Free Malware Removal Forum

by **Jiten** » November 13th, 2009, 12:55 pm

Whenever I search using google, A new firefox window opens with several tabs. Most of the tabs are random and seem adware/ malware caused.

I believe the laptop was infected when I got it back from my cousin. I have run a few scans, which I will post below aswell. Any help will be appreciated. Thanks in advance. Jiten.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:51:36, on 13/11/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Sophos\Sophos Anti-Rootkit\sargui.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Soni\Local Settings\temp\hbttwb.exe
C:\Documents and Settings\Soni\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [SonyPowerCfg] C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_A54B7D6FB1DA63EA.dll/cmsidewiki.html
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 8080584796
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless WiFi Service (S24EventMonitor) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

--
End of file - 7095 bytes
-----------------------------------
Malwarebytes' Anti-Malware 1.41
Database version: 3156
Windows 5.1.2600 Service Pack 3

12/11/2009 21:54:17
mbam-log-2009-11-12 (21-54-17).txt

Scan type: Quick Scan
Objects scanned: 99882
Time elapsed: 5 minute(s), 24 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Soni\Local Settings\temp\8D7.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
----------------------
I ran a Sophos Anti-Rootkit Scan and it shows the following two files. I don't know what to make of it.

Area: Windows registry
Description: Hidden registry key
Location: \HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext
Removable: No
Notes: (no more detail available)

Area: Windows registry
Description: Hidden registry value
Location: \HKEY_USERS\S-1-5-18\Software\Microsoft\Windows NT\CurrentVersion\Windows\load
Removable: No
Notes: (type 1, length 2) " "

by **deltalima** » November 16th, 2009, 6:56 am

Hi Jiten,

Welcome to the forum.

My nickname is deltalima and I will be helping you with your computer problems.

HijackThis logs can take some time to research, so please be patient with me.

Please note the following:

I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for this issue on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
If after 3 days you have not responded to this topic, it will be closed, and you will need to start a new one.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.
All of my posts need to be checked by a teacher, so please be patient while I attempt to remove your malware.

Uninstall List

Open HijackThis.
Look under System tools.
Click on the Open Uninstall Manager... button.
Click on the Save list... button.
It will prompt you to save. Save this log in a convenient location. By default it's named uninstall_list.txt.
Notepad will open. Please copy and paste the contents of this log in your next reply.

by **deltalima** » November 16th, 2009, 9:32 am

Hi Jiten,

Set Your Computer to Show All Files/Folders.

Click Start.
Click My Computer (Computer in Vista)..
Select the Tools menu and click Folder Options.
Select the View Tab.
Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck Hide protected operating system files (recommended).
Click Yes to confirm.
Uncheck the Hide file extensions for known file types.
Click OK.

In addition, go to Start, Search. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that 'Search system folders', 'Search hidden files and folders', and 'Search subfolders' are checked.

Next

Upload a File to Virustotal

Please go to Virustotal

Copy/paste this file and path into the white box at the top:

C:\Documents and Settings\Soni\Local Settings\temp\hbttwb.exe

Press Submit - this will submit the file for testing.
Please wait for all the scanners to finish then copy and paste the results in your next response.

RSIT (Random's System Information Tool)
Please download RSIT by random/random... save it to your desktop.

Double click on RSIT.exe to run it... read the disclaimer... click on Continue.
RSIT will start running. When done... 2 logs files...will be produced.
The first one, "log.txt", <<will be maximized... the second one, "info.txt", <<will be minimized.
Please post both... "log.txt" and "info.txt", file contents in your next reply.

(These logs can be lengthy, so post 1 log per reply please.)

Download GMER Rootkit Scanner from here.

Double click the .exe file. If asked to allow gmer.sys driver to load, please consent
If it gives you a warning at program start about rootkit activity and asks if you want to run a scan...click NO.
Run Gmer again and click on the Rootkit tab.
Look at the right hand side (under Files) and uncheck all drives with the exception of your C drive.
Make sure all other boxes on the right of the screen are checked, EXCEPT for "Show All".
Click on the "Scan" and wait for the scan to finish.
Note: Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while this scan completes. Also do not use your computer during the scan.
When completed, click on the Copy button and right-click on your Desktop, choose "New" > Text document. Once the file is created, open it and right-click again and choose Paste or Ctrl+V. Save the file as gmer.txt and copy the information in your next reply.
Note: If you have any problems, try running GMER in SAFE MODE"

Important! Please do not select the "Show all" checkbox during the scan..

Please post the GMER log along with log.txt and info.txt from the RSIT scan into your next reply (3 seperate posts).

Please also post the results from the Virustotal scan.

by **Jiten** » November 16th, 2009, 8:52 pm

Hey deltalima thanks for being the helper.

I did try Virustotal and Jotti aswell, however, that file was not found on the system, hence no log for it. I've posted the 3 other logs as requested.

RSIT Logs
-------------
Log.txt

Logfile of random's system information tool 1.06 (written by random/random)
Run by Soni at 2009-11-16 23:20:00
Microsoft Windows XP Professional Service Pack 3
System drive C: has 66 GB (87%) free of 76 GB
Total RAM: 2046 MB (71% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:20:05, on 16/11/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe
C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Soni\Desktop\RSIT.exe
C:\Documents and Settings\Soni\Desktop\Soni.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [SonyPowerCfg] C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_A54B7D6FB1DA63EA.dll/cmsidewiki.html
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 8080584796
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless WiFi Service (S24EventMonitor) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

--
End of file - 7291 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Malwarebytes' Scheduled Update for Soni.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-03-30 403824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2009-11-01 263280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2009-11-01 263280]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SonyPowerCfg"=C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2005-05-15 184320]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2009-09-11 2054360]
"Apoint"=C:\Program Files\Apoint\Apoint.exe [2003-11-07 114688]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2009-10-06 18750976]
"Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2009-09-10 420176]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-08-20 13537280]
"Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2009-09-10 1312080]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2008-08-20 86016]
"IntelZeroConfig"=C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe [2009-02-27 1368064]
"IntelWireless"=C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [2009-02-27 1202448]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-07-26 3883856]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-11-01 39408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Quick Search Box]
C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe [2009-11-01 122880]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe [2009-02-27 1368064]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISBMgr.exe]
C:\Program Files\Sony\ISB Utility\ISBMgr.exe [2004-02-20 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-11 149280]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-11-01 39408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Update ESET's licence.lnk]
C:\PROGRA~1\ESET\MINODL~1\MINODL~1.EXE -u -d 10000 []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\VESWinlogon]
C:\WINDOWS\system32\VESWinlogon.dll [2005-05-20 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

