Logfile of random's system information tool 1.04 (written by random/random)
Run by john w desch at 2008-10-02 15:39:27
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 27 GB (70%) free of 38 GB
Total RAM: 1023 MB (55% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:39:34 PM, on 10/2/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Documents and Settings\All Users\Application Data\vsfahcvc\jgfyfaxa.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Labtec\Media Keyboard\V5.0\KbdAp32A.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\vejsbqvm.exe
C:\Program Files\BOINC\boincmgr.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\BOINC\boinc.exe
C:\Program Files\BOINC\projects\setiathome.berkeley.edu\setiathome_6.03_windows_intelx86.exe
C:\Program Files\BOINC\projects\setiathome.berkeley.edu\setiathome_6.03_windows_intelx86.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\john w desch\Desktop\RSIT.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Trend Micro\HijackThis\john w desch.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.weather.com/outlook/health/a ... ocal/02888R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
http://windowsupdate.microsoft.com/R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1219465684\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [LWBKEYBOARD] C:\Program Files\Labtec\Media Keyboard\V5.0\KbdAp32A.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [inrhc9qrj0epac] C:\Documents and Settings\john w desch\Local Settings\Temp\.tt32.tmp.exe /CR=1154B2FCFF633142087E2A1D757FAFE1240263E4ABFF617F18167161E96157753DA6E81937286D2F435E8FB12A5E505DF3187459B2436B6A872DFE47849F9973425DBB4A4F21095F04094B8663DB3B860E
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SrvProcMon] C:\WINDOWS\system32\vejsbqvm.exe
O4 - HKLM\..\Policies\Explorer\Run: [8KIYIV2T9A] C:\Documents and Settings\All Users\Application Data\vsfahcvc\jgfyfaxa.exe
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Global Startup: BOINC Manager.lnk = C:\Program Files\BOINC\boincmgr.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O9 - Extra button: Rip YouTube File - {38E51477-DDB4-4aed-9D61-D0C193E10749} - C:\Program Files\SoundTaxi\YouTubeRipper.dll
O9 - Extra 'Tools' menuitem: Rip YouTube file embedded in this page - {38E51477-DDB4-4aed-9D61-D0C193E10749} - C:\Program Files\SoundTaxi\YouTubeRipper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://www.update.microsoft.com/windows ... 9246871265O21 - SSODL: admdsc - {61CEB9C6-E806-D2B2-0C40-07EEA4FF057B} - C:\Program Files\nfywemf\admdsc.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SoundMovieServer - SoundMovieServer - C:\WINDOWS\system32\snmvtsvc.exe
--
End of file - 7311 bytes
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C554162-8CB7-45A4-B8F4-8EA1C75885F9}]
AOL Toolbar Launcher - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll [2007-03-23 1025584]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{DE9C389F-3316-41A7-809B-AA305ED9D922} - AOL Toolbar - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll [2007-03-23 1025584]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"PtiuPbmd"=C:\WINDOWS\system32\ptipbm.dll [2003-01-15 24576]
"ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2004-07-10 339968]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"HostManager"=C:\Program Files\Common Files\AOL\1219465684\ee\AOLSoftware.exe [2007-05-25 42032]
"LWBKEYBOARD"=C:\Program Files\Labtec\Media Keyboard\V5.0\KbdAp32A.exe [2005-01-28 387584]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2006-11-03 866584]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"inrhc9qrj0epac"=C:\Documents and Settings\john w desch\Local Settings\Temp\.tt32.tmp.exe /CR=1154B2FCFF633142087E2A1D757FAFE1240263E4ABFF617F18167161E96157753DA6E81937286D2F435E8FB12A5E505DF3187459B2436B6A872DFE47849F9973425DBB4A4F21095F04094B8663DB3B860E []
