# Please Help: MS Removal Tool Warning and ccsetmgr.exe Errors



## itrocks4u (Nov 27, 2004)

Hi,

I'm not sure what's wrong with my computer but it has closed all my applications down. I tried running Hijack this as well as the TSG SysInfo but none of them work. It gives me an error that "Application cannot be executed. The file SysInfo[1].exe is infected when I try to run the TSG sysinfo file. Is there any other way to run this?

It's giving me errors related to "MS Removal Tool Warning" etc. items related to ccsetmgr.exe. Half the items are not opening on the computer anymore.

I'm not sure how to proced from here or how I can make it run better.

Please help.

---------------

Update: Was able to run the above files in Safe Mode. However, I was not able to install the latest version of Hijack This. The last version installed on my computer was 2.0.2, so let me know if that helps. Below are both the printouts:

TSG SysInfo:

Tech Support Guy System Info Utility version 1.0.0.1
OS Version: Microsoft Windows XP Home Edition, Service Pack 3, 32 bit
Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz, x86 Family 15 Model 3 Stepping 4
Processor Count: 1
RAM: 1022 Mb
Graphics Card: NVIDIA GeForce 6200 , 1 Mb
Hard Drives: C: Total - 4611 MB, Free - 2402 MB; D: Total - 71696 MB, Free - 3221 MB; H: Total - 476937 MB, Free - 226430 MB; 
Motherboard: Intel Corporation , D865GBF , AAC28140-406 , BQBF41401900 
Antivirus: Symantec AntiVirus Corporate Edition, Updated: Yes, On-Demand Scanner: Enabled

HiJack This Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:57:12 AM, on 09/04/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Safe mode

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\Documents and Settings\Ours\Desktop\Salman\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - Default URLSearchHook is missing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: BrowserHelper Class - {9A065C65-4EE7-4DDD-9918-F129089A894A} - D:\Program Files\Windows Home Server\WHSDeskBands.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - D:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Home Server Banner - {D73E76A3-F902-45BD-8FC8-95AE8E014671} - D:\Program Files\Windows Home Server\WHSDeskBands.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - D:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [SoundMAXPnP] D:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [Lexmark 2200 Series] "D:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "D:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [Microsoft Works Update Detection] D:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [CloudPlugin] "D:\Program Files\IMT Labs Messenger Plugin\Cloud.exe"
O4 - HKLM\..\Run: [RemoteControl] "D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SsAAD.exe] D:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [Athan] D:\Program Files\Athan\Athan.exe
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] D:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [HP Software Update] D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] D:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [nwiz] D:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "H:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WDDMStatus.lnk = D:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O16 - DPF: {983A9C21-8207-4B58-BBB8-0EBC3D7C5505} (Domino Web Access 8 Control) - http://beowulf.schulich.yorku.ca/dwa8W.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Unknown owner - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - D:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - D:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - D:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Update Service (gupdate1ca597c7db22888) (gupdate1ca597c7db22888) - Google Inc. - D:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - D:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - D:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - H:\Program Files\EA Games\Need for Speed Undercover\PB\PnkBstrA.exe
O23 - Service: SAVRoam (SavRoam) - symantec - D:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Sunbelt CounterSpy Antispyware (SBCSSvc) - Unknown owner - D:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - D:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TVersityMediaServer - Unknown owner - H:\Program Files\TVersity\Media Server\MediaServer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - D:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WDDMService - WDC - D:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe

--
End of file - 11056 bytes


----------



## Cookiegal (Aug 27, 2003)

Please run the following on-line scanner:

http://www.eset.com/online-scanner

Accept the Terms of Use and then press the Start button

Allow the ActiveX control to be installed.

Put a check by Remove found threats and then run the scan.

When the scan is finished, you will see the results in a window.

A log.txt file is created here: C:\Program Files\EsetOnlineScanner\log.txt.

Open the log file with Notepad and copy and paste the contents here please.


----------



## itrocks4u (Nov 27, 2004)

Here you go:


[email protected] as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6425
# api_version=3.0.2
# EOSSerial=f831eaca32abe247949b2ff11e5c00b6
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-04-10 10:16:06
# local_time=2011-04-10 06:16:06 (-0500, Eastern Daylight Time)
# country="Canada"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=256 16777215 100 0 0 0 0 0
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=6143 16777215 0 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# compatibility_mode=9217 16777214 75 67 20119130 86744332 0 0
# scanned=205598
# found=47
# cleaned=47
# scan_time=8583
D:\Documents and Settings\Ours\Application Data\Sun\Java\Deployment\cache\6.0\59\1baeccbb-5b54363b	probably a variant of Win32/Agent.RPSVWU trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\Documents and Settings\Ours\Application Data\Sun\Java\Deployment\cache\6.0\9\36c06809-368f95f4	probably a variant of Win32/Agent.RPSVWU trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\Documents and Settings\Ours\Desktop\Spyware\winpfind3u\WinPFind3u\MovedFiles\Documents and Settings\Ours\Desktop\Live Safety Center.lnk	Win32/Adware.SecToolbar application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\Documents and Settings\Ours\Desktop\Spyware\winpfind3u\WinPFind3u\MovedFiles\Documents and Settings\Ours\Desktop\Online Security Guide.lnk	Win32/Adware.SecToolbar application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\Documents and Settings\Ours\Desktop\Spyware\winpfind3u\WinPFind3u\MovedFiles\WINDOWS\SYSTEM32\grbminsu.ini	Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\Documents and Settings\Ours\Desktop\Spyware\winpfind3u\WinPFind3u\MovedFiles\WINDOWS\SYSTEM32\pdsuwubd.ini	Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\Documents and Settings\Ours\Desktop\Spyware\winpfind3u\WinPFind3u\MovedFiles\WINDOWS\SYSTEM32\qbipmkok.ini	Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\Documents and Settings\Ours\Desktop\Spyware\winpfind3u\WinPFind3u\MovedFiles\WINDOWS\SYSTEM32\vjtiusvw.ini	Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\Documents and Settings\Ours\DoctorWeb\Quarantine\BSINSTALL.exe	Win32/Adware.180Solutions application (deleted - quarantined)	00000000000000000000000000000000	C
D:\Documents and Settings\Ours\DoctorWeb\Quarantine\BSINSTALL1.exe	Win32/Adware.180Solutions application (deleted - quarantined)	00000000000000000000000000000000	C
D:\Documents and Settings\Ours\DoctorWeb\Quarantine\BSINSTALLnew.exe	Win32/Adware.SaveNow application (deleted - quarantined)	00000000000000000000000000000000	C
D:\Documents and Settings\Ours\DoctorWeb\Quarantine\waterfalls1awfree.exe	multiple threats (deleted - quarantined)	00000000000000000000000000000000	C
D:\Documents and Settings\Ours\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\f_000731	a variant of Win32/Kryptik.MKY trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\Documents and Settings\Ours\My Documents\Downloads\BestAntivirus2011 (1).exe	a variant of Win32/Kryptik.MKY trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\Documents and Settings\Ours\My Documents\Downloads\BestAntivirus2011 (10).exe	a variant of Win32/Kryptik.MKY trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\Documents and Settings\Ours\My Documents\Downloads\BestAntivirus2011 (11).exe	a variant of Win32/Kryptik.MKY trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\Documents and Settings\Ours\My Documents\Downloads\BestAntivirus2011 (2).exe	a variant of Win32/Kryptik.MKY trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\Documents and Settings\Ours\My Documents\Downloads\BestAntivirus2011 (3).exe	a variant of Win32/Kryptik.MKY trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\Documents and Settings\Ours\My Documents\Downloads\BestAntivirus2011 (4).exe	a variant of Win32/Kryptik.MKY trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\Documents and Settings\Ours\My Documents\Downloads\BestAntivirus2011 (5).exe	a variant of Win32/Kryptik.MKY trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\Documents and Settings\Ours\My Documents\Downloads\BestAntivirus2011 (6).exe	a variant of Win32/Kryptik.MKY trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\Documents and Settings\Ours\My Documents\Downloads\BestAntivirus2011 (7).exe	a variant of Win32/Kryptik.MKY trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\Documents and Settings\Ours\My Documents\Downloads\BestAntivirus2011 (8).exe	a variant of Win32/Kryptik.MKY trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\Documents and Settings\Ours\My Documents\Downloads\BestAntivirus2011.exe	a variant of Win32/Kryptik.MKY trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\qoobox\Quarantine\D\Documents and Settings\Administrator\Favorites\Online Security Guide.lnk.vir	Win32/Adware.SecToolbar application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\qoobox\Quarantine\D\Documents and Settings\All Users\Application Data\nLd24500kNeCe24500\nLd24500kNeCe24500.exe.vir	a variant of Win32/Kryptik.MKY trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\qoobox\Quarantine\D\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk.vir	Win32/Adware.SecToolbar application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\qoobox\Quarantine\D\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk.vir	Win32/Adware.SecToolbar application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\qoobox\Quarantine\D\Documents and Settings\Ours\Desktop\Live Safety Center.lnk.vir	Win32/Adware.SecToolbar application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\qoobox\Quarantine\D\Documents and Settings\Ours\Desktop\Online Security Guide.lnk.vir	Win32/Adware.SecToolbar application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\qoobox\Quarantine\D\Documents and Settings\Ours\Favorites\Online Security Guide.lnk.vir	Win32/Adware.SecToolbar application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\qoobox\Quarantine\D\WINDOWS\system32\ttstv.bak1.vir	Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\qoobox\Quarantine\D\WINDOWS\system32\ttstv.bak2.vir	Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\qoobox\Quarantine\D\WINDOWS\system32\ttstv.ini.vir	Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{3CB65C08-9A07-4357-AA5E-2FCC6CA398D8}\RP689\A0084908.exe	a variant of Win32/Kryptik.MKY trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{3CB65C08-9A07-4357-AA5E-2FCC6CA398D8}\RP691\A0085086.lnk	Win32/Adware.SecToolbar application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{3CB65C08-9A07-4357-AA5E-2FCC6CA398D8}\RP691\A0085087.lnk	Win32/Adware.SecToolbar application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{3CB65C08-9A07-4357-AA5E-2FCC6CA398D8}\RP691\A0085088.ini	Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{3CB65C08-9A07-4357-AA5E-2FCC6CA398D8}\RP691\A0085089.ini	Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{3CB65C08-9A07-4357-AA5E-2FCC6CA398D8}\RP691\A0085090.ini	Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{3CB65C08-9A07-4357-AA5E-2FCC6CA398D8}\RP691\A0085091.ini	Win32/Adware.Virtumonde.NEO application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{3CB65C08-9A07-4357-AA5E-2FCC6CA398D8}\RP691\A0085092.exe	Win32/Adware.180Solutions application (deleted - quarantined)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{3CB65C08-9A07-4357-AA5E-2FCC6CA398D8}\RP691\A0085093.exe	Win32/Adware.180Solutions application (deleted - quarantined)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{3CB65C08-9A07-4357-AA5E-2FCC6CA398D8}\RP691\A0085094.exe	Win32/Adware.SaveNow application (deleted - quarantined)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{3CB65C08-9A07-4357-AA5E-2FCC6CA398D8}\RP691\A0085095.exe	multiple threats (deleted - quarantined)	00000000000000000000000000000000	C
D:\WINDOWS\system32\Kaspersky Lab\Kaspersky On-line Scanner\kavuninstall.exe	probably a variant of Win32/Agent.MRUGBEH trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
H:\Music\Incomplete\T-5190700-sajni new cover version.mp3	a variant of WMA/TrojanDownloader.GetCodec.gen trojan (cleaned - quarantined)	00000000000000000000000000000000	C


