Hello Wingman, thank you for your time as I can see you are very busy.
I have included the logs you requested.
I have reran Malwarebytes since my first post as I was infected with a one of those fake virus software programs that would not let me open Firefox. When I do a Google search, if I click on one of the links it will open a new search type page. It will also just open a new tab every so often to either a "random" site or to one that Avast stops as an attempt to download a Trojan.
Thank you,
Zedman2K
Logfile of random's system information tool 1.06 (written by random/random)
Run by Jerry at 2010-04-10 19:47:12
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 19 GB (55%) free of 34 GB
Total RAM: 2814 MB (65% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:47:13 PM, on 4/10/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\notepad.exe
D:\Downloads\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Jerry.exe
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - d:\Program Files\Spybot - Search &
Destroy\SDHelper.dll
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\Microsoft Office\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\Microsoft Office\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - d:\Program Files\Spybot - Search &
Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - d:\Program
Files\Spybot - Search & Destroy\SDHelper.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
http://go.microsoft.com/fwlink/?linkid=39204O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
--
End of file - 2198 bytes
======Scheduled tasks folder======
C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
C:\WINDOWS\tasks\MP Scheduled Scan.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper
Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - d:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2009-01-26 1879896]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast5"=C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2010-03-09 2769336]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-12-11 948672]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-12-22 35760]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCU]
C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus CX7400 Series]
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICDA.EXE [2007-02-15 179200]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GBTUpd]
C:\Program Files\GIGABYTE\GBTUpd\PreRun.exe []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSSE]
C:\Program Files\Microsoft Security Essentials\msseces.exe [2010-02-21 1093208]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
d:\Program Files\PowerISO\PWRISOVM.EXE [2009-11-08 180224]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
C:\WINDOWS\RTHDCPL.EXE [2009-08-14 18702336]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
d:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
d:\program files\steam\steam.exe [2010-02-20 1217872]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-01-11 246504]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2009]
C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"rpcapd"=3
"PnkBstrA"=2
"ose"=3
"odserv"=3
"Microsoft Office Groove Audit Service"=3
"JavaQuickStarterService"=2
"idsvc"=3
"IDriverT"=3
"ES lite Service"=2
"BCUService"=2
"Ati HotKey Poller"=2
"uvnc_service"=3
"PnkBstrB"=2
"MsMpSvc"=2
"EPSON_PM_RPCV4_01"=2
"CrossLoopService"=2
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2009-07-29 155648]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12
2217848]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapp
lications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
"C:\Program Files\Steam\steamapps\zedmanmmiv\counter-strike source\hl2.exe"="C:\Program
Files\Steam\steamapps\zedmanmmiv\counter-strike source\hl2.exe:*:Enabled:hl2"
"C:\Program Files\Steam\Steam.exe"="C:\Program Files\Steam\Steam.exe:*:Enabled:Steam"
"C:\Program Files\Gigabyte\GBTUpd\RunUpd.exe"="C:\Program Files\Gigabyte\GBTUpd\RunUpd.exe:*:Enabled:RunUpd"
"C:\Program Files\Gigabyte\GBTUpd\GBTUpd.exe"="C:\Program Files\Gigabyte\GBTUpd\GBTUpd.exe:*:Enabled:GBTUpd.exe"
"C:\Program Files\Gigabyte\EasySaver\UpdExe.exe"="C:\Program Files\Gigabyte\EasySaver\UpdExe.exe:*:Enabled:Exe File"