"ISTray"=C:\Program Files\Spyware Doctor\pctsTray.exe [2008-08-25 1168264]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"8KIYIV2T9A"=C:\Documents and Settings\All Users\Application Data\vsfahcvc\jgfyfaxa.exe [2008-09-26 65536]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
"SrvProcMon"=C:\WINDOWS\system32\vejsbqvm.exe [2008-09-26 98304]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup
BOINC Manager.lnk - C:\Program Files\BOINC\boincmgr.exe
HotSync Manager.lnk - C:\Program Files\palmOne\Hotsync.exe
C:\Documents and Settings\john w desch\Start Menu\Programs\Startup
OpenOffice.org 2.4.lnk - C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2007-09-29 122880]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
admdsc - {61CEB9C6-E806-D2B2-0C40-07EEA4FF057B} - C:\Program Files\nfywemf\admdsc.dll [2008-09-26 131072]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"=C:\PROGRA~1\WINDOW~4\MpShHook.dll [2006-11-03 83224]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdauxservice]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdcoreservice]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"NoDispScrSavPage"=0
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\Common Files\aol\acs\AOLDial.exe"="C:\Program Files\Common Files\aol\acs\AOLDial.exe:*:Enabled:AOL Connectivity Service Dialer"
"C:\Program Files\Common Files\aol\acs\AOLacsd.exe"="C:\Program Files\Common Files\aol\acs\AOLacsd.exe:*:Enabled:AOL Connectivity Service"
"C:\Program Files\Common Files\aol\1219465684\ee\aolsoftware.exe"="C:\Program Files\Common Files\aol\1219465684\ee\aolsoftware.exe:*:Enabled:AOL Shared Components"
"C:\Program Files\AOL 9.0\waol.exe"="C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL"
"C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe"="C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:*:Enabled:AOL TopSpeed"
"C:\Program Files\Common Files\aol\Loader\aolload.exe"="C:\Program Files\Common Files\aol\Loader\aolload.exe:*:Enabled:AOL Loader"
"C:\Program Files\Common Files\aol\System Information\sinf.exe"="C:\Program Files\Common Files\aol\System Information\sinf.exe:*:Enabled:AOL System Information"
"C:\Program Files\AOL 9.1\waol.exe"="C:\Program Files\AOL 9.1\waol.exe:*:Enabled:AOL"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Mozilla Firefox"
"C:\WINDOWS\Network Diagnostic\xpnetdiag.exe"="C:\WINDOWS\Network Diagnostic\xpnetdiag.exe:*:Disabled:@xpsp3res.dll,-20000"
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
======List of files/folders created in the last 1 months======
2008-10-02 15:33:51 ----D---- C:\rsit
2008-10-01 15:37:38 ----A---- C:\WINDOWS\QuickInstall.INI
2008-09-29 08:46:51 ----D---- C:\WINDOWS\system32\Adobe
2008-09-28 18:37:08 ----D---- C:\Program Files\Lavasoft
2008-09-28 18:37:07 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-09-28 18:35:20 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2008-09-28 10:26:00 ----A---- C:\WINDOWS\system32\PerfStringBackup.TMP
2008-09-28 10:24:48 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-28 10:24:46 ----D---- C:\Program Files\Common Files\PC Tools
2008-09-28 10:24:37 ----D---- C:\Program Files\Spyware Doctor
2008-09-28 10:24:37 ----D---- C:\Documents and Settings\john w desch\Application Data\PC Tools
2008-09-28 10:24:37 ----D---- C:\Documents and Settings\All Users\Application Data\PC Tools
2008-09-26 19:08:28 ----D---- C:\Documents and Settings\john w desch\Application Data\HouseCall 6.6
2008-09-26 16:06:52 ----D---- C:\Program Files\Trend Micro
2008-09-26 15:55:13 ----HD---- C:\WINDOWS\system32\smp
