for downloads called ATEST. This is the one I double clicked to activate the Trial Software but nothing much seemed to happen except the c: Command prompt (black screen / white writing) flashed for a second. It seems to be the only file as I did a search and nothing else showed up but I still can't delete the damned thing as it still says another program may be usuing it, but I can't find anything.

When you has me run Hijack this and go into tool settings there is a button that says "Delete A File On Reboot", can I try clicking this ???

Thanks for all your time and help....

Darryl
 

· Registered
Joined
·
2,337 Posts
LOL - You're ahead of me on this one.

Open HJT and go to Delete a File on reboot. Browse to the file and click on it to open. You will then be prompted to restart you computer.

Let me know how you made out.
 

· Registered
Joined
·
97 Posts
Discussion Starter · #12 ·
Thanks Fred,

That worked and it is now gone !! Thank you so much.

I assume because you haven't said anything else about the posts I have sent you that my system is clear.

Those two folders that have the windows update setup on them, should I try installing them or can I delete the folders ??

One last question, that file that I delete from c:/windows, the IUN6002.exe, how come none of the adware/virus scans we did didn't pick that up ??

Thanks again Fred,

Darryl
 

· Registered
Joined
·
2,337 Posts
Your logs are now clean. Since those two files contain only Windows update files, you can leave them. As far as iun6002.exe, this file
has so many varients, all with different numbers, that detecting each one is difficult. Also keep in mind that NO Anti-spyware or Anti-virus program is
going to pick up everything.

Please complete the next "housekeeping" steps and read through the information below.


----------------------------------------

Windows XP - Reset Hidden Files


  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View tab.
  • Deselect the Show hidden files and folders option.
  • Select the Hide file extensions for known types option.
  • Select the Hide protected operating system files option.
  • Click Yes to confirm.
  • Click OK.

----------------------------------------

Clean-out and Reset System Restore

This will clean out any junk or malicious files left behind in System Restore

  • To turn off System Restore click Start > Right Click My Computer > Properties.
  • Click the System Restore tab and Check
  • "Turn off System Restore" or "Turn off System Restore on all drives" Click Apply.
  • When turning off System Restore, the existing restore points will be deleted. Click Yes to do this then Click OK.

  • Turn on System Restore by Clicking Start. Right-click My Computer, and then click Properties.
  • Click the System Restore tab. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives."
  • Click Apply, and then OK.

This will create a new Restore Point.

----------------------------------------

RE-ENABLE ANTI-SPYWARE APPLICATIONS

If you were instructed to dis-able Anti-spyware applications during this fix, you may re-enable them

----------------------------------------

Please read through the following information to help protect your computer in the future.


KEEP YOUR OPERATING SYSTEM UPDATED

Please ensure that you have already patched your system against the recent WMF exploit. Go to this page to get the KB912919 patch

MICROSOFT UPDATES

It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser
up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft
and download all the critical updates to help prevent possible re-infection.


ENABLE WINDOWS AUTO UPDATE

Go to Start>Run - type wuaucpl.cpl
tick on the checkbox - "Keep my computer up to date"
Under settings, choose "Automatically download the updates, and install them on the schedule that I specify".
Click on "OK".


ENABLE WINDOWS AUTO UPDATE

From within Internet Explorer click on the Tools menu and then click on Internet Options.
  • Select the Security tab
    • Click once on the Internet icon so it becomes highlighted.
    • Select Custom Level .
      • Change 'Download signed ActiveX controls' to Prompt
      • Change 'Download unsigned ActiveX controls' to Disable
      • Change 'Initialize and script ActiveX controls not marked as safe' to Disable
      • Change 'Installation of desktop items' to Prompt
      • Change 'Launching programs and files in an IFRAME' to Prompt
      • Change 'Navigate sub-frames across different domains' to Prompt
      • When all these changes have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Select OK to exit the Internet Properties page.



TOOLS TO HELP KEEP YOUR SYSTEM CLEAN

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs:

SpywareBlaster to help prevent spyware from installing in the first place.
  • Install & update SpywareBlaster with the latest definitions.
  • After you have updated, click the button - enable protection for all unprotected items


SpywareGuard to catch and block spyware before it can execute.