"C:\Program Files\Gigabyte\EasySaver\GBTUpd.exe"="C:\Program Files\Gigabyte\EasySaver\GBTUpd.exe:*:Enabled:GBTUpd.exe"
"D:\Program Files\Steam\Steam.exe"="D:\Program Files\Steam\Steam.exe:*:Enabled:Steam"
"D:\Program Files\Steam\steamapps\zedmanmmiv\counter-strike source\hl2.exe"="D:\Program
Files\Steam\steamapps\zedmanmmiv\counter-strike source\hl2.exe:*:Enabled:hl2"
"D:\Program Files\Steam\steamapps\zedmanmmiv\day of defeat source\hl2.exe"="D:\Program
Files\Steam\steamapps\zedmanmmiv\day of defeat source\hl2.exe:*:Enabled:hl2"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft
Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft
Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft
Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"D:\Program Files\Steam\steamapps\common\america's army 3\Binaries\AA3Game.exe"="D:\Program
Files\Steam\steamapps\common\america's army 3\Binaries\AA3Game.exe:*:Disabled:America's Army 3"
"C:\Documents and Settings\Jerry\Local Settings\Application Data\CrossLoop\vncviewer.exe"="C:\Documents and
Settings\Jerry\Local Settings\Application Data\CrossLoop\vncviewer.exe:*:Enabled:vncviewer.exe"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedappli
cations\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{15725b98-0bed-11df-adc5-806d6172696f}]
shell\AutoRun\command - D:\setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{54757af8-0b4a-11df-9178-806d6172696f}]
shell\AutoRun\command - D:\Run.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7fbe7920-1451-11df-96cf-0012179fe30e}]
shell\AutoRun\command - G:\USBAutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f855c47c-20cf-11df-96d8-0012179fe30e}]
shell\AutoRun\command - G:\StartPortableApps.exe
======File associations======
.scr - open - "%1" /S "%3"
======List of files/folders created in the last 1 months======
2010-04-10 19:39:21 ----DC---- C:\rsit
2010-04-10 19:37:50 ----D---- C:\WINDOWS\ERDNT
2010-04-10 19:36:48 ----D---- C:\Program Files\ERUNT
2010-04-07 22:16:39 ----D---- C:\Program Files\Trend Micro
2010-04-07 20:04:46 ----DC---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2010-04-07 18:48:37 ----A---- C:\WINDOWS\system32\lsdelete.exe
2010-04-07 17:39:00 ----HDC---- C:\Documents and Settings\All Users\Application
Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-04-07 17:38:54 ----DC---- C:\Documents and Settings\All Users\Application Data\Lavasoft
2010-04-07 17:38:54 ----D---- C:\Program Files\Lavasoft
2010-04-07 14:10:37 ----N---- C:\WINDOWS\system32\MpSigStub.exe
2010-04-07 14:08:34 ----D---- C:\Program Files\Microsoft Security Essentials
2010-04-07 13:56:21 ----A---- C:\WINDOWS\ntbtlog.txt
2010-04-06 23:44:54 ----DC---- C:\spoolerlogs
2010-04-03 00:13:17 ----D---- C:\Documents and Settings\Jerry\Application Data\UltraVNC
2010-03-31 14:45:22 ----HDC---- C:\WINDOWS\$NtUninstallKB980182$
2010-03-28 23:24:45 ----D---- C:\Documents and Settings\Jerry\Application Data\bfgbar
2010-03-28 18:08:34 ----D---- C:\Program Files\Turtix
2010-03-28 18:02:27 ----ADC---- C:\Documents and Settings\All Users\Application Data\TEMP
2010-03-28 18:01:46 ----D---- C:\Program Files\Big Fish Games Toolbar Installer
2010-03-28 17:59:53 ----D---- C:\Program Files\bfgclient
2010-03-28 17:58:48 ----DC---- C:\Documents and Settings\All Users\Application Data\BigFishGamesCache
2010-03-28 00:54:02 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
2010-03-28 00:53:56 ----A---- C:\WINDOWS\system32\PnkBstrA.exe
2010-03-20 02:29:27 ----D---- C:\Documents and Settings\Jerry\Application Data\Help
2010-03-20 02:29:27 ----D---- C:\Documents and Settings\Jerry\Application Data\gtk-2.0
2010-03-18 00:54:52 ----D---- C:\Documents and Settings\Jerry\Application Data\Malwarebytes
2010-03-18 00:54:47 ----DC---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2010-03-18 00:54:47 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-03-11 21:32:17 ----D---- C:\Documents and Settings\Jerry\Application Data\Ubisoft
2010-03-11 21:31:57 ----A---- C:\WINDOWS\system32\XAudio2_5.dll
2010-03-11 21:31:57 ----A---- C:\WINDOWS\system32\xactengine3_5.dll
2010-03-11 21:31:57 ----A---- C:\WINDOWS\system32\D3DCompiler_42.dll
2010-03-11 21:31:54 ----A---- C:\WINDOWS\system32\d3dcsx_42.dll
2010-03-11 21:31:53 ----A---- C:\WINDOWS\system32\D3DX9_42.dll