2008-09-26 15:55:13 ----D---- C:\WINDOWS\mslagent
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\WINWGPX.EXE
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\winsystem.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\winlogonpc.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\temp#01.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\taack.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\sysreq.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\ssvchost.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\Rundl1.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\regm64.dll
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\psoft1.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\ps1.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\newsd32.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\netode.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\mwin32.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\mtr2.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\mssecu.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\msgp.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\hxiwlgpm.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\hoproxy.dll
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\h@tkeysh@@k.dll
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\dpcproxy.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\bdn.com
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\awtoolb.dll
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\anticipator.dll
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\akttzn.exe
2008-09-26 15:55:13 ----A---- C:\WINDOWS\mssecu.exe
2008-09-26 15:55:13 ----A---- C:\WINDOWS\iTunesMusic.exe
2008-09-26 15:55:13 ----A---- C:\WINDOWS\bdn.com
2008-09-26 15:55:13 ----A---- C:\WINDOWS\a.bat
2008-09-26 15:54:54 ----D---- C:\Program Files\nfywemf
2008-09-26 15:54:48 ----D---- C:\Documents and Settings\All Users\Application Data\vsfahcvc
2008-09-26 15:54:47 ----AH---- C:\WINDOWS\system32\vejsbqvm.exe
2008-09-17 09:53:30 ----D---- C:\Documents and Settings\john w desch\Application Data\OpenOffice.org2
2008-09-17 09:51:28 ----D---- C:\Program Files\OpenOffice.org 2.4
2008-09-17 09:51:04 ----AH---- C:\WINDOWS\system32\javaws.exe
2008-09-17 09:51:04 ----AH---- C:\WINDOWS\system32\javaw.exe
2008-09-17 09:51:04 ----AH---- C:\WINDOWS\system32\java.exe
2008-09-17 09:44:53 ----D---- C:\Program Files\TurboLaw
2008-09-14 14:32:56 ----D---- C:\WINDOWS\Sun
2008-09-14 14:32:56 ----D---- C:\Documents and Settings\john w desch\Application Data\Sun
2008-09-14 14:32:13 ----D---- C:\Program Files\Java
2008-09-14 14:32:05 ----D---- C:\Program Files\Common Files\Java
2008-09-10 17:14:21 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
======List of files/folders modified in the last 1 months======
2008-10-02 15:38:55 ----D---- C:\Program Files\BOINC
2008-10-02 15:34:07 ----D---- C:\WINDOWS\Prefetch
2008-10-02 15:31:13 ----D---- C:\Program Files\Mozilla Firefox
2008-10-02 15:28:34 ----A---- C:\WINDOWS\win.ini
2008-10-02 15:26:20 ----D---- C:\WINDOWS\Temp
2008-10-02 15:25:38 ----HD---- C:\WINDOWS\system32\drivers
2008-10-01 18:05:59 ----A---- C:\WINDOWS\SchedLgU.Txt
2008-10-01 15:37:38 ----D---- C:\WINDOWS
2008-10-01 15:26:34 ----D---- C:\Program Files\palmOne
2008-10-01 15:16:51 ----HD---- C:\WINDOWS\system32\CatRoot2
2008-09-30 17:04:09 ----D---- C:\Program Files\Diablo II
2008-09-30 16:57:38 ----D---- C:\Documents and Settings\john w desch\Application Data\Adobe
2008-09-30 16:39:22 ----HD---- C:\WINDOWS\inf
2008-09-29 08:46:52 ----RD---- C:\Program Files
2008-09-29 08:46:51 ----HD---- C:\WINDOWS\system32
2008-09-29 00:09:31 ----A---- C:\WINDOWS\NeroDigital.ini
2008-09-28 18:39:51 ----SHD---- C:\WINDOWS\Installer
