|
|
|
can't get a free online scan
|
|
|
bobwheel2
Junior Member
|
27. July 2008 @ 19:53 |
Link to this message
|
Hi everyone I really need some help in resolving some issues I have with my computer. First off when I do a ctrl+alt+delete I SELECT task manager but it only appears in my taskbar, when I click on it it seems to fly off to the right of my screen so I can't access it.
When This happeed I Googled for an answer, but did not get much help, but the information I did put together was I had some kind of virus.
So with that in mind I downloaded a few different free anti virus progs, namely Avas. avg & avira all these programs found some sort of viruses an deleted them. The ones that AVG found that it could not delete were a hidden driver in my system32 folder & also it reported a number of files it could not scan as the were password protected (?)
I tried Trend,Panda,Kaspersky & even windows free online PC scanner but I could not get thier activ x install software to download, so in essence I coul not do a free online scan. Stopzilla allowed me to do an onlne scan and found numerous probems, but would not delete any till I signed up for the full program, which I think is a bit of a con
Anyway that where I'm at - I would be obidged for any help in gtting my pc back to normal. I have done all my system restore points, but to no avail...............Please help me out! don't wanna re-install as I have too many files to save.
|
|
bobwheel2
Junior Member
|
28. July 2008 @ 06:39 |
Link to this message
|
This is my latest HJthis log.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:31:09, on 28/07/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Nero\Nero8\InCD\InCD.exe
C:\Program Files\Process Lasso\ProcessGovernor.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Process Lasso\ProcessLasso.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\taskeng.exe
C:\Windows\explorer.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
F2 - REG:system.ini: UserInit=
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero8\InCD\InCD.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [TrayServer] C:\Program Files\MAGIX\Movies2go_III_Download_version\TrayServer.exe
O4 - HKLM\..\Run: [ProcessGovernor] C:\Program Files\Process Lasso\processgovernor.exe
O4 - HKLM\..\RunServices: [Microsoft Updates] svehost.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ProcessSupervisorGUI] C:\Program Files\Process Lasso\ProcessLasso.exe /tray
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housec...ivex/hcImpl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/Share...bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper200711281.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Share...n/bin/cabsa.cab
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: Nero Registry InCD Service (NeroRegInCDSrv) - Nero AG - C:\Program Files\Nero\Nero8\InCD\NBHRegInCDSrv.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\Windows\system32\drivers\pclepci.sys
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
--
End of file - 7165 bytes
|
Senior Member
|
28. July 2008 @ 09:47 |
Link to this message
|
Hi bobwheel2
Please download Combofix. With Combofix, at the download window, please rename it to Combo-fix before downloading it.
Now, please boot into safe mode which you can do by repeatedly pressing the F8 key after you press the power button. Then run Combofix and follow the prompts. Understand that things like your system clock changing and your desktop disappearing might happen. Do not worry, because all will be restored later. Do not click on the Comobofix window, as it may cause it to stall. If it asks for a reboot, do it. Post the log (which will be locatd at C:\ComboFix.txt) here.
Best Regards :D
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
Advertisement
|
|
|
|
bobwheel2
Junior Member
|
28. July 2008 @ 21:59 |
Link to this message
|
ComboFix 08-07-27.5 - bobbywheel 2008-07-29 2:20:49.1 - NTFSx86 MINIMAL
Microsoft® Windows Vista? Home Premium 6.0.6001.1.1252.1.1033.18.1261 [GMT 1:00]
Running from: C:\Users\bobbywheel\Desktop\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Users\BOBBYW~1\AppData\Roaming\inst.exe
C:\Users\bobbywheel\AppData\Roaming\inst.exe
C:\Windows\system32\MSINET.oca
D:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2008-06-28 to 2008-07-29 )))))))))))))))))))))))))))))))
.
2008-07-29 02:20 . 2008-07-29 02:20 <DIR> d-------- C:\327882R2FWJFW
2008-07-28 08:32 . 2008-07-28 08:32 <DIR> d-------- C:\Program Files\Easy Video Joiner
2008-07-28 01:07 . 2008-07-28 01:07 <DIR> d-------- C:\Users\All Users\SUPERAntiSpyware.com
2008-07-28 01:07 . 2008-07-28 01:07 <DIR> d-------- C:\PROGRA~2\SUPERAntiSpyware.com
2008-07-28 01:06 . 2008-07-28 01:06 <DIR> d-------- C:\Users\bobbywheel\AppData\Roaming\SUPERAntiSpyware.com
2008-07-28 01:06 . 2008-07-28 01:06 <DIR> d-------- C:\Users\BOBBYW~1\AppData\Roaming\SUPERAntiSpyware.com
2008-07-28 01:06 . 2008-07-28 01:06 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-07-27 23:55 . 2008-07-27 23:55 <DIR> d-------- C:\Program Files\Marsu-Fix
2008-07-27 23:55 . 2008-07-27 23:55 159,907 --a------ C:\Windows\Marsu-Fix Uninstaller.exe
2008-07-27 23:54 . 2008-07-27 23:54 <DIR> d-------- C:\Users\bobbywheel\AppData\Roaming\ESET
2008-07-27 23:54 . 2008-07-27 23:54 <DIR> d-------- C:\Users\BOBBYW~1\AppData\Roaming\ESET
2008-07-27 23:49 . 2008-07-27 23:49 <DIR> d-------- C:\Windows\LastGood.Tmp
2008-07-27 22:00 . 2008-03-03 14:25 5,702 --ah----- C:\Windows\nod32restoretemdono.reg
2008-07-27 21:51 . 2008-07-27 21:51 <DIR> d-------- C:\Program Files\ESET
2008-07-27 10:29 . 2008-07-27 10:31 <DIR> d-------- C:\!Submit
2008-07-26 21:09 . 2008-07-27 23:48 <DIR> d-------- C:\Users\All Users\ESET
2008-07-26 21:09 . 2008-07-27 23:48 <DIR> d-------- C:\PROGRA~2\ESET
2008-07-26 15:38 . 2008-07-26 15:38 <DIR> d-------- C:\Program Files\DVDFab 5
2008-07-26 09:37 . 2008-07-26 09:37 <DIR> d-------- C:\Users\bobbywheel\AppData\Roaming\Yatec Games
2008-07-26 09:37 . 2008-07-26 09:37 <DIR> d-------- C:\Users\BOBBYW~1\AppData\Roaming\Yatec Games
2008-07-24 18:53 . 2008-07-24 18:53 <DIR> d-------- C:\Users\All Users\Avira(5)
2008-07-24 18:53 . 2008-07-24 18:53 <DIR> d-------- C:\Program Files\Avira(0)
2008-07-24 18:53 . 2008-07-24 18:53 <DIR> d-------- C:\PROGRA~2\Avira(5)
2008-07-24 15:31 . 2008-07-24 17:09 <DIR> d-------- C:\Program Files\RegCure
2008-07-24 13:00 . 2008-07-24 13:08 <DIR> d-------- C:\Users\All Users\SITEguard
2008-07-24 13:00 . 2008-07-24 13:08 <DIR> d-------- C:\PROGRA~2\SITEguard
2008-07-24 12:58 . 2008-07-25 18:51 <DIR> d-------- C:\Users\All Users\STOPzilla!
