# The specified procedure could not be found....



## NijimaSan (Jun 19, 2009)

*I need help in trying to figure out what this means....* I tried (re)installing System Mechanic 8 on my computer today after my computer crashed. It worked fine for several days until today.

Now I keep getting that message. I've uninstalled it and reinstalled it several times. I've ran registry programs. Nothing seems to work.

My computer crashed today. I reinstalled Windows XP and files that I had saved on a separate partition for the past three days were gone.
This happened once before about a month or two ago but the files lost were much more severe.

I thought it was a physical problem with the disk since it seemed that files disappeared after those two times. I was having problems with Mozilla Firefox 24 hours ago but deleted it, the profiles, and rebuilt everythig from scratch. Everything was going fine until today.

I hope somebody can help......

Files on my partition are disappearing. Programs that once worked well are not working at all. I'm not sure what to do.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:09:29 AM, on 6/19/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Wallpaper Master\Wallpaper.exe
D:\ComputerNotes\RoboFormData\TB71\RoboTaskBarIcon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\File-Ex 3\FileEx.exe
C:\Program Files\ShutDownPro\ShutDownPro.EXE
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\iolo\common\lib\ioloServiceManager.exe
C:\Documents and Settings\All Users\Application Data\iolo\EjectCDReminder.exe
C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Flock\flock.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.excite.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - D:\ComputerNotes\RoboFormData\TB71\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - D:\ComputerNotes\RoboFormData\TB71\roboform.dll
O3 - Toolbar: Foxit Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: &Linkman - {5C9DCA26-CEC4-4280-A831-D622D4DBF113} - C:\PROGRA~1\Linkman\LINKMA~1.DLL
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [FinePrint Dispatcher v5] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe" /source=HKLM
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TakeABreak] C:\Program Files\My Rest Break\MyRestBreak.exe
O4 - HKCU\..\Run: [WallpaperChanger] C:\Program Files\Wallpaper Master\Wallpaper.exe
O4 - HKCU\..\Run: [RoboForm] "D:\ComputerNotes\RoboFormData\TB71\RoboTaskBarIcon.exe"
O4 - Startup: File-Ex.lnk = C:\Program Files\File-Ex 3\FileEx.exe
O4 - Startup: ShutDownPro.lnk = C:\Program Files\ShutDownPro\ShutDownPro.EXE
O8 - Extra context menu item: >Search in Linkman - file://D:\My Documents\Linkman\iescript_search.htm
O8 - Extra context menu item: Add to Linkman - file://D:\My Documents\Linkman\iescript_add.htm
O8 - Extra context menu item: Add to Linkman (all tabs) - file://D:\My Documents\Linkman\iescript_addall.htm
O8 - Extra context menu item: Add to Linkman and Edit - file://D:\My Documents\Linkman\iescript_edit.htm
O8 - Extra context menu item: Add to WebSite-Watcher - C:\Documents and Settings\Eric\Application Data\aignes\WebSite-Watcher\config\settings\wswie.htm
O8 - Extra context menu item: Customize Menu - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Fill Forms - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComSavePass.html
O8 - Extra context menu item: Show Linkman - file://D:\My Documents\Linkman\iescript_show.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate1c9cb83eecd96d8) (gupdate1c9cb83eecd96d8) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: iolo System Service (ioloSystemService) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 8970 bytes


----------



## Cookiegal (Aug 27, 2003)

Firs tof all, forget System Mechanic. Registry cleaners usually cause more harm than good. Let's see if we can find out what's going on with the computer.

Please download Malwarebytes' Anti-Malware from *Here*.

Double Click *mbam-setup.exe* to install the application.
Make sure a checkmark is placed next to *Update Malwarebytes' Anti-Malware* and *Launch Malwarebytes' Anti-Malware*, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "*Perform Quick Scan*", then click *Scan*.
The scan may take some time to finish, so please be patient.
When the scan is complete, click *OK*, then *Show Results* to view the results.
Make sure that *everything is checked*, and click *Remove Selected*.
When disinfection is completed, a log will open in Notepad and you may be prompted to restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the entire report in your next reply.
Extra Note:

*If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.*


----------



## NijimaSan (Jun 19, 2009)

OK....so far so good. I did everything you said. The program found 5 malware entries in the registry, which it deleted. 

I don't actually know if my computer is fixed but I do know that I feel a LOT better now than I dd 48 hours ago.  

Your help and the help on this site has been fantastic. Thank you for pulling me out of a situation that if I had followed it, things would have gotten much worse.

Should I do a full scan now? In the Quick Scan sufficient or no? 

Malwarebytes' Anti-Malware 1.38
Database version: 2317
Windows 5.1.2600 Service Pack 3

6/20/2009 1:43:50 PM
mbam-log-2009-06-20 (13-43-50).txt

Scan type: Quick Scan
Objects scanned: 81641
Time elapsed: 5 minute(s), 14 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 5
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CLASSES_ROOT\scrfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: ("%1" /S) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: (regedit.exe "%1") -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


----------



## Cookiegal (Aug 27, 2003)

Please visit *Combofix Guide & Instructions * for instructions for installing the recovery console and downloading and running ComboFix.

The only thing different from the instructions there is that when downloading and saving the ComboFix.exe I would like you to rename it to Combo-Fix.exe please.

Post the log from ComboFix when you've accomplished that along with a new HijackThis log.

Important notes regarding ComboFix:

ComboFix may reset a number of Internet Explorer's settings, including making it the default browser. This can easily be changed once we're finished.

ComboFix also prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you, please let me know. This can be undone manually when we're finished. Read  *HERE * for an article written by dvk01 on why we disable autoruns.


----------



## NijimaSan (Jun 19, 2009)

Ok.....here we go.

The ComboFix log:

ComboFix 09-06-20.02 - Eric 06/20/2009 17:18.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.958.335 [GMT -7:00]
Running from: c:\documents and settings\Eric\Desktop\Combo-Fix.exe
AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Updated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
FW: ZoneAlarm Security Suite Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\mfc45.dll
d:\recycler\NPROTECT\00000361.
e:\recycler\NPROTECT\00000050.
e:\recycler\NPROTECT\00000079.
e:\recycler\NPROTECT\00000100.
e:\recycler\NPROTECT\00000117.
e:\recycler\NPROTECT\00000122.
e:\recycler\NPROTECT\00000133.
e:\recycler\NPROTECT\00000163.
e:\recycler\NPROTECT\00000176.
e:\recycler\NPROTECT\00000195.
e:\recycler\NPROTECT\00000239.
e:\recycler\NPROTECT\00000250.
e:\recycler\NPROTECT\00000268.
e:\recycler\NPROTECT\00000315.
e:\recycler\NPROTECT\00000324.
e:\recycler\NPROTECT\00000331.
e:\recycler\NPROTECT\00000332.
e:\recycler\NPROTECT\00000336.
e:\recycler\NPROTECT\00000339.
e:\recycler\NPROTECT\00000374.
e:\recycler\NPROTECT\00000375.
e:\recycler\NPROTECT\00000402.
e:\recycler\NPROTECT\00000423.
e:\recycler\NPROTECT\00000445.
e:\recycler\NPROTECT\00000446.
e:\recycler\NPROTECT\00000447.
e:\recycler\NPROTECT\00000448.
e:\recycler\NPROTECT\00000453.
e:\recycler\NPROTECT\00000516.
e:\recycler\NPROTECT\00000517.
e:\recycler\NPROTECT\00000518.
e:\recycler\NPROTECT\00000519.
e:\recycler\NPROTECT\00000548.
e:\recycler\NPROTECT\00000549.
e:\recycler\NPROTECT\00000550.
e:\recycler\NPROTECT\00000551.
e:\recycler\NPROTECT\00000552.
e:\recycler\NPROTECT\00000553.
e:\recycler\NPROTECT\00000554.
e:\recycler\NPROTECT\00000608.
e:\recycler\NPROTECT\00000609.
e:\recycler\NPROTECT\00000611.
e:\recycler\NPROTECT\00000612.
e:\recycler\NPROTECT\00000613.
e:\recycler\NPROTECT\00000614.
e:\recycler\NPROTECT\00000690.
e:\recycler\NPROTECT\00000715.
e:\recycler\NPROTECT\00000719.
e:\recycler\NPROTECT\00000726.
e:\recycler\NPROTECT\00000738.
e:\recycler\NPROTECT\00000751.
e:\recycler\NPROTECT\00000763.
e:\recycler\NPROTECT\00000776.
e:\recycler\NPROTECT\00000777.
e:\recycler\NPROTECT\00000781.
e:\recycler\NPROTECT\00000817.
e:\recycler\NPROTECT\00000820.
e:\recycler\NPROTECT\00000827.
e:\recycler\NPROTECT\00000843.
e:\recycler\NPROTECT\00000851.com -
e:\recycler\NPROTECT\00000913.
e:\recycler\NPROTECT\00000946.
e:\recycler\NPROTECT\00000947.
e:\recycler\NPROTECT\00000948.
e:\recycler\NPROTECT\00000989.
e:\recycler\NPROTECT\00000990.
e:\recycler\NPROTECT\00000997.
e:\recycler\NPROTECT\00001011.
e:\recycler\NPROTECT\00001057.
e:\recycler\NPROTECT\00001067.
e:\recycler\NPROTECT\00001069.
e:\recycler\NPROTECT\00001094.
e:\recycler\NPROTECT\00001100.
e:\recycler\NPROTECT\00001101.
e:\recycler\NPROTECT\00001119.
e:\recycler\NPROTECT\00001140.
e:\recycler\NPROTECT\00001141.
e:\recycler\NPROTECT\00001159.
e:\recycler\NPROTECT\00001172.
e:\recycler\NPROTECT\00001188.
e:\recycler\NPROTECT\00001192.
e:\recycler\NPROTECT\00001200.
e:\recycler\NPROTECT\00001201.
e:\recycler\NPROTECT\00001206.
e:\recycler\NPROTECT\00001207.
e:\recycler\NPROTECT\00001208.
e:\recycler\NPROTECT\00001209.
e:\recycler\NPROTECT\00001222.
e:\recycler\NPROTECT\00001223.
e:\recycler\NPROTECT\00001227.
e:\recycler\NPROTECT\00001270.
e:\recycler\NPROTECT\00001295.
e:\recycler\NPROTECT\00001311.
e:\recycler\NPROTECT\00001361.
e:\recycler\NPROTECT\00001412.
e:\recycler\NPROTECT\00001434.
e:\recycler\NPROTECT\00001455.
e:\recycler\NPROTECT\00001459.
e:\recycler\NPROTECT\00001507.
e:\recycler\NPROTECT\00001521.
e:\recycler\NPROTECT\00001546.
e:\recycler\NPROTECT\00001555.
e:\recycler\NPROTECT\00001583.
e:\recycler\NPROTECT\00001596.
e:\recycler\NPROTECT\00001606.
e:\recycler\NPROTECT\00001620.
e:\recycler\NPROTECT\00001628.
e:\recycler\NPROTECT\00001645.
e:\recycler\NPROTECT\00001655.
e:\recycler\NPROTECT\00001667.
e:\recycler\NPROTECT\00001699.
e:\recycler\NPROTECT\00001705.
e:\recycler\NPROTECT\00001780.
e:\recycler\NPROTECT\00001800.
e:\recycler\NPROTECT\00001802.
e:\recycler\NPROTECT\00001803.
e:\recycler\NPROTECT\00001809.
e:\recycler\NPROTECT\00001826.
e:\recycler\NPROTECT\00001832.
e:\recycler\NPROTECT\00001836.
e:\recycler\NPROTECT\00001897.
e:\recycler\NPROTECT\00001901.
e:\recycler\NPROTECT\00001929.
e:\recycler\NPROTECT\00001934.
e:\recycler\NPROTECT\00001960.
e:\recycler\NPROTECT\00001965.
e:\recycler\NPROTECT\00001967.
e:\recycler\NPROTECT\00001968.
e:\recycler\NPROTECT\00001983.
e:\recycler\NPROTECT\00002005.
e:\recycler\NPROTECT\00002010.
e:\recycler\NPROTECT\00002027.
e:\recycler\NPROTECT\00002028.
e:\recycler\NPROTECT\00002043.
e:\recycler\NPROTECT\00002077.
e:\recycler\NPROTECT\00002095.
e:\recycler\NPROTECT\00002099.
e:\recycler\NPROTECT\00002108.

.
((((((((((((((((((((((((( Files Created from 2009-05-21 to 2009-06-21 )))))))))))))))))))))))))))))))
.

2009-06-20 20:35 . 2009-06-20 20:35 -------- d-----w- c:\documents and settings\Eric\Application Data\Malwarebytes
2009-06-20 20:34 . 2009-06-17 18:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-20 20:34 . 2009-06-20 20:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-20 20:34 . 2009-06-17 18:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-20 20:34 . 2009-06-20 20:35 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-19 08:09 . 2009-06-19 08:09 -------- d-----w- c:\program files\Trend Micro
2009-06-19 06:03 . 2009-06-19 06:03 -------- d-----w- c:\program files\CCleaner
2009-06-19 06:00 . 2009-06-20 21:46 -------- d-----w- c:\program files\RegistryFix7
2009-06-19 05:55 . 2009-06-19 05:55 -------- d-----w- c:\documents and settings\All Users\Application Data\RegCure
2009-06-19 01:12 . 2008-04-14 12:00 101376 -c--a-w- c:\windows\system32\dllcache\srusbusd.dll
2009-06-19 01:11 . 2008-04-14 12:00 13463552 -c--a-w- c:\windows\system32\dllcache\hwxjpn.dll
2009-06-19 00:48 . 2008-04-14 12:00 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll
2009-06-19 00:48 . 2008-04-14 12:00 13312 ----a-w- c:\windows\system32\irclass.dll
2009-06-19 00:48 . 2008-04-14 12:00 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2009-06-19 00:48 . 2008-04-14 12:00 24661 ----a-w- c:\windows\system32\spxcoins.dll
2009-06-16 06:01 . 2009-06-16 06:02 -------- d-----w- c:\program files\WinMerge
2009-06-16 04:38 . 2009-06-16 04:39 -------- d-----w- c:\program files\WebSite-Watcher
2009-06-16 04:15 . 2009-06-19 04:33 -------- d-----w- c:\documents and settings\Eric\Local Settings\Application Data\Eraser
2009-06-16 04:15 . 2009-06-16 04:15 -------- d--h--w- c:\documents and settings\All Users\Application Data\{A25FEDC1-F6D7-440C-BCE2-B71F595F6646}
2009-06-16 04:15 . 2007-12-31 09:46 2375336 ----a-w- c:\documents and settings\All Users\Application Data\{A25FEDC1-F6D7-440C-BCE2-B71F595F6646}\EraserSetup32.exe
2009-06-16 04:15 . 2009-06-16 04:15 -------- d-----w- c:\program files\Eraser
2009-06-16 04:08 . 2009-06-16 04:15 -------- d-----w- c:\documents and settings\Eric\Application Data\CyberMatrix
2009-06-16 04:08 . 2009-06-16 04:08 -------- d-----w- c:\program files\Clipboard Magic
2009-06-16 04:06 . 2009-06-16 04:06 -------- d-----w- c:\program files\Atomic Clock Sync
2009-06-16 00:10 . 2009-06-16 00:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Innovative Solutions
2009-06-15 19:33 . 2009-06-15 19:33 10134 ----a-r- c:\documents and settings\Eric\Application Data\Microsoft\Installer\{E064390A-2F64-4195-9A55-30D4B20B865A}\ARPPRODUCTICON.exe
2009-06-15 19:33 . 2009-06-15 19:33 -------- d-----w- c:\program files\DIFX
2009-06-15 19:33 . 2006-09-08 04:16 10112 ----a-w- c:\windows\system32\drivers\wdcsam.sys
2009-06-15 19:31 . 2009-06-15 19:31 8854 ----a-r- c:\documents and settings\Eric\Application Data\Microsoft\Installer\{0AB76F69-E761-4CFA-B9B0-A1906B4E9E4B}\Uninstall_WD_Diagnos_0AB76F69E7614CFAB9B0A1906B4E9E4B.exe
2009-06-15 19:31 . 2009-06-15 19:31 40960 ----a-r- c:\documents and settings\Eric\Application Data\Microsoft\Installer\{0AB76F69-E761-4CFA-B9B0-A1906B4E9E4B}\WinDlg.exe_0AB76F69E7614CFAB9B0A1906B4E9E4B_3.exe
2009-06-15 19:31 . 2009-06-15 19:31 10134 ----a-r- c:\documents and settings\Eric\Application Data\Microsoft\Installer\{0AB76F69-E761-4CFA-B9B0-A1906B4E9E4B}\ARPPRODUCTICON.exe
2009-06-15 19:31 . 2009-06-15 19:33 -------- d-----w- c:\program files\Western Digital Technologies
2009-06-15 19:30 . 2009-06-15 19:30 10134 ----a-r- c:\documents and settings\Eric\Application Data\Microsoft\Installer\{FD6C6B7F-5696-48C5-A601-2EE9E50C3D46}\ARPPRODUCTICON.exe
2009-06-15 19:12 . 2009-06-15 19:12 -------- d-----w- c:\program files\Pazera_Free_MOV_to_AVI_Converter
2009-06-15 19:00 . 2009-06-15 19:00 -------- d-----w- c:\program files\Duplicate Cleaner
2009-06-15 16:52 . 2009-06-15 16:52 -------- d-----w- c:\program files\LopeSoft
2009-06-15 16:35 . 2009-06-15 16:35 -------- d-----w- c:\program files\SyncToy 2.0
2009-06-15 16:35 . 2009-06-15 16:35 -------- d-----w- c:\program files\Microsoft Sync Framework
2009-06-15 15:43 . 2009-06-15 15:43 -------- d-sh--w- c:\documents and settings\Eric\IECompatCache
2009-06-14 06:30 . 2009-06-14 06:30 -------- d-----w- c:\program files\Fast Duplicate File Finder
2009-06-14 04:22 . 2009-06-15 19:33 364544 ----a-w- c:\windows\system32\WDBtnMgr.exe
2009-06-14 02:30 . 2009-06-15 22:22 -------- d-----w- c:\program files\FolderMatch
2009-06-13 20:52 . 2009-06-13 20:52 -------- d-----w- c:\program files\Symantec
2009-06-13 12:50 . 2009-06-15 22:18 518 ----a-w- c:\documents and settings\Eric\Application Data\iolo\Registry\Last\restore.bat
2009-06-12 23:09 . 2009-06-12 23:09 -------- d-----w- c:\documents and settings\Eric\Application Data\WindSolutions
2009-06-12 23:09 . 2009-06-12 23:09 -------- d-----w- c:\program files\CopyTransManagerv0.824
2009-06-12 21:40 . 2009-06-12 21:40 1525 ----a-w- c:\documents and settings\Eric\Application Data\iolo\restore.bat
2009-06-12 21:32 . 2009-06-12 21:32 -------- d-----w- c:\documents and settings\LocalService\Application Data\iolo
2009-06-12 21:30 . 2009-06-19 16:48 -------- d-----w- c:\documents and settings\All Users\Application Data\iolo
2009-06-12 21:30 . 2009-06-13 12:49 -------- d-----w- c:\documents and settings\Eric\Application Data\iolo
2009-06-08 04:32 . 2009-06-08 04:32 -------- d-----w- c:\program files\iPod
2009-06-08 04:31 . 2009-06-08 04:32 -------- d-----w- c:\program files\iTunes
2009-06-08 04:29 . 2009-06-08 04:30 -------- d-----w- c:\program files\QuickTime
2009-06-08 04:24 . 2009-06-08 04:24 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-04 05:19 . 2009-06-04 05:19 -------- d-----w- c:\program files\diskdigger0.8.1
2009-06-03 01:44 . 2009-06-03 01:44 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-06-03 01:44 . 2009-06-03 01:44 -------- d-sh--w- c:\documents and settings\Eric\PrivacIE
2009-06-03 01:42 . 2009-06-03 01:42 -------- d-sh--w- c:\documents and settings\Eric\IETldCache
2009-06-03 01:40 . 2009-06-11 02:59 -------- d-----w- c:\windows\ie8updates
2009-06-03 01:38 . 2009-06-03 01:40 -------- dc-h--w- c:\windows\ie8
2009-05-30 22:13 . 2009-02-08 00:36 4608 ------w- c:\windows\system32\chkvdisk.exe
2009-05-30 22:12 . 2009-05-30 22:13 -------- d-----w- c:\windows\system32\configfix
2009-05-30 22:11 . 2009-05-30 22:11 -------- d-----w- c:\program files\Rollback20090310