2008-09-28 18:35:20 ----D---- C:\Program Files\Common Files
2008-09-28 10:31:26 ----SD---- C:\WINDOWS\Tasks
2008-09-27 16:23:35 ----A---- C:\WINDOWS\imsins.BAK
2008-09-27 16:16:50 ----RSHDC---- C:\WINDOWS\system32\dllcache
2008-09-27 16:13:48 ----RD---- C:\WINDOWS\Web
2008-09-27 10:15:32 ----AH---- C:\WINDOWS\system32\CmdLineExt03.dll
2008-09-26 16:21:00 ----D---- C:\Program Files\Internet Explorer
2008-09-26 16:18:01 ----SHD---- C:\System Volume Information
2008-09-26 16:18:01 ----HD---- C:\WINDOWS\system32\Restore
2008-09-17 15:27:30 ----D---- C:\Program Files\AOL 9.1
2008-09-17 09:51:35 ----RSD---- C:\WINDOWS\Fonts
2008-09-14 14:32:50 ----SD---- C:\WINDOWS\Downloaded Program Files
2008-09-14 14:31:26 ----AH---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-09-12 07:14:30 ----D---- C:\WINDOWS\Help
2008-09-10 17:14:22 ----D---- C:\WINDOWS\WinSxS
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 aslm75;aslm75; \??\C:\WINDOWS\system32\drivers\aslm75.sys []
R1 IKSysFlt;System Filter Driver; C:\WINDOWS\system32\drivers\iksysflt.sys [2008-08-25 66952]
R1 IKSysSec;System Security Driver; C:\WINDOWS\system32\drivers\iksyssec.sys [2008-08-25 81288]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 pctfw2;pctfw2; \??\C:\WINDOWS\system32\drivers\pctfw2.sys []
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-04 12032]
R2 tmcomm;tmcomm; \??\C:\WINDOWS\system32\drivers\tmcomm.sys []
R3 admjoy;Aureal Game Port Enumerator; C:\WINDOWS\system32\DRIVERS\admjoy.sys [2004-08-03 10880]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2007-09-29 2456064]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mf;mf; C:\WINDOWS\system32\DRIVERS\mf.sys [2008-04-13 63744]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 MovRVDrv32;MovRVDrv32; C:\WINDOWS\system32\DRIVERS\MovRVDrv32.sys [2007-12-28 3768]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 SndTDriverV32;SndTDriverV32; C:\WINDOWS\system32\drivers\SndTDriverV32.sys [2008-08-19 23096]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 wanatw;WAN Miniport (ATW); C:\WINDOWS\system32\DRIVERS\wanatw4.sys [2003-01-10 33588]
R3 wdm_au8810;Aureal Vortex 8810 Audio Driver (WDM); C:\WINDOWS\system32\drivers\adm8810.sys [2001-10-05 539776]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2007-12-06 285952]
S3 Ad-Watch Connect Filter;Ad-Watch Connect Kernel Filter; \??\C:\WINDOWS\system32\drivers\NSDriver.sys []
S3 ctljystk;Creative SBLive! Gameport; C:\WINDOWS\system32\DRIVERS\ctljystk.sys [2001-08-17 3712]
S3 emu10k;Creative SB Live! (WDM); C:\WINDOWS\system32\drivers\emu10k1m.sys [2001-08-17 283904]
S3 emu10k1;Creative Interface Manager Driver (WDM); C:\WINDOWS\system32\drivers\ctlfacem.sys [2001-08-17 6912]
S3 PalmUSBD;PalmUSBD; C:\WINDOWS\system32\drivers\PalmUSBD.sys [2008-08-23 16694]
S3 sfman;Creative SoundFont Manager Driver (WDM); C:\WINDOWS\system32\drivers\sfmanm.sys [2001-08-17 36480]
S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-07-17 611664]
R2 AOL ACS;AOL Connectivity Service; C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe [2006-10-23 46640]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2007-09-29 483328]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2005-11-15 73728]
R2 sdAuxService;PC Tools Auxiliary Service; C:\Program Files\Spyware Doctor\pctsAuxs.exe [2008-06-13 356920]
R2 sdCoreService;PC Tools Security Service; C:\Program Files\Spyware Doctor\pctsSvc.exe [2008-08-25 1077640]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2004-07-10 516096]
S2 WinDefend;Windows Defender; C:\Program Files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
S3 SoundMovieServer;SoundMovieServer; C:\WINDOWS\system32\snmvtsvc.exe [2008-08-19 200704]
-----------------EOF-----------------