2008-07-24 12:58 . 2008-07-24 12:58 <DIR> d-------- C:\Program Files\STOPzilla!
2008-07-24 12:58 . 2008-07-24 12:58 <DIR> d-------- C:\Program Files\Common Files\iS3
2008-07-24 12:58 . 2008-07-25 18:51 <DIR> d-------- C:\PROGRA~2\STOPzilla!
2008-07-24 12:28 . 2008-07-24 12:28 <DIR> dr------- C:\Windows\System32\config\systemprofile\Documents
2008-07-24 12:26 . 2008-07-24 13:09 <DIR> d-------- C:\Program Files\SpywareDetector
2008-07-19 17:29 . 2008-07-19 17:29 <DIR> d-------- C:\Users\bobbywheel\AppData\Roaming\MAGIX
2008-07-19 17:29 . 2008-07-19 17:29 <DIR> d-------- C:\Users\BOBBYW~1\AppData\Roaming\MAGIX
2008-07-19 17:28 . 2003-04-18 16:29 44,544 --a------ C:\Windows\System32\msxml4a.dll
2008-07-19 17:26 . 2008-07-19 17:29 <DIR> d-------- C:\Users\All Users\MAGIX
2008-07-19 17:26 . 2008-07-19 17:28 <DIR> d-------- C:\Program Files\MAGIX
2008-07-19 17:26 . 2008-07-19 17:29 <DIR> d-------- C:\PROGRA~2\MAGIX
2008-07-19 17:26 . 2007-04-27 10:43 120,200 --a------ C:\Windows\System32\DLLDEV32i.dll
2008-07-19 17:25 . 2008-07-20 12:35 <DIR> d-------- C:\Windows\System32\MAGIX
2008-07-19 17:25 . 2008-04-15 16:14 700,416 --a------ C:\Windows\System32\mgxoschk.dll
2008-07-19 17:25 . 2008-07-20 12:35 5,937 --a------ C:\Windows\mgxoschk.ini
2008-07-19 00:09 . 2008-07-27 01:33 <DIR> d-------- C:\Program Files\MagicDVDCopier
2008-07-18 00:00 . 2008-07-19 00:38 47,360 --a------ C:\Users\bobbywheel\AppData\Roaming\pcouffin.sys
2008-07-18 00:00 . 2008-07-19 00:38 47,360 --a------ C:\Users\BOBBYW~1\AppData\Roaming\pcouffin.sys
2008-07-16 22:51 . 2008-07-16 22:51 <DIR> d-------- C:\Users\bobbywheel\AppData\Roaming\DivX
2008-07-16 22:51 . 2008-07-16 22:51 <DIR> d-------- C:\Users\BOBBYW~1\AppData\Roaming\DivX
2008-07-16 22:47 . 2004-03-29 16:23 90,112 --a------ C:\Windows\unvise32.exe
2008-07-16 22:46 . 2008-07-16 22:47 <DIR> d-------- C:\Program Files\LooksBuilderSE
2008-07-16 22:44 . 2003-06-26 10:04 237,568 -ra------ C:\Windows\System32\qtmlClient.dll
2008-07-16 22:44 . 2003-07-01 16:49 69,632 --a------ C:\Windows\System32\MtxPreview.dll
2008-07-16 22:44 . 2003-07-01 16:49 49,152 --a------ C:\Windows\System32\MtxParhBFXPreview.dll
2008-07-16 22:44 . 2003-01-20 09:08 49,152 --a------ C:\Windows\System32\CvoAPI.dll
2008-07-16 22:44 . 2003-07-09 10:43 45,056 --a------ C:\Windows\System32\BFXSrcFilter.ax
2008-07-16 22:44 . 2007-12-12 19:02 0 --a------ C:\Windows\Graffiti5.2Pin.ini
2008-07-16 22:43 . 2008-07-16 22:43 <DIR> d-------- C:\Program Files\Boris FX, Inc
2008-07-16 22:38 . 2008-07-16 22:38 <DIR> d-------- C:\Program Files\Common Files\Pinnacle
2008-07-16 22:37 . 2008-07-16 22:37 <DIR> d-------- C:\Users\All Users\Pinnacle Studio Ultimate
2008-07-16 22:37 . 2008-07-16 22:37 <DIR> d-------- C:\PROGRA~2\Pinnacle Studio Ultimate
2008-07-16 22:32 . 2008-07-16 22:32 <DIR> d-------- C:\Users\All Users\Studio 12
2008-07-16 22:32 . 2008-07-16 22:32 <DIR> d-------- C:\Users\All Users\Pinnacle Studio Plus
2008-07-16 22:32 . 2008-07-16 22:32 <DIR> d-------- C:\Program Files\Common Files\Yahoo!