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-21 00:18 . 2009-04-13 19:20 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-20 23:21 . 2009-04-12 03:49 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-06-20 21:02 . 2009-04-14 07:10 2602772 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-06-20 21:02 . 2009-04-14 07:10 194218784 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-06-20 20:44 . 2009-06-20 20:45 57344 ----a-w- c:\windows\Internet Logs\xDBA.tmp
2009-06-20 20:32 . 2009-04-12 05:38 -------- d-----w- c:\documents and settings\Eric\Application Data\MailWasherPro
2009-06-20 10:03 . 2009-06-20 18:06 112640 ----a-w- c:\windows\Internet Logs\xDB9.tmp
2009-06-20 05:49 . 2009-04-12 01:59 26152 ----a-w- c:\documents and settings\Eric\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-19 09:04 . 2009-06-19 16:48 85504 ----a-w- c:\windows\Internet Logs\xDB8.tmp
2009-06-19 07:00 . 2009-05-13 03:37 -------- d-----w- c:\program files\Flock
2009-06-19 06:16 . 2009-06-19 06:17 103936 ----a-w- c:\windows\Internet Logs\xDB7.tmp
2009-06-19 04:46 . 2009-06-19 05:08 70144 ----a-w- c:\windows\Internet Logs\xDB6.tmp
2009-06-19 04:09 . 2009-06-19 04:31 77312 ----a-w- c:\windows\Internet Logs\xDB5.tmp
2009-06-19 01:09 . 2009-04-12 01:51 22704 ----a-w- c:\windows\system32\emptyregdb.dat
2009-06-16 09:36 . 2009-06-19 01:31 49664 ----a-w- c:\windows\Internet Logs\xDB4.tmp
2009-06-16 09:28 . 2009-06-16 09:28 139264 ----a-w- c:\windows\Internet Logs\xDB3.tmp
2009-06-16 06:13 . 2009-04-14 10:28 -------- d-----w- c:\program files\FindAndRunRobot
2009-06-16 06:09 . 2009-04-17 03:55 -------- d-----w- c:\program files\DcUpdater
2009-06-16 00:40 . 2009-06-16 00:42 137728 ----a-w- c:\windows\Internet Logs\xDB1.tmp
2009-06-16 00:40 . 2009-06-16 00:42 2885120 ----a-w- c:\windows\Internet Logs\xDB2.tmp
2009-06-14 02:30 . 2009-04-17 00:07 249856 ------w- c:\windows\Setup1.exe
2009-06-14 02:30 . 2009-04-17 00:07 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-06-13 20:52 . 2009-04-12 05:18 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-13 12:49 . 2009-04-25 22:51 -------- d-----w- c:\program files\File-Ex 3
2009-06-13 12:49 . 2009-04-17 10:19 -------- d-----w- c:\program files\Audiograbber
2009-06-13 12:49 . 2009-04-16 04:25 -------- d-----w- c:\program files\PicaView
2009-06-12 22:27 . 2009-04-12 07:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-06-08 04:32 . 2009-04-12 07:38 -------- d-----w- c:\program files\Common Files\Apple
2009-06-07 06:00 . 2009-06-07 06:00 61436 ----a-w- c:\windows\Internet Logs\vsmon_2nd_2009_06_06_22_46_56_small.dmp.zip
2009-06-02 23:39 . 2009-06-02 23:39 771102 ----a-w- c:\windows\Internet Logs\vsmon_on_demand_crt_term_2009_06_01_22_10_32_full.dmp.zip
2009-06-02 23:39 . 2009-06-02 23:39 147119 ----a-w- c:\windows\Internet Logs\vsmon_2nd_2009_06_01_22_10_27_small.dmp.zip
2009-05-30 02:42 . 2009-04-13 21:29 1 ----a-w- c:\documents and settings\Eric\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-05-29 20:36 . 2009-04-12 07:39 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-05-29 20:36 . 2009-04-12 07:39 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-05-28 05:49 . 2009-05-28 05:49 157834 ----a-w- c:\windows\Internet Logs\vsmon_2nd_2009_05_27_22_44_15_small.dmp.zip
2009-05-28 00:19 . 2009-04-16 23:56 -------- d-----w- c:\documents and settings\Eric\Application Data\Audacity
2009-05-25 20:30 . 2009-04-17 00:31 1635 ----a-w- c:\documents and settings\Eric\Application Data\SAS7_000.DAT
2009-05-18 05:19 . 2009-05-03 00:12 -------- d-----w- c:\program files\Google
2009-05-13 03:37 . 2009-05-13 03:37 -------- d-----w- c:\documents and settings\Eric\Application Data\Flock
2009-05-09 08:30 . 2009-05-09 08:30 147905 ----a-w- c:\windows\Internet Logs\vsmon_2nd_2009_05_09_01_25_03_small.dmp.zip
2009-05-09 07:28 . 2009-05-09 07:27 -------- d-----w- c:\program files\Wallpaper Master
2009-05-06 22:30 . 2009-04-17 03:03 9 ----a-w- c:\documents and settings\Eric\config.dat
2009-05-06 01:11 . 2009-05-06 01:11 -------- d-----w- c:\documents and settings\Eric\Application Data\U3
2009-05-04 05:23 . 2009-05-04 05:23 -------- d-----w- c:\program files\Timex
2009-05-03 23:31 . 2009-04-12 06:42 -------- d-----w- c:\documents and settings\Eric\Application Data\Winamp
2009-05-03 20:20 . 2009-04-12 06:42 -------- d-----w- c:\program files\Winamp
2009-05-03 06:57 . 2009-05-03 06:57 -------- d-----w- c:\program files\Cool Timer
2009-05-03 06:44 . 2009-04-17 10:39 -------- d-----w- c:\program files\Mp3tag
2009-05-01 23:21 . 2009-04-12 02:25 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2009-04-25 22:50 . 2009-04-25 22:50 -------- d-----w- c:\documents and settings\Eric\Application Data\File-Ex
2009-04-25 07:13 . 2009-04-25 07:11 -------- d-----w- c:\program files\NoteTab Pro 5
2009-04-25 07:12 . 2009-04-25 07:11 -------- d-----w- c:\documents and settings\Eric\Application Data\NoteTab Pro
2009-04-25 07:10 . 2009-04-25 07:10 -------- d-----w- c:\program files\NoteTab Pro
2009-04-25 03:20 . 2009-04-25 03:20 -------- d-----w- c:\program files\Firaxis Games
2009-04-25 01:46 . 2009-04-25 01:22 -------- d-----w- c:\program files\Linkman
2009-04-25 01:16 . 2009-04-25 01:16 -------- d-----w- c:\program files\Essentials Codec Pack
2009-04-17 03:55 . 2009-04-17 03:55 46 ----a-w- c:\windows\system32\DonationCoder_dcupdater_InstallInfo.dat
2009-04-17 03:55 . 2009-04-17 03:55 46 ----a-w- c:\documents and settings\Eric\Local Settings\Application Data\DonationCoder_dcupdater_InstallInfo.dat
2009-04-16 07:35 . 2009-04-16 06:33 554 ----a-w- c:\windows\mozver.dat
2009-04-16 02:18 . 2009-04-16 02:15 78810 ----a-w- c:\windows\hpfins05.dat
2009-04-14 10:28 . 2009-04-14 10:28 46 ----a-w- c:\windows\system32\DonationCoder_findrunrobot_InstallInfo.dat
2009-04-14 10:28 . 2009-04-14 10:28 46 ----a-w- c:\documents and settings\Eric\Local Settings\Application Data\DonationCoder_findrunrobot_InstallInfo.dat
2009-04-14 10:11 . 2009-04-14 10:11 44384 ----a-w- c:\windows\system32\drivers\tifsfilt.sys
2009-04-14 10:11 . 2009-04-14 10:11 441760 ----a-w- c:\windows\system32\drivers\timntr.sys
2009-04-14 10:11 . 2009-04-14 10:11 129248 ----a-w- c:\windows\system32\drivers\snapman.sys
2009-04-14 10:11 . 2009-04-14 10:11 368736 ----a-w- c:\windows\system32\drivers\tdrpman.sys
2009-04-12 02:54 . 2009-04-12 02:54 0 ----a-w- c:\windows\nsreg.dat
2009-04-12 01:59 . 2009-04-12 01:52 76487 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-04-01 02:20 . 2009-04-14 07:08 72584 ----a-w- c:\windows\zllsputility.exe
2009-04-01 02:20 . 2009-04-14 07:08 1221512 ----a-w- c:\windows\system32\zpeng25.dll
2009-04-01 02:20 . 2009-04-14 07:08 69000 ----a-w- c:\windows\system32\zlcomm.dll
2009-04-01 02:20 . 2009-04-14 07:08 103816 ----a-w- c:\windows\system32\zlcommdb.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-11-18 19:58 333192 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"TakeABreak"="c:\program files\My Rest Break\MyRestBreak.exe" [2007-09-19 88576]
"WallpaperChanger"="c:\program files\Wallpaper Master\Wallpaper.exe" [2005-11-08 321536]
"RoboForm"="d:\computernotes\RoboFormData\TB71\RoboTaskBarIcon.exe" [2009-05-13 160592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-04-01 982408]
"type32"="c:\program files\Microsoft IntelliType Pro\type32.exe" [2005-03-15 196608]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2005-03-23 217088]
"FinePrint Dispatcher v5"="c:\windows\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe" [2007-11-07 507904]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-05-30 292136]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-05-21 177472]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-09 7311360]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-05-09 86016]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-05-09 1519616]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2009-02-17 17508864]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2008-08-19 77824]
"AlcWzrd"="ALCWZRD.EXE" - c:\windows\ALCWZRD.EXE [2008-06-19 2808832]