SPYBOT - SEARCH & DESTROY Download and install Spybot - Search & Destroy with its
TeaTimer option.
This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with
the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here


AD-AWARE Download and install Ad-Aware. You should use this program to scan
your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product
can be found here


IE-SPYAD IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
  • Download IE-SpyAD - Extract the contents to a new folder
  • From within the folder, double-click install.bat
  • Select Option #2 - Install the new IE-SPYAD list.
  • Then return to the main menu.
  • Select option #4 - Add the old porn sites domain

A tutorial for IE-SPYAD can be found here


MVPS HOST FILE The MVPS Hosts file replaces your current HOSTS file
with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to
those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.

  • Download Host.zip to your desktop.
  • From your Desktop right-click (hosts.zip) and select:
    Extract All from the menu.
  • Click Next, click Next, select the option:
    "Show Extracted files"
  • Click Finish

This will open the newly created hosts folder on your Desktop.

Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated
HOSTS file to the correct location on your machine.


MCAFEE SITE ADVISOR SITE ADVISOR is a free IE plug-in (also suport for Firefox browser)
which is used in conjunction with the Google search engine. It advises which web sites are considered safe and which sites could pose a problem.
It also shows what problems were encountered with each site, such as malicious downloads, spam, and related links.


ANTI-VIRUS AND FIREWALL PROGRAMS


ANTIVIRUS SOFTWARE It is very important that you have anti-virus software running on your machine.
This alone can save you a lot of trouble with malware in the future.
See this link for a listing of some online antivirus scanners: Anti-Spyware Tutorial

Here are some very good free Antivirus products which are available:




If you do not have a firewall, here are 4 free ones available for personal use:

Understanding and Using Firewalls



INFORMATIONAL READING


In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles:




Please respond one more time and let me know you received this post so it can be marked resolved



If you feel that we have helped you, please help us keep this site free for all. Please visit our DONATION PAGE.
 

· Registered
Joined
·
97 Posts
Discussion Starter · #14 ·
Hi Fred,

This is an amazing forum and I will definately support it with a donation of atleast $20 (or more if i can afford). Hell my computer store is 30 minutes away so it saved me gas and time.

One more question if I can before I let you go....

I have asked this around at a couple of places including my work and haven't resolved it yet so I may have to take my computer back anyways, But I would really like your thoughts first and what you think I may be able to check before doing so....

This has been going on since I bought the damn thing is in September....

My monitor periodically flashes off then comes back on seconds later.

Just before it does this I can move my mouse pointer but can't click on anything..

If I happened to be watching a video playing from my computer to my TV at the time, the video on the computer comes back and continues to play fine but the video on the TV is screwy afterwards.

This doesn't necesarily happen when playing a video either, actually I can't find a common ocurrence when it happens. I know it's not my monitor because I have switched monitors to try it.

Sometimes (very rare) when it happens it even reboots my computer.

I do know it usually only happens when the mouse pointer is being moved but it doesn't happen all the time. Sometimes nothing for hours and then it can flash 5 times on me in the next 5 minutes or twice in an hour. But I never have seen it happen when the computer is just sitting idle.

It has also done it with and without being connected to the internet.

Lastnight I was using a small program i always use to join a few MP3 files together and all of a sudden the computer shuts off and reboots in the middle of it. (this was just a one minute procedure for the program to do)

This has happended before, I think even once I was on the internet and just clicked on a link and the Computer again shut off and rebooted.

After rebooting the computer usually comes back with the message "Your System has just recovered from a serious error"

Any Ideas would be appreciated and then I will stop bothering you !!!! :pray:


Thanks,
Darryl

About my System....

I'm using a NEC Multisync 75 CRT and 1024x768 res, 32 bit color and 75HZ

AMD ATHLON(tm) 64 x2 DUAL CORE PROCESSOR
3800+ 2.01ghz(X2)2.00GB RAM

WINDOWS XP HOME SERVICE PACK 2

Nvidia 6800GS Graphics Card
ForceWare Release 90
Version: 93.71 Driver

Ati Wonder Remote Elite Tuner Card
Powercinema4 Tuner Software
 
1 - 17 of 17 Posts
Status
Not open for further replies.
Top