======List of files/folders created in the last 1 months======

2009-11-16 23:20:00 ----D---- C:\rsit
2009-11-14 19:52:28 ----D---- C:\Program Files\Veetle
2009-11-14 04:31:26 ----A---- C:\WINDOWS\system32\Netw2r32.dll
2009-11-14 04:31:26 ----A---- C:\WINDOWS\system32\Netw2c32.dll
2009-11-14 04:30:48 ----D---- C:\Program Files\Common Files\Intel
2009-11-13 18:32:34 ----A---- C:\WINDOWS\system32\javaws.exe
2009-11-13 18:32:34 ----A---- C:\WINDOWS\system32\javaw.exe
2009-11-13 18:32:34 ----A---- C:\WINDOWS\system32\java.exe
2009-11-13 03:10:51 ----D---- C:\WINDOWS\system32\appmgmt
2009-11-13 02:56:28 ----D---- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2009-11-13 02:39:02 ----D---- C:\Program Files\Sophos
2009-11-13 02:33:50 ----D---- C:\WINDOWS\temp
2009-11-13 01:53:45 ----HD---- C:\WINDOWS\PIF
2009-11-13 00:33:08 ----A---- C:\WINDOWS\system32\wuapi.dll.mui
2009-11-12 23:56:10 ----D---- C:\Documents and Settings\All Users\Application Data\SlySoft
2009-11-12 23:00:45 ----A---- C:\WINDOWS\system32\nvwrszht.dll
2009-11-12 23:00:45 ----A---- C:\WINDOWS\system32\nvwrszhc.dll
2009-11-12 23:00:45 ----A---- C:\WINDOWS\system32\nvwrstr.dll
2009-11-12 23:00:45 ----A---- C:\WINDOWS\system32\nvrstr.dll
2009-11-12 23:00:44 ----A---- C:\WINDOWS\system32\nvwrsth.dll
2009-11-12 23:00:44 ----A---- C:\WINDOWS\system32\nvrsth.dll
2009-11-12 23:00:43 ----A---- C:\WINDOWS\system32\nvwrssv.dll
2009-11-12 23:00:43 ----A---- C:\WINDOWS\system32\nvwrssl.dll
2009-11-12 23:00:43 ----A---- C:\WINDOWS\system32\nvwrssk.dll
2009-11-12 23:00:43 ----A---- C:\WINDOWS\system32\nvrssv.dll
2009-11-12 23:00:43 ----A---- C:\WINDOWS\system32\nvrssl.dll
2009-11-12 23:00:43 ----A---- C:\WINDOWS\system32\nvrssk.dll
2009-11-12 23:00:42 ----A---- C:\WINDOWS\system32\nvwrsru.dll
2009-11-12 23:00:42 ----A---- C:\WINDOWS\system32\nvwrsptb.dll
2009-11-12 23:00:42 ----A---- C:\WINDOWS\system32\nvrsru.dll
2009-11-12 23:00:42 ----A---- C:\WINDOWS\system32\nvrsptb.dll
2009-11-12 23:00:41 ----A---- C:\WINDOWS\system32\nvwrspt.dll
2009-11-12 23:00:41 ----A---- C:\WINDOWS\system32\nvwrspl.dll
2009-11-12 23:00:41 ----A---- C:\WINDOWS\system32\nvrspt.dll
2009-11-12 23:00:41 ----A---- C:\WINDOWS\system32\nvrspl.dll
2009-11-12 23:00:40 ----A---- C:\WINDOWS\system32\nvwrsno.dll
2009-11-12 23:00:40 ----A---- C:\WINDOWS\system32\nvwrsnl.dll
2009-11-12 23:00:40 ----A---- C:\WINDOWS\system32\nvrsno.dll
2009-11-12 23:00:40 ----A---- C:\WINDOWS\system32\nvrsnl.dll
2009-11-12 23:00:39 ----A---- C:\WINDOWS\system32\nvwrsko.dll
2009-11-12 23:00:39 ----A---- C:\WINDOWS\system32\nvwrsja.dll
2009-11-12 23:00:39 ----A---- C:\WINDOWS\system32\nvwrsit.dll
2009-11-12 23:00:38 ----A---- C:\WINDOWS\system32\nvwrshu.dll
2009-11-12 23:00:38 ----A---- C:\WINDOWS\system32\nvwrshe.dll
2009-11-12 23:00:38 ----A---- C:\WINDOWS\system32\nvrshu.dll
2009-11-12 23:00:38 ----A---- C:\WINDOWS\system32\nvrshe.dll
2009-11-12 23:00:37 ----A---- C:\WINDOWS\system32\nvwrsfr.dll
2009-11-12 23:00:37 ----A---- C:\WINDOWS\system32\nvwrsfi.dll
2009-11-12 23:00:37 ----A---- C:\WINDOWS\system32\nvwrsesm.dll
2009-11-12 23:00:37 ----A---- C:\WINDOWS\system32\nvrsfi.dll
2009-11-12 23:00:37 ----A---- C:\WINDOWS\system32\nvrsesm.dll
2009-11-12 23:00:36 ----A---- C:\WINDOWS\system32\nvwrses.dll
2009-11-12 23:00:36 ----A---- C:\WINDOWS\system32\nvwrseng.dll
2009-11-12 23:00:36 ----A---- C:\WINDOWS\system32\nvrseng.dll
2009-11-12 23:00:35 ----A---- C:\WINDOWS\system32\nvwrsel.dll
2009-11-12 23:00:35 ----A---- C:\WINDOWS\system32\nvwrsde.dll
2009-11-12 23:00:35 ----A---- C:\WINDOWS\system32\nvwrsda.dll
2009-11-12 23:00:35 ----A---- C:\WINDOWS\system32\nvrsel.dll
2009-11-12 23:00:35 ----A---- C:\WINDOWS\system32\nvrsda.dll
2009-11-12 23:00:34 ----A---- C:\WINDOWS\system32\nvwrscs.dll
2009-11-12 23:00:34 ----A---- C:\WINDOWS\system32\nvwrsar.dll
2009-11-12 23:00:34 ----A---- C:\WINDOWS\system32\nvrscs.dll
2009-11-12 23:00:34 ----A---- C:\WINDOWS\system32\nvrsar.dll
2009-11-12 22:42:34 ----D---- C:\Program Files\SystemRequirementsLab
2009-11-12 22:42:22 ----D---- C:\Documents and Settings\Soni\Application Data\SystemRequirementsLab
2009-11-12 21:50:42 ----A---- C:\WINDOWS\system32\Log_20091112_215042_840.txt
2009-11-12 21:45:05 ----A---- C:\WINDOWS\system32\Log_20091112_214505_294.txt
2009-11-12 21:39:50 ----D---- C:\Program Files\PixiePack Codec Pack
2009-11-12 21:36:04 ----D---- C:\Documents and Settings\All Users\Application Data\RapidSolution
2009-11-11 10:22:53 ----HDC---- C:\WINDOWS\$NtUninstallKB969947$
2009-11-08 17:08:43 ----D---- C:\Program Files\SopCast
2009-11-02 18:46:03 ----D---- C:\Documents and Settings\Soni\Application Data\Thunderbird
2009-11-02 15:45:27 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer
2009-11-02 15:45:18 ----D---- C:\Program Files\QT Lite
2009-11-02 13:12:56 ----A---- C:\WINDOWS\system32\msonpmon.dll
2009-11-02 13:12:06 ----D---- C:\Program Files\Microsoft Works
2009-11-02 13:11:07 ----D---- C:\Program Files\Microsoft Visual Studio
2009-11-02 13:11:07 ----D---- C:\Program Files\Common Files\DESIGNER
2009-11-02 13:09:56 ----D---- C:\Program Files\Microsoft.NET
2009-11-02 13:07:44 ----D---- C:\Program Files\Microsoft Visual Studio 8
2009-11-02 13:06:17 ----D---- C:\WINDOWS\SHELLNEW
2009-11-02 13:04:01 ----D---- C:\Program Files\Microsoft Office
2009-11-02 13:03:59 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2009-11-02 13:02:52 ----RHD---- C:\MSOCache
2009-11-02 12:57:50 ----D---- C:\Documents and Settings\Soni\Application Data\Malwarebytes
2009-11-02 12:57:41 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-11-02 12:57:40 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-11-02 12:33:39 ----D---- C:\WINDOWS\pss
2009-11-02 12:32:39 ----D---- C:\WINDOWS\Sun
2009-11-02 08:58:47 ----RASHD---- C:\cmdcons
2009-11-02 08:57:46 ----D---- C:\WINDOWS\ERDNT
2009-11-02 07:41:22 ----D---- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2009-11-02 07:31:27 ----D---- C:\Documents and Settings\Soni\Application Data\Intel
2009-11-02 07:29:58 ----D---- C:\Documents and Settings\All Users\Application Data\Intel
2009-11-02 07:28:39 ----A---- C:\WINDOWS\system32\nvexpbar.dll
2009-11-02 07:28:39 ----A---- C:\WINDOWS\system32\nvcpluir.dll
2009-11-02 07:28:39 ----A---- C:\WINDOWS\system32\nvcplui.exe
2009-11-02 07:28:38 ----A---- C:\WINDOWS\system32\nwiz.exe
2009-11-02 07:28:38 ----A---- C:\WINDOWS\system32\nvwimg.dll
2009-11-02 07:28:38 ----A---- C:\WINDOWS\system32\nvwdmcpl.dll
2009-11-02 07:28:38 ----A---- C:\WINDOWS\system32\nvsysrot.dll
2009-11-02 07:28:38 ----A---- C:\WINDOWS\system32\nvshell.dll
2009-11-02 07:28:38 ----A---- C:\WINDOWS\system32\nvmccsrs.dll
2009-11-02 07:28:38 ----A---- C:\WINDOWS\system32\nview.dll
2009-11-02 07:28:38 ----A---- C:\WINDOWS\system32\nvgfx.dll
2009-11-02 07:28:38 ----A---- C:\WINDOWS\system32\nvdspsch.exe
2009-11-02 07:28:38 ----A---- C:\WINDOWS\system32\nvcolor.exe
2009-11-02 07:28:37 ----D---- C:\WINDOWS\nview
2009-11-02 07:28:37 ----A---- C:\WINDOWS\system32\nvappbar.exe
2009-11-02 07:28:37 ----A---- C:\WINDOWS\system32\keystone.exe
2009-11-02 07:27:55 ----A---- C:\WINDOWS\system32\NVUNINST.EXE
2009-11-02 07:25:27 ----D---- C:\Program Files\Realtek
2009-11-02 07:25:21 ----A---- C:\WINDOWS\RtlExUpd.dll
2009-11-02 07:22:10 ----A---- C:\WINDOWS\system32\CSVer.dll
2009-11-02 07:22:09 ----D---- C:\Program Files\Intel
2009-11-02 07:21:59 ----HD---- C:\Intel
2009-11-02 07:20:25 ----D---- C:\WINDOWS\system32\Adobe
2009-11-02 06:54:13 ----A---- C:\WINDOWS\system32\XceedZip.dll
2009-11-02 06:33:41 ----RAH---- C:\WINDOWS\system32\Vxdif.dll
2009-11-02 06:33:41 ----D---- C:\Program Files\Apoint
2009-11-02 03:50:42 ----A---- C:\WINDOWS\system32\mucltui.dll.mui
2009-11-02 03:50:42 ----A---- C:\WINDOWS\system32\mucltui.dll
2009-11-01 07:56:55 ----DC---- C:\WINDOWS\$NtUninstallWdf01009$
2009-11-01 07:56:13 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-11-01 07:40:15 ----D---- C:\Program Files\Driver-Soft
2009-11-01 07:39:42 ----HD---- C:\Config.Msi
2009-11-01 07:37:11 ----D---- C:\Documents and Settings\All Users\Application Data\UAB
2009-11-01 07:37:10 ----D---- C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
2009-11-01 07:25:07 ----A---- C:\WINDOWS\Model.txt
2009-11-01 07:17:43 ----D---- C:\Documents and Settings\Soni\Application Data\Google
2009-11-01 07:17:05 ----D---- C:\Program Files\Google
2009-10-31 20:12:41 ----HDC---- C:\WINDOWS\$NtUninstallKB961503$
2009-10-31 19:58:47 ----D---- C:\Program Files\Microsoft Silverlight
2009-10-31 19:57:54 ----D---- C:\Program Files\Microsoft