c:\documents and settings\Eric\Start Menu\Programs\Startup\
File-Ex.lnk - c:\program files\File-Ex 3\FileEx.exe [2009-4-25 208896]
ShutDownPro.lnk - c:\program files\ShutDownPro\ShutDownPro.EXE [2009-4-17 100352]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ chkvdisk\0autocheck autochk *

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCPxpsp2res.dll,-22009

S2 gupdate1c9cb83eecd96d8;Google Update Service (gupdate1c9cb83eecd96d8);c:\program files\Google\Update\GoogleUpdate.exe [5/2/2009 5:13 PM 133104]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [6/15/2009 12:33 PM 10112]
.
Contents of the 'Scheduled Tasks' folder

2009-06-20 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-03 00:12]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.excite.com/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: >Search in Linkman - file://d:\my documents\Linkman\iescript_search.htm
IE: Add to Linkman - file://d:\my documents\Linkman\iescript_add.htm
IE: Add to Linkman (all tabs) - file://d:\my documents\Linkman\iescript_addall.htm
IE: Add to Linkman and Edit - file://d:\my documents\Linkman\iescript_edit.htm
IE: Add to WebSite-Watcher - c:\documents and settings\Eric\Application Data\aignes\WebSite-Watcher\config\settings\wswie.htm
IE: Customize Menu - file://d:\computernotes\RoboFormData\TB71\RoboFormComCustomizeIEMenu.html
IE: Fill Forms - file://d:\computernotes\RoboFormData\TB71\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://d:\computernotes\RoboFormData\TB71\RoboFormComShowToolbar.html
IE: Save Forms - file://d:\computernotes\RoboFormData\TB71\RoboFormComSavePass.html
IE: Show Linkman - file://d:\my documents\Linkman\iescript_show.htm
FF - ProfilePath - 
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-20 17:21
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\EncryptionInterface*]
"l_encryption_e"="2528435F42422A317B245B5F3E443E293E602A2F455F3B4236277D2B335F5E3538513B602126425E43\003"
"l_encryption_d"="585A4B59405A\00A"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(768)
c:\windows\system32\relog_ap.dll
.
Completion time: 2009-06-21 17:22
ComboFix-quarantined-files.txt 2009-06-21 00:22

Pre-Run: 40,555,098,112 bytes free
Post-Run: 40,584,216,576 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

387 --- E O F --- 2009-06-11 02:59


----------



## NijimaSan (Jun 19, 2009)

The New Hijiack log right after:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:23:28 PM, on 6/20/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Wallpaper Master\Wallpaper.exe
D:\ComputerNotes\RoboFormData\TB71\RoboTaskBarIcon.exe
C:\Program Files\File-Ex 3\FileEx.exe
C:\Program Files\ShutDownPro\ShutDownPro.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.excite.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - D:\ComputerNotes\RoboFormData\TB71\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - D:\ComputerNotes\RoboFormData\TB71\roboform.dll
O3 - Toolbar: Foxit Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: &Linkman - {5C9DCA26-CEC4-4280-A831-D622D4DBF113} - C:\PROGRA~1\Linkman\LINKMA~1.DLL
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [FinePrint Dispatcher v5] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe" /source=HKLM
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TakeABreak] C:\Program Files\My Rest Break\MyRestBreak.exe
O4 - HKCU\..\Run: [WallpaperChanger] C:\Program Files\Wallpaper Master\Wallpaper.exe
O4 - HKCU\..\Run: [RoboForm] "D:\ComputerNotes\RoboFormData\TB71\RoboTaskBarIcon.exe"
O4 - Startup: File-Ex.lnk = C:\Program Files\File-Ex 3\FileEx.exe
O4 - Startup: ShutDownPro.lnk = C:\Program Files\ShutDownPro\ShutDownPro.EXE
O8 - Extra context menu item: >Search in Linkman - file://D:\My Documents\Linkman\iescript_search.htm
O8 - Extra context menu item: Add to Linkman - file://D:\My Documents\Linkman\iescript_add.htm
O8 - Extra context menu item: Add to Linkman (all tabs) - file://D:\My Documents\Linkman\iescript_addall.htm
O8 - Extra context menu item: Add to Linkman and Edit - file://D:\My Documents\Linkman\iescript_edit.htm
O8 - Extra context menu item: Add to WebSite-Watcher - C:\Documents and Settings\Eric\Application Data\aignes\WebSite-Watcher\config\settings\wswie.htm
O8 - Extra context menu item: Customize Menu - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Fill Forms - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComSavePass.html
O8 - Extra context menu item: Show Linkman - file://D:\My Documents\Linkman\iescript_show.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate1c9cb83eecd96d8) (gupdate1c9cb83eecd96d8) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 8654 bytes


----------



## NijimaSan (Jun 19, 2009)

bump


----------



## Cookiegal (Aug 27, 2003)

Please stop bumping your thread.