----------



## Cookiegal (Aug 27, 2003)

Please visit *Combofix Guide & Instructions * for instructions for installing the recovery console and downloading and running ComboFix.

The only thing different from the instructions there is that when downloading and saving the ComboFix.exe I would like you to rename it to puppy.exe please.

Post the log from ComboFix when you've accomplished that along with a new HijackThis log.

Important notes regarding ComboFix:

ComboFix may reset a number of Internet Explorer's settings, including making it the default browser. This can easily be changed once we're finished.

ComboFix also prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you, please let me know. This can be undone manually when we're finished. Read  *HERE * for an article written by dvk01 on why we disable autoruns.


----------



## itrocks4u (Nov 27, 2004)

Done! Mind if i ask why we changed the name of the file to puppy.exe?

As requested - ComboFix.txt log followed by HJT log:

ComboFix 11-04-11.02 - Ours 12/04/2011 0:15.6.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.305 [GMT -4:00]
Running from: d:\documents and settings\Ours\Desktop\puppy.exe
AV: Symantec AntiVirus Corporate Edition *Disabled/Updated* {FB06448E-52B8-493A-90F3-E43226D3305C}
FW: ZoneAlarm Firewall *Disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.
.
((((((((((((((((((((((((( Files Created from 2011-03-12 to 2011-04-12 )))))))))))))))))))))))))))))))
.
.
2011-04-10 03:11 . 2011-04-10 03:11	--------	d-----w-	d:\documents and settings\Administrator\Local Settings\Application Data\Google
2011-04-09 07:59 . 2011-04-09 07:59	--------	d-----w-	d:\documents and settings\Administrator\Local Settings\Application Data\Adobe
2011-04-09 07:25 . 2011-04-09 07:25	--------	d-----w-	d:\documents and settings\Administrator\Local Settings\Application Data\Symantec
2011-04-09 07:23 . 2011-04-09 07:23	--------	d-----w-	d:\documents and settings\Administrator\Application Data\Malwarebytes
2011-04-09 07:22 . 2011-04-09 07:22	--------	d-sh--w-	d:\documents and settings\Administrator\IETldCache
2011-03-24 04:20 . 2011-03-24 05:45	--------	d-----w-	d:\documents and settings\Ours\Local Settings\Application Data\AirVideoServer
2011-03-21 02:33 . 2011-03-21 02:33	--------	d-----w-	d:\program files\Western Digital
2011-03-21 02:32 . 2011-03-21 02:32	--------	d-----w-	d:\documents and settings\Ours\Local Settings\Application Data\Western Digital
2011-03-19 00:07 . 2011-03-19 01:36	--------	d-----w-	d:\documents and settings\Ours\Application Data\SmartDraw
2011-03-18 23:57 . 2011-03-18 23:58	--------	d-----w-	d:\program files\SmartDraw VP
2011-03-13 20:45 . 2011-03-13 20:45	--------	d-----w-	d:\documents and settings\Ours\fontconfig
2011-03-13 06:30 . 2009-07-07 01:57	49904	----a-r-	d:\windows\system32\drivers\BVRPMPR5.SYS
2011-03-13 06:29 . 2011-03-13 06:49	--------	d-----w-	D:\Netgear
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-09 13:53 . 2002-08-29 12:00	270848	----a-w-	d:\windows\system32\sbe.dll
2011-02-09 13:53 . 2002-08-29 12:00	186880	----a-w-	d:\windows\system32\encdec.dll
2011-02-02 07:58 . 2004-10-16 02:57	2067456	----a-w-	d:\windows\system32\mstscax.dll
2011-01-27 11:57 . 2004-10-16 02:57	677888	----a-w-	d:\windows\system32\mstsc.exe
2011-01-21 14:44 . 2002-08-29 12:00	439296	----a-w-	d:\windows\system32\shimgvw.dll
2009-02-24 19:34 . 2009-02-24 19:34	1044480	----a-w-	d:\program files\mozilla firefox\plugins\libdivx.dll
2009-02-24 19:34 . 2009-02-24 19:34	200704	----a-w-	d:\program files\mozilla firefox\plugins\ssldivx.dll
2007-06-26 03:18 . 2006-04-24 02:44	61038	----a-w-	d:\program files\mozilla firefox\components\jar50.dll
2007-06-26 03:18 . 2006-04-24 02:44	49256	----a-w-	d:\program files\mozilla firefox\components\jsd3250.dll
2007-06-26 03:18 . 2006-04-24 02:44	166000	----a-w-	d:\program files\mozilla firefox\components\xpinstal.dll
.
.
((((((((((((((((((((((((((((( [email protected]_04.06.35 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-04-12 01:00 . 2011-04-12 01:00	16384 d:\windows\temp\Perflib_Perfdata_408.dat
+ 2011-04-10 04:27 . 2011-02-02 22:11	222080 d:\windows\system32\MpSigStub.exe