2010-03-11 21:31:53 ----A---- C:\WINDOWS\system32\d3dx11_42.dll
2010-03-11 21:31:53 ----A---- C:\WINDOWS\system32\d3dx10_42.dll
2010-03-11 21:31:52 ----A---- C:\WINDOWS\system32\XAPOFX1_3.dll
2010-03-11 21:31:52 ----A---- C:\WINDOWS\system32\D3DX9_41.dll
2010-03-11 21:31:52 ----A---- C:\WINDOWS\system32\d3dx10_41.dll
2010-03-11 21:31:52 ----A---- C:\WINDOWS\system32\D3DCompiler_41.dll
2010-03-11 21:31:51 ----A---- C:\WINDOWS\system32\XAudio2_4.dll
2010-03-11 21:31:51 ----A---- C:\WINDOWS\system32\xactengine3_4.dll
2010-03-11 21:31:51 ----A---- C:\WINDOWS\system32\X3DAudio1_6.dll
2010-03-11 21:31:50 ----A---- C:\WINDOWS\system32\XAudio2_3.dll
2010-03-11 21:31:50 ----A---- C:\WINDOWS\system32\XAPOFX1_2.dll
2010-03-11 21:31:50 ----A---- C:\WINDOWS\system32\D3DX9_40.dll
2010-03-11 21:31:50 ----A---- C:\WINDOWS\system32\d3dx10_40.dll
2010-03-11 21:31:50 ----A---- C:\WINDOWS\system32\D3DCompiler_40.dll
2010-03-11 21:31:49 ----A---- C:\WINDOWS\system32\XAudio2_2.dll
2010-03-11 21:31:49 ----A---- C:\WINDOWS\system32\XAPOFX1_1.dll
2010-03-11 21:31:49 ----A---- C:\WINDOWS\system32\xactengine3_3.dll
2010-03-11 21:31:49 ----A---- C:\WINDOWS\system32\X3DAudio1_5.dll
2010-03-11 21:31:48 ----A---- C:\WINDOWS\system32\xactengine3_2.dll
2010-03-11 21:31:47 ----A---- C:\WINDOWS\system32\XAudio2_1.dll
2010-03-11 21:31:47 ----A---- C:\WINDOWS\system32\XAPOFX1_0.dll
2010-03-11 21:31:47 ----A---- C:\WINDOWS\system32\xactengine3_1.dll
2010-03-11 21:31:46 ----A---- C:\WINDOWS\system32\X3DAudio1_4.dll
2010-03-11 21:31:46 ----A---- C:\WINDOWS\system32\D3DX9_38.dll
2010-03-11 21:31:46 ----A---- C:\WINDOWS\system32\d3dx10_38.dll
2010-03-11 21:31:46 ----A---- C:\WINDOWS\system32\D3DCompiler_38.dll
2010-03-11 21:31:45 ----A---- C:\WINDOWS\system32\XAudio2_0.dll
2010-03-11 21:31:45 ----A---- C:\WINDOWS\system32\xactengine3_0.dll
2010-03-11 21:31:44 ----A---- C:\WINDOWS\system32\X3DAudio1_3.dll
2010-03-11 21:31:44 ----A---- C:\WINDOWS\system32\D3DX9_37.dll
2010-03-11 21:31:44 ----A---- C:\WINDOWS\system32\d3dx10_37.dll
2010-03-11 21:31:44 ----A---- C:\WINDOWS\system32\D3DCompiler_37.dll
2010-03-11 21:31:43 ----A---- C:\WINDOWS\system32\xactengine2_10.dll
2010-03-11 21:31:43 ----A---- C:\WINDOWS\system32\d3dx10_36.dll
2010-03-11 21:31:43 ----A---- C:\WINDOWS\system32\D3DCompiler_36.dll
2010-03-11 21:31:42 ----A---- C:\WINDOWS\system32\d3dx9_36.dll
======List of files/folders modified in the last 1 months======
2010-04-10 19:45:25 ----RD---- C:\Program Files
2010-04-10 19:39:23 ----D---- C:\WINDOWS\Prefetch
2010-04-10 19:37:50 ----D---- C:\WINDOWS
2010-04-10 18:46:37 ----D---- C:\WINDOWS\Temp
2010-04-10 06:48:24 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-04-10 00:24:43 ----D---- C:\WINDOWS\system32
2010-04-10 00:24:42 ----D---- C:\WINDOWS\system32\drivers
2010-04-09 18:56:37 ----D---- C:\WINDOWS\system32\CatRoot2
2010-04-09 18:47:55 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-04-09 18:42:53 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-04-09 17:12:36 ----HD---- C:\WINDOWS\inf
2010-04-07 22:34:28 ----RSHC---- C:\boot.ini
2010-04-07 22:34:28 ----A---- C:\WINDOWS\win.ini
2010-04-07 22:34:28 ----A---- C:\WINDOWS\system.ini
2010-04-07 22:27:31 ----SD---- C:\WINDOWS\Tasks
2010-04-07 22:19:47 ----SD---- C:\WINDOWS\Downloaded Program Files
2010-04-07 20:40:32 ----D---- C:\Program Files\Mozilla Firefox
2010-04-07 20:31:29 ----SHDC---- C:\Config.Msi
2010-04-07 20:31:29 ----SHD---- C:\WINDOWS\Installer
2010-04-07 20:31:10 ----D---- C:\WINDOWS\WinSxS
2010-04-07 20:29:31 ----HD---- C:\Program Files\InstallShield Installation Information
2010-04-07 20:29:31 ----D---- C:\Program Files\Common Files
2010-04-07 20:28:51 ----D---- C:\Program Files\Gigabyte
2010-04-07 17:43:21 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-04-07 17:25:00 ----D---- C:\WINDOWS\msapps
2010-04-07 14:21:49 ----RSD---- C:\WINDOWS\Fonts
2010-04-07 14:08:42 ----SDC---- C:\Documents and Settings\All Users\Application Data\Microsoft
2010-04-06 23:49:57 ----D---- C:\WINDOWS\system32\config
2010-04-06 23:49:40 ----D---- C:\WINDOWS\system32\wbem
2010-04-06 23:49:39 ----D---- C:\WINDOWS\Registration
2010-04-06 23:48:57 ----D---- C:\Documents and Settings\Jerry\Application Data\BitTorrent
2010-03-31 07:24:06 ----HD---- C:\WINDOWS\$hf_mig$