2008-07-16 22:32 . 2008-07-16 22:32 <DIR> d-------- C:\PROGRA~2\Studio 12
2008-07-16 22:32 . 2008-07-16 22:32 <DIR> d-------- C:\PROGRA~2\Pinnacle Studio Plus
2008-07-16 16:21 . 2008-07-16 16:28 <DIR> d-------- C:\Program Files\vso
2008-07-16 13:53 . 2008-07-16 13:53 <DIR> d-------- C:\Users\All Users\Elaborate Bytes
2008-07-16 13:53 . 2008-07-16 13:53 <DIR> d-------- C:\PROGRA~2\Elaborate Bytes
2008-07-16 13:26 . 2008-07-19 00:36 24 --ahs---- C:\Windows\SACF0EE4B.tmp
2008-07-16 13:25 . 2008-07-16 13:25 <DIR> d-------- C:\Program Files\SlySoft
2008-07-16 13:00 . 2008-07-16 13:00 <DIR> d-------- C:\Program Files\Elaborate Bytes
2008-07-16 11:39 . 2008-07-26 15:38 <DIR> d-------- C:\Users\bobbywheel\AppData\Roaming\Vso
2008-07-16 11:39 . 2008-07-26 15:38 <DIR> d-------- C:\Users\BOBBYW~1\AppData\Roaming\Vso
2008-07-15 20:37 . 2008-07-16 09:07 <DIR> d-------- C:\Users\All Users\DVD Shrink
2008-07-15 20:37 . 2008-07-16 07:41 <DIR> d-------- C:\Program Files\DVD Shrink
2008-07-15 20:37 . 2008-07-16 09:07 <DIR> d-------- C:\PROGRA~2\DVD Shrink
2008-07-15 16:43 . 2008-07-28 22:18 <DIR> d-------- C:\Program Files\a-squared Free
2008-07-14 16:13 . 2008-07-14 16:13 <DIR> d-------- C:\Users\All Users\DigitalChocolate
2008-07-14 16:13 . 2008-07-14 16:13 <DIR> d-------- C:\PROGRA~2\DigitalChocolate
2008-07-14 15:15 . 2008-07-14 15:15 <DIR> d-------- C:\Users\All Users\MumboJumbo
2008-07-14 15:15 . 2008-07-14 15:15 <DIR> d-------- C:\PROGRA~2\MumboJumbo
2008-07-13 01:23 . 2008-07-28 09:19 <DIR> d-------- C:\Program Files\Panda Security
2008-07-12 23:44 . 2008-06-26 02:45 12,240,896 --a------ C:\Windows\System32\NlsLexicons0007.dll
2008-07-12 23:44 . 2008-06-26 02:45 2,644,480 --a------ C:\Windows\System32\NlsLexicons0009.dll
2008-07-12 23:44 . 2008-06-26 04:29 801,280 --a------ C:\Windows\System32\NaturalLanguage6.dll
2008-07-12 15:49 . 2008-07-12 15:49 <DIR> d-------- C:\Users\bobbywheel\AppData\Roaming\iWin
2008-07-12 15:49 . 2008-07-12 15:49 <DIR> d-------- C:\Users\BOBBYW~1\AppData\Roaming\iWin
2008-07-12 15:46 . 2008-07-12 15:46 <DIR> d-------- C:\Users\All Users\Trymedia
2008-07-12 15:46 . 2008-07-12 15:46 <DIR> d-------- C:\PROGRA~2\Trymedia
2008-07-11 13:39 . 2008-07-15 12:56 <DIR> d-------- C:\Users\bobbywheel\AppData\Roaming\MysteryStudio
2008-07-11 13:39 . 2008-07-15 12:56 <DIR> d-------- C:\Users\BOBBYW~1\AppData\Roaming\MysteryStudio
2008-07-11 01:58 . 2008-07-11 01:58 <DIR> d-------- C:\Windows\Ice Cream Dee Lites
2008-07-11 01:50 . 2008-07-11 01:52 <DIR> d-------- C:\Program Files\The Sultan's Labyrinth
2008-07-11 01:37 . 2008-07-11 01:37 <DIR> d-------- C:\Windows\Airport Mania
2008-07-11 01:37 . 2008-07-11 01:37 <DIR> d-------- C:\Program Files\Airport Mania
2008-07-11 01:33 . 2008-07-11 01:33 <DIR> d-------- C:\Windows\Hide & Secret 2 - Cliffhanger Castle
2008-07-11 01:33 . 2008-07-11 01:33 <DIR> d-------- C:\Program Files\Hide & Secret 2 - Cliffhanger Castle
2008-07-11 01:29 . 2008-07-11 01:29 <DIR> d-------- C:\Windows\The Secret of Margrave Manor
2008-07-11 01:29 . 2008-07-11 01:30 <DIR> d-------- C:\Program Files\The Secret of Margrave Manor
2008-07-11 01:27 . 2008-07-11 01:27 <DIR> d-------- C:\Windows\Fitness Frenzy
2008-07-11 01:27 . 2008-07-11 01:27 <DIR> d-------- C:\Program Files\Fitness Frenzy
2008-07-11 01:23 . 2008-07-11 01:23 <DIR> d-------- C:\Windows\Tower Bloxx Deluxe
2008-07-11 01:23 . 2008-07-11 01:23 <DIR> d-------- C:\Program Files\Tower Bloxx Deluxe
2008-07-11 01:21 . 2008-07-11 01:21 <DIR> d-------- C:\Windows\Mystery Cookbook
2008-07-11 01:21 . 2008-07-11 01:22 <DIR> d-------- C:\Program Files\Mystery Cookbook
2008-07-11 01:19 . 2008-07-11 01:19 <DIR> d-------- C:\Users\All Users\SpinTop Games
2008-07-11 01:19 . 2008-07-11 01:19 <DIR> d-------- C:\PROGRA~2\SpinTop Games
2008-07-11 01:13 . 2008-07-11 01:13 <DIR> d-------- C:\Windows\ColorUp! Wedding Scrapbook
2008-07-11 01:13 . 2008-07-11 01:13 <DIR> d-------- C:\Program Files\ColorUp! Wedding Scrapbook
2008-07-11 01:10 . 2008-07-11 01:10 <DIR> d-------- C:\Windows\10 Days Under The Sea
2008-07-11 01:10 . 2008-07-11 01:11 <DIR> d-------- C:\Program Files\10 Days Under The Sea
2008-07-11 01:09 . 2008-07-11 01:09 <DIR> d-------- C:\Windows\Build-a-lot 2 - Town of the Year