Please go to *Start *- *Run *- type in *eventvwr.msc* to open the event viewer. Look under both "Application" and "System" for recent (the last 48 hours or so) errors (shown in red) and if found, do this for each one.

Double-click the error to open it up and then click on the icon that looks like two pieces of paper. This will copy the full error. Then "paste" the error into Notepad. Do this for each one until you have them all listed in Notepad and then copy and paste the list in a reply here please.


----------



## NijimaSan (Jun 19, 2009)

in the last 48 hours. However, there were some under System. Here they are.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7009
Date: 6/20/2009
Time: 5:21:12 PM
User: N/A
Computer: ERIC-DFCCB6FEE6
Description:
Timeout (30000 milliseconds) waiting for the PEVSystemStart service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7009
Date: 6/20/2009
Time: 5:21:11 PM
User: N/A
Computer: ERIC-DFCCB6FEE6
Description:
Timeout (30000 milliseconds) waiting for the PEVSystemStart service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7009
Date: 6/20/2009
Time: 5:18:41 PM
User: N/A
Computer: ERIC-DFCCB6FEE6
Description:
Timeout (30000 milliseconds) waiting for the PEVSystemStart service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 6/20/2009
Time: 2:03:25 PM
User: N/A
Computer: ERIC-DFCCB6FEE6
Description:
The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 6/20/2009
Time: 1:45:50 PM
User: N/A
Computer: ERIC-DFCCB6FEE6
Description:
The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 6/19/2009
Time: 9:49:03 AM
User: N/A
Computer: ERIC-DFCCB6FEE6
Description:
The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


----------



## Cookiegal (Aug 27, 2003)

Please do an online scan with Kaspersky WebScanner

Kaspersky online scanner uses JAVA tecnology to perform the scan. If you do not have Java then you will need to go to the following link and download the latest version:

*JRE 6 Update 13*

Instructions for Kaspersky scan:


Read through the requirements and privacy statement and click on *Accept* button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click *Run*.
When the downloads have finished, click on *Settings*.
Make sure the following is checked. 
*Spyware, Adware, Dialers, and other potentially dangerous programs 
Archives
Mail databases*

Click on *My Computer* under *Scan*.
Once the scan is complete, it will display the results. Click on *View Scan Report*.
You will see a list of infected items there. Click on *Save Report As...*.
Save this report to a convenient place. Change the *Files of type* to *Text file (.txt)* before clicking on the *Save* button.
Please post this log in your next reply.


----------



## NijimaSan (Jun 19, 2009)

Here you go.....sadly.....nothing to report.

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Sunday, June 21, 2009
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Monday, June 22, 2009 02:41:52
Records in database: 2375681
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - Folder:


Scan statistics:
Files scanned: 121765
Threat name: 0
Infected objects: 0
Suspicious objects: 0
Duration of the scan: 02:05:24

No malware has been detected. The scan area is clean.

The selected area was scanned.


----------



## NijimaSan (Jun 19, 2009)

Man, I hope you're starting to see something that I surely don't


----------



## Cookiegal (Aug 27, 2003)

Have you tried doing a system restore to a point before this happened?


----------



## NijimaSan (Jun 19, 2009)

I use Rollback RX. It disables Windows XP System restore. 

When I tried to restore previous "snapshots" it still caused problems. I just can't pin it down to one thing or I can't see how or if those problems are related to each other.


----------



## Cookiegal (Aug 27, 2003)

Go to *Start * *Run *- type *msconfig*  click OK and click on the *startup tab*. Uncheck everything there except for your anti-virus program. I assume Zone Alarm is both firewall and anti-virus as I don't see any other. Then reboot and let me know if the problem persists please.


----------



## NijimaSan (Jun 19, 2009)

There didn't seem to be any problems on loadup. It seemed to startup with no problems.

I think I need to clarify something though. Right now, the computer seems fine. For the past days I've posted on this forum the computer seems to work correctly. 

There hasn't been any problems since the computer crashed last week.

What I hope to do, with your help, is figure out if there are any signs that would prevent such a major crash from happening again.


----------



## Cookiegal (Aug 27, 2003)

When a system crashes, it creates a minidump file and that can usually tells us what driver or program caused the crash.

See if you can find the latest one at this location and zip it up and attach it here. I'm not equipped to read it but I'll ask someone to do it for us. 

C:\Windows\Minidump\Minidump.dmp


----------



## NijimaSan (Jun 19, 2009)

Sorry, there was no minidump file that my computer could find.


----------



## Cookiegal (Aug 27, 2003)

Open HijackThis and click on the *Open Misc Tools section* button. Click on the *Open Uninstall Manager* button. Click the *Save List* button. Save the list then copy and paste it here.

Also, please do this one:

Please open HijackThis.
Click on *Open Misc Tools Section*
Make sure that both boxes beside "Generate StartupList Log" are checked:

*List all minor sections(Full)*
*List Empty Sections(Complete)*
Click *Generate StartupList Log*.
Click *Yes* at the prompt.
It will open a text file. Please copy the entire contents of that page and paste it here.


----------



## NijimaSan (Jun 19, 2009)

ACDSee 9 Photo Manager
Acronis True Image Home
Adobe Flash Player 10 ActiveX
Adobe Flash Player Plugin
AI RoboForm (All Users)
AoA Audio Extractor 1.0
APA PERRLA
Apple Mobile Device Support
Apple Software Update
Atomic Clock Sync
Audacity 1.2.6
Audacity 1.3.6 (Unicode)
AusLogics Disk Defrag
Bonjour
Clipboard Magic 4.01
Cool Timer 3.6
DcUpdater 1.23.01
Dragon NaturallySpeaking 9
DriverMax 4
DriverMax 5
Duplicate Cleaner 1.3.1
Eraser
Eraser
Fast Duplicate File Finder 1.1.0.0
FastStone Capture 5.3
File-Ex v3.0.0.24
FileMenu Tools
Find+Run Robot 2.61.01
FinePrint
Flock (2.0.3)
FolderMatch v3.4.8
Foxit Reader
Foxit Toolbar
GEAR driver installer for x86 and x64
GOM Player
GoodSync
Google Earth
Google Update Helper
HijackThis 2.0.2
Hotfix for Windows XP (KB952287)
HP Deskjet 3900 series
HP Imaging Device Functions 5.0
HP Software Update
HP Solution Center & Imaging Support Tools 5.0
IcoFX 1.6.4
iTunes
Java(TM) 6 Update 14
Java(TM) 6 Update 2
Java(TM) 6 Update 7
Linkman 6.8
Linkman 7.8.0.12
MailWasher Pro
Malwarebytes' Anti-Malware
Microsoft .NET Framework 2.0
Microsoft Age of Empires II
Microsoft Age of Empires II: The Conquerors Expansion
Microsoft Office 2000 Professional
Microsoft Sync Framework Runtime v1.0 (x86)
Microsoft Sync Framework Services v1.0 (x86)
Microsoft Visual C++ 2005 Redistributable
MobileMe Control Panel
Moffsoft FreeCalc
Mozilla Firefox (3.0.11)
Mozilla Thunderbird (2.0.0.21)
Mp3tag v2.43
MPEG2 Codec(libmpeg2/mad)
MSXML 4.0 SP2 (KB954430)
My Rest Break 1.0
Nero 8
neroxml
Norton PartitionMagic 8.0
NoteTab Pro (Remove only)
NoteTab Pro 5 (Remove only)
NVIDIA Drivers
OpenOffice.org 3.0
PathCopyEx
PicaView
PowerDesk 6
QuickTime
Real Alternative 1.9.0
Realtek High Definition Audio Driver
Revo Uninstaller 1.83
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953155)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969897)
Security Update for Windows XP (KB970238)
ShutDownPro
Sid Meier's Pirates!
SyncToy 2.0 (x86)
The Ultimate Troubleshooter
Tidy Start Menu
Timex Data Link USB
True Launch Bar
Tweak UI
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
VC 9.0 Runtime
VCRedistSetup
VideoLAN VLC media player 0.8.6e
Wallpaper Master v2.16
WD Diagnostics
WD Firewire HID Driver
WDCSAM Driver
WebSite-Watcher 5.0.1
Winamp
Windows Driver Package - Western Digital Technologies (WDC_SAM) WDC_SAM (12/05/2006 1.0.0007.0)
Windows Essentials Media Codec Pack 1.0
Windows Media Format Runtime
WinMerge 2.10.2.0
WinRAR archiver
WinZip
ZoneAlarm Security Suite