2010-03-29 19:45:03 ----D---- C:\WINDOWS\Debug
2010-03-20 03:25:23 ----D---- C:\WINDOWS\system32\LogFiles
2010-03-20 02:29:21 ----D---- C:\WINDOWS\system32\DirectX
2010-03-20 02:28:23 ----D---- C:\Program Files\File Scavenger 3.2
2010-03-20 02:25:39 ----D---- C:\Program Files\Movie Maker
2010-03-20 00:58:26 ----SD---- C:\Documents and Settings\Jerry\Application Data\Microsoft
2010-03-18 01:36:22 ----D---- C:\WINDOWS\Config
2010-03-14 05:29:49 ----DC---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2010-03-13 20:38:26 ----D---- C:\WINDOWS\Help
2010-03-11 21:31:29 ----RSD---- C:\WINDOWS\assembly
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2010-03-09 28880]
R1 AmdPPM;AMD HwPState Processor Driver; C:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 33792]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2010-03-09 162640]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2010-03-09 46672]
R1 MpFilter;Microsoft Malware Protection Driver; C:\WINDOWS\system32\DRIVERS\MpFilter.sys [2009-12-02 149040]
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2009-11-08 59388]
R1 truecrypt;truecrypt; C:\WINDOWS\System32\drivers\truecrypt.sys [2010-02-22 223440]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-13 8832]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2010-03-09 19024]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2010-03-09 100432]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2010-03-09 23376]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-07-29 4411392]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13
144384]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2009-08-18 5884416]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-04 12160]
R3 RT2500;Linksys Wireless-G PCI Adapter Driver; C:\WINDOWS\system32\DRIVERS\RT2500.sys [2005-10-20 243328]
R3 RTHDMIAzAudService;Service for HDMI; C:\WINDOWS\system32\drivers\RtKHDMI.sys [2009-06-24 3734976]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13
30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
S3 Ambfilt;Ambfilt; C:\WINDOWS\system32\drivers\Ambfilt.sys [2008-08-05 1684736]
S3 AODDriver;AODDriver; \??\C:\Program Files\GIGABYTE\ET6\i386\AODDriver.sys []
S3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
S3 cpuz130;cpuz130; \??\C:\DOCUME~1\Jerry\LOCALS~1\Temp\cpuz130\cpuz_x32.sys []
S3 ENTECH;ENTECH; \??\C:\WINDOWS\system32\DRIVERS\ENTECH.sys []
S3 etdrv;etdrv; \??\C:\WINDOWS\etdrv.sys []
S3 gdrv;gdrv; \??\C:\WINDOWS\gdrv.sys []
S3 mcdbus;Driver for MagicISO SCSI Host Controller; C:\WINDOWS\system32\DRIVERS\mcdbus.sys []
S3 Monfilt;Monfilt; C:\WINDOWS\system32\drivers\Monfilt.sys [2006-01-04 1389056]
S3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
S3 nm;Network Monitor Driver; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2008-04-13 40320]
S3 pbfilter;pbfilter; \??\D:\Program Files\PeerBlock\pbfilter.sys []
S3 PnkBstrK;PnkBstrK; \??\C:\WINDOWS\system32\drivers\PnkBstrK.sys []
S3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2009-06-29
142592]
S3 usbbus;LGE CDMA Composite USB Device; C:\WINDOWS\system32\DRIVERS\lgusbbus.sys [2007-07-23 12416]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 UsbDiag;LGE CDMA USB Serial Port; C:\WINDOWS\system32\DRIVERS\lgusbdiag.sys [2007-07-23 19840]
S3 USBModem;LGE CDMA USB Modem; C:\WINDOWS\system32\DRIVERS\lgusbmodem.sys [2007-07-23 21632]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys
[2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-03-09 40384]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [2010-04-07
1265264]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-03-09 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-03-09 40384]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86;
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0;
c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 getPlusHelper;getPlus(R) Helper; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
S4 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2009-07-29 602112]
S4 CrossLoopService;CrossLoop Service; C:\Documents and Settings\Jerry\Local Settings\Application
Data\CrossLoop\CrossLoopService.exe [2010-03-15 560792]
S4 EPSON_PM_RPCV4_01;EPSON V3 Service4(01); C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3
