High CPU Usage Problem

[Dr Tim]

Hey. I have a high CPU Usage almost constantly and it sometimes slows things down quite a lot. I think it might be related to 'svchost.exe' or 'javaw.exe'.

Anyway, here is my HiJackThis Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:08:05, on 09/05/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Apoint\Apoint.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 0776897281
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 7770 bytes


Thanks in advance.

[Axephilic]

Welcome to the Malware Removal Forums! My name is Adam and I will be assisting you with getting the malware off of your computer. Please observe the following points before we start:

1. If at any point you don't understand something, please let me know and I will be glad to explain or go more into depth for you.
2. Please remember, I am a volunteer and I have a personal life. I go to school full time, have a part time job, and I do sports. A lot of this takes a lot of time.
3. Please keep all of your replies in this topic/thread and do not make a new topic/thread, thanks!
4. Please stick with this, don't stop responding because the symptoms are gone, the infection could still be there. Keep replying to my posts until I give you the All Clean message.
5. If you don't reply within five days after my last instructions this topic will be closed. If you will not be able to reply within five days please tell me so the topic will not be closed.
6. Please do not run other tools to remove the malware unless I ask you to until I give you the all clean. They will just mess up my fixes and make things more complicated, not fix the problem.

I don't see anything significant in your first log so we will take a deeper look.

RSIT

• Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
• Double click on RSIT.exe to run RSIT.
• Click Continue at the disclaimer screen.
• Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)

Regards,
Adam

[Dr Tim]

Thanks for your reply.

Log.txt

Logfile of random's system information tool 1.06 (written by random/random)
Run by Tim at 2009-05-13 17:44:49
Microsoft Windows XP Professional Service Pack 3
System drive C: has 37 GB (65%) free of 57 GB
Total RAM: 2047 MB (61% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:45:32, on 13/05/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Apoint\Apoint.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Tim\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Tim.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 0776897281
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 7843 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2009-05-05 312928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-04-28 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-04-28 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"BluetoothAuthenticationAgent"=bthprops.cpl,,BluetoothAuthenticationAgent []
"ehTray"=C:\WINDOWS\ehome\ehtray.exe [2005-08-05 64512]
"IntelZeroConfig"=C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe [2005-07-22 401408]
""= []
"IntelWireless"=C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe [2005-07-22 385024]
"ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2005-08-05 344064]
"Apoint"=C:\Program Files\Apoint\Apoint.exe [2005-10-07 176128]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-02-05 81000]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-04-28 148888]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2009-05-05 198160]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]
"H/PC Connection Agent"=C:\Program Files\Microsoft ActiveSync\Wcescomm.exe [2006-11-13 1289000]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2009-04-21 24264488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2005-08-03 46080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll [2005-07-22 110592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"