+ 2011-04-10 04:20 . 2011-04-10 04:20	1155072 d:\windows\Installer\69fc0.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="d:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-17 3872080]
"Creative Detector"="d:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400]
"swg"="d:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-23 39408]
"Google Update"="d:\documents and settings\Ours\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-03-19 136176]
"AirVideoServer"="h:\program files\AirVideoServer\AirVideoServer.exe" [2010-09-22 4923784]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="d:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-05-29 790528]
"Lexmark 2200 Series"="d:\program files\Lexmark 2200 Series\lxbvbmgr.exe" [2004-02-13 57344]
"FaxCenterServer"="d:\program files\Lexmark Fax Solutions\fm3032.exe" [2004-02-04 294912]
"Microsoft Works Update Detection"="d:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-07 50688]
"CloudPlugin"="d:\program files\IMT Labs Messenger Plugin\Cloud.exe" [2005-01-26 81920]
"RemoteControl"="d:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-03 32768]
"SsAAD.exe"="d:\progra~1\Sony\SONICS~1\SsAAD.exe" [2005-01-25 81920]
"Athan"="d:\program files\Athan\Athan.exe" [2007-09-06 1003520]
"NeroFilterCheck"="d:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"ZoneAlarm Client"="d:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"ccApp"="d:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-07-20 52896]
"vptray"="d:\progra~1\SYMANT~1\VPTray.exe" [2006-09-28 125168]
"HP Software Update"="d:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 49152]
"AppleSyncNotifier"="d:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-22 47904]
"Adobe Reader Speed Launcher"="d:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792]
"SunJavaUpdateSched"="d:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"nwiz"="d:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-07-08 1753192]
"NvMediaCenter"="d:\windows\system32\NvMcTray.dll" [2010-07-09 110696]
"NvCplDaemon"="d:\windows\system32\NvCpl.dll" [2010-07-09 13923432]
"QuickTime Task"="d:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"iTunesHelper"="h:\program files\iTunes\iTunesHelper.exe" [2011-01-25 421160]
.
d:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - d:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
WDDMStatus.lnk - d:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe [2010-9-8 5185536]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ autocheck autochk *\0SsiEfr.e
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBCSSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Post-it® Software Notes Lite.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\Post-it® Software Notes Lite.lnk
backup=d:\windows\pss\Post-it® Software Notes Lite.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=d:\windows\pss\WinZip Quick Pick.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
2005-02-04 23:32	135168	----a-w-	d:\program files\Picasa2\PicasaMediaDetector.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
2005-08-19 23:34	3084288	----a-w-	d:\program files\Yahoo!\Messenger\ypager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\uTorrent\\uTorrent.exe"=
"d:\\Program Files\\Windows Home Server\\Discovery.exe"=
"h:\\Program Files\\TVersity\\Media Server\\MediaServer.exe"=
"h:\\Program Files\\TVersity\\Media Server\\MShare.exe"=
"d:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"d:\\Documents and Settings\\Ours\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"d:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"d:\\Program Files\\Messenger\\msmsgs.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"d:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"h:\\Program Files\\iTunes\\iTunes.exe"=
"h:\\Program Files\\Research In Motion\\BlackBerry Desktop\\Rim.Desktop.exe"=
"\\\\MyBookLive\\Public\\Software\\AirVideoServer\\AirVideoServer.exe"=
"h:\\Program Files\\AirVideoServer\\AirVideoServer.exe"=
"d:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R0 sptd;sptd;d:\windows\system32\drivers\sptd.sys [07/05/2006 3:39 PM 642560]
R2 eusk2par;EUTRON SmartKey Parallel Driver;d:\windows\system32\drivers\eusk2par.sys [07/06/2005 11:34 PM 16695]