Logfile of random's system information tool 1.04 (written by random/random)
Run by john w desch at 2008-10-02 15:39:27
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 27 GB (70%) free of 38 GB
Total RAM: 1023 MB (55% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:39:34 PM, on 10/2/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Documents and Settings\All Users\Application Data\vsfahcvc\jgfyfaxa.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Labtec\Media Keyboard\V5.0\KbdAp32A.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\vejsbqvm.exe
C:\Program Files\BOINC\boincmgr.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\BOINC\boinc.exe
C:\Program Files\BOINC\projects\setiathome.berkeley.edu\setiathome_6.03_windows_intelx86.exe
C:\Program Files\BOINC\projects\setiathome.berkeley.edu\setiathome_6.03_windows_intelx86.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\john w desch\Desktop\RSIT.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Trend Micro\HijackThis\john w desch.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.weather.com/outlook/health/a ... ocal/02888R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
http://windowsupdate.microsoft.com/R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1219465684\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [LWBKEYBOARD] C:\Program Files\Labtec\Media Keyboard\V5.0\KbdAp32A.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [inrhc9qrj0epac] C:\Documents and Settings\john w desch\Local Settings\Temp\.tt32.tmp.exe /CR=1154B2FCFF633142087E2A1D757FAFE1240263E4ABFF617F18167161E96157753DA6E81937286D2F435E8FB12A5E505DF3187459B2436B6A872DFE47849F9973425DBB4A4F21095F04094B8663DB3B860E
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SrvProcMon] C:\WINDOWS\system32\vejsbqvm.exe
O4 - HKLM\..\Policies\Explorer\Run: [8KIYIV2T9A] C:\Documents and Settings\All Users\Application Data\vsfahcvc\jgfyfaxa.exe
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Global Startup: BOINC Manager.lnk = C:\Program Files\BOINC\boincmgr.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O9 - Extra button: Rip YouTube File - {38E51477-DDB4-4aed-9D61-D0C193E10749} - C:\Program Files\SoundTaxi\YouTubeRipper.dll
O9 - Extra 'Tools' menuitem: Rip YouTube file embedded in this page - {38E51477-DDB4-4aed-9D61-D0C193E10749} - C:\Program Files\SoundTaxi\YouTubeRipper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://www.update.microsoft.com/windows ... 9246871265O21 - SSODL: admdsc - {61CEB9C6-E806-D2B2-0C40-07EEA4FF057B} - C:\Program Files\nfywemf\admdsc.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SoundMovieServer - SoundMovieServer - C:\WINDOWS\system32\snmvtsvc.exe
--
End of file - 7311 bytes
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C554162-8CB7-45A4-B8F4-8EA1C75885F9}]
AOL Toolbar Launcher - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll [2007-03-23 1025584]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{DE9C389F-3316-41A7-809B-AA305ED9D922} - AOL Toolbar - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll [2007-03-23 1025584]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"PtiuPbmd"=C:\WINDOWS\system32\ptipbm.dll [2003-01-15 24576]
"ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2004-07-10 339968]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"HostManager"=C:\Program Files\Common Files\AOL\1219465684\ee\AOLSoftware.exe [2007-05-25 42032]
"LWBKEYBOARD"=C:\Program Files\Labtec\Media Keyboard\V5.0\KbdAp32A.exe [2005-01-28 387584]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2006-11-03 866584]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"inrhc9qrj0epac"=C:\Documents and Settings\john w desch\Local Settings\Temp\.tt32.tmp.exe /CR=1154B2FCFF633142087E2A1D757FAFE1240263E4ABFF617F18167161E96157753DA6E81937286D2F435E8FB12A5E505DF3187459B2436B6A872DFE47849F9973425DBB4A4F21095F04094B8663DB3B860E []