SSRP\E_S40RP7.EXE [2007-01-11 113664]
S4 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
[2005-04-04 69632]
S4 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
[2008-07-29 881664]
S4 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-01-28 153376]
S4 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft
Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S4 MsMpSvc;Microsoft Antimalware Service; C:\Program Files\Microsoft Security Essentials\MsMpEng.exe [2009-12-09 17904]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication
Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
[2008-11-04 441712]
S4 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S4 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2010-03-28 75064]
S4 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2010-04-04 189480]
S4 uvnc_service;uvnc_service; C:\Documents and Settings\Jerry\Local Settings\Application Data\CrossLoop\winvnc.exe
[2009-12-06 1590216]
-----------------EOF-----------------
info.txt logfile of random's system information tool 1.06 2010-04-10 19:47:15
======Uninstall list======
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall
{2FC4457D-409E-466F-861F-FB0CB796B53E}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall
{2FC4457D-409E-466F-861F-FB0CB796B53E}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall
{2FC4457D-409E-466F-861F-FB0CB796B53E}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall
{2FC4457D-409E-466F-861F-FB0CB796B53E}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall
{2FC4457D-409E-466F-861F-FB0CB796B53E}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall
{2FC4457D-409E-466F-861F-FB0CB796B53E}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall
{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall
{F580DDD5-8D37-4998-968E-EBB76BB86787}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall
{187308AB-5FA7-4F14-9AB9-D290383A10D9}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall
{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0044-0409-0000-0000000FF1CE} /uninstall
{2FC4457D-409E-466F-861F-FB0CB796B53E}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall
{DE5A002D-8122-4278-A7EE-3121E7EA254E}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall
{2FC4457D-409E-466F-861F-FB0CB796B53E}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-00BA-0409-0000-0000000FF1CE} /uninstall
{2FC4457D-409E-466F-861F-FB0CB796B53E}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0114-0409-0000-0000000FF1CE} /uninstall
{2FC4457D-409E-466F-861F-FB0CB796B53E}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall
{DE5A002D-8122-4278-A7EE-3121E7EA254E}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0117-0409-0000-0000000FF1CE} /uninstall
{2FC4457D-409E-466F-861F-FB0CB796B53E}
7-Zip 4.65-->"d:\Program Files\7-Zip\Uninstall.exe"
Ad-Aware Email Scanner for Outlook-->MsiExec.exe /I{338F08AB-C262-42C7-B000-34DE1A475273}
Ad-Aware-->"C:\Documents and Settings\All Users\Application
Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}\Ad-AwareInstaller.exe" REMOVE=TRUE MODIFY=FALSE
Ad-Aware-->C:\Documents and Settings\All Users\Application
Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}\Ad-AwareInstaller.exe
Adobe Download Manager-->"C:\WINDOWS\system32\rundll32.exe" "C:\Program Files\NOS\bin\getPlus_Helper.dll",Uninstall
/IE2883E8F-472F-4fb0-9522-AC9BF37916A7 /Get1
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.3.1-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A93000000001}
AMD Processor Driver-->C:\Program Files\InstallShield Installation
Information\{C151CE54-E7EA-4804-854B-F515368B0798}\setup.exe -runfromtemp -l0x0009 -removeonly
America's Army 3-->"D:\Program Files\Steam\steam.exe"
steam://uninstall/13140ATI - Software Uninstall Utility-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Catalyst Control Center-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup
"C:\Program Files\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x0
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart
-flags:0x2010001 -inf_class:DISPLAY -clean
ATI Parental Control & Encoder-->MsiExec.exe /I{36CDA33B-909B-4719-97D1-C4B99309BDC7}
avast! Free Antivirus-->C:\Program Files\Alwil Software\Avast5\aswRunDll.exe "C:\Program Files\Alwil