R2 Vcs;Vcs support;d:\windows\system32\drivers\Vcs.sys [17/04/2005 5:33 PM 6852]
R2 WDDMService;WDDMService;d:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [08/09/2010 10:41 AM 237056]
R2 WHSConnector;Windows Home Server Connector Service;d:\program files\Windows Home Server\WHSConnector.exe [06/09/2007 6:53 PM 302112]
R2 WinDefend;Windows Defender;d:\program files\Windows Defender\MsMpEng.exe [03/11/2006 7:19 PM 13592]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;d:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [28/05/2010 4:14 PM 102448]
S2 gupdate1ca597c7db22888;Google Update Service (gupdate1ca597c7db22888);d:\program files\Google\Update\GoogleUpdate.exe [30/10/2009 12:17 PM 133104]
S3 ALSysIO;ALSysIO;\??\d:\docume~1\Ours\LOCALS~1\Temp\ALSysIO.sys --> d:\docume~1\Ours\LOCALS~1\Temp\ALSysIO.sys [?]
S3 cpuz129;cpuz129;\??\d:\docume~1\Ours\LOCALS~1\Temp\cpuz_x32.sys --> d:\docume~1\Ours\LOCALS~1\Temp\cpuz_x32.sys [?]
S3 JL2005;JL2005A Toy Camera;d:\windows\system32\drivers\toywdm.sys [04/06/2004 1:21 PM 70888]
S3 SavRoam;SAVRoam;d:\program files\Symantec AntiVirus\SavRoam.exe [27/09/2006 9:33 PM 116464]
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-05 d:\windows\Tasks\AppleSoftwareUpdate.job
- d:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
.
2011-04-12 d:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- d:\program files\Google\Update\GoogleUpdate.exe [2009-10-30 16:17]
.
2011-04-12 d:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- d:\program files\Google\Update\GoogleUpdate.exe [2009-10-30 16:17]
.
2011-04-10 d:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1078081533-287218729-725345543-1004Core.job
- d:\documents and settings\Ours\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-08-26 05:03]
.
2011-04-12 d:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1078081533-287218729-725345543-1004UA.job
- d:\documents and settings\Ours\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-08-26 05:03]
.
2011-04-12 d:\windows\Tasks\MP Scheduled Scan.job
- d:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 23:20]
.
2011-04-12 d:\windows\Tasks\SDMsgUpdate (TE).job
- h:\progra~1\SMARTD~1\Messages\SDNotify.exe [2011-03-19 17:29]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Download with Download Accelerator Lite - d:\program files\Download Accelerator Lite\dal.htm
IE: Google Sidewiki... - d:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
DPF: DirectAnimation Java Classes - file://d:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://d:\windows\Java\classes\xmldso.cab
FF - ProfilePath - d:\documents and settings\Ours\Application Data\Mozilla\Firefox\Profiles\s0mrbavn.default\
FF - prefs.js: browser.search.selectedEngine - Google
.
.
------- File Associations -------
.
.scr=AutoCADScriptFile
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-Kaspersky On-line Scanner - d:\windows\System32\KASPER~1\KASPER~1\kavuninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-12 00:28
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
AirVideoServer = h:\program files\AirVideoServer\AirVideoServer.exe? 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1078081533-287218729-725345543-1004\Software\SecuROM\License information*]
"datasecu"=hex:c1,0c,b4,7c,8e,34,cc,da,07,e4,66,9e,b3,d0,08,44,d3,20,74,be,7e,
ca,56,f6,e4,32,db,67,f3,6e,ad,90,bd,65,2c,8c,52,55,34,55,10,b8,d9,c1,8d,7b,\
"rkeysecu"=hex:24,97,3a,90,3f,ce,3b,d4,da,0a,a0,9b,e2,13,5e,14
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(716)
d:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(1940)
d:\windows\system32\WININET.dll
d:\program files\IMT Labs Messenger Plugin\CloudH1.dll
d:\windows\system32\ieframe.dll
d:\windows\system32\webcheck.dll
d:\windows\system32\WPDShServiceObj.dll
d:\windows\system32\PortableDeviceTypes.dll
d:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2011-04-12 00:32:27
ComboFix-quarantined-files.txt 2011-04-12 04:32
ComboFix2.txt 2011-04-10 04:10
ComboFix3.txt 2009-01-27 03:48
ComboFix4.txt 2007-11-13 16:31
.
Pre-Run: 4,619,632,640 bytes free
Post-Run: 4,595,564,544 bytes free
.
Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 3135DCBAE11D5FBD3E4EF461BD20CE20