----------



## NijimaSan (Jun 19, 2009)

StartupList report, 6/25/2009, 10:51:07 PM
StartupList version: 1.52.2
Started from : C:\Program Files\Trend Micro\HijackThis\HijackThis.EXE
Detected: Windows XP SP3 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP3 (6.00.2900.5512)
* Using default options
* Including empty and uninteresting sections
* Showing rarely important sections
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe
C:\Program Files\Wallpaper Master\Wallpaper.exe
C:\Program Files\VCOM\PowerDesk\PDExplo.exe
C:\Program Files\My Rest Break\MyRestBreak.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
D:\ComputerNotes\RoboFormData\TB71\RoboTaskBarIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\File-Ex 3\FileEx.exe
C:\Program Files\ShutDownPro\ShutDownPro.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\Eric\Start Menu\Programs\Startup]
File-Ex.lnk = C:\Program Files\File-Ex 3\FileEx.exe
ShutDownPro.lnk = C:\Program Files\ShutDownPro\ShutDownPro.EXE

Shell folders AltStartup:
*Folder not found*

User shell folders Startup:
*Folder not found*

User shell folders AltStartup:
*Folder not found*

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
*No files*

Shell folders Common AltStartup:
*Folder not found*

User shell folders Common Startup:
*Folder not found*

User shell folders Alternate Common Startup:
*Folder not found*

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
*Registry value not found*

[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry value not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ZoneAlarm Client = "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
type32 = "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
SunJavaUpdateSched = "C:\Program Files\Java\jre6\bin\jusched.exe"
SoundMan = SOUNDMAN.EXE
RTHDCPL = RTHDCPL.EXE
nwiz = nwiz.exe /install
NvMediaCenter = RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
iTunesHelper = "C:\Program Files\iTunes\iTunesHelper.exe"
IntelliPoint = "C:\Program Files\Microsoft IntelliPoint\point32.exe"
FinePrint Dispatcher v5 = "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe" /source=HKLM
AppleSyncNotifier = C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
AlcWzrd = ALCWZRD.EXE

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

WallpaperChanger = C:\Program Files\Wallpaper Master\Wallpaper.exe
TakeABreak = C:\Program Files\My Rest Break\MyRestBreak.exe
RoboForm = "D:\ComputerNotes\RoboFormData\TB71\RoboTaskBarIcon.exe"
ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

[OptionalComponents]
*No values found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

File association entry for .EXE:
HKEY_CLASSES_ROOT\exefile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .COM:
HKEY_CLASSES_ROOT\ComFile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .BAT:
HKEY_CLASSES_ROOT\batfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .PIF:
HKEY_CLASSES_ROOT\piffile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .SCR:
HKEY_CLASSES_ROOT\scrfile\shell\open\command

(Default) = "%1" /S

--------------------------------------------------

File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = C:\WINDOWS\system32\mshta.exe "%1" %*

--------------------------------------------------

File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command

(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] *
StubPath = C:\WINDOWS\system32\ieudinit.exe

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP

[>{26923b43-4d38-484f-9b9e-de460746276c}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *
StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

[{4b218e3e-bc98-4770-93d3-2731b9329278}] *
StubPath = %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection MarketplaceLinkInstall 896 %systemroot%\inf\ie.inf

[{5945c046-1e7d-11d1-bc44-00c04fd912be}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = %SystemRoot%\system32\ie4uinit.exe

[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *
StubPath = C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

--------------------------------------------------

Enumerating ICQ Agent Autostart apps:
HKCU\Software\Mirabilis\ICQ\Agent\Apps

*Registry key not found*

--------------------------------------------------

Load/Run keys from C:\WINDOWS\WIN.INI:

load=*INI section not found*
run=*INI section not found*

Load/Run keys from Registry:

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=*Registry value not found*

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=*Registry value not found*
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

--------------------------------------------------

Verifying REGEDIT.EXE integrity:

- Regedit.exe found in C:\WINDOWS
- .reg open command is normal (regedit.exe %1)
- Company name OK: 'Microsoft Corporation'
- Original filename OK: 'REGEDIT.EXE'
- File description: 'Registry Editor'

Registry check passed

--------------------------------------------------

Enumerating Browser Helper Objects:

AskBar BHO - C:\Program Files\AskBarDis\bar\bin\askBar.dll - {201f27d4-3704-41d6-89c1-aa35e39143ed}
RoboForm - D:\ComputerNotes\RoboFormData\TB71\roboform.dll - {724d43a9-0d85-11d4-9908-00400523e39a}
(no name) - C:\Program Files\Java\jre6\bin\jp2ssv.dll - {DBC80044-A445-435b-BC74-9C25C1C588A9}
JQSIEStartDetectorImpl - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll - {E7E6F031-17CE-4C07-BC86-EABFE594F69C}

--------------------------------------------------

Enumerating Task Scheduler jobs:

GoogleUpdateTaskMachine.job

--------------------------------------------------

Enumerating Download Program Files:

[Java Plug-in 1.6.0_14]
InProcServer32 = C:\Program Files\Java\jre6\bin\jp2iexp.dll
CODEBASE = http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab

[Java Plug-in 1.6.0_02]
InProcServer32 = C:\Program Files\Java\jre6\bin\jp2iexp.dll
CODEBASE = http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab

[Java Plug-in 1.6.0_07]
InProcServer32 = C:\Program Files\Java\jre6\bin\jp2iexp.dll
CODEBASE = http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

[Java Plug-in 1.6.0_14]
InProcServer32 = C:\Program Files\Java\jre6\bin\jp2iexp.dll
CODEBASE = http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab

[Java Plug-in 1.6.0_14]
InProcServer32 = C:\Program Files\Java\jre6\bin\npjpi160_14.dll
CODEBASE = http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash10b.ocx
CODEBASE = http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab


----------



## NijimaSan (Jun 19, 2009)

Pt. 2.....................

--------------------------------------------------

Enumerating Winsock LSP files:

NameSpace #1: C:\Program Files\Bonjour\mdnsNSP.dll
NameSpace #2: C:\WINDOWS\System32\mswsock.dll
NameSpace #3: C:\WINDOWS\System32\winrnr.dll
NameSpace #4: C:\WINDOWS\System32\mswsock.dll
Protocol #1: C:\WINDOWS\system32\mswsock.dll
Protocol #2: C:\WINDOWS\system32\mswsock.dll
Protocol #3: C:\WINDOWS\system32\mswsock.dll
Protocol #4: C:\WINDOWS\system32\rsvpsp.dll
Protocol #5: C:\WINDOWS\system32\rsvpsp.dll
Protocol #6: C:\WINDOWS\system32\mswsock.dll
Protocol #7: C:\WINDOWS\system32\mswsock.dll
Protocol #8: C:\WINDOWS\system32\mswsock.dll
Protocol #9: C:\WINDOWS\system32\mswsock.dll
Protocol #10: C:\WINDOWS\system32\mswsock.dll
Protocol #11: C:\WINDOWS\system32\mswsock.dll
Protocol #12: C:\WINDOWS\system32\mswsock.dll
Protocol #13: C:\WINDOWS\system32\mswsock.dll