2009-10-31 19:57:34 ----D---- C:\Program Files\Windows Live SkyDrive
2009-10-31 19:57:07 ----D---- C:\Program Files\Windows Live
2009-10-31 19:38:17 ----D---- C:\Program Files\Common Files\Windows Live
2009-10-31 19:35:20 ----D---- C:\Documents and Settings\All Users\Application Data\WinZip
2009-10-31 19:35:16 ----D---- C:\Program Files\WinZip
2009-10-31 19:21:30 ----D---- C:\Documents and Settings\Soni\Application Data\Foxit
2009-10-31 19:21:29 ----D---- C:\Program Files\Foxit Software
2009-10-31 19:20:32 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-10-31 19:20:11 ----D---- C:\Program Files\Java
2009-10-31 19:19:38 ----D---- C:\Documents and Settings\Soni\Application Data\Macromedia
2009-10-31 19:19:38 ----D---- C:\Documents and Settings\Soni\Application Data\Adobe
2009-10-31 19:13:11 ----D---- C:\Documents and Settings\Soni\Application Data\Sun
2009-10-31 19:12:58 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$
2009-10-31 19:12:37 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$
2009-10-31 19:12:29 ----HDC---- C:\WINDOWS\$NtUninstallKB929399$
2009-10-31 19:11:56 ----HDC---- C:\WINDOWS\$NtUninstallKB939683$
2009-10-31 19:11:18 ----HDC---- C:\WINDOWS\$NtUninstallKB941569$
2009-10-31 19:07:16 ----D---- C:\Documents and Settings\All Users\Application Data\Google
2009-10-31 18:59:30 ----D---- C:\WINDOWS\system32\Lang
2009-10-31 18:57:38 ----D---- C:\Documents and Settings\Soni\Application Data\ESET
2009-10-31 18:57:22 ----SHD---- C:\RECYCLER
2009-10-31 18:56:33 ----D---- C:\Program Files\ESET
2009-10-31 18:56:33 ----D---- C:\Documents and Settings\All Users\Application Data\ESET
2009-10-31 18:54:56 ----D---- C:\Documents and Settings\Soni\Application Data\Mozilla
2009-10-31 18:54:50 ----D---- C:\Program Files\Mozilla Firefox
2009-10-31 18:52:40 ----HDC---- C:\WINDOWS\$NtUninstallKB971513$
2009-10-31 18:52:35 ----HDC---- C:\WINDOWS\$NtUninstallKB975467$
2009-10-31 18:52:29 ----HDC---- C:\WINDOWS\$NtUninstallKB968389$
2009-10-31 18:52:07 ----D---- C:\Documents and Settings\All Users\Application Data\Sony Corporation
2009-10-31 18:51:41 ----HDC---- C:\WINDOWS\$NtUninstallKB969059$
2009-10-31 18:51:37 ----HDC---- C:\WINDOWS\$NtUninstallKB958869$
2009-10-31 18:51:29 ----HDC---- C:\WINDOWS\$NtUninstallKB971486$
2009-10-31 18:51:24 ----HDC---- C:\WINDOWS\$NtUninstallKB974112$
2009-10-31 18:51:19 ----HDC---- C:\WINDOWS\$NtUninstallKB974571$
2009-10-31 18:51:15 ----HDC---- C:\WINDOWS\$NtUninstallKB975025$
2009-10-31 18:51:11 ----HDC---- C:\WINDOWS\$NtUninstallKB954155_WM9$
2009-10-31 18:51:07 ----HDC---- C:\WINDOWS\$NtUninstallKB973525$
2009-10-31 18:51:00 ----HDC---- C:\WINDOWS\$NtUninstallKB974455$
2009-10-31 18:50:53 ----HDC---- C:\WINDOWS\$NtUninstallKB968816_WM9$
2009-10-31 18:50:50 ----HDC---- C:\WINDOWS\$NtUninstallKB971961$
2009-10-31 18:50:45 ----HDC---- C:\WINDOWS\$NtUninstallKB956844$
2009-10-31 18:50:18 ----D---- C:\WINDOWS\ie8updates
2009-10-31 18:49:46 ----D---- C:\WINDOWS\WBEM
2009-10-31 18:48:20 ----HDC---- C:\WINDOWS\ie8
2009-10-31 18:47:15 ----A---- C:\WINDOWS\system32\MRT.exe
2009-10-31 18:45:34 ----HDC---- C:\WINDOWS\$NtUninstallKB961371-v2$
2009-10-31 18:45:27 ----HDC---- C:\WINDOWS\$NtUninstallKB970653-v3$
2009-10-31 18:45:24 ----HDC---- C:\WINDOWS\$NtUninstallKB971657$
2009-10-31 18:45:19 ----HDC---- C:\WINDOWS\$NtUninstallKB973815$
2009-10-31 18:45:13 ----HDC---- C:\WINDOWS\$NtUninstallKB960859$
2009-10-31 18:45:09 ----HDC---- C:\WINDOWS\$NtUninstallKB973507$
2009-10-31 18:45:05 ----HDC---- C:\WINDOWS\$NtUninstallKB973354$
2009-10-31 18:44:54 ----HDC---- C:\WINDOWS\$NtUninstallKB956744$
2009-10-31 18:44:49 ----HDC---- C:\WINDOWS\$NtUninstallKB973869$
2009-10-31 18:44:41 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9$
2009-10-31 18:44:37 ----HDC---- C:\WINDOWS\$NtUninstallKB971557$
2009-10-31 18:44:32 ----HDC---- C:\WINDOWS\$NtUninstallKB971633$
2009-10-31 18:40:30 ----D---- C:\WINDOWS\system32\XPSViewer
2009-10-31 18:40:26 ----D---- C:\Program Files\MSBuild
2009-10-31 18:40:20 ----D---- C:\Program Files\Reference Assemblies
2009-10-31 18:39:53 ----N---- C:\WINDOWS\system32\xpssvcs.dll
2009-10-31 18:39:53 ----N---- C:\WINDOWS\system32\xpsshhdr.dll
2009-10-31 18:39:53 ----N---- C:\WINDOWS\system32\prntvpt.dll
2009-10-31 18:37:08 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2009-10-31 18:37:03 ----HDC---- C:\WINDOWS\$NtUninstallKB968537$
2009-10-31 18:36:59 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2009-10-31 18:36:54 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2009-10-31 18:36:50 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2009-10-31 18:36:43 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2009-10-31 18:36:32 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2009-10-31 18:36:26 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2009-10-31 18:36:20 ----HDC---- C:\WINDOWS\$NtUninstallbasecsp$
2009-10-31 18:36:11 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2009-10-31 18:36:07 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2009-10-31 18:36:03 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2009-10-31 18:35:59 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2009-10-31 18:35:54 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2009-10-31 18:35:50 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2009-10-31 18:35:45 ----HDC---- C:\WINDOWS\$NtUninstallKB943729$
2009-10-31 18:35:39 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2009-10-31 18:35:34 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2009-10-31 18:35:29 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2009-10-31 18:35:25 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2009-10-31 18:35:21 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2009-10-31 18:35:17 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2009-10-31 18:35:13 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2009-10-31 18:35:09 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2009-10-31 18:35:05 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2009-10-31 18:34:59 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2009-10-31 18:34:53 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2009-10-31 18:34:49 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2009-10-31 18:34:43 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2009-10-31 18:34:35 ----N---- C:\WINDOWS\system32\spmsg.dll
2009-10-31 18:34:34 ----HDC---- C:\WINDOWS\$NtUninstallMSCompPackV1$
2009-10-31 18:34:23 ----D---- C:\Program Files\Windows Media Connect 2
2009-10-31 18:34:12 ----HDC---- C:\WINDOWS\$NtUninstallwmp11$
2009-10-31 18:33:40 ----HDC---- C:\WINDOWS\$NtUninstallWMFDist11$
2009-10-31 18:33:21 ----D---- C:\WINDOWS\system32\LogFiles
2009-10-31 18:33:17 ----HDC---- C:\WINDOWS\$NtUninstallWudf01000$
2009-10-31 18:32:22 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-10-31 18:31:26 ----RSD---- C:\WINDOWS\assembly
2009-10-31 18:31:26 ----D---- C:\WINDOWS\Microsoft.NET
2009-10-31 18:31:25 ----D---- C:\WINDOWS\system32\URTTemp
2009-10-31 18:30:15 ----A---- C:\WINDOWS\system32\msvcr71.dll
2009-10-31 18:30:15 ----A---- C:\WINDOWS\system32\msvcp71.dll
2009-10-31 18:30:15 ----A---- C:\WINDOWS\system32\MFC71u.dll
2009-10-31 18:29:13 ----A---- C:\WINDOWS\VAIOUpdt.INI
2009-10-31 18:28:34 ----A---- C:\WINDOWS\system32\VESWinlogon.dll
2009-10-31 18:28:19 ----A---- C:\WINDOWS\system32\mfc70.dll
2009-10-31 18:27:56 ----D---- C:\Documents and Settings\Soni\Application Data\Sony Corporation
2009-10-31 18:27:55 ----A---- C:\WINDOWS\system32\msvcp70.dll
2009-10-31 18:27:55 ----A---- C:\WINDOWS\system32\mfc70u.dll
2009-10-31 18:27:54 ----D---- C:\Program Files\Sony
2009-10-31 18:27:10 ----HD---- C:\Program Files\InstallShield Installation Information
2009-10-31 18:27:10 ----D---- C:\Program Files\Common Files\Sony Shared
2009-10-31 18:27:10 ----A---- C:\WINDOWS\system32\msvcr70.dll
2009-10-31 18:27:00 ----D---- C:\Program Files\Common Files\InstallShield
2009-10-31 18:17:14 ----N---- C:\WINDOWS\system32\xpsp4res.dll
2009-10-31 18:09:55 ----D---- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2009-10-31 18:09:52 ----D---- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2009-10-31 18:04:20 ----D---- C:\WINDOWS\system32\PreInstall
2009-10-31 18:04:19 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2009-10-31 18:04:18 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2009-10-31 18:04:18 ----HD---- C:\WINDOWS\$hf_mig$
2009-10-31 18:02:45 ----RA---- C:\WINDOWS\system32\mdmxsdk.dll
2009-10-31 18:02:45 ----RA---- C:\WINDOWS\system32\hsfci015.dll