----------------------------------------------

Hijack This Log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:49:40 AM, on 12/04/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Windows Defender\MsMpEng.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\LEXBCES.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\LEXPPS.EXE
D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
D:\WINDOWS\System32\CTsvcCDA.exe
D:\Program Files\Symantec AntiVirus\DefWatch.exe
D:\Program Files\Java\jre6\bin\jqs.exe
H:\Program Files\EA Games\Need for Speed Undercover\PB\PnkBstrA.exe
D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Symantec AntiVirus\Rtvscan.exe
D:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
D:\Program Files\Windows Home Server\WHSConnector.exe
D:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
D:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe
D:\Program Files\Lexmark 2200 Series\lxbvbmon.exe
D:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
D:\Program Files\IMT Labs Messenger Plugin\Cloud.exe
D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
D:\Program Files\Common Files\Symantec Shared\ccApp.exe
D:\PROGRA~1\SYMANT~1\VPTray.exe
D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
D:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
D:\Program Files\Common Files\Java\Java Update\jusched.exe
D:\WINDOWS\system32\RUNDLL32.EXE
H:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\Windows Defender\MSASCui.exe
D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\wscntfy.exe
D:\WINDOWS\explorer.exe
D:\Program Files\Google\Chrome\Application\chrome.exe
D:\Program Files\Google\Chrome\Application\chrome.exe
D:\Program Files\Google\Chrome\Application\chrome.exe
D:\WINDOWS\system32\msiexec.exe
H:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\Internet Explorer\iexplore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
N3 - Netscape 7: # Mozilla User Preferences

/* Do not edit this file.
*
* If you make changes to this file while the browser is running,
* the changes will be overwritten when the browser exits.
*
* To make a manual change to preferences, you can visit the URL about:config
* For more information, see http://www.mozilla.org/unix/customizing.html#prefs
*/

user_pref("__000.aim.general.im.enterCR", false);
user_pref("__000.aim.general.im.tabKey", false);
user_pref("__000.aim.general.im.timeStamp", false);
user_pref("__sys.aim.filexfer.location", "");
user_pref("__sys.aim.general.im.enterCR", false);
user_pref("__sys.aim.general.im.smilies", false);
user_pref("__sys.aim.general.im.tabKey", false);
user_pref("__sys.aim.general.im.timeStamp", false);
user_pref("__sys.aim.general.snsautosignon", false);
user_pref("__sys.aim.general.today", false);
user_pref("aim.session.firsttime", false);
user_pref("browser.activation.checkedNNFlag", true);
user_pref("browser.bookmarks.added_static_root", true);
user_pref("
N3 - Netscape 7: # Mozilla User Preferences