======List of files/folders created in the last 1 months======

2009-05-13 17:44:49 ----D---- C:\rsit
2009-05-09 22:06:50 ----D---- C:\Program Files\Trend Micro
2009-05-09 21:49:00 ----D---- C:\Documents and Settings\Tim\Application Data\skypePM
2009-05-09 21:47:51 ----D---- C:\Documents and Settings\Tim\Application Data\Skype
2009-05-09 21:47:36 ----D---- C:\Program Files\Common Files\Skype
2009-05-09 21:47:33 ----RD---- C:\Program Files\Skype
2009-05-09 21:47:23 ----D---- C:\Documents and Settings\All Users\Application Data\Skype
2009-05-08 17:29:48 ----D---- C:\WINDOWS\system32\appmgmt
2009-05-08 17:29:04 ----A---- C:\WINDOWS\tosOBEX.INI
2009-05-08 16:58:11 ----A---- C:\WINDOWS\ModemLog_Standard 33600 bps Modem.txt
2009-05-07 20:57:32 ----D---- C:\Documents and Settings\Tim\Application Data\Any Video Converter Professional
2009-05-07 20:57:28 ----D---- C:\Program Files\Any Video Converter Professional
2009-05-07 20:27:51 ----D---- C:\Program Files\Aimersoft
2009-05-07 19:27:06 ----D---- C:\Program Files\IMPlus for Skype 1.00 for PocketPC
2009-05-07 19:12:34 ----D---- C:\Program Files\HeroCraft
2009-05-07 17:45:34 ----D---- C:\Program Files\Palm
2009-05-07 17:31:55 ----D---- C:\WINDOWS\Downloaded Installations
2009-05-05 21:11:36 ----D---- C:\Program Files\Common Files\xing shared
2009-05-05 21:11:27 ----A---- C:\WINDOWS\system32\rmoc3260.dll
2009-05-05 21:11:16 ----A---- C:\WINDOWS\system32\pndx5032.dll
2009-05-05 21:11:16 ----A---- C:\WINDOWS\system32\pndx5016.dll
2009-05-05 21:11:15 ----D---- C:\Program Files\Real
2009-05-05 21:11:15 ----A---- C:\WINDOWS\system32\pncrt.dll
2009-05-05 21:11:10 ----D---- C:\Program Files\Common Files\Real
2009-05-05 21:11:07 ----D---- C:\Documents and Settings\Tim\Application Data\Real
2009-05-05 20:02:05 ----A---- C:\WINDOWS\brmx2001.ini
2009-05-05 20:01:18 ----A---- C:\WINDOWS\BRWMARK.INI
2009-05-05 20:01:18 ----A---- C:\WINDOWS\BRPP2KA.INI
2009-05-05 20:00:27 ----N---- C:\WINDOWS\system32\PtrcENG.dll
2009-05-05 20:00:18 ----N---- C:\WINDOWS\system32\Pdrvinst.dll
2009-05-05 20:00:18 ----D---- C:\Program Files\Brother
2009-05-05 20:00:16 ----N---- C:\WINDOWS\system32\BRWEBUP.EXE
2009-05-05 20:00:16 ----N---- C:\WINDOWS\system32\BrWebIns.dll
2009-05-01 23:16:25 ----D---- C:\Program Files\Sun
2009-05-01 22:13:12 ----D---- C:\Program Files\PokerStars
2009-05-01 18:20:42 ----D---- C:\Documents and Settings\Tim\Application Data\WinRAR
2009-05-01 18:19:17 ----D---- C:\Program Files\WinRAR
2009-04-29 22:06:57 ----HDC---- C:\WINDOWS\$NtUninstallKB961503$
2009-04-28 18:44:26 ----D---- C:\WINDOWS\.jagex_cache_32
2009-04-28 18:44:19 ----D---- C:\WINDOWS\Sun
2009-04-28 18:43:29 ----A---- C:\WINDOWS\ODBC.INI
2009-04-28 18:43:21 ----N---- C:\WINDOWS\system32\mdimon.dll
2009-04-28 18:42:40 ----D---- C:\Program Files\Microsoft ActiveSync
2009-04-28 18:42:34 ----D---- C:\Program Files\Common Files\DESIGNER
2009-04-28 18:42:03 ----D---- C:\WINDOWS\SHELLNEW
2009-04-28 18:41:59 ----D---- C:\Program Files\Microsoft.NET
2009-04-28 18:41:59 ----D---- C:\Program Files\Microsoft Office
2009-04-28 18:41:07 ----N---- C:\WINDOWS\system32\javaws.exe
2009-04-28 18:41:07 ----N---- C:\WINDOWS\system32\javaw.exe
2009-04-28 18:41:07 ----N---- C:\WINDOWS\system32\java.exe
2009-04-28 18:41:07 ----N---- C:\WINDOWS\system32\deploytk.dll
2009-04-28 18:40:44 ----D---- C:\Program Files\Java
2009-04-28 18:38:34 ----RHD---- C:\MSOCache
2009-04-28 18:36:33 ----D---- C:\Documents and Settings\Tim\Application Data\Sun
2009-04-27 21:48:50 ----D---- C:\Program Files\VSTplugins
2009-04-27 21:48:50 ----D---- C:\Documents and Settings\Tim\Application Data\Publish Providers
2009-04-27 21:48:22 ----D---- C:\Documents and Settings\Tim\Application Data\Sony
2009-04-27 21:39:23 ----D---- C:\Documents and Settings\All Users\Application Data\Sony
2009-04-27 21:38:51 ----D---- C:\Program Files\Sony
2009-04-27 21:34:37 ----D---- C:\Program Files\MSBuild
2009-04-27 21:29:50 ----D---- C:\WINDOWS\system32\XPSViewer
2009-04-27 21:28:58 ----D---- C:\Program Files\Reference Assemblies
2009-04-27 21:28:22 ----N---- C:\WINDOWS\system32\spmsg2.dll
2009-04-27 21:00:33 ----D---- C:\Documents and Settings\Tim\Application Data\Sony Setup
2009-04-27 19:20:21 ----D---- C:\Documents and Settings\Tim\Application Data\Adobe
2009-04-27 19:12:30 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-04-27 19:12:30 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-04-27 18:48:22 ----N---- C:\WINDOWS\system32\mucltui.dll.mui
2009-04-27 18:48:21 ----N---- C:\WINDOWS\system32\mucltui.dll
2009-04-27 18:38:36 ----N---- C:\WINDOWS\system32\MSVCR71.dll
2009-04-27 18:38:36 ----N---- C:\WINDOWS\system32\MSVCP71.dll
2009-04-27 18:38:36 ----N---- C:\WINDOWS\system32\MFC71.dll
2009-04-27 18:38:36 ----N---- C:\WINDOWS\system32\aswBoot.exe
2009-04-27 18:38:33 ----D---- C:\Program Files\Alwil Software
2009-04-27 18:34:50 ----D---- C:\Documents and Settings\Tim\Application Data\Mozilla
2009-04-27 18:34:33 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2009-04-27 18:34:29 ----N---- C:\WINDOWS\system32\MSSTDFMT.DLL
2009-04-27 18:34:28 ----D---- C:\Program Files\SpywareBlaster
2009-04-27 18:25:23 ----D---- C:\Documents and Settings\Tim\Application Data\Macromedia
2009-04-27 18:24:57 ----D---- C:\Program Files\Mozilla Firefox
2009-04-27 18:13:12 ----D---- C:\Program Files\Microsoft
2009-04-27 18:12:54 ----D---- C:\Program Files\Windows Live SkyDrive
2009-04-27 18:12:29 ----D---- C:\Program Files\Windows Live
2009-04-27 18:00:01 ----D---- C:\Program Files\Common Files\Windows Live
2009-04-27 17:57:29 ----HDC---- C:\WINDOWS\$NtUninstallKB959772_WM11$
2009-04-27 17:57:25 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$
2009-04-27 17:57:20 ----HDC---- C:\WINDOWS\$NtUninstallKB929399$
2009-04-27 17:57:05 ----HDC---- C:\WINDOWS\$NtUninstallKB936782_WMP11$
2009-04-27 17:56:54 ----HDC---- C:\WINDOWS\$NtUninstallKB939683$
2009-04-27 17:40:25 ----HDC---- C:\WINDOWS\$NtUninstallKB963027$
2009-04-27 17:40:18 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2009-04-27 17:40:12 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2009-04-27 17:40:04 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2009-04-27 17:39:52 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2009-04-27 17:39:45 ----HDC---- C:\WINDOWS\$NtUninstallKB961373$
2009-04-27 17:39:38 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2009-04-27 17:39:29 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2009-04-27 17:39:23 ----HDC---- C:\WINDOWS\$NtUninstallKB958690$