--------------------------------------------------

Enumerating Windows NT/2000/XP services

Microsoft ACPI Driver: system32\DRIVERS\ACPI.sys (system)
Acronis Scheduler2 Service: "C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe" (autostart)
Microsoft Kernel Acoustic Echo Canceller: system32\drivers\aec.sys (manual start)
AFD: \SystemRoot\System32\drivers\afd.sys (system)
Alerter: %SystemRoot%\system32\svchost.exe -k LocalService (disabled)
Application Layer Gateway Service: %SystemRoot%\System32\alg.exe (manual start)
ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter: system32\DRIVERS\AN983.sys (manual start)
Apple Mobile Device: "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe" (autostart)
Application Management: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
1394 ARP Client Protocol: system32\DRIVERS\arp1394.sys (manual start)
ASP.NET State Service: %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (manual start)
RAS Asynchronous Media Driver: system32\DRIVERS\asyncmac.sys (manual start)
Standard IDE/ESDI Hard Disk Controller: system32\DRIVERS\atapi.sys (system)
ATM ARP Client Protocol: system32\DRIVERS\atmarpc.sys (manual start)
Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Audio Stub Driver: system32\DRIVERS\audstub.sys (manual start)
Background Intelligent Transfer Service: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
Bonjour Service: "C:\Program Files\Bonjour\mDNSResponder.exe" (autostart)
Computer Browser: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
catchme: \??\C:\DOCUME~1\Eric\LOCALS~1\Temp\catchme.sys (manual start)
CD-ROM Driver: system32\DRIVERS\cdrom.sys (system)
Indexing Service: %SystemRoot%\system32\cisvc.exe (manual start)
ClipBook: %SystemRoot%\system32\clipsrv.exe (disabled)
.NET Runtime Optimization Service v2.0.50727_X86: C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (manual start)
COM+ System Application: C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start)
Cryptographic Services: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
DCOM Server Process Launcher: %SystemRoot%\system32\svchost -k DcomLaunch (autostart)
DHCP Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Disk Driver: system32\DRIVERS\disk.sys (system)
Logical Disk Manager Administrative Service: %SystemRoot%\System32\dmadmin.exe /com (manual start)
dmboot: System32\drivers\dmboot.sys (disabled)
Logical Disk Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Microsoft Kernel DLS Syntheiszer: system32\drivers\DMusic.sys (manual start)
DNS Client: %SystemRoot%\system32\svchost.exe -k NetworkService (autostart)
Wired AutoConfig: %SystemRoot%\System32\svchost.exe -k dot3svc (manual start)
Microsoft Kernel DRM Audio Descrambler: system32\drivers\drmkaud.sys (manual start)
Extensible Authentication Protocol Service: %SystemRoot%\System32\svchost.exe -k eapsvcs (manual start)
Error Reporting Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Event Log: %SystemRoot%\system32\services.exe (autostart)
COM+ Event System: C:\WINDOWS\system32\svchost.exe -k netsvcs (manual start)
Fast User Switching Compatibility: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
FltMgr: system32\DRIVERS\fltMgr.sys (system)
Volume Manager Driver: system32\DRIVERS\ftdisk.sys (system)
GEAR ASPI Filter Driver: system32\DRIVERS\GEARAspiWDM.sys (manual start)
Generic Packet Classifier: system32\DRIVERS\msgpc.sys (manual start)
Google Update Service (gupdate1c9cb83eecd96d8): "C:\Program Files\Google\Update\GoogleUpdate.exe" /svc (autostart)
Microsoft UAA Bus Driver for High Definition Audio: system32\DRIVERS\HDAudBus.sys (manual start)
Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
HID Input Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Microsoft HID Class Driver: system32\DRIVERS\hidusb.sys (manual start)
Health Key and Certificate Management Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
HTTP: System32\Drivers\HTTP.sys (manual start)
HTTP SSL: %SystemRoot%\System32\svchost.exe -k HTTPFilter (manual start)
i8042 Keyboard and PS/2 Mouse Port Driver: system32\DRIVERS\i8042prt.sys (system)
InstallDriver Table Manager: "C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe" (manual start)
CD-Burning Filter Driver: system32\DRIVERS\imapi.sys (system)
IMAPI CD-Burning COM Service: %systemroot%\system32\imapi.exe (manual start)
Service for Realtek HD Audio (WDM): system32\drivers\RtkHDAud.sys (manual start)
IPv6 Windows Firewall Driver: system32\DRIVERS\Ip6Fw.sys (manual start)
IP Traffic Filter Driver: system32\DRIVERS\ipfltdrv.sys (manual start)
IP in IP Tunnel Driver: system32\DRIVERS\ipinip.sys (manual start)
IP Network Address Translator: system32\DRIVERS\ipnat.sys (manual start)
iPod Service: "C:\Program Files\iPod\bin\iPodService.exe" (manual start)
IPSEC driver: system32\DRIVERS\ipsec.sys (system)
IR Enumerator Service: system32\DRIVERS\irenum.sys (manual start)
PnP ISA/EISA Bus Driver: system32\DRIVERS\isapnp.sys (system)
Java Quick Starter: "C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf" (autostart)
Keyboard Class Driver: system32\DRIVERS\kbdclass.sys (system)
KLIF: system32\DRIVERS\klif.sys (system)
Microsoft Kernel Wave Audio Mixer: system32\drivers\kmixer.sys (manual start)
Server: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Workstation: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
TCP/IP NetBIOS Helper: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
Messenger: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)
NetMeeting Remote Desktop Sharing: C:\WINDOWS\system32\mnmsrvc.exe (manual start)
Mouse Class Driver: system32\DRIVERS\mouclass.sys (system)
Mouse HID Driver: system32\DRIVERS\mouhid.sys (manual start)
WebDav Client Redirector: system32\DRIVERS\mrxdav.sys (manual start)
MRXSMB: system32\DRIVERS\mrxsmb.sys (system)
Distributed Transaction Coordinator: C:\WINDOWS\system32\msdtc.exe (manual start)
Windows Installer: %systemroot%\system32\msiexec.exe /V (manual start)
Microsoft Streaming Service Proxy: system32\drivers\MSKSSRV.sys (manual start)
Microsoft Streaming Clock Proxy: system32\drivers\MSPCLOCK.sys (manual start)
Microsoft Streaming Quality Manager Proxy: system32\drivers\MSPQM.sys (manual start)
Microsoft System Management BIOS Driver: system32\DRIVERS\mssmbios.sys (manual start)
Network Access Protection Agent: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Remote Access NDIS TAPI Driver: system32\DRIVERS\ndistapi.sys (manual start)
NDIS Usermode I/O Protocol: system32\DRIVERS\ndisuio.sys (manual start)
Remote Access NDIS WAN Driver: system32\DRIVERS\ndiswan.sys (manual start)
Nero BackItUp Scheduler 3: C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (autostart)
NetBIOS Interface: system32\DRIVERS\netbios.sys (system)
NetBios over Tcpip: system32\DRIVERS\netbt.sys (system)
Network DDE: %SystemRoot%\system32\netdde.exe (disabled)
Network DDE DSDM: %SystemRoot%\system32\netdde.exe (disabled)
Net Logon: %SystemRoot%\system32\lsass.exe (manual start)
Network Connections: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
1394 Net Driver: system32\DRIVERS\nic1394.sys (manual start)
Network Location Awareness (NLA): %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
NMIndexingService: "C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe" (manual start)
NT LM Security Support Provider: %SystemRoot%\system32\lsass.exe (manual start)
Removable Storage: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
nv: system32\DRIVERS\nv4_mini.sys (manual start)
NVIDIA Display Driver Service: %SystemRoot%\system32\nvsvc32.exe (autostart)
IPX Traffic Filter Driver: system32\DRIVERS\nwlnkflt.sys (manual start)
IPX Traffic Forwarder Driver: system32\DRIVERS\nwlnkfwd.sys (manual start)
OHCI Compliant IEEE 1394 Host Controller: system32\DRIVERS\ohci1394.sys (system)
PCI Bus Driver: system32\DRIVERS\pci.sys (system)
PCIIde: system32\DRIVERS\pciide.sys (system)
Plug and Play: %SystemRoot%\system32\services.exe (autostart)
Microsoft IntelliPoint Filter Driver: system32\DRIVERS\point32.sys (manual start)
IPSEC Services: %SystemRoot%\system32\lsass.exe (autostart)
WAN Miniport (PPTP): system32\DRIVERS\raspptp.sys (manual start)
Processor Driver: system32\DRIVERS\processr.sys (system)
Protected Storage: %SystemRoot%\system32\lsass.exe (autostart)
QoS Packet Scheduler: system32\DRIVERS\psched.sys (manual start)
Direct Parallel Link Driver: system32\DRIVERS\ptilink.sys (manual start)
Remote Access Auto Connection Driver: system32\DRIVERS\rasacd.sys (system)
Remote Access Auto Connection Manager: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
WAN Miniport (L2TP): system32\DRIVERS\rasl2tp.sys (manual start)
Remote Access Connection Manager: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
Remote Access PPPOE Driver: system32\DRIVERS\raspppoe.sys (manual start)
Direct Parallel: system32\DRIVERS\raspti.sys (manual start)
Rdbss: system32\DRIVERS\rdbss.sys (system)
RDPCDD: System32\DRIVERS\RDPCDD.sys (system)
Remote Desktop Help Session Manager: C:\WINDOWS\system32\sessmgr.exe (manual start)
Digital CD Audio Playback Filter Driver: system32\DRIVERS\redbook.sys (system)
Routing and Remote Access: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)
Remote Procedure Call (RPC) Locator: %SystemRoot%\system32\locator.exe (manual start)
Remote Procedure Call (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)
QoS RSVP: %SystemRoot%\system32\rsvp.exe (manual start)
Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)
SBP-2 Transport/Protocol Bus Driver: system32\DRIVERS\sbp2port.sys (system)
Smart Card: %SystemRoot%\System32\SCardSvr.exe (manual start)
Task Scheduler: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Secdrv: system32\DRIVERS\secdrv.sys (manual start)
Secondary Logon: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Windows Firewall/Internet Connection Sharing (ICS): %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Shell Hardware Detection: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Acronis Snapshots Manager: system32\DRIVERS\snapman.sys (system)
Microsoft Kernel Audio Splitter: system32\drivers\splitter.sys (manual start)
Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)
System Restore Filter Driver: system32\DRIVERS\sr.sys (system)
srescan: system32\ZoneLabs\srescan.sys (system)
System Restore Service: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Srv: system32\DRIVERS\srv.sys (manual start)
SSDP Discovery Service: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)
Windows Image Acquisition (WIA): %SystemRoot%\system32\svchost.exe -k imgsvc (autostart)
Software Bus Driver: system32\DRIVERS\swenum.sys (manual start)
Microsoft Kernel GS Wavetable Synthesizer: system32\drivers\swmidi.sys (manual start)
MS Software Shadow Copy Provider: C:\WINDOWS\system32\dllhost.exe /Processid:{BF398B8A-8DB4-41FB-A43B-DCFED269F5C9} (manual start)
Microsoft Kernel System Audio Device: system32\drivers\sysaudio.sys (manual start)
Performance Logs and Alerts: %SystemRoot%\system32\smlogsvc.exe (disabled)
Telephony: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
TCP/IP Protocol Driver: system32\DRIVERS\tcpip.sys (system)
Acronis Try&Decide and Restore Points filter: system32\DRIVERS\tdrpman.sys (system)
Terminal Device Driver: system32\DRIVERS\termdd.sys (system)
Terminal Services: %SystemRoot%\System32\svchost -k DComLaunch (manual start)
Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Acronis True Image FS Filter: system32\DRIVERS\tifsfilt.sys (autostart)
Acronis True Image Backup Archive Explorer: system32\DRIVERS\timntr.sys (system)
Distributed Link Tracking Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Acronis Try And Decide Service: "C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe" (autostart)
Windows User Mode Driver Framework: C:\WINDOWS\system32\wdfmgr.exe (manual start)
Microcode Update Driver: system32\DRIVERS\update.sys (manual start)
Universal Plug and Play Device Host: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)
Uninterruptible Power Supply: %SystemRoot%\System32\ups.exe (manual start)
Apple Mobile USB Driver: System32\Drivers\usbaapl.sys (manual start)
Microsoft USB Generic Parent Driver: system32\DRIVERS\usbccgp.sys (manual start)
Microsoft USB 2.0 Enhanced Host Controller Miniport Driver: system32\DRIVERS\usbehci.sys (manual start)
USB2 Enabled Hub: system32\DRIVERS\usbhub.sys (manual start)
Microsoft USB Open Host Controller Miniport Driver: system32\DRIVERS\usbohci.sys (manual start)
Microsoft USB PRINTER Class: system32\DRIVERS\usbprint.sys (manual start)
USB Scanner Driver: system32\DRIVERS\usbscan.sys (manual start)
USB Mass Storage Driver: system32\DRIVERS\USBSTOR.SYS (manual start)
VgaSave: \SystemRoot\System32\drivers\vga.sys (system)
vsdatant: System32\vsdatant.sys (system)
TrueVector Internet Monitor: C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service (autostart)
Volume Shadow Copy: %SystemRoot%\System32\vssvc.exe (manual start)
Windows Time: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Remote Access IP ARP Driver: system32\DRIVERS\wanarp.sys (manual start)
WD SCSI Pass Thru driver: system32\DRIVERS\wdcsam.sys (manual start)
Microsoft WINMM WDM Audio Compatibility Driver: system32\drivers\wdmaud.sys (manual start)
WebClient: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
Windows Management Instrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Portable Media Serial Number Service: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
WMI Performance Adapter: C:\WINDOWS\system32\wbem\wmiapsrv.exe (manual start)
Security Center: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Automatic Updates: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Wireless Zero Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Network Provisioning Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)