/* Do not edit this file.
*
* If you make changes to this file while the browser is running,
* the changes will be overwritten when the browser exits.
*
* To make a manual change to preferences, you can visit the URL about:config
* For more information, see http://www.mozilla.org/unix/customizing.html#prefs
*/

user_pref("__000.aim.general.im.enterCR", false);
user_pref("__000.aim.general.im.tabKey", false);
user_pref("__000.aim.general.im.timeStamp", false);
user_pref("__sys.aim.filexfer.location", "");
user_pref("__sys.aim.general.im.enterCR", false);
user_pref("__sys.aim.general.im.smilies", false);
user_pref("__sys.aim.general.im.tabKey", false);
user_pref("__sys.aim.general.im.timeStamp", false);
user_pref("__sys.aim.general.snsautosignon", false);
user_pref("__sys.aim.general.today", false);
user_pref("aim.session.firsttime", false);
user_pref("browser.activation.checkedNNFlag", true);
user_pref("browser.bookmarks.added_static_root", true);
user_pref("
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: BrowserHelper Class - {9A065C65-4EE7-4DDD-9918-F129089A894A} - D:\Program Files\Windows Home Server\WHSDeskBands.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - D:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Home Server Banner - {D73E76A3-F902-45BD-8FC8-95AE8E014671} - D:\Program Files\Windows Home Server\WHSDeskBands.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - D:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [SoundMAXPnP] D:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [Lexmark 2200 Series] "D:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "D:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [Microsoft Works Update Detection] D:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [CloudPlugin] "D:\Program Files\IMT Labs Messenger Plugin\Cloud.exe"
O4 - HKLM\..\Run: [RemoteControl] "D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SsAAD.exe] D:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [Athan] D:\Program Files\Athan\Athan.exe
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] D:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [HP Software Update] D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] D:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [nwiz] D:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "H:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Creative Detector] "D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [swg] "D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Google Update] "D:\Documents and Settings\Ours\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [AirVideoServer] H:\Program Files\AirVideoServer\AirVideoServer.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WDDMStatus.lnk = D:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
O8 - Extra context menu item: &Download with Download Accelerator Lite - D:\Program Files\Download Accelerator Lite\dal.htm
O8 - Extra context menu item: Google Sidewiki... - res://D:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O16 - DPF: {983A9C21-8207-4B58-BBB8-0EBC3D7C5505} (Domino Web Access 8 Control) - http://beowulf.schulich.yorku.ca/dwa8W.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\System32\browseui.dll
O23 - Service: Adobe LM Service - Unknown owner - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - D:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - D:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - D:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Update Service (gupdate1ca597c7db22888) (gupdate1ca597c7db22888) - Google Inc. - D:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - D:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - D:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - H:\Program Files\EA Games\Need for Speed Undercover\PB\PnkBstrA.exe
O23 - Service: SAVRoam (SavRoam) - symantec - D:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Sunbelt CounterSpy Antispyware (SBCSSvc) - Unknown owner - D:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - D:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TVersityMediaServer - Unknown owner - H:\Program Files\TVersity\Media Server\MediaServer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - D:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WDDMService - WDC - D:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe

--
End of file - 16415 bytes


----------



## Cookiegal (Aug 27, 2003)

You ran ComboFix twice so I need to see this log please.