2009-04-27 17:39:19 ----HDC---- C:\WINDOWS\$NtUninstallKB938464-v2$
2009-04-27 17:39:14 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2009-04-27 17:39:08 ----HDC---- C:\WINDOWS\$NtUninstallKB960715$
2009-04-27 17:39:03 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2009-04-27 17:38:59 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2009-04-27 17:38:53 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2009-04-27 17:38:47 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$
2009-04-27 17:38:42 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2009-04-27 17:38:37 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2009-04-27 17:38:32 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2009-04-27 17:38:25 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2009-04-27 17:38:21 ----D---- C:\Program Files\MSXML 4.0
2009-04-27 17:38:11 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2009-04-27 17:38:06 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2009-04-27 17:38:00 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2009-04-27 17:37:54 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2009-04-27 17:37:50 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2009-04-27 17:37:45 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2009-04-27 17:37:40 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2009-04-27 17:37:33 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2009-04-27 17:37:15 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2009-04-27 17:37:10 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2009-04-27 17:37:07 ----N---- C:\WINDOWS\system32\spmsg.dll
2009-04-27 17:37:06 ----HDC---- C:\WINDOWS\$NtUninstallMSCompPackV1$
2009-04-27 17:36:52 ----D---- C:\Program Files\Windows Media Connect 2
2009-04-27 17:36:36 ----HDC---- C:\WINDOWS\$NtUninstallwmp11$
2009-04-27 17:35:56 ----HDC---- C:\WINDOWS\$NtUninstallWMFDist11$
2009-04-27 17:35:35 ----HDC---- C:\WINDOWS\$NtUninstallWudf01000$
2009-04-27 17:35:05 ----HDC---- C:\WINDOWS\$NtUninstallKB925766$
2009-04-27 17:34:52 ----HDC---- C:\WINDOWS\$NtUninstallKB923689$
2009-04-27 17:34:41 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2009-04-27 17:34:36 ----HDC---- C:\WINDOWS\$NtUninstallKB950760$
2009-04-27 17:34:05 ----D---- C:\WINDOWS\ie7updates
2009-04-27 17:33:41 ----D---- C:\WINDOWS\WBEM
2009-04-27 17:32:00 ----HDC---- C:\WINDOWS\ie7
2009-04-27 17:31:51 ----HDC---- C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$
2009-04-27 17:31:40 ----HDC---- C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$
2009-04-27 17:30:29 ----N---- C:\WINDOWS\system32\MRT.exe
2009-04-27 17:23:29 ----HDC---- C:\WINDOWS\$NtUninstallKB941569$
2009-04-27 16:53:11 ----D---- C:\WINDOWS\system32\LogFiles
2009-04-27 16:45:14 ----N---- C:\WINDOWS\system32\xpsp4res.dll
2009-04-27 16:40:32 ----D---- C:\WINDOWS\Prefetch
2009-04-26 22:12:38 ----D---- C:\WINDOWS\system32\en-us
2009-04-26 22:12:37 ----D---- C:\WINDOWS\system32\scripting
2009-04-26 22:12:37 ----D---- C:\WINDOWS\system32\en
2009-04-26 22:12:37 ----D---- C:\WINDOWS\l2schemas
2009-04-26 22:12:36 ----D---- C:\WINDOWS\system32\bits
2009-04-26 22:10:19 ----D---- C:\WINDOWS\ServicePackFiles
2009-04-26 22:07:09 ----D---- C:\WINDOWS\network diagnostic
2009-04-26 22:02:09 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2009-04-26 21:24:12 ----D---- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2009-04-26 21:20:22 ----D---- C:\WINDOWS\system32\PreInstall
2009-04-26 21:20:20 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2009-04-26 21:15:31 ----SHD---- C:\RECYCLER
2009-04-26 21:14:25 ----A---- C:\WINDOWS\ModemLog_Conexant D110 MDC V.92 Modem.txt
2009-04-26 21:14:19 ----D---- C:\Program Files\CONEXANT
2009-04-26 21:11:00 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-04-26 21:10:59 ----N---- C:\WINDOWS\system32\Vxdif.dll
2009-04-26 21:10:59 ----D---- C:\Program Files\Apoint
2009-04-26 21:08:53 ----N---- C:\WINDOWS\system32\ksuser.dll
2009-04-26 21:08:51 ----N---- C:\WINDOWS\system32\Stac97co.dll
2009-04-26 21:08:51 ----D---- C:\Program Files\SigmaTel
2009-04-26 21:05:03 ----D---- C:\Program Files\Broadcom
2009-04-26 21:01:14 ----D---- C:\Program Files\ATI Technologies
2009-04-26 21:01:11 ----HD---- C:\Program Files\InstallShield Installation Information
2009-04-26 21:00:51 ----N---- C:\WINDOWS\system32\Oemdspif.dll
2009-04-26 21:00:51 ----N---- C:\WINDOWS\system32\ativvaxx.dll
2009-04-26 21:00:51 ----N---- C:\WINDOWS\system32\ativcoxx.dll
2009-04-26 21:00:51 ----N---- C:\WINDOWS\system32\atitvo32.dll
2009-04-26 21:00:51 ----N---- C:\WINDOWS\system32\atipdlxx.dll
2009-04-26 21:00:50 ----N---- C:\WINDOWS\system32\atioglxx.dll
2009-04-26 21:00:50 ----N---- C:\WINDOWS\system32\atioglx1.dll
2009-04-26 21:00:50 ----N---- C:\WINDOWS\system32\atikvmag.dll
2009-04-26 21:00:50 ----N---- C:\WINDOWS\system32\atiiiexx.dll
2009-04-26 21:00:50 ----N---- C:\WINDOWS\system32\ATIDDC.DLL
2009-04-26 21:00:50 ----N---- C:\WINDOWS\system32\ati3duag.dll
2009-04-26 21:00:50 ----N---- C:\WINDOWS\system32\Ati2mdxx.exe
2009-04-26 21:00:50 ----N---- C:\WINDOWS\system32\ati2evxx.exe
2009-04-26 21:00:50 ----N---- C:\WINDOWS\system32\ati2evxx.dll
2009-04-26 21:00:50 ----N---- C:\WINDOWS\system32\ati2edxx.dll
2009-04-26 21:00:50 ----N---- C:\WINDOWS\system32\ati2dvag.dll
2009-04-26 21:00:50 ----N---- C:\WINDOWS\system32\ati2cqag.dll
2009-04-26 20:47:11 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2009-04-26 20:45:21 ----D---- C:\Documents and Settings\Tim\Application Data\Intel
2009-04-26 20:45:12 ----N---- C:\WINDOWS\system32\iwca.dll
2009-04-26 20:45:01 ----N---- C:\WINDOWS\system32\results.txt
2009-04-26 20:44:39 ----D---- C:\Documents and Settings\All Users\Application Data\Intel
2009-04-26 20:44:07 ----N---- C:\WINDOWS\system32\W29MLRES.DLL
2009-04-26 20:44:03 ----D---- C:\Program Files\Intel
2009-04-26 20:42:18 ----D---- C:\WINDOWS\system32\vmm32
2009-04-26 20:42:16 ----D---- C:\Program Files\Dell
2009-04-26 20:41:48 ----D---- C:\Program Files\Common Files\InstallShield
2009-04-26 20:32:59 ----D---- C:\Documents and Settings\Tim\Application Data\Identities
2009-04-26 20:32:53 ----HD---- C:\Program Files\Uninstall Information
2009-04-26 20:32:06 ----N---- C:\WINDOWS\system32\h323log.txt
2009-04-26 20:29:03 ----N---- C:\WINDOWS\system32\irftp.exe
2009-04-26 20:29:02 ----N---- C:\WINDOWS\system32\wshirda.dll
2009-04-26 20:29:02 ----N---- C:\WINDOWS\system32\irmon.dll