2009-10-31 18:02:45 ----D---- C:\Program Files\CONEXANT
2009-10-31 17:56:54 ----A---- C:\WINDOWS\system32\nvudisp.exe
2009-10-31 17:51:32 ----D---- C:\WINDOWS\system32\RTCOM
2009-10-31 17:51:32 ----A---- C:\WINDOWS\ALCMTR.EXE
2009-10-31 17:51:31 ----A---- C:\WINDOWS\ALCWZRD.EXE
2009-10-31 17:51:27 ----A---- C:\WINDOWS\SOUNDMAN.EXE
2009-10-31 17:51:27 ----A---- C:\WINDOWS\RTLCPL.EXE
2009-10-31 17:51:25 ----A---- C:\WINDOWS\MicCal.exe
2009-10-31 17:51:20 ----A---- C:\WINDOWS\RTHDCPL.EXE
2009-10-31 17:51:14 ----N---- C:\WINDOWS\system32\ksuser.dll
2009-10-31 17:50:36 ----RA---- C:\WINDOWS\system32\IntelNic.dll
2009-10-31 17:50:36 ----A---- C:\WINDOWS\system32\e100bmsg.dll
2009-10-31 17:50:35 ----A---- C:\WINDOWS\system32\Prounstl.exe
2009-10-31 17:46:56 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2009-10-31 17:36:57 ----D---- C:\Documents and Settings\Soni\Application Data\Identities
2009-10-31 17:36:55 ----HD---- C:\Program Files\Uninstall Information
2009-10-31 17:36:48 ----ASH---- C:\Documents and Settings\Soni\Application Data\desktop.ini
2009-10-31 17:36:47 ----SD---- C:\Documents and Settings\Soni\Application Data\Microsoft
2009-10-31 17:36:04 ----D---- C:\WINDOWS\SoftwareDistribution
2009-10-31 17:36:02 ----D---- C:\WINDOWS\Prefetch
2009-10-31 17:36:00 ----SD---- C:\WINDOWS\system32\Microsoft
2009-10-31 17:35:59 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-10-31 17:32:24 ----D---- C:\WINDOWS\system32\xircom
2009-10-31 17:32:24 ----D---- C:\Program Files\xerox
2009-10-31 17:32:24 ----D---- C:\Program Files\microsoft frontpage
2009-10-31 17:32:03 ----A---- C:\WINDOWS\control.ini
2009-10-31 17:32:03 ----A---- C:\AUTOEXEC.BAT
2009-10-31 17:31:47 ----A---- C:\WINDOWS\OEWABLog.txt
2009-10-31 17:31:42 ----A---- C:\WINDOWS\system32\mapi32.dll
2009-10-31 17:30:51 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-10-31 17:30:51 ----RD---- C:\WINDOWS\Offline Web Pages
2009-10-31 17:30:51 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2009-10-31 17:30:45 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2009-10-31 17:30:41 ----HD---- C:\Program Files\WindowsUpdate
2009-10-31 17:30:11 ----D---- C:\WINDOWS\system32\DirectX
2009-10-31 17:29:54 ----A---- C:\WINDOWS\system32\atrace.dll
2009-10-31 17:29:49 ----A---- C:\WINDOWS\system32\desktop.ini
2009-10-31 17:29:49 ----A---- C:\WINDOWS\desktop.ini
2009-10-31 17:29:37 ----A---- C:\WINDOWS\system32\nmevtmsg.dll
2009-10-31 17:29:35 ----A---- C:\WINDOWS\system32\acctres.dll
2009-10-31 17:29:34 ----D---- C:\Program Files\Common Files\Services
2009-10-31 17:29:30 ----SD---- C:\WINDOWS\Tasks
2009-10-31 17:29:30 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2009-10-31 17:29:29 ----D---- C:\Program Files\Common Files\MSSoap
2009-10-31 17:29:19 ----D---- C:\WINDOWS\srchasst
2009-10-31 17:29:17 ----D---- C:\WINDOWS\system32\Macromed
2009-10-31 17:29:11 ----A---- C:\WINDOWS\system32\wuweb.dll
2009-10-31 17:29:11 ----A---- C:\WINDOWS\system32\wucltui.dll
2009-10-31 17:29:11 ----A---- C:\WINDOWS\system32\wuauserv.dll
2009-10-31 17:29:11 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2009-10-31 17:29:10 ----A---- C:\WINDOWS\system32\wups.dll
2009-10-31 17:29:10 ----A---- C:\WINDOWS\system32\wuaueng.dll
2009-10-31 17:29:09 ----N---- C:\WINDOWS\system32\wuauclt.exe
2009-10-31 17:29:09 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2009-10-31 17:29:09 ----A---- C:\WINDOWS\system32\wuapi.dll
2009-10-31 17:29:09 ----A---- C:\WINDOWS\system32\bitsprx4.dll
2009-10-31 17:29:09 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2009-10-31 17:29:09 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2009-10-31 17:29:08 ----N---- C:\WINDOWS\system32\qmgr.dll
2009-10-31 17:29:08 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2009-10-31 17:28:59 ----D---- C:\Program Files\Movie Maker
2009-10-31 17:28:35 ----A---- C:\WINDOWS\system32\safrslv.dll
2009-10-31 17:28:35 ----A---- C:\WINDOWS\system32\safrdm.dll
2009-10-31 17:28:35 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2009-10-31 17:28:35 ----A---- C:\WINDOWS\system32\racpldlg.dll
2009-10-31 17:28:29 ----A---- C:\WINDOWS\system32\fltMc.exe
2009-10-31 17:28:29 ----A---- C:\WINDOWS\system32\fltlib.dll
2009-10-31 17:28:28 ----N---- C:\WINDOWS\system32\srsvc.dll
2009-10-31 17:28:28 ----D---- C:\WINDOWS\system32\Restore
2009-10-31 17:28:28 ----A---- C:\WINDOWS\system32\srrstr.dll
2009-10-31 17:28:28 ----A---- C:\WINDOWS\system32\srclient.dll
2009-10-31 17:28:27 ----A---- C:\WINDOWS\system32\mnmdd.dll
2009-10-31 17:28:27 ----A---- C:\WINDOWS\system32\isrdbg32.dll
2009-10-31 17:28:27 ----A---- C:\WINDOWS\system32\ils.dll
2009-10-31 17:28:26 ----A---- C:\WINDOWS\system32\nmmkcert.dll
2009-10-31 17:28:26 ----A---- C:\WINDOWS\system32\msconf.dll
2009-10-31 17:28:26 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2009-10-31 17:28:23 ----D---- C:\Program Files\NetMeeting
2009-10-31 17:28:22 ----A---- C:\WINDOWS\system32\msoert2.dll
2009-10-31 17:28:22 ----A---- C:\WINDOWS\system32\msoeacct.dll
2009-10-31 17:28:20 ----A---- C:\WINDOWS\system32\inetres.dll
2009-10-31 17:28:20 ----A---- C:\WINDOWS\system32\inetcomm.dll
2009-10-31 17:28:17 ----N---- C:\WINDOWS\system32\schedsvc.dll
2009-10-31 17:28:17 ----D---- C:\Program Files\Outlook Express
2009-10-31 17:28:17 ----A---- C:\WINDOWS\system32\mstinit.exe
2009-10-31 17:28:16 ----A---- C:\WINDOWS\system32\mstask.dll
2009-10-31 17:28:16 ----A---- C:\WINDOWS\system32\icwphbk.dll
2009-10-31 17:28:16 ----A---- C:\WINDOWS\system32\icwdial.dll
2009-10-31 17:28:15 ----A---- C:\WINDOWS\system32\isign32.dll
2009-10-31 17:28:15 ----A---- C:\WINDOWS\system32\inetcfg.dll
2009-10-31 17:28:08 ----D---- C:\Program Files\Common Files\System
2009-10-31 17:28:04 ----D---- C:\Program Files\Internet Explorer
2009-10-31 17:27:25 ----D---- C:\Program Files\ComPlus Applications
2009-10-31 17:27:22 ----A---- C:\WINDOWS\vbaddin.ini
2009-10-31 17:27:22 ----A---- C:\WINDOWS\vb.ini
2009-10-31 17:27:17 ----D---- C:\WINDOWS\Registration
2009-10-31 17:27:07 ----D---- C:\Program Files\Windows Media Player
2009-10-31 17:26:57 ----D---- C:\Program Files\Messenger
2009-10-31 17:26:52 ----D---- C:\Program Files\MSN Gaming Zone
2009-10-31 17:26:52 ----A---- C:\WINDOWS\system32\write.exe
2009-10-31 17:26:43 ----A---- C:\WINDOWS\system32\sndvol32.exe
2009-10-31 17:26:42 ----A---- C:\WINDOWS\system32\hticons.dll
2009-10-31 17:26:42 ----A---- C:\WINDOWS\system32\avwav.dll
2009-10-31 17:26:42 ----A---- C:\WINDOWS\system32\avtapi.dll
2009-10-31 17:26:42 ----A---- C:\WINDOWS\system32\avmeter.dll
2009-10-31 17:26:41 ----A---- C:\WINDOWS\system32\winchat.exe
2009-10-31 17:26:34 ----A---- C:\WINDOWS\system32\getuname.dll
2009-10-31 17:26:34 ----A---- C:\WINDOWS\system32\charmap.exe
2009-10-31 17:26:33 ----A---- C:\WINDOWS\system32\sol.exe
2009-10-31 17:26:33 ----A---- C:\WINDOWS\system32\calc.exe
2009-10-31 17:26:32 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2009-10-31 17:26:32 ----A---- C:\WINDOWS\system32\tskill.exe
2009-10-31 17:26:32 ----A---- C:\WINDOWS\system32\reset.exe
2009-10-31 17:26:32 ----A---- C:\WINDOWS\system32\freecell.exe
2009-10-31 17:26:31 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2009-10-31 17:26:31 ----A---- C:\WINDOWS\system32\tslabels.ini
2009-10-31 17:26:31 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2009-10-31 17:26:31 ----A---- C:\WINDOWS\system32\tscon.exe
2009-10-31 17:26:31 ----A---- C:\WINDOWS\system32\shadow.exe
2009-10-31 17:26:31 ----A---- C:\WINDOWS\system32\rwinsta.exe
2009-10-31 17:26:31 ----A---- C:\WINDOWS\system32\regini.exe
2009-10-31 17:26:31 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2009-10-31 17:26:31 ----A---- C:\WINDOWS\system32\qwinsta.exe
2009-10-31 17:26:31 ----A---- C:\WINDOWS\system32\qappsrv.exe
2009-10-31 17:26:31 ----A---- C:\WINDOWS\system32\msg.exe
2009-10-31 17:26:30 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2009-10-31 17:26:30 ----A---- C:\WINDOWS\system32\logoff.exe
2009-10-31 17:26:30 ----A---- C:\WINDOWS\system32\cdmodem.dll
2009-10-31 17:26:23 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2009-10-31 17:26:05 ----D---- C:\Program Files\MSN
2009-10-31 17:26:04 ----A---- C:\WINDOWS\system32\sndrec32.exe
2009-10-31 17:26:04 ----A---- C:\WINDOWS\system32\accwiz.exe
2009-10-31 17:26:03 ----A---- C:\WINDOWS\system32\mplay32.exe
2009-10-31 17:26:03 ----A---- C:\WINDOWS\system32\hypertrm.dll
2009-10-31 17:26:02 ----D---- C:\Program Files\Windows NT
2009-10-31 17:26:02 ----A---- C:\WINDOWS\system32\mspaint.exe
2009-10-31 17:26:02 ----A---- C:\WINDOWS\system32\clipbrd.exe