Software\Avast5\Setup\setiface.dll" RunSetup
Big Fish Games: Game Manager-->C:\Program Files\bfgclient\Uninstall.exe
BitTorrent-->"C:\Program Files\BitTorrent\BitTorrent.exe" /UNINSTALL
CCleaner-->"d:\Program Files\CCleaner\uninst.exe"
Counter-Strike: Source-->"D:\Program Files\Steam\steam.exe"
steam://uninstall/240CrossLoop 2.72-->"C:\Documents and Settings\Jerry\Local Settings\Application Data\CrossLoop\unins000.exe"
Day of Defeat: Source-->"D:\Program Files\Steam\steam.exe"
steam://uninstall/300EPSON Printer Software-->C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /R
ERUNT 1.1j-->"C:\Program Files\ERUNT\unins000.exe"
GIMP 2.6.8-->"d:\Program Files\GIMP-2.0\setup\unins000.exe"
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package
{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package
{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
IrfanView (remove only)-->d:\Program Files\IrfanView\iv_uninstall.exe
Java(TM) 6 Update 18-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216018FF}
K-Lite Codec Pack 5.7.0 (Full)-->"d:\Program Files\K-Lite Codec Pack\unins000.exe"
LG USB Modem Drivers-->MsiExec.exe /I{FA02ACAC-9E14-4878-A257-92A22A647C2C}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Antimalware-->MsiExec.exe /X{E590FD1C-E8C6-4D2E-8CA9-77B403F7EE01}
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Office Access MUI (English) 2007-->MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
Microsoft Office Access Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
Microsoft Office Enterprise 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup
Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007-->MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Groove MUI (English) 2007-->MsiExec.exe /X{90120000-00BA-0409-0000-0000000FF1CE}
Microsoft Office Groove Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0114-0409-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (English) 2007-->MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE}
Microsoft Office OneNote MUI (English) 2007-->MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2007-->MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Publisher MUI (English) 2007-->MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Security Essentials-->C:\Program Files\Microsoft Security Essentials\setup.exe /x
Microsoft Security Essentials-->MsiExec.exe /I{EF98A02A-1748-4762-9B7D-5ED1600520D5}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
Mozilla Firefox (3.6.3)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
OpenOffice.org 3.1-->MsiExec.exe /I{A16B3EA2-8798-4960-8D8B-18D3149AD617}
PowerISO-->"d:\Program Files\PowerISO\uninstall.exe"
REALTEK GbE & FE Ethernet PCI-E NIC Driver-->C:\Program Files\InstallShield Installation
Information\{C9BED750-1211-4480-B1A5-718A3BE15525}\Setup.Exe -runfromtemp -removeonly
Realtek High Definition Audio Driver-->RunDll32
C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield
Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\SETUP.EXE" -l0x9 -removeonly
Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE}
/uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
Security Update for 2007 Microsoft Office System (KB978380)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE}
/uninstall {667A88D1-0369-4070-A62A-70672D68A9BF}
Security Update for Microsoft Office Excel 2007 (KB978382)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE}
/uninstall {6DE3DABF-0203-426B-B330-7287D1003E86}
Security Update for Microsoft Office Outlook 2007 (KB972363)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE}
/uninstall {120BE9A0-9B09-4855-9E0C-7DEE45CB03C0}
Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE}
/uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
Security Update for Microsoft Office Publisher 2007 (KB969693)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE}
/uninstall {7BE67088-1EB3-4569-8E75-DDAFBF61BC4E}
Security Update for Microsoft Office system 2007 (972581)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE}
/uninstall {3D019598-7B59-447A-80AE-815B703B84FF}
Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE}
/uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