2009-04-26 20:27:06 ----N---- C:\WINDOWS\system32\usbui.dll
2009-04-26 20:25:05 ----A---- C:\WINDOWS\imsins.BAK
2009-04-26 20:25:01 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-04-26 20:25:00 ----SHD---- C:\WINDOWS\Installer
2009-04-26 20:24:59 ----D---- C:\Program Files\Common Files\ODBC
2009-04-26 20:24:59 ----A---- C:\WINDOWS\ODBCINST.INI
2009-04-26 20:24:53 ----D---- C:\Program Files\Common Files\SpeechEngines
2009-04-26 20:24:52 ----RD---- C:\Program Files
2009-04-26 20:24:52 ----D---- C:\Program Files\Common Files\Microsoft Shared
2009-04-26 20:24:52 ----D---- C:\Program Files\Common Files
2009-04-26 20:24:49 ----N---- C:\WINDOWS\system32\kbdtuq.dll
2009-04-26 20:24:49 ----N---- C:\WINDOWS\system32\kbdtuf.dll
2009-04-26 20:24:49 ----N---- C:\WINDOWS\system32\kbdazel.dll
2009-04-26 20:24:47 ----N---- C:\WINDOWS\system32\kbdycc.dll
2009-04-26 20:24:47 ----N---- C:\WINDOWS\system32\kbduzb.dll
2009-04-26 20:24:47 ----N---- C:\WINDOWS\system32\kbdur.dll
2009-04-26 20:24:47 ----N---- C:\WINDOWS\system32\kbdtat.dll
2009-04-26 20:24:47 ----N---- C:\WINDOWS\system32\kbdru1.dll
2009-04-26 20:24:47 ----N---- C:\WINDOWS\system32\kbdru.dll
2009-04-26 20:24:47 ----N---- C:\WINDOWS\system32\kbdmon.dll
2009-04-26 20:24:47 ----N---- C:\WINDOWS\system32\kbdkyr.dll
2009-04-26 20:24:47 ----N---- C:\WINDOWS\system32\kbdkaz.dll
2009-04-26 20:24:47 ----N---- C:\WINDOWS\system32\kbdbu.dll
2009-04-26 20:24:47 ----N---- C:\WINDOWS\system32\kbdblr.dll
2009-04-26 20:24:47 ----N---- C:\WINDOWS\system32\kbdaze.dll
2009-04-26 20:24:45 ----N---- C:\WINDOWS\system32\kbdhept.dll
2009-04-26 20:24:45 ----N---- C:\WINDOWS\system32\kbdhela3.dll
2009-04-26 20:24:45 ----N---- C:\WINDOWS\system32\kbdhela2.dll
2009-04-26 20:24:45 ----N---- C:\WINDOWS\system32\kbdhe319.dll
2009-04-26 20:24:45 ----N---- C:\WINDOWS\system32\kbdhe220.dll
2009-04-26 20:24:45 ----N---- C:\WINDOWS\system32\kbdgkl.dll
2009-04-26 20:24:44 ----N---- C:\WINDOWS\system32\kbdhe.dll
2009-04-26 20:24:43 ----N---- C:\WINDOWS\system32\kbdlv1.dll
2009-04-26 20:24:43 ----N---- C:\WINDOWS\system32\kbdlv.dll
2009-04-26 20:24:43 ----N---- C:\WINDOWS\system32\kbdlt1.dll
2009-04-26 20:24:43 ----N---- C:\WINDOWS\system32\kbdlt.dll
2009-04-26 20:24:43 ----N---- C:\WINDOWS\system32\kbdest.dll
2009-04-26 20:24:41 ----N---- C:\WINDOWS\system32\kbdycl.dll
2009-04-26 20:24:41 ----N---- C:\WINDOWS\system32\kbdsl1.dll
2009-04-26 20:24:41 ----N---- C:\WINDOWS\system32\kbdsl.dll
2009-04-26 20:24:41 ----N---- C:\WINDOWS\system32\kbdro.dll
2009-04-26 20:24:41 ----N---- C:\WINDOWS\system32\kbdpl1.dll
2009-04-26 20:24:41 ----N---- C:\WINDOWS\system32\kbdpl.dll
2009-04-26 20:24:41 ----N---- C:\WINDOWS\system32\kbdhu1.dll
2009-04-26 20:24:41 ----N---- C:\WINDOWS\system32\kbdhu.dll
2009-04-26 20:24:41 ----N---- C:\WINDOWS\system32\kbdcz2.dll
2009-04-26 20:24:41 ----N---- C:\WINDOWS\system32\kbdcz1.dll
2009-04-26 20:24:41 ----N---- C:\WINDOWS\system32\kbdcz.dll
2009-04-26 20:24:41 ----N---- C:\WINDOWS\system32\kbdcr.dll
2009-04-26 20:24:41 ----N---- C:\WINDOWS\system32\KBDAL.DLL
2009-04-26 20:24:37 ----N---- C:\WINDOWS\system32\spxcoins.dll
2009-04-26 20:24:37 ----N---- C:\WINDOWS\system32\irclass.dll
2009-04-26 20:24:37 ----N---- C:\WINDOWS\system32\EqnClass.Dll
2009-04-26 20:24:37 ----N---- C:\WINDOWS\system32\dgsetup.dll
2009-04-26 20:24:37 ----N---- C:\WINDOWS\system32\dgrpsetu.dll
2009-04-26 20:24:34 ----N---- C:\WINDOWS\system32\CONFIG.TMP
2009-04-26 20:24:34 ----N---- C:\WINDOWS\system32\batt.dll
2009-04-26 20:24:34 ----A---- C:\WINDOWS\TASKMAN.EXE
2009-04-26 20:24:34 ----A---- C:\WINDOWS\notepad.exe
2009-04-26 20:24:33 ----N---- C:\WINDOWS\system32\storprop.dll
2009-04-26 20:24:19 ----ASH---- C:\Documents and Settings\All Users\Application Data\desktop.ini
2009-04-26 20:24:18 ----RA---- C:\WINDOWS\SET2E.tmp
2009-04-26 20:24:18 ----RA---- C:\WINDOWS\SET2D.tmp
2009-04-26 20:24:13 ----RA---- C:\WINDOWS\SET8.tmp
2009-04-26 20:24:08 ----RA---- C:\WINDOWS\SET4.tmp
2009-04-26 20:24:07 ----RA---- C:\WINDOWS\SET3.tmp
2009-04-26 20:23:58 ----D---- C:\WINDOWS\system32\CatRoot2
2009-04-26 20:23:58 ----D---- C:\WINDOWS\system32\CatRoot
2009-04-26 20:23:52 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2009-04-26 20:23:20 ----A---- C:\WINDOWS\setuplog.txt
2009-04-26 20:23:14 ----D---- C:\Documents and Settings
2009-04-26 20:23:13 ----SHD---- C:\System Volume Information
2009-04-26 20:22:11 ----SH---- C:\boot.ini
2009-04-26 20:12:08 ----D---- C:\WINDOWS\RegisteredPackages
2009-04-26 20:09:40 ----HDC---- C:\WINDOWS\$NtUninstallKB900325$
2009-04-26 20:09:17 ----HDC---- C:\WINDOWS\$NtUninstallKB902841$
2009-04-26 20:09:04 ----HDC---- C:\WINDOWS\$NtUninstallKB888795$
2009-04-26 20:08:52 ----HDC---- C:\WINDOWS\$NtUninstallKB899510$
2009-04-26 20:08:35 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-04-26 20:08:35 ----RSD---- C:\WINDOWS\Fonts
2009-04-26 20:08:35 ----RD---- C:\WINDOWS\Web
2009-04-26 20:08:35 ----HD---- C:\WINDOWS\inf
2009-04-26 20:08:35 ----D---- C:\WINDOWS\WinSxS
2009-04-26 20:08:35 ----D---- C:\WINDOWS\twain_32
2009-04-26 20:08:35 ----D---- C:\WINDOWS\Temp
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32\wins
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32\wbem
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32\usmt
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32\spool
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32\ShellExt
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32\Setup
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32\ras
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32\oobe
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32\npp
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32\mui
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32\inetsrv
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32\IME
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32\icsxml
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32\ias
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32\export
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32\drivers
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32\dhcp
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32\config
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32\3com_dmi
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32\3076
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32\2052
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32\1054