"ISTray"=C:\Program Files\Spyware Doctor\pctsTray.exe [2008-08-25 1168264]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"8KIYIV2T9A"=C:\Documents and Settings\All Users\Application Data\vsfahcvc\jgfyfaxa.exe [2008-09-26 65536]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
"SrvProcMon"=C:\WINDOWS\system32\vejsbqvm.exe [2008-09-26 98304]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup
BOINC Manager.lnk - C:\Program Files\BOINC\boincmgr.exe
HotSync Manager.lnk - C:\Program Files\palmOne\Hotsync.exe
C:\Documents and Settings\john w desch\Start Menu\Programs\Startup
OpenOffice.org 2.4.lnk - C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2007-09-29 122880]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
admdsc - {61CEB9C6-E806-D2B2-0C40-07EEA4FF057B} - C:\Program Files\nfywemf\admdsc.dll [2008-09-26 131072]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"=C:\PROGRA~1\WINDOW~4\MpShHook.dll [2006-11-03 83224]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdauxservice]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdcoreservice]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"NoDispScrSavPage"=0
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\Common Files\aol\acs\AOLDial.exe"="C:\Program Files\Common Files\aol\acs\AOLDial.exe:*:Enabled:AOL Connectivity Service Dialer"
"C:\Program Files\Common Files\aol\acs\AOLacsd.exe"="C:\Program Files\Common Files\aol\acs\AOLacsd.exe:*:Enabled:AOL Connectivity Service"
"C:\Program Files\Common Files\aol\1219465684\ee\aolsoftware.exe"="C:\Program Files\Common Files\aol\1219465684\ee\aolsoftware.exe:*:Enabled:AOL Shared Components"
"C:\Program Files\AOL 9.0\waol.exe"="C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL"
"C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe"="C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:*:Enabled:AOL TopSpeed"
"C:\Program Files\Common Files\aol\Loader\aolload.exe"="C:\Program Files\Common Files\aol\Loader\aolload.exe:*:Enabled:AOL Loader"
"C:\Program Files\Common Files\aol\System Information\sinf.exe"="C:\Program Files\Common Files\aol\System Information\sinf.exe:*:Enabled:AOL System Information"
"C:\Program Files\AOL 9.1\waol.exe"="C:\Program Files\AOL 9.1\waol.exe:*:Enabled:AOL"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Mozilla Firefox"
"C:\WINDOWS\Network Diagnostic\xpnetdiag.exe"="C:\WINDOWS\Network Diagnostic\xpnetdiag.exe:*:Disabled:@xpsp3res.dll,-20000"
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
======List of files/folders created in the last 1 months======
2008-10-02 15:33:51 ----D---- C:\rsit
2008-10-01 15:37:38 ----A---- C:\WINDOWS\QuickInstall.INI
2008-09-29 08:46:51 ----D---- C:\WINDOWS\system32\Adobe
2008-09-28 18:37:08 ----D---- C:\Program Files\Lavasoft
2008-09-28 18:37:07 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-09-28 18:35:20 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2008-09-28 10:26:00 ----A---- C:\WINDOWS\system32\PerfStringBackup.TMP
2008-09-28 10:24:48 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-28 10:24:46 ----D---- C:\Program Files\Common Files\PC Tools
2008-09-28 10:24:37 ----D---- C:\Program Files\Spyware Doctor
2008-09-28 10:24:37 ----D---- C:\Documents and Settings\john w desch\Application Data\PC Tools
2008-09-28 10:24:37 ----D---- C:\Documents and Settings\All Users\Application Data\PC Tools
2008-09-26 19:08:28 ----D---- C:\Documents and Settings\john w desch\Application Data\HouseCall 6.6
2008-09-26 16:06:52 ----D---- C:\Program Files\Trend Micro
2008-09-26 15:55:13 ----HD---- C:\WINDOWS\system32\smp
2008-09-26 15:55:13 ----D---- C:\WINDOWS\mslagent