2009-10-31 17:26:01 ----D---- C:\WINDOWS\system32\en-US
2009-10-31 17:26:01 ----A---- C:\WINDOWS\system32\spider.exe
2009-10-31 17:26:00 ----A---- C:\WINDOWS\system32\tsgqec.dll
2009-10-31 17:26:00 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2009-10-31 17:26:00 ----A---- C:\WINDOWS\system32\rhttpaa.dll
2009-10-31 17:25:59 ----A---- C:\WINDOWS\system32\aaclient.dll
2009-10-31 17:25:58 ----A---- C:\WINDOWS\system32\mstscax.dll
2009-10-31 17:25:58 ----A---- C:\WINDOWS\system32\mstsc.exe
2009-10-31 17:25:57 ----N---- C:\WINDOWS\system32\termsrv.dll
2009-10-31 17:25:57 ----A---- C:\WINDOWS\system32\sessmgr.exe
2009-10-31 17:25:57 ----A---- C:\WINDOWS\system32\remotepg.dll
2009-10-31 17:25:57 ----A---- C:\WINDOWS\system32\rdshost.exe
2009-10-31 17:25:57 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2009-10-31 17:25:57 ----A---- C:\WINDOWS\system32\rdchost.dll
2009-10-31 17:25:56 ----D---- C:\WINDOWS\system32\MsDtc
2009-10-31 17:25:56 ----A---- C:\WINDOWS\system32\rdpwsx.dll
2009-10-31 17:25:56 ----A---- C:\WINDOWS\system32\rdpsnd.dll
2009-10-31 17:25:56 ----A---- C:\WINDOWS\system32\rdpclip.exe
2009-10-31 17:25:56 ----A---- C:\WINDOWS\system32\qprocess.exe
2009-10-31 17:25:56 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2009-10-31 17:25:56 ----A---- C:\WINDOWS\system32\icaapi.dll
2009-10-31 17:25:56 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2009-10-31 17:25:55 ----A---- C:\WINDOWS\system32\mtxoci.dll
2009-10-31 17:25:55 ----A---- C:\WINDOWS\system32\msdtctm.dll
2009-10-31 17:25:55 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2009-10-31 17:25:54 ----A---- C:\WINDOWS\system32\xolehlp.dll
2009-10-31 17:25:54 ----A---- C:\WINDOWS\system32\msdtclog.dll
2009-10-31 17:25:54 ----A---- C:\WINDOWS\system32\msdtc.exe
2009-10-31 17:25:53 ----D---- C:\WINDOWS\system32\Com
2009-10-31 17:25:53 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2009-10-31 17:25:53 ----A---- C:\WINDOWS\system32\mtxex.dll
2009-10-31 17:25:53 ----A---- C:\WINDOWS\system32\mtxdm.dll
2009-10-31 17:25:53 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2009-10-31 17:25:53 ----A---- C:\WINDOWS\system32\colbact.dll
2009-10-31 17:25:52 ----A---- C:\WINDOWS\system32\stclient.dll
2009-10-31 17:25:52 ----A---- C:\WINDOWS\system32\comrepl.dll
2009-10-31 17:25:52 ----A---- C:\WINDOWS\system32\comaddin.dll
2009-10-31 17:25:52 ----A---- C:\WINDOWS\system32\clbcatex.dll
2009-10-31 17:25:52 ----A---- C:\WINDOWS\system32\catsrvps.dll
2009-10-31 17:25:51 ----A---- C:\WINDOWS\system32\catsrvut.dll
2009-10-31 17:25:51 ----A---- C:\WINDOWS\system32\catsrv.dll
2009-10-31 17:25:50 ----A---- C:\WINDOWS\system32\comuid.dll
2009-10-31 17:25:50 ----A---- C:\WINDOWS\system32\comsvcs.dll
2009-10-31 17:25:50 ----A---- C:\WINDOWS\system32\comsnap.dll
2009-10-31 17:25:49 ----A---- C:\WINDOWS\system32\clbcatq.dll
2009-10-31 17:25:41 ----A---- C:\WINDOWS\system32\servdeps.dll
2009-10-31 17:25:41 ----A---- C:\WINDOWS\system32\mmfutil.dll
2009-10-31 17:25:41 ----A---- C:\WINDOWS\system32\licwmi.dll
2009-10-31 17:25:40 ----A---- C:\WINDOWS\system32\cmprops.dll
2009-10-31 17:23:37 ----A---- C:\WINDOWS\system32\h323log.txt
2009-10-31 17:21:10 ----A---- C:\WINDOWS\system32\usbui.dll
2009-10-31 17:20:00 ----SHD---- C:\WINDOWS\Installer
2009-10-31 17:20:00 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-10-31 17:19:59 ----D---- C:\Program Files\Common Files\ODBC
2009-10-31 17:19:59 ----A---- C:\WINDOWS\ODBCINST.INI
2009-10-31 17:19:54 ----D---- C:\Program Files\Common Files\SpeechEngines
2009-10-31 17:19:51 ----D---- C:\Program Files\Common Files\Microsoft Shared
2009-10-31 17:19:50 ----RD---- C:\Program Files
2009-10-31 17:19:50 ----D---- C:\Program Files\Common Files
2009-10-31 17:19:44 ----A---- C:\WINDOWS\system32\spxcoins.dll
2009-10-31 17:19:44 ----A---- C:\WINDOWS\system32\irclass.dll
2009-10-31 17:19:44 ----A---- C:\WINDOWS\system32\EqnClass.Dll
2009-10-31 17:19:44 ----A---- C:\WINDOWS\system32\dgsetup.dll
2009-10-31 17:19:44 ----A---- C:\WINDOWS\system32\dgrpsetu.dll
2009-10-31 17:19:42 ----A---- C:\WINDOWS\TASKMAN.EXE
2009-10-31 17:19:41 ----N---- C:\WINDOWS\system32\CONFIG.TMP
2009-10-31 17:19:41 ----A---- C:\WINDOWS\system32\batt.dll
2009-10-31 17:19:40 ----A---- C:\WINDOWS\NOTEPAD.EXE
2009-10-31 17:19:38 ----A---- C:\WINDOWS\system32\storprop.dll
2009-10-31 17:19:27 ----ASH---- C:\Documents and Settings\All Users\Application Data\desktop.ini
2009-10-31 17:19:11 ----D---- C:\WINDOWS\system32\CatRoot2
2009-10-31 17:19:11 ----D---- C:\WINDOWS\system32\CatRoot
2009-10-31 17:19:05 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2009-10-31 17:18:44 ----A---- C:\WINDOWS\setuplog.txt
2009-10-31 17:18:39 ----D---- C:\Documents and Settings
2009-10-31 17:18:38 ----SHD---- C:\System Volume Information
2009-10-31 17:18:05 ----RASH---- C:\boot.ini
2009-10-31 17:13:28 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-10-31 17:13:28 ----RSD---- C:\WINDOWS\Fonts
2009-10-31 17:13:28 ----RD---- C:\WINDOWS\Web
2009-10-31 17:13:28 ----HD---- C:\WINDOWS\inf
2009-10-31 17:13:28 ----D---- C:\WINDOWS\WinSxS
2009-10-31 17:13:28 ----D---- C:\WINDOWS\twain_32
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system32\wins
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system32\wbem
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system32\usmt
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system32\spool
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system32\ShellExt
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system32\Setup
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system32\scripting
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system32\ras
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system32\oobe
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system32\npp
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system32\mui
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system32\inetsrv
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system32\IME
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system32\icsxml
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system32\ias
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system32\export
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system32\en
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system32\dhcp
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system32\3com_dmi
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system32\3076
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system32\2052
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system32\1054
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system32\1042
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system32\1041
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system32\1037
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system32\1033
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system32\1031
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system32\1028
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system32\1025
2009-10-31 17:13:28 ----D---- C:\WINDOWS\system
2009-10-31 17:13:28 ----D---- C:\WINDOWS\security
2009-10-31 17:13:28 ----D---- C:\WINDOWS\Resources
2009-10-31 17:13:28 ----D---- C:\WINDOWS\repair
2009-10-31 17:13:28 ----D---- C:\WINDOWS\Provisioning
2009-10-31 17:13:28 ----D---- C:\WINDOWS\PeerNet
2009-10-31 17:13:28 ----D---- C:\WINDOWS\pchealth
2009-10-31 17:13:28 ----D---- C:\WINDOWS\NLDRV
2009-10-31 17:13:28 ----D---- C:\WINDOWS\Network Diagnostic
2009-10-31 17:13:28 ----D---- C:\WINDOWS\mui
2009-10-31 17:13:28 ----D---- C:\WINDOWS\msapps
2009-10-31 17:13:28 ----D---- C:\WINDOWS\msagent
2009-10-31 17:13:28 ----D---- C:\WINDOWS\Media
2009-10-31 17:13:28 ----D---- C:\WINDOWS\L2Schemas
2009-10-31 17:13:28 ----D---- C:\WINDOWS\java
2009-10-31 17:13:28 ----D---- C:\WINDOWS\ime
2009-10-31 17:13:28 ----D---- C:\WINDOWS\Help
2009-10-31 17:13:28 ----D---- C:\WINDOWS\ehome
2009-10-31 17:13:28 ----D---- C:\WINDOWS\Driver Cache
2009-10-31 17:13:28 ----D---- C:\WINDOWS\Debug
2009-10-31 17:13:28 ----D---- C:\WINDOWS\Cursors
2009-10-31 17:13:28 ----D---- C:\WINDOWS\Connection Wizard
2009-10-31 17:13:28 ----D---- C:\WINDOWS\Config
2009-10-31 17:13:28 ----D---- C:\WINDOWS\AppPatch
2009-10-31 17:13:28 ----D---- C:\WINDOWS\addins
2009-10-31 17:13:27 ----D---- C:\WINDOWS\system32\drivers
2009-10-31 17:13:27 ----D---- C:\WINDOWS\system32\config
2009-10-31 17:13:27 ----D---- C:\WINDOWS\system32
2009-10-31 17:13:27 ----D---- C:\WINDOWS