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32\1042
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32\1041
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32\1037
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32\1033
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32\1031
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32\1028
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32\1025
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system32
2009-04-26 20:08:35 ----D---- C:\WINDOWS\system
2009-04-26 20:08:35 ----D---- C:\WINDOWS\security
2009-04-26 20:08:35 ----D---- C:\WINDOWS\Resources
2009-04-26 20:08:35 ----D---- C:\WINDOWS\repair
2009-04-26 20:08:35 ----D---- C:\WINDOWS\Provisioning
2009-04-26 20:08:35 ----D---- C:\WINDOWS\PeerNet
2009-04-26 20:08:35 ----D---- C:\WINDOWS\pchealth
2009-04-26 20:08:35 ----D---- C:\WINDOWS\mui
2009-04-26 20:08:35 ----D---- C:\WINDOWS\msapps
2009-04-26 20:08:35 ----D---- C:\WINDOWS\msagent
2009-04-26 20:08:35 ----D---- C:\WINDOWS\Media
2009-04-26 20:08:35 ----D---- C:\WINDOWS\java
2009-04-26 20:08:35 ----D---- C:\WINDOWS\ime
2009-04-26 20:08:35 ----D---- C:\WINDOWS\Help
2009-04-26 20:08:35 ----D---- C:\WINDOWS\ehome
2009-04-26 20:08:35 ----D---- C:\WINDOWS\Driver Cache
2009-04-26 20:08:35 ----D---- C:\WINDOWS\dell
2009-04-26 20:08:35 ----D---- C:\WINDOWS\Debug
2009-04-26 20:08:35 ----D---- C:\WINDOWS\Cursors
2009-04-26 20:08:35 ----D---- C:\WINDOWS\Connection Wizard
2009-04-26 20:08:35 ----D---- C:\WINDOWS\Config
2009-04-26 20:08:35 ----D---- C:\WINDOWS\AppPatch
2009-04-26 20:08:35 ----D---- C:\WINDOWS\addins
2009-04-26 20:08:35 ----D---- C:\WINDOWS
2009-04-26 20:08:34 ----HDC---- C:\WINDOWS\$NtUninstallKB912812$
2009-04-26 20:08:22 ----HDC---- C:\WINDOWS\$NtUninstallKB899337$
2009-04-26 20:08:12 ----HDC---- C:\WINDOWS\$NtUninstallKB895961$
2009-04-26 20:08:02 ----HDC---- C:\WINDOWS\$NtUninstallKB891593$
2009-04-26 20:07:36 ----N---- C:\WINDOWS\system32\spupdsvc.exe
2009-04-26 20:07:34 ----HDC---- C:\WINDOWS\$NtUninstallKB903157$
2009-04-26 20:04:43 ----D---- C:\WINDOWS\system32\URTTemp
2009-04-26 19:55:48 ----ASH---- C:\Documents and Settings\Tim\Application Data\desktop.ini
2009-04-26 19:55:47 ----SD---- C:\Documents and Settings\Tim\Application Data\Microsoft
2009-04-26 19:50:03 ----D---- C:\WINDOWS\SoftwareDistribution
2009-04-26 19:49:57 ----SD---- C:\WINDOWS\system32\Microsoft
2009-04-26 19:49:57 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-04-26 19:45:25 ----D---- C:\WINDOWS\system32\xircom
2009-04-26 19:45:25 ----D---- C:\Program Files\xerox
2009-04-26 19:45:25 ----D---- C:\Program Files\microsoft frontpage
2009-04-26 19:44:41 ----D---- C:\DELL
2009-04-26 19:44:30 ----HD---- C:\WINDOWS\$hf_mig$
2009-04-26 19:44:28 ----N---- C:\WINDOWS\system32\xpsp3res.dll
2009-04-26 19:44:11 ----A---- C:\WINDOWS\control.ini
2009-04-26 19:44:11 ----A---- C:\AUTOEXEC.BAT
2009-04-26 19:43:52 ----A---- C:\WINDOWS\OEWABLog.txt
2009-04-26 19:43:46 ----N---- C:\WINDOWS\system32\mapi32.dll
2009-04-26 19:42:14 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-04-26 19:42:14 ----RD---- C:\WINDOWS\Offline Web Pages
2009-04-26 19:42:14 ----N---- C:\WINDOWS\system32\logonui.exe.manifest
2009-04-26 19:42:05 ----N---- C:\WINDOWS\system32\cdplayer.exe.manifest
2009-04-26 19:41:56 ----HD---- C:\Program Files\WindowsUpdate
2009-04-26 19:41:33 ----D---- C:\WINDOWS\system32\DirectX
2009-04-26 19:41:14 ----N---- C:\WINDOWS\system32\atrace.dll
2009-04-26 19:41:11 ----N---- C:\WINDOWS\system32\desktop.ini
2009-04-26 19:41:11 ----A---- C:\WINDOWS\desktop.ini
2009-04-26 19:41:06 ----N---- C:\WINDOWS\system32\nmevtmsg.dll
2009-04-26 19:41:06 ----N---- C:\WINDOWS\system32\acctres.dll
2009-04-26 19:41:05 ----D---- C:\Program Files\Common Files\Services
2009-04-26 19:41:03 ----SD---- C:\WINDOWS\Tasks
2009-04-26 19:41:03 ----N---- C:\WINDOWS\system32\icfgnt5.dll
2009-04-26 19:41:02 ----D---- C:\Program Files\Common Files\MSSoap
2009-04-26 19:40:59 ----D---- C:\WINDOWS\srchasst
2009-04-26 19:40:58 ----D---- C:\WINDOWS\system32\Macromed
2009-04-26 19:40:54 ----N---- C:\WINDOWS\system32\wuweb.dll
2009-04-26 19:40:54 ----N---- C:\WINDOWS\system32\wups.dll
2009-04-26 19:40:54 ----N---- C:\WINDOWS\system32\wucltui.dll
2009-04-26 19:40:54 ----N---- C:\WINDOWS\system32\wuauserv.dll
2009-04-26 19:40:54 ----N---- C:\WINDOWS\system32\wuaueng1.dll
2009-04-26 19:40:54 ----N---- C:\WINDOWS\system32\wuaueng.dll
2009-04-26 19:40:54 ----N---- C:\WINDOWS\system32\wuauclt1.exe
2009-04-26 19:40:54 ----N---- C:\WINDOWS\system32\wuauclt.exe
2009-04-26 19:40:54 ----N---- C:\WINDOWS\system32\wuapi.dll
2009-04-26 19:40:53 ----N---- C:\WINDOWS\system32\qmgrprxy.dll
2009-04-26 19:40:53 ----N---- C:\WINDOWS\system32\qmgr.dll
2009-04-26 19:40:53 ----N---- C:\WINDOWS\system32\bitsprx3.dll
2009-04-26 19:40:53 ----N---- C:\WINDOWS\system32\bitsprx2.dll
2009-04-26 19:40:46 ----N---- C:\WINDOWS\system32\safrslv.dll
2009-04-26 19:40:46 ----N---- C:\WINDOWS\system32\safrdm.dll
2009-04-26 19:40:46 ----N---- C:\WINDOWS\system32\safrcdlg.dll
2009-04-26 19:40:46 ----N---- C:\WINDOWS\system32\racpldlg.dll
2009-04-26 19:40:42 ----N---- C:\WINDOWS\system32\srsvc.dll
2009-04-26 19:40:42 ----N---- C:\WINDOWS\system32\srrstr.dll
2009-04-26 19:40:42 ----N---- C:\WINDOWS\system32\srclient.dll
2009-04-26 19:40:42 ----N---- C:\WINDOWS\system32\fltmc.exe
2009-04-26 19:40:42 ----N---- C:\WINDOWS\system32\fltlib.dll
2009-04-26 19:40:42 ----D---- C:\WINDOWS\system32\Restore
2009-04-26 19:40:41 ----N---- C:\WINDOWS\system32\nmmkcert.dll
2009-04-26 19:40:41 ----N---- C:\WINDOWS\system32\msconf.dll
2009-04-26 19:40:41 ----N---- C:\WINDOWS\system32\mnmsrvc.exe
2009-04-26 19:40:41 ----N---- C:\WINDOWS\system32\mnmdd.dll
2009-04-26 19:40:41 ----N---- C:\WINDOWS\system32\isrdbg32.dll
2009-04-26 19:40:41 ----N---- C:\WINDOWS\system32\ils.dll
2009-04-26 19:40:39 ----N---- C:\WINDOWS\system32\msoert2.dll
2009-04-26 19:40:39 ----N---- C:\WINDOWS\system32\msoeacct.dll
2009-04-26 19:40:39 ----D---- C:\Program Files\NetMeeting
2009-04-26 19:40:38 ----N---- C:\WINDOWS\system32\inetres.dll
2009-04-26 19:40:38 ----N---- C:\WINDOWS\system32\inetcomm.dll
2009-04-26 19:40:36 ----N---- C:\WINDOWS\system32\schedsvc.dll
2009-04-26 19:40:36 ----N---- C:\WINDOWS\system32\mstinit.exe
2009-04-26 19:40:36 ----N---- C:\WINDOWS\system32\mstask.dll
2009-04-26 19:40:36 ----D---- C:\Program Files\Outlook Express
2009-04-26 19:40:35 ----N---- C:\WINDOWS\system32\isign32.dll