2008-07-11 01:09 . 2008-07-11 01:09 <DIR> d-------- C:\Program Files\Build-a-lot 2 - Town of the Year
2008-07-11 01:07 . 2008-07-11 01:07 <DIR> d-------- C:\Windows\Sherlock Holmes - The Mystery of the Persian Carpet
2008-07-11 01:07 . 2008-07-11 01:07 <DIR> d-------- C:\Program Files\Sherlock Holmes - The Mystery of the Persian Carpet
2008-07-11 01:04 . 2008-07-11 01:04 <DIR> d-------- C:\Windows\Laura Jones & the Gates of Good & Evil
2008-07-11 01:04 . 2008-07-11 01:05 <DIR> d-------- C:\Program Files\Laura Jones & the Gates of Good & Evil
2008-07-11 00:59 . 2008-07-11 00:59 <DIR> d-------- C:\Windows\The Amazing Brain Train
2008-07-11 00:59 . 2008-07-11 00:59 <DIR> d-------- C:\Program Files\The Amazing Brain Train
2008-07-11 00:57 . 2008-07-11 00:57 <DIR> d-------- C:\Windows\Ranch Rush
2008-07-11 00:57 . 2008-07-18 18:48 <DIR> d-------- C:\Program Files\Ranch Rush
2008-07-11 00:55 . 2008-07-11 00:55 <DIR> d-------- C:\Windows\Mystery Stories-Island of Hope
2008-07-11 00:55 . 2008-07-11 00:55 <DIR> d-------- C:\Program Files\Mystery Stories-Island of Hope
2008-07-10 19:11 . 2008-07-11 01:15 <DIR> d-------- C:\Program Files\BFG
2008-07-10 14:47 . 2008-07-10 14:47 <DIR> d-------- C:\Windows\Picto Words
2008-07-10 14:47 . 2008-07-10 14:47 <DIR> d-------- C:\Program Files\Picto Words
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-28 21:16 --------- d-----w C:\PROGRA~2\Spybot - Search & Destroy
2008-07-28 10:27 --------- d---a-w C:\PROGRA~2\TEMP
2008-07-28 10:26 --------- d-----w C:\Program Files\SpywareBlaster
2008-07-28 09:40 --------- d-----w C:\Users\bobbywheel\AppData\Roaming\BitTorrent
2008-07-28 09:40 --------- d-----w C:\Users\BOBBYW~1\AppData\Roaming\BitTorrent
2008-07-28 01:42 --------- d-----w C:\PROGRA~2\Google Updater
2008-07-28 00:05 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-07-27 23:06 97,928 ----a-w C:\Windows\system32\drivers\avgldx86.sys
2008-07-27 07:32 --------- d-----w C:\Users\bobbywheel\AppData\Roaming\TrojanHunter
2008-07-27 07:32 --------- d-----w C:\Users\BOBBYW~1\AppData\Roaming\TrojanHunter
2008-07-27 01:05 --------- d-----w C:\Program Files\TrojanHunter 5.0
2008-07-27 00:33 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-07-27 00:33 --------- d-----w C:\Program Files\Tomb Raider - Anniversary
2008-07-27 00:33 --------- d-----w C:\Program Files\PFConfig
2008-07-27 00:33 --------- d-----w C:\Program Files\OpenAL
2008-07-27 00:33 --------- d-----w C:\Program Files\Microsoft Works
2008-07-27 00:33 --------- d-----w C:\Program Files\Google
2008-07-27 00:33 --------- d-----w C:\Program Files\DART Karaoke Studio CDG
2008-07-27 00:33 --------- d-----w C:\Program Files\Common Files\LightScribe
2008-07-27 00:33 --------- d-----w C:\PROGRA~2\Media Center Programs
2008-07-26 03:51 --------- d-----w C:\PROGRA~2\avg8
2008-07-21 23:17 --------- d-----w C:\Program Files\ffdshow
2008-07-18 23:42 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-18 23:42 --------- d-----w C:\Program Files\Pinnacle
2008-07-18 22:04 --------- d-----w C:\Program Files\BitTorrent
2008-07-16 08:05 --------- d-----w C:\Program Files\Sega
2008-07-15 17:29 --------- d-----w C:\PROGRA~2\CyberLink
2008-07-13 21:33 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-07-13 21:29 --------- d-----w C:\Program Files\Common Files\Scanner
2008-07-12 22:51 --------- d-----w C:\PROGRA~2\Microsoft Help
2008-07-11 13:59 10,520 ----a-w C:\Windows\System32\avgrsstx.dll
2008-07-11 07:07 --------- d-----w C:\Program Files\Bus Simulator
2008-07-10 14:24 --------- d-----w C:\Program Files\Windows Mail
2008-07-09 01:05 --------- d-----w C:\Program Files\Selectsoft
2008-07-06 18:36 --------- d-----w C:\Program Files\Home Cinema
2008-07-06 18:35 --------- d-----w C:\Program Files\CyberLink
2008-07-02 00:37 --------- d-----w C:\Program Files\UBISOFT
2008-06-28 18:24 --------- d-----w C:\Program Files\Vivendi Universal Games
2008-06-27 11:17 --------- d-----w C:\Program Files\Enigma Software Group
2008-06-23 17:22 36,734 ----a-w C:\Windows\System32\OggDSuninst.exe
2008-06-21 14:20 69,128 ----a-w C:\Windows\system32\drivers\avgwfpx.sys
2008-06-21 14:20 12,936 ----a-w C:\Windows\system32\drivers\avgrkx86.sys
2008-06-16 08:09 --------- d-----w C:\PROGRA~2\X10 Settings