======List of files/folders modified in the last 1 months======

2009-11-13 20:00:49 ----A---- C:\WINDOWS\win.ini
2009-11-13 20:00:49 ----A---- C:\WINDOWS\system.ini
2009-10-22 09:19:04 ----N---- C:\WINDOWS\system32\mshtml.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 DMICall;Sony DMI Call service; C:\WINDOWS\system32\DRIVERS\DMICall.sys [2000-12-05 3952]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2009-09-11 108792]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2009-09-11 55768]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 36352]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2009-09-11 116008]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2009-09-11 135048]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2004-03-17 13059]
R2 s24trans;WLAN Transport; C:\WINDOWS\system32\DRIVERS\s24trans.sys [2008-08-13 11904]
R3 ApfiltrService;Alps Pointing-device Filter Driver; C:\WINDOWS\system32\DRIVERS\Apfiltr.sys [2003-09-29 94601]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-14 13952]
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2009-06-19 33096]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys [2005-05-23 1034752]
R3 HSFHWAZL;HSFHWAZL; C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys [2005-05-23 178048]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2009-10-06 5922816]
R3 MBAMProtector;MBAMProtector; \??\C:\WINDOWS\system32\drivers\mbam.sys []
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-08-20 6596192]
R3 SNC;Sony Notebook Control Device; C:\WINDOWS\system32\DRIVERS\SonyNC.sys [2001-08-17 20752]
R3 tifmsony;tifmsony; C:\WINDOWS\system32\drivers\tifmsony.sys [2007-02-28 80896]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
R3 w29n51;Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows XP; C:\WINDOWS\system32\DRIVERS\w29n51.sys [2008-01-07 2216064]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2005-05-23 716288]
S3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
S3 catchme;catchme; \??\C:\DOCUME~1\Soni\LOCALS~1\Temp\catchme.sys []
S3 E100B;Intel(R) PRO Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2007-11-16 165496]
S3 MEMSWEEP2;MEMSWEEP2; \??\C:\WINDOWS\system32\490.tmp []
S3 NAL;Nal Service ; \??\C:\WINDOWS\system32\Drivers\iqvw32.sys []
S3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
S3 tbhsd;Tunebite High-Speed Dubbing; C:\WINDOWS\system32\drivers\tbhsd.sys [2008-11-04 43552]
S3 tifm;tifm; C:\WINDOWS\system32\drivers\tifm.sys [2006-04-01 66816]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2009-09-11 735960]
R2 EvtEng;Intel(R) PROSet/Wireless Event Log; C:\Program Files\Intel\WiFi\bin\EvtEng.exe [2009-02-27 870672]
R2 MBAMService;MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2009-09-10 269648]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-08-20 159813]
R2 RegSrvc;Intel(R) PROSet/Wireless Registry Service; C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe [2009-02-27 473360]
R2 S24EventMonitor;Intel(R) PROSet/Wireless WiFi Service; C:\Program Files\Intel\WiFi\bin\S24EvMon.exe [2009-02-27 909312]
R2 VAIO Event Service;VAIO Event Service; C:\Program Files\Sony\VAIO Event Service\VESMgr.exe [2005-05-20 153600]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-03-30 1533808]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2009-09-11 20680]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-11-01 182768]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Info.txt

info.txt logfile of random's system information tool 1.06 2009-11-16 23:20:06

======Uninstall list======

-->MsiExec.exe /I{403EF592-953B-4794-BCEF-ECAB835C2095}
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0044-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-00BA-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0114-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0117-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Shockwave Player 11.5-->"C:\WINDOWS\system32\Adobe\Shockwave 11\uninstaller.exe"
Driver Genius Professional Edition-->"C:\Program Files\Driver-Soft\DriverGenius\unins000.exe"
Foxit Reader-->C:\Program Files\Foxit Software\Foxit Reader\Uninstall.exe
Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_FA58D781DE2D47E1.exe" /uninstall
Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
HDAUDIO SoftV92 Data Fax Modem with SmartCP-->C:\Program Files\CONEXANT\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_20030003\HXFSETUP.EXE -U -ISnyHDANk.inf
HijackThis 2.0.2-->"C:\Documents and Settings\Soni\Desktop\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows Media Player 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB970653-v3)-->"C:\WINDOWS\$NtUninstallKB970653-v3$\spuninst\spuninst.exe"
Intel PROSet Wireless-->Intel PROSet Wireless
Intel(R) Network Connections 14.7.23.0-->MsiExec.exe /i{4449B83C-1257-4355-8F3E-71280E922B5F} ARPREMOVE=1
Java(TM) 6 Update 17-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216016FF}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 1.1 Security Update (KB953297)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M953297\M953297Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Base Smart Card Cryptographic Service Provider Package-->"C:\WINDOWS\$NtUninstallbasecsp$\spuninst\spuninst.exe"
Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Office Access MUI (English) 2007-->MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
Microsoft Office Access Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
Microsoft Office Enterprise 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007-->MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Groove MUI (English) 2007-->MsiExec.exe /X{90120000-00BA-0409-0000-0000000FF1CE}
Microsoft Office Groove Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0114-0409-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (English) 2007-->MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE}
Microsoft Office Live Add-in 1.4-->MsiExec.exe /I{AE3CF174-872C-46C6-B9F6-C0593F3BC7B8}
Microsoft Office OneNote MUI (English) 2007-->MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2007-->MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Publisher MUI (English) 2007-->MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mozilla Firefox (3.5.5)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
NVIDIA Drivers-->C:\WINDOWS\system32\nvuninst.exe UninstallGUI
PixiePack Codec Pack-->MsiExec.exe /I{B2C3BB6B-E005-4246-B8E5-DF0A4D073CDC}
QT Lite 3.0.0-->"C:\Program Files\QT Lite\unins000.exe"
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x9 -removeonly
Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
Security Update for 2007 Microsoft Office System (KB973704)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {E626DC89-A787-4553-9BB3-DC2EC7E1593F}
Security Update for Microsoft Office Excel 2007 (KB973593)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {7D6255E3-3423-4D8B-A328-F6F8D28DD5FE}
Security Update for Microsoft Office Outlook 2007 (KB972363)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {120BE9A0-9B09-4855-9E0C-7DEE45CB03C0}
Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
Security Update for Microsoft Office Publisher 2007 (KB969693)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {7BE67088-1EB3-4569-8E75-DDAFBF61BC4E}
Security Update for Microsoft Office system 2007 (972581)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {3D019598-7B59-447A-80AE-815B703B84FF}
Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
Security Update for Microsoft Office system 2007 (KB974234)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC}
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {71127777-8B2C-4F97-AF7A-6CF8CAC8224D}
Security Update for Windows Internet Explorer 8 (KB971961)-->"C:\WINDOWS\ie8updates\KB971961-IE8\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 8 (KB974455)-->"C:\WINDOWS\ie8updates\KB974455-IE8\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB954155)-->"C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB968816)-->"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956744)-->"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958869)-->"C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe"
Security Update for Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"
Security Update for Windows XP (KB961371-v2)-->"C:\WINDOWS\$NtUninstallKB961371-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
Security Update for Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"
Security Update for Windows XP (KB969059)-->"C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe"
Security Update for Windows XP (KB969947)-->"C:\WINDOWS\$NtUninstallKB969947$\spuninst\spuninst.exe"
Security Update for Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
Security Update for Windows XP (KB971486)-->"C:\WINDOWS\$NtUninstallKB971486$\spuninst\spuninst.exe"
Security Update for Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"
Security Update for Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"
Security Update for Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"
Security Update for Windows XP (KB971961)-->"C:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.exe"
Security Update for Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"
Security Update for Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"
Security Update for Windows XP (KB973525)-->"C:\WINDOWS\$NtUninstallKB973525$\spuninst\spuninst.exe"
Security Update for Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"
Security Update for Windows XP (KB974112)-->"C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe"
Security Update for Windows XP (KB974455)-->"C:\WINDOWS\$NtUninstallKB974455$\spuninst\spuninst.exe"
Security Update for Windows XP (KB974571)-->"C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe"
Security Update for Windows XP (KB975025)-->"C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.exe"
Security Update for Windows XP (KB975467)-->"C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe"
Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
Setting Utility Series-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{59452470-A902-477F-9338-9B88101681BD}\Setup.exe" -l0x9 UNINSTALL
Sony MP4 Shared Library-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{01FDC9FC-4D4F-4DB0-ACD1-D3E8E1D52902}\setup.exe" -l0x9 -removeonly
Sony Utilities DLL-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EF3D45BB-2260-4008-88EA-492E7744A9DF}\setup.exe" -l0x9 -removeonly
Sony Video Shared Library-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BE56FEF0-1A0F-4719-B3AD-34B5087AFA6D}\setup.exe" -l0x9 -removeonly
SopCast 3.2.4-->C:\Program Files\SopCast\uninst.exe
Sophos Anti-Rootkit 1.5.0-->C:\Program Files\Sophos\Sophos Anti-Rootkit\helper.exe remove
System Requirements Lab-->C:\Program Files\SystemRequirementsLab\Uninstall.exe
Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
Update for Microsoft Office 2007 Help for Common Features (KB963673)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {AB365889-0395-4FAD-B702-CA5985D53D42}
Update for Microsoft Office Access 2007 Help (KB963663)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {6B76A18A-AA1E-42AB-A7AD-6C84BBB43987}
Update for Microsoft Office Excel 2007 Help (KB963678)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {199DF7B6-169C-448C-B511-1054101BE9C9}
Update for Microsoft Office Infopath 2007 Help (KB963662)-->msiexec /package {90120000-0044-0409-0000-0000000FF1CE} /uninstall {716B81B8-B13C-41DF-8EAC-7A2F656CAB63}
Update for Microsoft Office OneNote 2007 Help (KB963670)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {2744EF05-38E1-4D5D-B333-E021EDAEA245}
Update for Microsoft Office Outlook 2007 Help (KB963677)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {0451F231-E3E3-4943-AB9F-58EB96171784}
Update for Microsoft Office Powerpoint 2007 Help (KB963669)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {397B1D4F-ED7B-4ACA-A637-43B670843876}
Update for Microsoft Office Publisher 2007 Help (KB963667)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {2E40DE55-B289-4C8B-8901-5D369B16814F}
Update for Microsoft Office Script Editor Help (KB963671)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {CD11C6A2-FFC6-4271-8EAB-79C3582F505C}
Update for Microsoft Office Word 2007 (KB974561)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {0CDDBAA2-2111-4A0E-A1B0-76C40C635331}
Update for Microsoft Office Word 2007 Help (KB963665)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {80E762AA-C921-4839-9D7D-DB62A72C0726}
Update for Microsoft Windows (KB971513)-->"C:\WINDOWS\$NtUninstallKB971513$\spuninst\spuninst.exe"
Update for Outlook 2007 Junk Email Filter (kb975960)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {F1AB1BED-7477-4D5A-BD0C-04C2109459A5}
Update for Windows Internet Explorer 8 (KB975364)-->"C:\WINDOWS\ie8updates\KB975364-IE8\spuninst\spuninst.exe"
Update for Windows Internet Explorer 8 (KB976749)-->"C:\WINDOWS\ie8updates\KB976749-IE8\spuninst\spuninst.exe"
Update for Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Update for Windows XP (KB943729)-->"C:\WINDOWS\$NtUninstallKB943729$\spuninst\spuninst.exe"
Update for Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Update for Windows XP (KB961503)-->"C:\WINDOWS\$NtUninstallKB961503$\spuninst\spuninst.exe"
Update for Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Update for Windows XP (KB968389)-->"C:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.exe"
Update for Windows XP (KB973815)-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"
VAIO Control Center-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FC37C108-821D-4EDE-8F40-D5B497586805}\Setup.exe" -l0x9
VAIO Event Service-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F0D85ADD-DD61-4B43-87A0-6DA52A211A8B}\Setup.exe" -l0x9
VAIO Power Management-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9E319E96-ED8E-4B01-9775-C521A1869A25}\Setup.exe" -l0x9 UNINSTALL
Veetle TV 0.9.15-->C:\Program Files\Veetle\UninstallVeetleTV.exe
Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"
Windows Live Call-->MsiExec.exe /I{F6BD194C-4190-4D73-B1B1-C48C99921BFE}
Windows Live Communications Platform-->MsiExec.exe /I{ED00D08A-3C5F-488D-93A0-A04F21F23956}
Windows Live Essentials-->C:\Program Files\Windows Live\Installer\wlarp.exe
Windows Live Essentials-->MsiExec.exe /I{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}
Windows Live ID Sign-in Assistant-->MsiExec.exe /X{10A44844-4465-456E-8C97-80BDD4F68845}
Windows Live Messenger-->MsiExec.exe /X{A85FD55B-891B-4314-97A5-EA96C0BD80B5}
Windows Live Upload Tool-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
WinZip 14.0-->MsiExec.exe /X{CD95F661-A5C4-44F5-A6AA-ECDD91C240BA}
Wireless LAN Starter-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{61D6E4FB-1A62-4EB1-BE56-929B00C155CF}\Setup.exe" -l0x9