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\WINWGPX.EXE
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\winsystem.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\winlogonpc.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\temp#01.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\taack.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\sysreq.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\ssvchost.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\Rundl1.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\regm64.dll
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\psoft1.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\ps1.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\newsd32.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\netode.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\mwin32.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\mtr2.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\mssecu.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\msgp.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\hxiwlgpm.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\hoproxy.dll
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\h@tkeysh@@k.dll
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\dpcproxy.exe
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\bdn.com
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\awtoolb.dll
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\anticipator.dll
2008-09-26 15:55:13 ----AH---- C:\WINDOWS\system32\akttzn.exe
2008-09-26 15:55:13 ----A---- C:\WINDOWS\mssecu.exe
2008-09-26 15:55:13 ----A---- C:\WINDOWS\iTunesMusic.exe
2008-09-26 15:55:13 ----A---- C:\WINDOWS\bdn.com
2008-09-26 15:55:13 ----A---- C:\WINDOWS\a.bat
2008-09-26 15:54:54 ----D---- C:\Program Files\nfywemf
2008-09-26 15:54:48 ----D---- C:\Documents and Settings\All Users\Application Data\vsfahcvc
2008-09-26 15:54:47 ----AH---- C:\WINDOWS\system32\vejsbqvm.exe
2008-09-17 09:53:30 ----D---- C:\Documents and Settings\john w desch\Application Data\OpenOffice.org2
2008-09-17 09:51:28 ----D---- C:\Program Files\OpenOffice.org 2.4
2008-09-17 09:51:04 ----AH---- C:\WINDOWS\system32\javaws.exe
2008-09-17 09:51:04 ----AH---- C:\WINDOWS\system32\javaw.exe
2008-09-17 09:51:04 ----AH---- C:\WINDOWS\system32\java.exe
2008-09-17 09:44:53 ----D---- C:\Program Files\TurboLaw
2008-09-14 14:32:56 ----D---- C:\WINDOWS\Sun
2008-09-14 14:32:56 ----D---- C:\Documents and Settings\john w desch\Application Data\Sun
2008-09-14 14:32:13 ----D---- C:\Program Files\Java
2008-09-14 14:32:05 ----D---- C:\Program Files\Common Files\Java
2008-09-10 17:14:21 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
======List of files/folders modified in the last 1 months======
2008-10-02 15:38:55 ----D---- C:\Program Files\BOINC
2008-10-02 15:34:07 ----D---- C:\WINDOWS\Prefetch
2008-10-02 15:31:13 ----D---- C:\Program Files\Mozilla Firefox
2008-10-02 15:28:34 ----A---- C:\WINDOWS\win.ini
2008-10-02 15:26:20 ----D---- C:\WINDOWS\Temp
2008-10-02 15:25:38 ----HD---- C:\WINDOWS\system32\drivers
2008-10-01 18:05:59 ----A---- C:\WINDOWS\SchedLgU.Txt
2008-10-01 15:37:38 ----D---- C:\WINDOWS
2008-10-01 15:26:34 ----D---- C:\Program Files\palmOne
2008-10-01 15:16:51 ----HD---- C:\WINDOWS\system32\CatRoot2
2008-09-30 17:04:09 ----D---- C:\Program Files\Diablo II
2008-09-30 16:57:38 ----D---- C:\Documents and Settings\john w desch\Application Data\Adobe
2008-09-30 16:39:22 ----HD---- C:\WINDOWS\inf
2008-09-29 08:46:52 ----RD---- C:\Program Files
2008-09-29 08:46:51 ----HD---- C:\WINDOWS\system32
2008-09-29 00:09:31 ----A---- C:\WINDOWS\NeroDigital.ini
2008-09-28 18:39:51 ----SHD---- C:\WINDOWS\Installer