2008-06-14 19:01 --------- d-----w C:\Program Files\Java
2008-06-14 12:03 --------- d-----w C:\PROGRA~2\Yahoo! Companion
2008-06-12 19:36 7,680 ----a-w C:\Windows\System32\ff_vfw.dll
2008-06-09 10:12 --------- d-----w C:\Program Files\NDSMovie_EN
2008-06-09 08:57 --------- d-----w C:\PROGRA~2\Office Genuine Advantage
2008-06-09 07:27 --------- d-----w C:\Program Files\AviSynth 2.5
2008-06-09 07:26 --------- d-----w C:\Program Files\eRightSoft
2008-06-08 20:04 116,120 ----a-w C:\GDIPFONTCACHEV1.DAT
2008-06-08 12:17 --------- d-----w C:\Users\bobbywheel\AppData\Roaming\Thinstall
2008-06-08 12:17 --------- d-----w C:\Users\BOBBYW~1\AppData\Roaming\Thinstall
2008-06-07 14:30 --------- d-----w C:\Program Files\MSECache
2008-06-06 23:22 --------- d-----w C:\Program Files\MSBuild
2008-06-06 23:21 --------- d-----w C:\Program Files\Microsoft.NET
2008-06-06 23:20 --------- d-----w C:\Program Files\Microsoft Visual Studio 8
2008-06-03 10:38 --------- d-----w C:\Users\bobbywheel\AppData\Roaming\Yahoo!
2008-06-03 10:38 --------- d-----w C:\Users\BOBBYW~1\AppData\Roaming\Yahoo!
2008-05-27 05:21 1,582,592 ----a-w C:\Windows\System32\tquery.dll
2008-05-27 05:21 1,418,240 ----a-w C:\Windows\System32\mssrch.dll
2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\SearchFilterHost.exe
2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\mssitlb.dll
2008-05-27 05:17 754,176 ----a-w C:\Windows\System32\propsys.dll
2008-05-27 05:17 60,416 ----a-w C:\Windows\System32\msscntrs.dll
2008-05-27 05:17 6,103,040 ----a-w C:\Windows\System32\chtbrkr.dll
2008-05-27 05:17 34,816 ----a-w C:\Windows\System32\msscb.dll
2008-05-27 05:17 32,768 ----a-w C:\Windows\System32\mssprxy.dll
2008-05-27 05:17 313,344 ----a-w C:\Windows\System32\thawbrkr.dll
2008-05-27 05:17 301,568 ----a-w C:\Windows\System32\srchadmin.dll
2008-05-27 05:17 194,560 ----a-w C:\Windows\System32\offfilt.dll
2008-05-27 05:17 143,872 ----a-w C:\Windows\System32\korwbrkr.dll
2008-05-27 05:17 11,776 ----a-w C:\Windows\System32\msshooks.dll
2008-05-27 05:17 1,671,680 ----a-w C:\Windows\System32\chsbrkr.dll
2008-05-27 04:59 18,904 ----a-w C:\Windows\System32\StructuredQuerySchemaTrivial.bin
2008-05-27 04:59 106,605 ----a-w C:\Windows\System32\StructuredQuerySchema.bin
2008-05-10 03:35 564,736 ----a-w C:\Windows\System32\emdmgmt.dll
2008-05-08 21:59 90,112 ----a-w C:\Windows\System32\wshext.dll
2008-05-08 21:59 430,080 ----a-w C:\Windows\System32\vbscript.dll
2008-05-08 21:59 180,224 ----a-w C:\Windows\System32\scrobj.dll
2008-05-08 21:59 172,032 ----a-w C:\Windows\System32\scrrun.dll
2008-05-08 21:59 155,648 ----a-w C:\Windows\System32\wscript.exe
2008-05-08 21:58 135,168 ----a-w C:\Windows\System32\cscript.exe
2008-04-05 18:11 174 --sha-w C:\Program Files\desktop.ini
2008-03-30 02:55 382 ----a-w C:\Users\bobbywheel\AppData\Roaming\wklnhst.dat
2008-03-30 02:55 382 ----a-w C:\Users\BOBBYW~1\AppData\Roaming\wklnhst.dat
2008-01-04 14:07 22,328 ----a-w C:\Users\bobbywheel\AppData\Roaming\PnkBstrK.sys
2008-01-04 14:07 22,328 ----a-w C:\Users\BOBBYW~1\AppData\Roaming\PnkBstrK.sys
2006-05-03 09:06 163,328 --sha-r C:\Windows\System32\flvDX.dll
2007-02-21 10:47 31,232 --sha-r C:\Windows\System32\msfDX.dll
2007-12-17 12:43 27,648 --sh--w C:\Windows\System32\Smab0.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\NBHShellExt]
@="{8D2223A2-B3C6-4e32-B096-CDD11F628C60}"
[HKEY_CLASSES_ROOT\CLSID\{8D2223A2-B3C6-4e32-B096-CDD11F628C60}]
2007-12-13 23:02 96552 --a------ C:\Program Files\Nero\Nero8\InCD\NBHShx.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 08:33 125952]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-05 16:05 68856]
"ProcessSupervisorGUI"="C:\Program Files\Process Lasso\ProcessLasso.exe" [2008-07-21 15:48 276480]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"="C:\Windows\system32\msconfig.exe" [2008-01-19 08:33 227840]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-08-07 01:05 200704]
"InCD"="C:\Program Files\Nero\Nero8\InCD\InCD.exe" [2007-12-13 23:02 1082152]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-09-12 10:58 8497696]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-28 00:06 1235736]
"TrayServer"="C:\Program Files\MAGIX\Movies2go_III_Download_version\TrayServer.exe" [2008-02-07 12:00 90112]