======Hosts File======

127.0.0.1 localhost

======Security center information======

AV: ESET Smart Security 4.0
FW: ESET Personal firewall

======System event log======

Computer Name: SONI-LAPTOP
Event Code: 58
Message: Syntax error in manifest or policy file "C:\Program Files\ESET\ESET Smart Security\Microsoft.VC80.MFCLOC.MANIFEST" on line 5.

Record Number: 722
Source Name: SideBySide
Time Written: 20091101071100.000000+000
Event Type: error
User:

Computer Name: SONI-LAPTOP
Event Code: 34
Message: Component identity found in manifest does not match the identity of the component requested

Record Number: 721
Source Name: SideBySide
Time Written: 20091101071100.000000+000
Event Type: error
User:

Computer Name: SONI-LAPTOP
Event Code: 59
Message: Generate Activation Context failed for C:\Program Files\ESET\ESET Smart Security\MFC80U.DLL.
Reference error message: The operation completed successfully.
.

Record Number: 704
Source Name: SideBySide
Time Written: 20091101071029.000000+000
Event Type: error
User:

Computer Name: SONI-LAPTOP
Event Code: 58
Message: Syntax error in manifest or policy file "C:\Program Files\ESET\ESET Smart Security\Microsoft.VC80.MFCLOC.MANIFEST" on line 5.

Record Number: 703
Source Name: SideBySide
Time Written: 20091101071029.000000+000
Event Type: error
User:

Computer Name: SONI-LAPTOP
Event Code: 34
Message: Component identity found in manifest does not match the identity of the component requested

Record Number: 702
Source Name: SideBySide
Time Written: 20091101071029.000000+000
Event Type: error
User:

=====Application event log=====

Computer Name: SONI-LAPTOP
Event Code: 5603
Message: A provider, Rsop Planning Mode Provider, has been registered in the WMI namespace, root\RSOP, but did not specify the HostingModel property. This provider will be run using the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.

Record Number: 15
Source Name: WinMgmt
Time Written: 20091031172755.000000+000
Event Type: warning
User: NT AUTHORITY\SYSTEM

Computer Name: SONI-LAPTOP
Event Code: 5603
Message: A provider, Rsop Planning Mode Provider, has been registered in the WMI namespace, root\RSOP, but did not specify the HostingModel property. This provider will be run using the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.

Record Number: 14
Source Name: WinMgmt
Time Written: 20091031172755.000000+000
Event Type: warning
User: NT AUTHORITY\SYSTEM

Computer Name: SONI-LAPTOP
Event Code: 63
Message: A provider, CmdTriggerConsumer, has been registered in the WMI namespace, Root\cimv2, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

Record Number: 13
Source Name: WinMgmt
Time Written: 20091031172755.000000+000
Event Type: warning
User: NT AUTHORITY\SYSTEM

Computer Name: SONI-LAPTOP
Event Code: 63
Message: A provider, CmdTriggerConsumer, has been registered in the WMI namespace, Root\cimv2, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

Record Number: 12
Source Name: WinMgmt
Time Written: 20091031172755.000000+000
Event Type: warning
User: NT AUTHORITY\SYSTEM

Computer Name: SONI-LAPTOP
Event Code: 63
Message: A provider, HiPerfCooker_v1, has been registered in the WMI namespace, Root\WMI, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

Record Number: 11
Source Name: WinMgmt
Time Written: 20091031172753.000000+000
Event Type: warning
User: NT AUTHORITY\SYSTEM

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\wbem;%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files\Intel\WiFi\bin;C:\Program Files\Intel\DMIX;C:\Program Files\QT Lite\QTSystem;C:\Program Files\Intel\WiFi\bin\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 13 Stepping 8, GenuineIntel
"PROCESSOR_REVISION"=0d08
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

Gmer Log.txt

GMER 1.0.15.15227 - http://www.gmer.net
Rootkit scan 2009-11-17 00:43:42
Windows 5.1.2600 Service Pack 3
Running: 8fetibse.exe; Driver: C:\DOCUME~1\Soni\LOCALS~1\Temp\kxdiypod.sys

---- System - GMER 1.0.15 ----

SSDT 895438A0 ZwAssignProcessToJobObject
SSDT 89542CB0 ZwOpenProcess
SSDT 895430D0 ZwOpenThread
SSDT 895436D0 ZwSuspendProcess
SSDT 895434F0 ZwSuspendThread
SSDT 89542EE0 ZwTerminateProcess
SSDT 89543310 ZwTerminateThread

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\ESET\ESET Smart Security\ekrn.exe[296] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 4 Bytes [C2, 04, 00, 00]

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)
AttachedDevice \Driver\Tcpip \Device\Ip epfwtdi.sys (ESET Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdi.sys (ESET Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\Tcpip \Device\Udp epfwtdi.sys (ESET Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\Tcpip \Device\RawIp epfwtdi.sys (ESET Personal Firewall TDI filter/ESET)
AttachedDevice \FileSystem\Fastfat \Fat eamon.sys (Amon monitor/ESET)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Threads - GMER 1.0.15 ----

Thread System [4:548] 89541930

---- EOF - GMER 1.0.15 ----

by **Jiten** » November 16th, 2009, 9:52 pm

I forgot to attach the Uninstall List in the previous post. Its posted here below. Thanks. Jiten.

2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Shockwave Player 11.5
Driver Genius Professional Edition
Foxit Reader
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
HDAUDIO SoftV92 Data Fax Modem with SmartCP
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Intel PROSet Wireless
Intel(R) Network Connections 14.7.23.0
Java(TM) 6 Update 17
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office Live Add-in 1.4
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.5.5)
MSVCRT
NVIDIA Drivers
PixiePack Codec Pack
QT Lite 3.0.0
Realtek High Definition Audio Driver
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB973704)
Security Update for Microsoft Office Excel 2007 (KB973593)
Security Update for Microsoft Office Outlook 2007 (KB972363)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office Publisher 2007 (KB969693)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371-v2)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974455)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Segoe UI
Setting Utility Series
Sony MP4 Shared Library
Sony Utilities DLL
Sony Video Shared Library
SopCast 3.2.4
Sophos Anti-Rootkit 1.5.0
System Requirements Lab
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 (KB974561)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Microsoft Windows (KB971513)
Update for Outlook 2007 Junk Email Filter (kb975960)
Update for Windows Internet Explorer 8 (KB975364)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows XP (KB898461)
Update for Windows XP (KB943729)
Update for Windows XP (KB951978)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973815)
VAIO Control Center
VAIO Event Service
VAIO Power Management
Veetle TV 0.9.15
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Messenger
Windows Live Upload Tool
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
WinZip 14.0
Wireless LAN Starter

by **deltalima** » November 17th, 2009, 7:59 am

Hi Jiten,

TFC (Temp File Cleaner)

Please download TFC.exe...by Old Timer. Save it to your desktop.
Print these instructions. Save any unsaved work. TFC will close ALL open programs... including your browser!
Double click on TFC.exe to run it.
TFC will begin cleaning up the "temp" files... it may take only a few seconds or it could be several minutes, depending on the amount of temp files found.
If prompted to reboot... click Yes.

! Important ! If TFC prompts you to reboot, please do so immediately, before proceeding to any other steps or other use of your computer.

GooredFix
Please download GooredFix...by jpshortstuff.
Save it to your desktop. Alternate site.

Ensure all Firefox windows are closed.
Double-click GooredFix.exe to run it.
When prompted to run the scan, click Yes.
GooredFix will check for infections, and then a log file will open... named "GooredFix.txt".
Please copy and paste the contents of the GooredFix.txt file in your next reply.

by **Jiten** » November 17th, 2009, 3:29 pm

Here is the log.