--------------------------------------------------

Enumerating Windows NT logon/logoff scripts:

Windows NT checkdisk command:
BootExecute = chkvdisk

Windows NT 'Wininit.ini':
PendingFileRenameOperations: *Registry value not found*

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll

--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*No values found*

--------------------------------------------------

End of report, 34,235 bytes
Report generated in 0.172 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only


----------



## Cookiegal (Aug 27, 2003)

I don't see anything out of order there.

Go to Control Panel - Add/Remove programs and remove these older versions of Java.

*Java(TM) 6 Update 2
Java(TM) 6 Update 7*

Are you still getting that message you mentioned in your initial post?


----------



## NijimaSan (Jun 19, 2009)

Ok...Done

The specified procedure message was only coming up with System Mechanic. After you started helping me, I uninstalled and reinstalled it once and I still got it. I uninstalled again and have not reinstalled it for some time, although I am planning to at some later time.


----------



## Cookiegal (Aug 27, 2003)

Are there any other problems then?


----------



## NijimaSan (Jun 19, 2009)

As of right now, none that I can see. I think I will try to reinstall System Mechanic and report back.


----------



## NijimaSan (Jun 19, 2009)

It seems to work now, but I disabled any messages about registry fixes.


----------



## Cookiegal (Aug 27, 2003)

Why do you want to reinstall System Mechanic? You're better off without it.


----------



## NijimaSan (Jun 19, 2009)

What should I use to fix the computer the next times it breaks down? The first time it broke down, I wasn't using System Mechanic. There has to be SOMETHING I can use.


----------



## Cookiegal (Aug 27, 2003)

Why do you expect it to breakdown again? Computers crash for a number of reasons. Since you can't retrieve a minidump, that doesn't tell us what program or driver may have been responsible for the crash but usually it's some incompatible software or hardware.

Please post a new HijackThis log so I can review as there may be some things that need to be addressed.


----------



## NijimaSan (Jun 19, 2009)

Here's the new Hijack log.....

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:39:16 PM, on 6/28/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\iolo\common\lib\ioloServiceManager.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Wallpaper Master\Wallpaper.exe
D:\ComputerNotes\RoboFormData\TB71\RoboTaskBarIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\File-Ex 3\FileEx.exe
C:\Program Files\ShutDownPro\ShutDownPro.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.excite.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - D:\ComputerNotes\RoboFormData\TB71\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - D:\ComputerNotes\RoboFormData\TB71\roboform.dll
O3 - Toolbar: Foxit Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: &Linkman - {5C9DCA26-CEC4-4280-A831-D622D4DBF113} - C:\PROGRA~1\Linkman\LINKMA~1.DLL
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [FinePrint Dispatcher v5] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe" /source=HKLM
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKCU\..\Run: [WallpaperChanger] C:\Program Files\Wallpaper Master\Wallpaper.exe
O4 - HKCU\..\Run: [TakeABreak] C:\Program Files\My Rest Break\MyRestBreak.exe
O4 - HKCU\..\Run: [RoboForm] "D:\ComputerNotes\RoboFormData\TB71\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: File-Ex.lnk = C:\Program Files\File-Ex 3\FileEx.exe
O4 - Startup: ShutDownPro.lnk = C:\Program Files\ShutDownPro\ShutDownPro.EXE
O8 - Extra context menu item: >Search in Linkman - file://D:\My Documents\Linkman\iescript_search.htm
O8 - Extra context menu item: Add to Linkman - file://D:\My Documents\Linkman\iescript_add.htm
O8 - Extra context menu item: Add to Linkman (all tabs) - file://D:\My Documents\Linkman\iescript_addall.htm
O8 - Extra context menu item: Add to Linkman and Edit - file://D:\My Documents\Linkman\iescript_edit.htm
O8 - Extra context menu item: Add to WebSite-Watcher - C:\Documents and Settings\Eric\Application Data\aignes\WebSite-Watcher\config\settings\wswie.htm
O8 - Extra context menu item: Customize Menu - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Fill Forms - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComSavePass.html
O8 - Extra context menu item: Show Linkman - file://D:\My Documents\Linkman\iescript_show.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\ComputerNotes\RoboFormData\TB71\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate1c9cb83eecd96d8) (gupdate1c9cb83eecd96d8) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: iolo System Service (ioloSystemService) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 9355 bytes


----------



## Cookiegal (Aug 27, 2003)

Close all other windows, rescan with HijackThis and put a check mark beside these entries then press "Fix Checked".

O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll

Then delete this folder:C:\Program Files\*AskBarDis*

Here are some final instructions for you.

*Follow these steps to uninstall Combofix and all of its files and components.*

 Click *START* then *RUN*
 Now type *ComboFix /u* in the runbox and click *OK*. Note the *space* between the *X* and the *U*, it needs to be there.









Now you should turn system restore off to flush out all previous system restore points, then turn it back on and create a new restore point:

To turn off system restore, on the Desktop, right click on *My Computer* and click on *Properties.*
Click the *System Restore* tab.
Check *Turn off System Restore.*
Click Apply and then click OK.

Restart your computer, turn System Restore back on and create a restore point.

To create a new restore point, click on *Start*  *All Programs*  *Accessories*  *System Tools* and then select *System Restore*.

In the System Restore wizard, select *Create a restore point* and click the Next button.

Type a name for your new restore point then click on Create.

I also recommend downloading  *SPYWAREBLASTER* for added protection.

*Read here* for info on how to tighten your security.


----------



## NijimaSan (Jun 19, 2009)

I did what you said, but there was no ComboFix program to uninstall. All that was left under that name were a couple of text files.

I installed SpywareBlaster, but left one cookie unprotected (Excite) since it is the site of my home page.

I am currently going through the information on tightening my security.


----------



## Cookiegal (Aug 27, 2003)

OK, thanks for the update.


----------