"ProcessGovernor"="C:\Program Files\Process Lasso\processgovernor.exe" [2008-07-21 15:47 127488]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 10:13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.yv12"= yv12vfw.dll
"vidc.mjpx"= Pvmjpg30.dll
"vidc.i420"= i420vfw.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\OneCareMP]
@=""
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 23:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
--a------ 2008-01-19 08:33 125952 C:\Windows\ehome\ehtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
--a------ 2007-12-03 15:21 2213160 C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-12-05 16:05 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{CBDA4680-00F1-46F9-9197-E328017EC222}"= UDP:6346:shareaza
"{D4ADD94F-84CD-4434-8DD2-DEEB3C2DACAB}"= TCP:6346:shareaza
"{097583F4-7DA5-464A-8D2A-37C39A67DBD5}"= Disabled:UDP:6346:shareaza
"{F5B02DDE-EC71-405F-B4A3-3288DCE76EFD}"= TCP:6346:shareaza
"TCP Query User{82F2A142-A3EC-4B89-8D6C-839D4D1CC8F8}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{1D61E265-7D52-4C64-821B-BFC5C15FC235}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"TCP Query User{0B64F96C-347F-4FB0-9A62-A9ED84006E78}C:\\users\\bobbywheel\\program files\\bittorrent\\bittorrent.exe"= UDP:C:\users\bobbywheel\program files\bittorrent\bittorrent.exe:bittorrent.exe
"UDP Query User{CE99FC2A-0307-4CC5-A22F-28B4C75B6F2D}C:\\users\\bobbywheel\\program files\\bittorrent\\bittorrent.exe"= TCP:C:\users\bobbywheel\program files\bittorrent\bittorrent.exe:bittorrent.exe
"TCP Query User{576E85E9-C543-4711-A268-A69CFFC51AF7}C:\\program files\\real\\realplayer\\realplay.exe"= UDP:C:\program files\real\realplayer\realplay.exe:RealPlayer
"UDP Query User{DCD6C77B-7214-4D4F-926B-B59B2FD5A996}C:\\program files\\real\\realplayer\\realplay.exe"= TCP:C:\program files\real\realplayer\realplay.exe:RealPlayer
"{A82BE43A-CAA1-4B8E-BF2B-3B1FA8D0518D}"= UDP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
"{A82BD4F7-F4B9-41EE-8037-3238FF270A40}"= TCP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
"{87774DF4-7EEE-4332-AC0A-26FA6FE99916}"= UDP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{3F155B3A-A58B-4A04-867E-4F0D13294508}"= TCP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{430B57F0-D374-4C86-BD5D-67051CDB0AA4}"= UDP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{AB181EF8-B623-44F3-A11A-DA2BDDAEB940}"= TCP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{27D0CDD4-95F0-4D74-9581-EFDA41B6C7CD}"= UDP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent
"{C86CB03B-BDF1-4048-B656-0F73630D74C7}"= TCP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent
"{00F6EDC4-4903-4EAD-9469-79149CF9DDD3}"= UDP:8000:bittorrent
"{EE6AC9DB-35EE-4F07-90AE-A20E0246A8AC}"= Disabled:UDP:C:\Program Files\UBISOFT\Assassin's Creed\AssassinsCreed_Dx10.exe:Assassin's Creed Dx10
"{A5C1439B-55F7-4D1C-95E2-7A38683E6583}"= Disabled:TCP:C:\Program Files\UBISOFT\Assassin's Creed\AssassinsCreed_Dx10.exe:Assassin's Creed Dx10
"{367861B7-3A7C-4957-9CA5-E619B6DA57D6}"= Disabled:UDP:C:\Program Files\UBISOFT\Assassin's Creed\AssassinsCreed_Dx9.exe:Assassin's Creed Dx9
"{EE7BDB5A-64C9-4362-9670-E4E8ECB484CE}"= Disabled:TCP:C:\Program Files\UBISOFT\Assassin's Creed\AssassinsCreed_Dx9.exe:Assassin's Creed Dx9
"{268A1A99-FECE-41D9-9865-CE7F31795463}"= Disabled:UDP:C:\Program Files\UBISOFT\Assassin's Creed\AssassinsCreed_Launcher.exe:Assassin's Creed Update
"{2D72133D-966A-471D-913F-C1E6A74268E1}"= Disabled:TCP:C:\Program Files\UBISOFT\Assassin's Creed\AssassinsCreed_Launcher.exe:Assassin's Creed Update
"{D17D79CF-30B1-46CD-800C-F09D26C9124F}"= Disabled:UDP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{8E34AA95-03D8-4355-B15E-880E5485F598}"= Disabled:TCP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{56E4CA1D-4627-4A99-97BD-A2FCCFCC3407}"= Disabled:UDP:C:\Program Files\Microsoft Games\Gears of War\Binaries\WarGame-G4WLive.exe:Gears of War
"{E0D755AA-2AE0-4AFB-AFBD-279E1A34B63B}"= Disabled:TCP:C:\Program Files\Microsoft Games\Gears of War\Binaries\WarGame-G4WLive.exe:Gears of War
"{5718B517-D1E7-4F97-810B-FB3B761472DF}"= Disabled:UDP:C:\Program Files\Midway Games\Hour of Victory\Binaries\LTCG-HOVGame.exe:Hour of Victory