2008-09-28 18:35:20 ----D---- C:\Program Files\Common Files
2008-09-28 10:31:26 ----SD---- C:\WINDOWS\Tasks
2008-09-27 16:23:35 ----A---- C:\WINDOWS\imsins.BAK
2008-09-27 16:16:50 ----RSHDC---- C:\WINDOWS\system32\dllcache
2008-09-27 16:13:48 ----RD---- C:\WINDOWS\Web
2008-09-27 10:15:32 ----AH---- C:\WINDOWS\system32\CmdLineExt03.dll
2008-09-26 16:21:00 ----D---- C:\Program Files\Internet Explorer
2008-09-26 16:18:01 ----SHD---- C:\System Volume Information
2008-09-26 16:18:01 ----HD---- C:\WINDOWS\system32\Restore
2008-09-17 15:27:30 ----D---- C:\Program Files\AOL 9.1
2008-09-17 09:51:35 ----RSD---- C:\WINDOWS\Fonts
2008-09-14 14:32:50 ----SD---- C:\WINDOWS\Downloaded Program Files
2008-09-14 14:31:26 ----AH---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-09-12 07:14:30 ----D---- C:\WINDOWS\Help
2008-09-10 17:14:22 ----D---- C:\WINDOWS\WinSxS
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 aslm75;aslm75; \??\C:\WINDOWS\system32\drivers\aslm75.sys []
R1 IKSysFlt;System Filter Driver; C:\WINDOWS\system32\drivers\iksysflt.sys [2008-08-25 66952]
R1 IKSysSec;System Security Driver; C:\WINDOWS\system32\drivers\iksyssec.sys [2008-08-25 81288]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 pctfw2;pctfw2; \??\C:\WINDOWS\system32\drivers\pctfw2.sys []
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-04 12032]
R2 tmcomm;tmcomm; \??\C:\WINDOWS\system32\drivers\tmcomm.sys []
R3 admjoy;Aureal Game Port Enumerator; C:\WINDOWS\system32\DRIVERS\admjoy.sys [2004-08-03 10880]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2007-09-29 2456064]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mf;mf; C:\WINDOWS\system32\DRIVERS\mf.sys [2008-04-13 63744]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 MovRVDrv32;MovRVDrv32; C:\WINDOWS\system32\DRIVERS\MovRVDrv32.sys [2007-12-28 3768]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 SndTDriverV32;SndTDriverV32; C:\WINDOWS\system32\drivers\SndTDriverV32.sys [2008-08-19 23096]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 wanatw;WAN Miniport (ATW); C:\WINDOWS\system32\DRIVERS\wanatw4.sys [2003-01-10 33588]
R3 wdm_au8810;Aureal Vortex 8810 Audio Driver (WDM); C:\WINDOWS\system32\drivers\adm8810.sys [2001-10-05 539776]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2007-12-06 285952]
S3 Ad-Watch Connect Filter;Ad-Watch Connect Kernel Filter; \??\C:\WINDOWS\system32\drivers\NSDriver.sys []
S3 ctljystk;Creative SBLive! Gameport; C:\WINDOWS\system32\DRIVERS\ctljystk.sys [2001-08-17 3712]
S3 emu10k;Creative SB Live! (WDM); C:\WINDOWS\system32\drivers\emu10k1m.sys [2001-08-17 283904]
S3 emu10k1;Creative Interface Manager Driver (WDM); C:\WINDOWS\system32\drivers\ctlfacem.sys [2001-08-17 6912]
S3 PalmUSBD;PalmUSBD; C:\WINDOWS\system32\drivers\PalmUSBD.sys [2008-08-23 16694]
S3 sfman;Creative SoundFont Manager Driver (WDM); C:\WINDOWS\system32\drivers\sfmanm.sys [2001-08-17 36480]
S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-07-17 611664]
R2 AOL ACS;AOL Connectivity Service; C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe [2006-10-23 46640]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2007-09-29 483328]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2005-11-15 73728]
R2 sdAuxService;PC Tools Auxiliary Service; C:\Program Files\Spyware Doctor\pctsAuxs.exe [2008-06-13 356920]
R2 sdCoreService;PC Tools Security Service; C:\Program Files\Spyware Doctor\pctsSvc.exe [2008-08-25 1077640]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2004-07-10 516096]
S2 WinDefend;Windows Defender; C:\Program Files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
S3 SoundMovieServer;SoundMovieServer; C:\WINDOWS\system32\snmvtsvc.exe [2008-08-19 200704]
-----------------EOF-----------------
ok did i post that correctly?