2009-04-26 19:40:35 ----N---- C:\WINDOWS\system32\inetcfg.dll
2009-04-26 19:40:35 ----N---- C:\WINDOWS\system32\icwphbk.dll
2009-04-26 19:40:35 ----N---- C:\WINDOWS\system32\icwdial.dll
2009-04-26 19:40:29 ----D---- C:\Program Files\Common Files\System
2009-04-26 19:40:25 ----D---- C:\Program Files\Internet Explorer
2009-04-26 19:39:42 ----RSD---- C:\WINDOWS\assembly
2009-04-26 19:39:04 ----D---- C:\Program Files\ComPlus Applications
2009-04-26 19:39:01 ----A---- C:\WINDOWS\vbaddin.ini
2009-04-26 19:39:01 ----A---- C:\WINDOWS\vb.ini
2009-04-26 19:38:54 ----D---- C:\WINDOWS\Registration
2009-04-26 19:38:43 ----D---- C:\Program Files\Online Services
2009-04-26 19:38:21 ----D---- C:\WINDOWS\Microsoft.NET
2009-04-26 19:38:16 ----D---- C:\Program Files\Windows Media Player
2009-04-26 19:37:52 ----D---- C:\Program Files\Windows Plus
2009-04-26 19:37:40 ----N---- C:\WINDOWS\system32\mhn.dll
2009-04-26 19:37:40 ----N---- C:\WINDOWS\system32\igdetect.dll
2009-04-26 19:37:34 ----D---- C:\Program Files\Movie Maker
2009-04-26 19:36:13 ----D---- C:\Program Files\Messenger
2009-04-26 19:36:10 ----N---- C:\WINDOWS\system32\write.exe
2009-04-26 19:36:10 ----D---- C:\Program Files\MSN Gaming Zone
2009-04-26 19:36:02 ----N---- C:\WINDOWS\system32\winchat.exe
2009-04-26 19:36:02 ----N---- C:\WINDOWS\system32\sndvol32.exe
2009-04-26 19:36:02 ----N---- C:\WINDOWS\system32\hticons.dll
2009-04-26 19:36:02 ----N---- C:\WINDOWS\system32\avwav.dll
2009-04-26 19:36:02 ----N---- C:\WINDOWS\system32\avtapi.dll
2009-04-26 19:36:02 ----N---- C:\WINDOWS\system32\avmeter.dll
2009-04-26 19:35:56 ----N---- C:\WINDOWS\system32\getuname.dll
2009-04-26 19:35:56 ----N---- C:\WINDOWS\system32\charmap.exe
2009-04-26 19:35:56 ----N---- C:\WINDOWS\system32\calc.exe
2009-04-26 19:35:55 ----N---- C:\WINDOWS\system32\winmine.exe
2009-04-26 19:35:55 ----N---- C:\WINDOWS\system32\sol.exe
2009-04-26 19:35:55 ----N---- C:\WINDOWS\system32\reset.exe
2009-04-26 19:35:55 ----N---- C:\WINDOWS\system32\mshearts.exe
2009-04-26 19:35:55 ----N---- C:\WINDOWS\system32\freecell.exe
2009-04-26 19:35:54 ----N---- C:\WINDOWS\system32\usrlogon.cmd
2009-04-26 19:35:54 ----N---- C:\WINDOWS\system32\tsshutdn.exe
2009-04-26 19:35:54 ----N---- C:\WINDOWS\system32\tslabels.ini
2009-04-26 19:35:54 ----N---- C:\WINDOWS\system32\tskill.exe
2009-04-26 19:35:54 ----N---- C:\WINDOWS\system32\tsdiscon.exe
2009-04-26 19:35:54 ----N---- C:\WINDOWS\system32\tscon.exe
2009-04-26 19:35:54 ----N---- C:\WINDOWS\system32\shadow.exe
2009-04-26 19:35:54 ----N---- C:\WINDOWS\system32\rwinsta.exe
2009-04-26 19:35:54 ----N---- C:\WINDOWS\system32\regini.exe
2009-04-26 19:35:54 ----N---- C:\WINDOWS\system32\rdpcfgex.dll
2009-04-26 19:35:54 ----N---- C:\WINDOWS\system32\qwinsta.exe
2009-04-26 19:35:54 ----N---- C:\WINDOWS\system32\qappsrv.exe
2009-04-26 19:35:54 ----N---- C:\WINDOWS\system32\msg.exe
2009-04-26 19:35:54 ----N---- C:\WINDOWS\system32\logoff.exe
2009-04-26 19:35:54 ----N---- C:\WINDOWS\system32\cdmodem.dll
2009-04-26 19:35:53 ----N---- C:\WINDOWS\system32\mtxlegih.dll
2009-04-26 19:35:53 ----N---- C:\WINDOWS\system32\mtxex.dll
2009-04-26 19:35:53 ----N---- C:\WINDOWS\system32\mtxdm.dll
2009-04-26 19:35:53 ----N---- C:\WINDOWS\system32\msdtcprf.ini
2009-04-26 19:35:53 ----N---- C:\WINDOWS\system32\dcomcnfg.exe
2009-04-26 19:35:53 ----N---- C:\WINDOWS\system32\comrepl.dll
2009-04-26 19:35:53 ----N---- C:\WINDOWS\system32\comaddin.dll
2009-04-26 19:35:52 ----N---- C:\WINDOWS\system32\stclient.dll
2009-04-26 19:35:52 ----N---- C:\WINDOWS\system32\comsnap.dll
2009-04-26 19:35:48 ----N---- C:\WINDOWS\system32\wmimgmt.msc
2009-04-26 19:35:34 ----D---- C:\Program Files\MSN
2009-04-26 19:35:33 ----N---- C:\WINDOWS\system32\sndrec32.exe
2009-04-26 19:35:33 ----N---- C:\WINDOWS\system32\mplay32.exe
2009-04-26 19:35:33 ----N---- C:\WINDOWS\system32\hypertrm.dll
2009-04-26 19:35:33 ----N---- C:\WINDOWS\system32\accwiz.exe
2009-04-26 19:35:33 ----D---- C:\Program Files\Windows NT
2009-04-26 19:35:32 ----N---- C:\WINDOWS\system32\tscfgwmi.dll
2009-04-26 19:35:32 ----N---- C:\WINDOWS\system32\spider.exe
2009-04-26 19:35:32 ----N---- C:\WINDOWS\system32\mspaint.exe
2009-04-26 19:35:32 ----N---- C:\WINDOWS\system32\clipbrd.exe
2009-04-26 19:35:31 ----N---- C:\WINDOWS\system32\tscupgrd.exe
2009-04-26 19:35:31 ----N---- C:\WINDOWS\system32\termsrv.dll
2009-04-26 19:35:31 ----N---- C:\WINDOWS\system32\sessmgr.exe
2009-04-26 19:35:31 ----N---- C:\WINDOWS\system32\remotepg.dll
2009-04-26 19:35:31 ----N---- C:\WINDOWS\system32\rdshost.exe
2009-04-26 19:35:31 ----N---- C:\WINDOWS\system32\rdsaddin.exe
2009-04-26 19:35:31 ----N---- C:\WINDOWS\system32\rdchost.dll
2009-04-26 19:35:31 ----N---- C:\WINDOWS\system32\mstscax.dll
2009-04-26 19:35:31 ----N---- C:\WINDOWS\system32\mstsc.exe
2009-04-26 19:35:30 ----N---- C:\WINDOWS\system32\rdpwsx.dll
2009-04-26 19:35:30 ----N---- C:\WINDOWS\system32\rdpsnd.dll
2009-04-26 19:35:30 ----N---- C:\WINDOWS\system32\rdpclip.exe
2009-04-26 19:35:30 ----N---- C:\WINDOWS\system32\qprocess.exe
2009-04-26 19:35:30 ----N---- C:\WINDOWS\system32\mtxoci.dll
2009-04-26 19:35:30 ----N---- C:\WINDOWS\system32\msdtcuiu.dll
2009-04-26 19:35:30 ----N---- C:\WINDOWS\system32\msdtcprx.dll
2009-04-26 19:35:30 ----N---- C:\WINDOWS\system32\icaapi.dll
2009-04-26 19:35:30 ----N---- C:\WINDOWS\system32\cfgbkend.dll
2009-04-26 19:35:30 ----D---- C:\WINDOWS\system32\MsDtc
2009-04-26 19:35:29 ----N---- C:\WINDOWS\system32\xolehlp.dll
2009-04-26 19:35:29 ----N---- C:\WINDOWS\system32\msdtctm.dll
2009-04-26 19:35:29 ----N---- C:\WINDOWS\system32\msdtclog.dll
2009-04-26 19:35:29 ----N---- C:\WINDOWS\system32\msdtc.exe
2009-04-26 19:35:29 ----N---- C:\WINDOWS\system32\colbact.dll
2009-04-26 19:35:29 ----D---- C:\WINDOWS\system32\Com
2009-04-26 19:35:28 ----N---- C:\WINDOWS\system32\comuid.dll
2009-04-26 19:35:28 ----N---- C:\WINDOWS\system32\comsvcs.dll
2009-04-26 19:35:28 ----N---- C:\WINDOWS\system32\clbcatex.dll
2009-04-26 19:35:28 ----N---- C:\WINDOWS\system32\catsrvut.dll
2009-04-26 19:35:28 ----N---- C:\WINDOWS\system32\catsrvps.dll
2009-04-26 19:35:28 ----N---- C:\WINDOWS\system32\catsrv.dll
2009-04-26 19:35:27 ----N---- C:\WINDOWS\system32\clbcatq.dll
2009-04-26 19:35:20 ----N---- C:\WINDOWS\system32\servdeps.dll
2009-04-26 19:35:20 ----N---- C:\WINDOWS\system32\mmfutil.dll
2009-04-26 19:35:20 ----N---- C:\WINDOWS\system32\licwmi.dll
2009-04-26 19:35:20 ----N---- C:\WINDOWS\system32\cmprops.dll