Security Update for Microsoft Office system 2007 (KB974234)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE}
/uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC}
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)-->msiexec /package
{90120000-0030-0000-0000-0000000FF1CE} /uninstall {71127777-8B2C-4F97-AF7A-6CF8CAC8224D}
Security Update for Microsoft Office Word 2007 (KB969604)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE}
/uninstall {CF3D6499-709C-43D0-8908-BC5652656050}
Security Update for Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe
C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Spybot - Search & Destroy-->"d:\Program Files\Spybot - Search & Destroy\unins000.exe"
Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
TrueCrypt-->"C:\Program Files\TrueCrypt\TrueCrypt Setup.exe" /u
Turtix-->"C:\Program Files\Turtix\Uninstall.exe"
Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall
{C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for Microsoft Office InfoPath 2007 (KB976416)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall
{432C5EE4-8096-4FF1-95E1-65219365DFF7}
Update for Outlook 2007 Junk Email Filter (kb979895)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall
{D45674C6-9127-4C84-8826-93FBC552DF53}
Update for Windows XP (KB980182)-->"C:\WINDOWS\$NtUninstallKB980182$\spuninst\spuninst.exe"
Visual C++ 2008 x86 Runtime - (v9.0.30729)-->MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5D14231E27}
Visual C++ 2008 x86 Runtime - v9.0.30729.01-->C:\WINDOWS\system32\msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D14231E27}
/qb+ REBOOTPROMPT=""
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
=====HijackThis Backups=====
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program
Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-04-07]
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft
Office\Office12\GrooveShellExtensions.dll [2010-04-07]
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) -
http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab [2010-04-07]
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
[2010-04-09]
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft
Office\Office12\GrooveSystemServices.dll [2010-04-09]
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common
Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-04-09]
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network
Diagnostic\xpnetdiag.exe [2010-04-09]
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\Microsoft
Office\Office12\ONBttnIE.dll [2010-04-09]
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe (file missing) [2010-04-09]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank [2010-04-09]
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\Microsoft
Office\Office12\ONBttnIE.dll [2010-04-09]
O4 - HKLM\..\Run: [Total PC Defender 2010] C:\Program Files\Total PC Defender 2010\Total PC Defender 2010.exe [2010-04-09]
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program
Files\Java\jre6\bin\jp2ssv.dll [2010-04-09]
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file
missing) [2010-04-09]
======Security center information======
AV: avast! Antivirus
AV: Microsoft Security Essentials (disabled)
======System event log======
Computer Name: ZED
Event Code: 51
Message: An error was detected on device \Device\Harddisk2\D during a paging operation.
Record Number: 3765
Source Name: Disk
Time Written: 20100302223147.000000-300
Event Type: warning
User:
Computer Name: ZED
Event Code: 51
Message: An error was detected on device \Device\Harddisk2\D during a paging operation.
Record Number: 3764
Source Name: Disk
Time Written: 20100302223147.000000-300
Event Type: warning
User:
Computer Name: ZED
Event Code: 51
Message: An error was detected on device \Device\Harddisk2\D during a paging operation.
Record Number: 3763
Source Name: Disk
Time Written: 20100302223147.000000-300
Event Type: warning
User:
Computer Name: ZED
Event Code: 51
Message: An error was detected on device \Device\Harddisk2\D during a paging operation.
Record Number: 3762
Source Name: Disk
Time Written: 20100302223147.000000-300
Event Type: warning
User:
Computer Name: ZED
Event Code: 51
Message: An error was detected on device \Device\Harddisk2\D during a paging operation.