GooredFix by jpshortstuff (09.11.09.1)
Log created at 19:28 on 17/11/2009 (Soni)
Firefox version 3.5.5 (en-GB)

========== GooredScan ==========

========== GooredLog ==========

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd} [18:54 31/10/2009]
{B13721C7-F507-4982-B2E5-502A71474FED} [04:23 17/11/2009]
{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} [19:20 31/10/2009]
{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} [18:32 13/11/2009]

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{20a82645-c095-46ed-80e3-08825760534b}"="c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\" [18:41 31/10/2009]

-=E.O.F=-

by **deltalima** » November 18th, 2009, 5:24 am

Hi Jiten,

Kaspersky Online Scan

You can use either Internet Explorer or Mozilla FireFox for this scan.

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

Please go to the Kaspersky website and perform an online antivirus scan.
Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
- Archives
Click on My Computer under Scan. * This will take a while. Please be patient *.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply along with a fresh HijackThis log.

by **Jiten** » November 18th, 2009, 1:56 pm

Alright mate. here's the logs you wanted. I did a sophos scan again, as I'm a bit intrigued by the two registry items that it found earlier, the scan again shows the two same items. I don't know what you make of it. Sophos only scanned and doesn't do anything apart from show me what it found, so I don't think any fizes or such will have occurred. Thanks once again for your help. Jiten.
--------------------
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Wednesday, November 18, 2009
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Wednesday, November 18, 2009 15:56:57
Records in database: 3234011
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: no

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Objects scanned: 30316
Threats found: 0
Infected objects found: 0
Suspicious objects found: 0
Scan duration: 00:55:33

No threats found. Scanned area is clean.

Selected area has been scanned.
-----------------------------------------------
Sophos Anti-Rootkit found the following two items.

Area: Windows registry
Description: Hidden registry key
Location: \HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext
Removable: No
Notes: (no more detail available)

Area: Windows registry
Description: Hidden registry value
Location: \HKEY_USERS\S-1-5-18\Software\Microsoft\Windows NT\CurrentVersion\Windows\load
Removable: No
Notes: (type 1, length 2) " "
-------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:56:09, on 18/11/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe
C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Skype\Toolbars\Shared\SkypeNames.exe
C:\Documents and Settings\Soni\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [SonyPowerCfg] C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray
O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe" /autorun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 8080584796
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless WiFi Service (S24EventMonitor) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

--
End of file - 7711 bytes

by **deltalima** » November 18th, 2009, 5:33 pm

Hi Jiten,

How is the computer running now? Do the new firefox windows still open?

If you are still experiencing the popups with Firefox then please uninstall Firefox completely and reintall.

The malware on your computer is proving to be difficult to pin down, we need to do another scan.

RootRepeal - Rootkit Detector

Download RootRepeal from the following location and save it to your desktop.
- Link 1
- Link 2
- Link 3
Unzip it to your Desktop
Double click RootRepeal.exe to start the program
Click on the Report tab at the bottom of the program window
Click the Scan button
In the Select Scan dialog, check:
- Drivers
- Files
- Processes
- SSDT
- Stealth Objects
- Hidden Services
- Shadow SSDT
Click the OK button
Check the box for your main system drive (Usually C:), and Click OK to start the scan

The scan can take some time. DO NOT run any other programs while the scan is running
When the scan is complete, the Save Report button will become available
Click this and save the report to your Desktop as RootRepeal.txt
Go to File, then Exit to close the program

Please include the contents of RootRepeal.txt in your next post.

by **Jiten** » November 18th, 2009, 7:08 pm

Easy Mate. Firefox popups and IE popups haven't appeared for a few days, Then again I barely use IE. The RootRepeal log in posted below.

ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time: 2009/11/18 22:40
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================

Drivers
-------------------
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xB68B5000 Size: 98304 File Visible: No Signed: -
Status: -

Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xBADD8000 Size: 8192 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xB53BA000 Size: 49152 File Visible: No Signed: -
Status: -

Hidden/Locked Files
-------------------
Path: c:\documents and settings\soni\application data\skype\jitensoni\etilqs_1lc7m6jc3lvsdilm5va6
Status: Allocation size mismatch (API: 4096, Raw: 0)

Path: c:\documents and settings\soni\application data\skype\jitensoni\etilqs_vbjgl3ackyc5vfnxp3ei
Status: Allocation size mismatch (API: 16384, Raw: 0)

SSDT
-------------------
#: 019 Function Name: NtAssignProcessToJobObject
Status: Hooked by "<unknown>" at address 0x895508a0

#: 122 Function Name: NtOpenProcess
Status: Hooked by "<unknown>" at address 0x8954fcb0

#: 128 Function Name: NtOpenThread
Status: Hooked by "<unknown>" at address 0x895500d0

#: 253 Function Name: NtSuspendProcess
Status: Hooked by "<unknown>" at address 0x895506d0

#: 254 Function Name: NtSuspendThread
Status: Hooked by "<unknown>" at address 0x895504f0

#: 257 Function Name: NtTerminateProcess
Status: Hooked by "<unknown>" at address 0x8954fee0

#: 258 Function Name: NtTerminateThread
Status: Hooked by "<unknown>" at address 0x89550310

Stealth Objects
-------------------
Object: Hidden Code [ETHREAD: 0x89e45958]
Process: System Address: 0x8954e930 Size: 1000

==EOF==

by **deltalima** » November 19th, 2009, 3:57 pm

Hi Jiten,

Please run Malwarebytes antimalware once more, ensure that you update to the latest definitions then run a full scan.

Download Blacklight from here:
http://www.f-secure.com/en_EMEA/security/security-lab/tools-and-services/blacklight/index.html
or
Link to it from the ftp site: ftp://ftp.f-secure.com/anti-virus/tools/fsbl.exe

Please save it to your desktop.

Go to Start-->Run, copy in the following text, and press Enter:

"%userprofile%\desktop\fsbl.exe" /expert

Accept the license agreement.
Click > scan, wait for it to finish, then click Close

There will be a log on your desktop with the name fsbl.xxxxxxx.log (the xxxxxxx stand for numbers).
Copy and paste the contents of this log into your next reply along with the log from Malwarebytes.

by **Jiten** » November 19th, 2009, 7:47 pm

Hiya Mate. The logs are posted below. Thanks.

--------------------------------------
11/19/09 22:37:26 [Info]: BlackLight Engine 2.2.1092 initialized
11/19/09 22:37:26 [Info]: OS: 5.1 build 2600 (Service Pack 3)
11/19/09 22:37:26 [Note]: 7019 4
11/19/09 22:37:26 [Note]: 7005 0
11/19/09 22:37:56 [Note]: 7006 0
11/19/09 22:37:56 [Note]: 7022 0
11/19/09 22:37:56 [Note]: 7011 1780
11/19/09 22:37:56 [Note]: 7035 0
11/19/09 22:37:56 [Note]: 7026 0
11/19/09 22:37:56 [Note]: 7026 0
11/19/09 22:37:56 [Note]: FSRAW library version 1.7.1024
11/19/09 22:47:19 [Note]: 7007 0

------------------------------------------
Malwarebytes' Anti-Malware 1.41
Database version: 3198
Windows 5.1.2600 Service Pack 3

19/11/2009 22:36:34
mbam-log-2009-11-19 (22-36-34).txt

Scan type: Full Scan (C:\|)
Objects scanned: 129933
Time elapsed: 17 minute(s), 28 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

by **deltalima** » November 20th, 2009, 6:54 pm

Hi Jiten,

I have not managed to identify the exact infection but the information that I can see strongly suggests that the infection is a rootkit and was installed at approximately 2009-11-12 23:00:39 and came as part of some video / DVD copying or playing software.

I must warn you that a rootkit is a set of software tools intended for concealing running processes, files or system data from the operating system.

You are strongly advised to do the following:

Disconnect the computer from the Internet and from any networked computers until it is cleaned.
Back up all your important data except programs. The programs can be reinstalled back from the original disc or from the Net.
Call all your banks, financial institutions, credit card companies and inform them that you may be a victim of identity theft and put a watch on your accounts. If you don't mind the hassle, change all your account numbers.
From a clean computer, change all your passwords (ISP login password, your email address(es) passwords, financial accounts, PayPal, eBay, Amazon, online groups and forums and any other online activities you carry out which require a username and password).

DO NOT change your passwords from this computer as the attacker will be able to get all the new passwords and transaction records.

Due to its rootkit functionality, your computer is very likely to have been compromised and there is no way that it can be trusted again. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be to do a reformat and reinstallation of the operating system (OS).

Should you have any questions please feel free to ask.

by **Jiten** » November 21st, 2009, 12:22 am

Hi. The following log was taken from Eset Smart Security, would this help you in indentifying the rootikit problem. You seem right enough that it has something to do with some sort of Video/ DVD playing or copying software.

12/11/2009 21:37:48
HTTP filter file http://moviedatabase.dynssl.com/Free Codec/Free Codec.v.1.3.27.exe
a variant of Win32/Olmarik.PU trojan connection terminated - quarantined

SONI-LAPTOP\Soni Threat was detected upon access to web by the application: C:\Program Files\Windows Media Player\wmplayer.exe.

If it's some sort of new variant, it could help with future attacks of it's kind. I assume that the file has been quarantined.

Ultimately, I guess I will end up formatting and reinstalling, but just thought I'd send the ESET message before I do anything. Thanks with the help so far, and let me know what you think.

Jiten

Free Malware Removal Forum

Firefox Popups & Ads.

Firefox Popups & Ads.

Re: Firefox Popups & Ads.

Re: Firefox Popups & Ads.

Re: Firefox Popups & Ads.

Re: Firefox Popups & Ads.

Re: Firefox Popups & Ads.

Re: Firefox Popups & Ads.

Re: Firefox Popups & Ads.

Re: Firefox Popups & Ads.

Re: Firefox Popups & Ads.

Re: Firefox Popups & Ads.

Re: Firefox Popups & Ads.

Re: Firefox Popups & Ads.

Re: Firefox Popups & Ads.

Re: Firefox Popups & Ads.

Who is online