"{DF541CD9-4EC5-4CFF-81B9-05B3C8AB4775}"= Disabled:TCP:C:\Program Files\Midway Games\Hour of Victory\Binaries\LTCG-HOVGame.exe:Hour of Victory
"{4EF1CFE9-F67F-4F77-85DF-0EE7D7C02539}"= Disabled:UDP:C:\Program Files\Codemasters\Turning Point - Fall of Liberty\Binaries\LTCG-TPGame.exe:Turning Point - Fall of Liberty
"{8BD0E68F-8B56-4995-995D-7411202F1221}"= Disabled:TCP:C:\Program Files\Codemasters\Turning Point - Fall of Liberty\Binaries\LTCG-TPGame.exe:Turning Point - Fall of Liberty
"TCP Query User{DD681D0F-66E6-4615-8BC8-B44260D1CFE5}C:\\program files\\utorrent\\utorrent.exe"= Disabled:UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{75D2DACF-088B-4601-9458-8074094F79A0}C:\\program files\\utorrent\\utorrent.exe"= Disabled:TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"TCP Query User{392414E4-E5DD-4E56-91F9-0A5B4F9316B5}C:\\program files\\yahoo!\\messenger\\yahoomessenger.exe"= UDP:C:\program files\yahoo!\messenger\yahoomessenger.exe:Yahoo! Messenger
"UDP Query User{052129B3-BCBB-425A-8FAB-56ECE53969FF}C:\\program files\\yahoo!\\messenger\\yahoomessenger.exe"= TCP:C:\program files\yahoo!\messenger\yahoomessenger.exe:Yahoo! Messenger
"{140F1035-6567-46CA-8D1C-334EBBFB061D}"= UDP:C:\Program Files\Shareaza\Shareaza.exe:Shareaza
"{43C6CFF0-4A3E-44DB-9DC7-6EF54BDB2DCC}"= TCP:C:\Program Files\Shareaza\Shareaza.exe:Shareaza
"TCP Query User{5B0D3A8A-1CEC-4FC9-AF1C-6AD8A2C0ABAD}C:\\users\\bobbywheel\\program files\\bittorrent\\bittorrent.exe"= UDP:C:\users\bobbywheel\program files\bittorrent\bittorrent.exe:bittorrent.exe
"UDP Query User{EC75DC4B-D013-46E7-9EEE-DF8601E1FF61}C:\\users\\bobbywheel\\program files\\bittorrent\\bittorrent.exe"= TCP:C:\users\bobbywheel\program files\bittorrent\bittorrent.exe:bittorrent.exe
"{4284B19E-9405-44D6-97EC-7CF8D672765F}"= C:\Program Files\AVG\AVG8\avgupd.exe:avgupd.exe
"{BE87E5C5-8D2A-4AE9-8EE1-C630F5B4EF20}"= C:\Program Files\AVG\AVG8\avgemc.exe:avgemc.exe
"{6A45A22B-254C-495D-8E2E-377BBEF416B7}"= C:\Program Files\AVG\AVG8\avgnsx.exe:avgnsx.exe
"{D0043937-0DFF-4174-8A47-DBBC96648B67}"= UDP:E:\Programs\programs\RM.exe:Render Manager
"{892D3D56-FA8D-4698-AD3A-29F1118F4D99}"= TCP:E:\Programs\programs\RM.exe:Render Manager
"{39699329-255A-4D06-9857-862DD6014EDA}"= UDP:E:\Programs\programs\Studio.exe:Studio
"{AD76885D-F139-49FE-8DD4-A6958ADDFFFF}"= TCP:E:\Programs\programs\Studio.exe:Studio
"{729DF34B-6687-4E8F-B919-F9E4502EC8E2}"= UDP:E:\Programs\programs\PMSRegisterFile.exe:PMSRegisterFile
"{B47B6426-8E10-41C5-8860-A96C62C21935}"= TCP:E:\Programs\programs\PMSRegisterFile.exe:PMSRegisterFile
"{D1970CB3-8A14-41FF-87FD-1BB9CED34358}"= UDP:E:\Programs\programs\umi.exe:umi
"{B65827B8-F4B8-436B-A3FD-8C7385CF669F}"= TCP:E:\Programs\programs\umi.exe:umi
"{E978F3F4-3B25-4ED5-9B60-BE9BFD0D75D3}"= UDP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
"{E1D31FD7-ADEB-419F-926A-E8774D08C355}"= TCP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
"{E984C991-B84A-46B9-99C7-A4E1EC6751E3}"= UDP:C:\Program Files\Pinnacle\Studio 11\programs\RM.exe:Render Manager
"{8D2E46C1-61DF-433C-8226-299CCBBD334A}"= TCP:C:\Program Files\Pinnacle\Studio 11\programs\RM.exe:Render Manager
"{BD0C3F3B-5EAB-435C-AD40-D425ED7CAE51}"= UDP:C:\Program Files\Pinnacle\Studio 11\programs\Studio.exe:Studio
"{8688E842-D92C-47C8-9D7C-04222231C20E}"= TCP:C:\Program Files\Pinnacle\Studio 11\programs\Studio.exe:Studio
"{4B6741CF-5489-4A1F-8791-2EA42F8E199F}"= UDP:C:\Program Files\Pinnacle\Studio 11\programs\PMSRegisterFile.exe:PMSRegisterFile
"{B19A9855-A73F-470E-9C0A-5FFD4CAB98A5}"= TCP:C:\Program Files\Pinnacle\Studio 11\programs\PMSRegisterFile.exe:PMSRegisterFile
"{A4F5B3E8-8B30-4AEC-9BC8-F1B19F7B0ABC}"= UDP:C:\Program Files\Pinnacle\Studio 11\programs\umi.exe:umi
"{C6975161-1B7F-4E3E-993B-A446E3AF4E41}"= TCP:C:\Program Files\Pinnacle\Studio 11\programs\umi.exe:umi
"{95DCF392-9712-4349-91DD-D61A5AC748F5}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{339F730A-310C-4511-9508-044A90759666}"= UDP:C:\Program Files\Eidos\Conflict Denied Ops\ConflictDeniedOps.exe:Conflict: Denied Ops
"{748C6477-AF2A-44DA-8D12-97911FC9BE76}"= TCP:C:\Program Files\Eidos\Conflict Denied Ops\ConflictDeniedOps.exe:Conflict: Denied Ops