======List of files/folders modified in the last 1 months======

2009-05-02 22:12:24 ----A---- C:\WINDOWS\win.ini
2009-04-26 20:30:19 ----A---- C:\WINDOWS\system.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-02-05 26944]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-02-05 114768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-02-05 51376]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.2.0.3; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2009-04-26 17801]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-02-05 94032]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2004-03-17 13059]
R2 s24trans;WLAN Transport; C:\WINDOWS\system32\DRIVERS\s24trans.sys [2005-07-22 11354]
R3 ApfiltrService;Alps Touch Pad Filter Driver for Windows 2000/XP; C:\WINDOWS\system32\DRIVERS\Apfiltr.sys [2005-09-28 113847]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-02-05 23152]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-08-03 1273344]
R3 bcm4sbxp;Broadcom 440x 10/100 Integrated Controller XP Driver; C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys [2006-08-17 44544]
R3 BthEnum;Bluetooth Request Block Driver; C:\WINDOWS\system32\DRIVERS\BthEnum.sys [2008-04-13 17024]
R3 BTHMODEM;Bluetooth Serial Communications Driver; C:\WINDOWS\system32\DRIVERS\bthmodem.sys [2008-04-13 37888]
R3 BthPan;Bluetooth Device (Personal Area Network); C:\WINDOWS\system32\DRIVERS\bthpan.sys [2008-04-13 101120]
R3 BTHUSB;Bluetooth Radio USB Driver; C:\WINDOWS\System32\Drivers\BTHUSB.sys [2008-04-13 18944]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSF_DPV.SYS [2005-05-03 1033728]
R3 HSFHWICH;HSFHWICH; C:\WINDOWS\system32\DRIVERS\HSFHWICH.sys [2005-05-03 208384]
R3 IWCA;Intel Wireless Connection Agent Miniport for Win XP; C:\WINDOWS\system32\DRIVERS\iwca.sys [2004-08-12 234496]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-10 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\WINDOWS\system32\DRIVERS\rfcomm.sys [2008-04-13 59136]
R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-13 79232]
R3 STAC97;SigmaTel C-Major Audio; C:\WINDOWS\system32\drivers\STAC97.sys [2005-03-10 273168]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 w29n51;Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows XP; C:\WINDOWS\system32\DRIVERS\w29n51.sys [2005-07-19 3289088]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2005-05-03 705408]
S1 OMCI;OMCI; \??\C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS []
S1 Tosrfcom;Bluetooth RFCOMM from TOSHIBA; C:\WINDOWS\System32\Drivers\tosrfcom.sys [2005-08-01 64896]
S3 BCOREUSB;BCOREUSB.Sys CSR test driver; C:\WINDOWS\System32\Drivers\BCOREUSB.sys [2005-10-03 86867]
S3 BTHPORT;Bluetooth Port Driver; C:\WINDOWS\System32\Drivers\BTHport.sys [2008-06-13 272128]
S3 MHNDRV;MHN driver; C:\WINDOWS\system32\DRIVERS\mhndrv.sys [2004-08-10 11008]
S3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2004-08-10 5888]
S3 sffdisk;SFF Storage Class Driver; C:\WINDOWS\system32\DRIVERS\sffdisk.sys [2008-04-13 11904]
S3 sffp_sd;SFF Storage Protocol Driver for SDBus; C:\WINDOWS\system32\DRIVERS\sffp_sd.sys [2008-04-13 11008]
S3 SONYPVU1;Sony USB Filter Driver (SONYPVU1); C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
S3 tosporte;Bluetooth Port Driver from Toshiba; C:\WINDOWS\system32\DRIVERS\tosporte.sys [2005-06-20 44288]
S3 Tosrfbd;Bluetooth RFBUS from TOSHIBA; C:\WINDOWS\System32\Drivers\tosrfbd.sys [2005-09-15 108672]
S3 Tosrfbnp;Bluetooth RFBNEP from TOSHIBA; C:\WINDOWS\System32\Drivers\tosrfbnp.sys [2005-09-15 36480]
S3 Tosrfhid;Bluetooth RFHID from TOSHIBA; C:\WINDOWS\system32\DRIVERS\Tosrfhid.sys [2005-09-03 62592]
S3 Tosrfusb;Bluetooth USB Controller; C:\WINDOWS\System32\Drivers\tosrfusb.sys [2005-08-30 36608]
S3 usb_rndisx;USB RNDIS Adapter; C:\WINDOWS\system32\DRIVERS\usb8023x.sys [2008-04-13 12800]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-02-05 18752]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2005-08-03 380928]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-02-05 138680]
R2 BthServ;Bluetooth Support Service; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 ehRecvr;Media Center Receiver Service; C:\WINDOWS\eHome\ehRecvr.exe [2006-10-09 237568]
R2 ehSched;Media Center Scheduler Service; C:\WINDOWS\eHome\ehSched.exe [2005-08-05 102912]
R2 EvtEng;EvtEng; C:\Program Files\Intel\Wireless\Bin\EvtEng.exe [2005-07-22 86016]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-04-28 152984]
R2 McrdSvc;Media Center Extender Service; C:\WINDOWS\ehome\mcrdsvc.exe [2005-08-05 99328]
R2 RegSrvc;RegSrvc; C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe [2005-07-22 139264]
R2 S24EventMonitor;Spectrum24 Event Monitor; C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe [2005-07-22 372809]
R2 WLANKEEPER;WLANKEEPER; C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe [2005-07-22 225353]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-02-05 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-02-05 352920]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2006-10-20 36864]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2006-10-30 741376]
S3 MHN;MHN; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2006-10-30 122880]

-----------------EOF-----------------


Info.txt

info.txt logfile of random's system information tool 1.06 2009-05-13 17:45:44

======Uninstall list======

-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Aimersoft Pocket PC Video Converter(Build 2.2.0.37)-->"C:\Program Files\Aimersoft\Pocket PC Video Converter\unins000.exe"
ALPS Touch Pad Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}\setup.exe" UNINSTALL
Any Video Converter Professional 2.7.3-->"C:\Program Files\Any Video Converter Professional\unins000.exe"
ATI - Software Uninstall Utility-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Control Panel-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}\setup.exe"
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
Broadcom 440x 10/100 Integrated Controller-->MsiExec.exe /X{9C9D0F85-5658-4A5E-95A9-65F7DB2916EE}
Brother DCP-540CN-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{958248A4-5106-44B3-BA2C-1ECFA804BDEE}\setup.exe" -l0x9 -removeonly /uninst
Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
C-Major Audio-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}\setup.exe" -l0x9 -remove -removeonly
Conexant D110 MDC V.92 Modem-->C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_8086&DEV_24x6&SUBSYS_542214F1\HXFSETUP.EXE -U -Idel5422k.inf
Critical Update for Windows Media Player 11 (KB959772)-->"C:\WINDOWS\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe"
Dell Resource CD-->MsiExec.exe /X{FCD9CD52-7222-4672-94A0-A722BA702FD0}
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows Media Player 10 (KB903157)-->"C:\WINDOWS\$NtUninstallKB903157$\spuninst\spuninst.exe"
Hotfix for Windows Media Player 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Intel(R) PROSet/Wireless Software-->C:\WINDOWS\Installer\iProInst.exe
Java DB 10.4.1.3-->MsiExec.exe /X{998D6972-F58E-479D-9248-8F179E55AE38}
Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216013FF}
Java(TM) SE Development Kit 6 Update 13-->MsiExec.exe /I{32A3A4F4-B792-11D6-A78A-00B0D0160130}
mCore-->MsiExec.exe /I{6DE14BE4-6F04-4935-8ABD-A0A19FE2E55A}
mDriver-->MsiExec.exe /I{28DA872A-0848-48CF-B749-19A198157A2A}
mDrWiFi-->MsiExec.exe /I{F6090A17-0967-4A8A-B3C3-422A1B514D49}
mHlpDell-->MsiExec.exe /I{49D687E5-6784-431B-A0A2-2F23B8CC5A1B}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft .NET Framework 3.0-->C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setup.exe
Microsoft .NET Framework 3.0-->MsiExec.exe /X{15095BF3-A3D7-4DDF-B193-3A496881E003}
Microsoft ActiveSync-->MsiExec.exe /I{99052DB7-9592-4522-A558-5417BBAD48EE}
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office Standard Edition 2003-->MsiExec.exe /I{91120409-6000-11D3-8CFE-0150048383C9}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
mIWA-->MsiExec.exe /I{3E9D596A-61D4-4239-BD19-2DB984D2A16F}
mIWCA-->MsiExec.exe /I{6FFFE74E-3FBD-4E2E-97F9-5E9A2A077626}
mLogView-->MsiExec.exe /I{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7}
mMHouse-->MsiExec.exe /I{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}
Mozilla Firefox (3.0.10)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
mPfMgr-->MsiExec.exe /I{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}
mPfWiz-->MsiExec.exe /I{90B0D222-8C21-4B35-9262-53B042F18AF9}
mProSafe-->MsiExec.exe /I{23FB368F-1399-4EAC-817C-4B83ECBE3D83}
mSSO-->MsiExec.exe /I{06BE8AFD-A8E2-4B63-BAE7-287016D16ACB}
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 6.0 Parser (KB925673)-->MsiExec.exe /I{FE9126DB-5F84-495A-BB46-3C724F1C2D08}
mToolkit-->MsiExec.exe /I{CA9BAADB-C262-4E05-B2E2-CEE8CE9809EC}
mWlsSafe-->MsiExec.exe /I{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}
mXML-->MsiExec.exe /I{9CC89556-3578-48DD-8408-04E66EBEF401}
mZConfig-->MsiExec.exe /I{7CD7A451-7224-49C8-95EF-9A1859C66607}
PokerStars-->"C:\Program Files\PokerStars\PokerStarsUninstall.exe" /u:PokerStars
RealPlayer-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
RevivalWM by HeroCraft (remove only)-->"C:\Program Files\HeroCraft\RevivalWM\Uninstall.exe"
Security Update for Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB963027)-->"C:\WINDOWS\ie7updates\KB963027-IE7\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923689)-->"C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Security Update for Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Security Update for Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
Security Update for Windows XP (KB963027)-->"C:\WINDOWS\$NtUninstallKB963027$\spuninst\spuninst.exe"
Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
Skype™ 4.0-->MsiExec.exe /X{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}
Sonic Encoders-->MsiExec.exe /I{9941F0AA-B903-4AF4-A055-83A9815CC011}
Sony Vegas Pro 8.0-->MsiExec.exe /X{B7E2A724-2774-4AC2-9F0A-B58C7319B6E6}
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
SpywareBlaster 4.2-->"C:\Program Files\SpywareBlaster\unins000.exe"
Sudoku-->C:\Program Files\Microsoft ActiveSync\Sudoku\Uninstall.exe Sudoku
Treo 750v User Guide-->MsiExec.exe /X{321A5AF2-1480-4BBF-B737-9B5E3D5591FA}
Update for Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Update for Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Update for Windows XP (KB961503)-->"C:\WINDOWS\$NtUninstallKB961503$\spuninst\spuninst.exe"
Update for Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Update Rollup 2 for Windows XP Media Center Edition 2005-->C:\WINDOWS\$NtUninstallKB900325$\spuninst\spuninst.exe
Windows Communication Foundation-->MsiExec.exe /X{491DD792-AD81-429C-9EB4-86DD3D22E333}
Windows Internet Explorer 7-->"C:\WINDOWS\ie7\spuninst\spuninst.exe"
Windows Live Call-->MsiExec.exe /I{F6BD194C-4190-4D73-B1B1-C48C99921BFE}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Essentials-->C:\Program Files\Windows Live\Installer\wlarp.exe
Windows Live Essentials-->MsiExec.exe /I{C6CA8874-5F22-4AF0-9BE3-016BF299C536}
Windows Live Messenger-->MsiExec.exe /X{0AAA9C97-74D4-47CE-B089-0B147EF3553C}
Windows Live Sign-in Assistant-->MsiExec.exe /I{45338B07-A236-4270-9A77-EBB4115517B5}
Windows Live Upload Tool-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows Workflow Foundation-->MsiExec.exe /I{7D1B85BD-AA07-48B8-808D-67A4067FC6BD}
Windows XP Media Center Edition 2005 KB925766-->"C:\WINDOWS\$NtUninstallKB925766$\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe

======Hosts File======

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

======Security center information======

AV: avast! antivirus 4.8.1335 [VPS 090513-0]

======System event log======

Computer Name: TIMSLAPTOP
Event Code: 18
Message: Windows cannot store Bluetooth link keys on the local transceiver because it cannot determine whether proper security is enabled for the device.

Record Number: 121
Source Name: BTHUSB
Time Written: 20090426210327.000000+060
Event Type: warning
User:

Computer Name: TIMSLAPTOP
Event Code: 7000
Message: The OMCI service failed to start due to the following error:
The system cannot find the file specified.


Record Number: 92
Source Name: Service Control Manager
Time Written: 20090426204231.000000+060
Event Type: error
User:

Computer Name: TIMSLAPTOP
Event Code: 18
Message: Windows cannot store Bluetooth link keys on the local transceiver because it cannot determine whether proper security is enabled for the device.

Record Number: 59
Source Name: BTHUSB
Time Written: 20090426203148.000000+060
Event Type: warning
User:

Computer Name: TIMSLAPTOP
Event Code: 18
Message: Windows cannot store Bluetooth link keys on the local transceiver because it cannot determine whether proper security is enabled for the device.

Record Number: 25
Source Name: BTHUSB
Time Written: 20090426195024.000000+060
Event Type: warning
User:

Computer Name: MACHINENAME
Event Code: 18
Message: Windows cannot store Bluetooth link keys on the local transceiver because it cannot determine whether proper security is enabled for the device.

Record Number: 3
Source Name: BTHUSB
Time Written: 20090426202828.000000+060
Event Type: warning
User:

=====Application event log=====

Computer Name: TIMSLAPTOP
Event Code: 5603
Message: A provider, Rsop Planning Mode Provider, has been registered in the WMI namespace, root\RSOP, but did not specify the HostingModel property. This provider will be run using the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.

Record Number: 26
Source Name: WinMgmt
Time Written: 20090426194325.000000+060
Event Type: warning
User: NT AUTHORITY\SYSTEM

Computer Name: TIMSLAPTOP
Event Code: 1031
Message:
Record Number: 15
Source Name: ASP.NET 1.0.3705.6018
Time Written: 20090426193951.000000+060
Event Type: error
User:

Computer Name: TIMSLAPTOP
Event Code: 63
Message: A provider, CmdTriggerConsumer, has been registered in the WMI namespace, Root\cimv2, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

Record Number: 13
Source Name: WinMgmt
Time Written: 20090426193937.000000+060
Event Type: warning
User: NT AUTHORITY\SYSTEM

Computer Name: TIMSLAPTOP
Event Code: 63
Message: A provider, CmdTriggerConsumer, has been registered in the WMI namespace, Root\cimv2, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

Record Number: 12
Source Name: WinMgmt
Time Written: 20090426193937.000000+060
Event Type: warning
User: NT AUTHORITY\SYSTEM

Computer Name: TIMSLAPTOP
Event Code: 63
Message: A provider, HiPerfCooker_v1, has been registered in the WMI namespace, Root\WMI, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

Record Number: 11
Source Name: WinMgmt
Time Written: 20090426193936.000000+060
Event Type: warning
User: NT AUTHORITY\SYSTEM

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI Control Panel
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 13 Stepping 8, GenuineIntel
"PROCESSOR_REVISION"=0d08
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

[Axephilic]

My mistake, I will edit this post shortly.

[Axephilic]

Hi there,

I decided to just add another post, my apologies about the previous one. Everything looks clean except one very minor line that is not related to malware.

Fix HijackThis lines

• Run HijackThis!
• Click on Do a System Scan only
• Place a tick next to the following lines:
  
  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

Close all open windows and click on Fix checked and when you get a popup window click on Yes.

Run GMER
Please download gmer.zip from Gmer and save it to your desktop.

1. Right click on gmer.zip and select Extract All....
2. Click Next on seeing the Welcome to the Compressed (zipped) Folders Extraction Wizard.
3. Click on the Browse button. Click on Desktop. Then click OK.
4. Click Next. It will start extracting.
5. Once done, check (tick) the Show extracted files box and click Finish.
6. Double click on gmer.exe to run it.
7. Select the Rootkit tab.
8. On the right hand side, check all the items to be scanned, but leave Show All box unchecked.
9. Select all drives that are connected to your system to be scanned.
10. Click on the Scan button.
11. When the scan is finished, click Copy to save the scan log to the Windows clipboard.
12. Open Notepad or a similar text editor.
13. Paste the clipboard contents into the text editor.
14. Save the Gmer scan log and post it in your next reply.
15. Close Gmer.
16. Open Command Prompt by going to Start > Run and type in cmd. Press Enter.
17. In Command Prompt, type in net stop gmer. Press Enter.
18. Type in exit to close Command Prompt.

Note: Do not run any programs while Gmer is running.

Kaspersky Online Scanner
Please go to Kaspersky website and perform an online antivirus scan.

1. Read through the requirements and privacy statement and click on Accept button.
2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
3. When the downloads have finished, click on Settings.
4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
   Spyware, Adware, Dialers, and other potentially dangerous programs
   Archives
   Mail databases
5. Click on My Computer under Scan.
6. Once the scan is complete, it will display the results. Click on View Scan Report.
7. You will see a list of infected items there. Click on Save Report As....
8. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
9. Please post this log in your next reply.

In your next reply, please include:

1. GMER log
2. Kaspersky results
3. A new HijackThis log

Regards,
Adam

[Dr Tim]

Opps, only just seen your reply, sorry.

I will get those scans done asap, any idea on how long they take?

[Axephilic]

It varies depending on the speed of your computer and how many files you have.. so I can't really say how long.

[Axephilic]

Hello,

THREE DAY BUMP!

It has been three days since my last post.

• Do you still need help with this?
• Do you need more time?
• Are you having problems following my instructions?

If after 48 hours you have not replied to this thread, then it will have to be closed!

Regards,
Adam

[NonSuch]

Due to a lack of response, this topic is now closed.

If you still require help, please open a new thread in the Infected? Virus, malware, adware, ransomware, oh my! forum, include a fresh FRST log, and wait for a new helper.