Record Number: 3761
Source Name: Disk
Time Written: 20100302223147.000000-300
Event Type: warning
User:
=====Application event log=====
Computer Name: ZED
Event Code: 1000
Message: Faulting application firefox.exe, version 1.9.2.3667, faulting module unknown, version 0.0.0.0, fault address
0x00000008.
Record Number: 762
Source Name: Application Error
Time Written: 20100301222734.000000-300
Event Type: error
User:
Computer Name: ZED
Event Code: 1001
Message: Fault bucket 1667465332.
Record Number: 758
Source Name: Application Error
Time Written: 20100225223708.000000-300
Event Type: error
User:
Computer Name: ZED
Event Code: 1000
Message: Faulting application firefox.exe, version 1.9.2.3667, faulting module jvm.dll, version 16.0.0.13, fault address
0x000c7cf2.
Record Number: 757
Source Name: Application Error
Time Written: 20100225223633.000000-300
Event Type: error
User:
Computer Name: ZED
Event Code: 63
Message: A provider, OffProv12, has been registered in the WMI namespace, Root\MSAPPS12, to use the LocalSystem account.
This account is privileged and the provider may cause a security violation if it does not correctly impersonate user
requests.
Record Number: 682
Source Name: WinMgmt
Time Written: 20100223181307.000000-300
Event Type: warning
User: NT AUTHORITY\SYSTEM
Computer Name: ZED
Event Code: 1000
Message: Faulting application hl2.exe, version 0.0.0.0, faulting module datacache.dll, version 0.0.0.0, fault address
0x0000b423.
Record Number: 635
Source Name: Application Error
Time Written: 20100213003740.000000-300
Event Type: error
User:
======Environment variables======
"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=16
"PROCESSOR_IDENTIFIER"=x86 Family 16 Model 5 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=0502
"NUMBER_OF_PROCESSORS"=4
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
-----------------EOF-----------------
GMER 1.0.15.15281 -
http://www.gmer.netRootkit scan 2010-04-10 19:54:56
Windows 5.1.2600 Service Pack 3
Running: zkwqpzpd.exe; Driver: C:\DOCUME~1\Jerry\LOCALS~1\Temp\pxtdypow.sys
---- System - GMER 1.0.15 ----
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose
[0xA83CDC56]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey
[0xA83CDB12]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteKey
[0xA83CE0C6]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey
[0xA83CDFF0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject
[0xA83CD6E8]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey
[0xA83CDBEC]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess
[0xA83CD628]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread
[0xA83CD68C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey
[0xA83CDD0C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRenameKey
[0xA83CE194]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey
[0xA83CDCCC]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey
[0xA83CDE4C]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateProcessEx
[0xA83DA4FE]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateSection
[0xA83DA322]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwLoadDriver
[0xA83DA45C]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) NtCreateSection
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
ObMakeTemporaryObject
---- Devices - GMER 1.0.15 ----
Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast!
self protection module/ALWIL Software)
AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast!
File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast!
TDI Filter Driver/ALWIL Software)
Device -> \Driver\atapi \Device\Harddisk0\DR0 8A9FCAC8
---- Disk sectors - GMER 1.0.15 ----
Disk \Device\Harddisk0\DR0 sector 01: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 02: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 03: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 04: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 05: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 06: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 07: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 08: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 09: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 10:
rootkit-like behavior; copy of MBR
Disk \Device\Harddisk0\DR0 sector 11: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 12: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 13: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 14: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 15: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 16: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 17: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 18: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 19: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 20: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 21: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 22: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 23: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 24: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 25: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 26: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 27: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 28: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 29: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 30: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 31: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 32:
rootkit-like behavior; copy of MBR
Disk \Device\Harddisk0\DR0 sector 33:
rootkit-like behavior; copy of MBR
Disk \Device\Harddisk0\DR0 sector 34: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 35: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 36: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 37: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 38: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 39: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 40: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 41: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 42: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 43: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 44: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 45: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 46: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 47: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 48: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 49: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 50: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 51: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 52: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 53: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 54: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 55: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 56: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 57: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 58: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 59: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 60: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 61: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 62: copy of
MBR
Disk \Device\Harddisk0\DR0 sector 63:
rootkit-like behavior; copy of MBR
---- Files - GMER 1.0.15 ----
File C:\WINDOWS\system32\drivers\atapi.sys suspicious
modification
---- EOF - GMER 1.0.15 ----