"TCP Query User{BCEF9A65-77F1-4B4E-9C13-ECC72422EA69}C:\\program files\\shareaza\\shareaza.exe"= UDP:C:\program files\shareaza\shareaza.exe:Shareaza Ultimate File Sharing
"UDP Query User{74394522-F28C-47D7-BC31-8FC100EF2EA3}C:\\program files\\shareaza\\shareaza.exe"= TCP:C:\program files\shareaza\shareaza.exe:Shareaza Ultimate File Sharing
"{85B2A133-89D5-4771-8C75-4158F9A986B9}"= C:\Program Files\Home Cinema\PowerDVD\PowerDVD.EXE:CyberLink PowerDVD
"{8F94A806-0DF4-480F-94C6-BF49849F948D}"= C:\Program Files\Home Cinema\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{675E9A6D-B49D-48AC-9DC1-97A646F6AE5F}"= UDP:C:\Program Files\Pinnacle\Studio 12\Programs\RM.exe:Render Manager
"{DFC6C6F1-B388-4A07-BBDB-A137BC18D8F3}"= TCP:C:\Program Files\Pinnacle\Studio 12\Programs\RM.exe:Render Manager
"{244AB8E6-FB3D-4314-BF6A-836B57F7AE0F}"= UDP:C:\Program Files\Pinnacle\Studio 12\Programs\Studio.exe:Studio
"{046705DD-3330-437F-AA5D-3D5F2C98F81F}"= TCP:C:\Program Files\Pinnacle\Studio 12\Programs\Studio.exe:Studio
"{04BAD827-B146-40DF-A877-89E7AD05824C}"= UDP:C:\Program Files\Pinnacle\Studio 12\Programs\umi.exe:umi
"{4A5B8240-CDD7-44B7-A39C-6E6BE42F5D3D}"= TCP:C:\Program Files\Pinnacle\Studio 12\Programs\umi.exe:umi
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\BitTorrent\\bittorrent.exe"= C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
R0 AvgRkx86;avgrkx86.sys;C:\Windows\system32\Drivers\avgrkx86.sys [2008-06-21 15:20]
R0 ViBus;ViBus;C:\Windows\system32\drivers\vibus.sys [2007-03-26 14:26]
R0 videX32;videX32;C:\Windows\system32\DRIVERS\videX32.sys [2006-10-17 21:22]
R0 ViPrt;VIA SATA IDE Device Driver;C:\Windows\system32\drivers\viprt.sys [2007-03-26 14:26]
R3 X10Hid;X10 Hid Device;C:\Windows\system32\Drivers\x10hid.sys [2006-11-17 11:31]
S1 AvgLdx86;AVG AVI Loader Driver x86;C:\Windows\system32\Drivers\avgldx86.sys [2008-07-28 00:06]
S2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-07-28 00:06]
S2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-28 00:06]
S2 NeroRegInCDSrv;Nero Registry InCD Service;C:\Program Files\Nero\Nero8\InCD\NBHRegInCDSrv.exe [2007-12-13 23:02]
S3 3xHybrid;Philips SAA713x PCI Card;C:\Windows\system32\DRIVERS\3xHybrid.sys [2007-01-08 17:43]
S3 AvgWfpX;AVG8 Firewall Driver x86;C:\Windows\system32\Drivers\avgwfpx.sys [2008-06-21 15:20]
S3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\Windows\system32\DRIVERS\fetnd5bv.sys [2007-04-17 10:58]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 15:18]
S3 HCWBT8xx;Hauppauge WinTV 848/9 WDM Video Driver;C:\Windows\system32\drivers\HCWBT8XX.sys [2002-03-01 00:35]
S3 Ph3xIB32;Philips 713x Inbox PCI TV Card;C:\Windows\system32\DRIVERS\Ph3xIB32.sys [2007-04-03 11:43]
S4 EUIANKBGV;EUIANKBGV;C:\Users\BOBBYW~1\AppData\Local\Temp\EUIANKBGV.exe []
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
\shell\AutoRun\command - I:\AutoRunCD.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\shell\AutoRun\command - J:\autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K]
\shell\AutoRun\command - K:\penumbra_bp_ger.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\L]
\shell\AutoRun\command - L:\AUTORUN.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\N]
\shell\AutoRun\command - N:\penumbra_bp_ger.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\P]
\shell\AutoRun\command - P:\AutoRun/AutoRun.bat
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\Q]
\shell\AutoRun\command - Q:\AutoRun/AutoRun.bat
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\S]
\shell\AutoRun\command - S:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\U]
\shell\AutoRun\command - U:\autorun.exe autorun.hta
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9aafd267-a4aa-11dc-a695-0019dba99940}]
\shell\AutoRun\command - setupSNK.exe
*Newly Created Service* - ECACHE
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://uk.yahoo.com/
R0 -: HKLM-Main,Start Page = hxxp://www.yahoo.co.uk/
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-29 02:24:24
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-07-29 2:24:58
ComboFix-quarantined-files.txt 2008-07-29 01:24:54
Pre-Run: 125,718,077,440 bytes free
Post-Run: 125,676,916,736 bytes free
420 --- E O F --- 2008-07-27 22:25:52
|
|