C:\qoobox\ComboFix2.txt


----------



## itrocks4u (Nov 27, 2004)

ComboFix 11-04-07.08 - Ours 09/04/2011 23:51:40.5.1 - x86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.776 [GMT -4:00]
Running from: d:\documents and settings\Ours\Desktop\Spyware\ComboFix.exe
AV: Symantec AntiVirus Corporate Edition *Enabled/Updated* {FB06448E-52B8-493A-90F3-E43226D3305C}
FW: ZoneAlarm Firewall *Enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\advpack.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\dxtmsft.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\dxtrans.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\extmgr.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\icardie.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\ie4uinit.exe
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\ieakeng.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\ieaksie.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\ieakui.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\ieapfltr.dat
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\ieapfltr.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\iedkcs32.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\ieframe.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\ieframe.dll.mui
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\iernonce.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\iertutil.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\ieudinit.exe
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\iexplore.exe
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\inetcpl.cpl
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\jsproxy.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\msfeeds.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\msfeedsbs.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\mshtml.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\mshtmled.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\msrating.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\mstime.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\occache.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\pngfilt.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\url.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\urlmon.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\webcheck.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2GDR\wininet.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\advpack.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\dxtmsft.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\dxtrans.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\extmgr.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\icardie.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\ie4uinit.exe
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\ieakeng.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\ieaksie.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\ieakui.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\ieapfltr.dat
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\ieapfltr.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\iedkcs32.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\ieframe.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\ieframe.dll.mui
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\iernonce.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\iertutil.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\ieudinit.exe
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\iexplore.exe
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\inetcpl.cpl
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\jsproxy.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\msfeeds.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\msfeedsbs.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\mshtml.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\mshtmled.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\msrating.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\mstime.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\occache.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\pngfilt.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\url.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\urlmon.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\webcheck.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\SP2QFE\wininet.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\update\spcustom.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\update\update.exe
d:\docume~1\Ours\LOCALS~1\Temp\IE7363.tmp\update\updspapi.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\advpack.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\dxtmsft.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\dxtrans.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\extmgr.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\icardie.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\ie4uinit.exe
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\ieakeng.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\ieaksie.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\ieakui.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\ieapfltr.dat
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\ieapfltr.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\iedkcs32.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\ieframe.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\ieframe.dll.mui
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\iernonce.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\iertutil.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\ieudinit.exe
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\iexplore.exe
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\inetcpl.cpl
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\jsproxy.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\msfeeds.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\msfeedsbs.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\mshtml.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\mshtmled.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\msrating.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\mstime.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\occache.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\pngfilt.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\url.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\urlmon.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\webcheck.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2GDR\wininet.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\advpack.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\dxtmsft.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\dxtrans.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\extmgr.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\icardie.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\ie4uinit.exe
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\ieakeng.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\ieaksie.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\ieakui.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\ieapfltr.dat
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\ieapfltr.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\iedkcs32.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\ieframe.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\ieframe.dll.mui
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\iernonce.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\iertutil.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\ieudinit.exe
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\iexplore.exe
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\inetcpl.cpl
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\jsproxy.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\msfeeds.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\msfeedsbs.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\mshtml.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\mshtmled.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\msrating.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\mstime.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\occache.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\pngfilt.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\url.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\urlmon.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\webcheck.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\SP2QFE\wininet.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\update\spcustom.dll
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\update\update.exe
d:\docume~1\Ours\LOCALS~1\Temp\IE73C6.tmp\update\updspapi.dll
d:\documents and settings\All Users\Application Data\nLd24500kNeCe24500
d:\documents and settings\All Users\Application Data\nLd24500kNeCe24500\nLd24500kNeCe24500
d:\documents and settings\All Users\Application Data\nLd24500kNeCe24500\nLd24500kNeCe24500.exe
d:\documents and settings\All Users\Application Data\Setup
d:\documents and settings\All Users\Application Data\Setup\setup.ini
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\advpack.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\dxtmsft.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\dxtrans.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\extmgr.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\icardie.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\ie4uinit.exe
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\ieakeng.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\ieaksie.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\ieakui.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\ieapfltr.dat
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\ieapfltr.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\iedkcs32.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\ieframe.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\ieframe.dll.mui
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\iernonce.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\iertutil.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\ieudinit.exe
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\iexplore.exe
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\inetcpl.cpl
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\jsproxy.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\msfeeds.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\msfeedsbs.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\mshtml.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\mshtmled.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\msrating.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\mstime.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\occache.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\pngfilt.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\url.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\urlmon.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\webcheck.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2GDR\wininet.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\advpack.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\dxtmsft.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\dxtrans.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\extmgr.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\icardie.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\ie4uinit.exe
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\ieakeng.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\ieaksie.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\ieakui.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\ieapfltr.dat
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\ieapfltr.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\iedkcs32.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\ieframe.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\ieframe.dll.mui
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\iernonce.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\iertutil.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\ieudinit.exe
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\iexplore.exe
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\inetcpl.cpl
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\jsproxy.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\msfeeds.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\msfeedsbs.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\mshtml.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\mshtmled.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\msrating.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\mstime.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\occache.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\pngfilt.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\url.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\urlmon.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\webcheck.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\SP2QFE\wininet.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\update\spcustom.dll
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\update\update.exe
d:\documents and settings\Ours\Local Settings\Temp\IE7363.tmp\update\updspapi.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\advpack.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\dxtmsft.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\dxtrans.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\extmgr.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\icardie.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\ie4uinit.exe
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\ieakeng.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\ieaksie.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\ieakui.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\ieapfltr.dat
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\ieapfltr.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\iedkcs32.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\ieframe.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\ieframe.dll.mui
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\iernonce.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\iertutil.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\ieudinit.exe
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\iexplore.exe
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\inetcpl.cpl
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\jsproxy.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\msfeeds.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\msfeedsbs.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\mshtml.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\mshtmled.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\msrating.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\mstime.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\occache.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\pngfilt.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\url.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\urlmon.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\webcheck.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2GDR\wininet.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\advpack.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\dxtmsft.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\dxtrans.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\extmgr.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\icardie.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\ie4uinit.exe
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\ieakeng.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\ieaksie.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\ieakui.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\ieapfltr.dat
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\ieapfltr.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\iedkcs32.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\ieframe.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\ieframe.dll.mui
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\iernonce.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\iertutil.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\ieudinit.exe
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\iexplore.exe
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\inetcpl.cpl
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\jsproxy.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\msfeeds.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\msfeedsbs.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\mshtml.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\mshtmled.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\msrating.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\mstime.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\occache.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\pngfilt.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\url.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\urlmon.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\webcheck.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\SP2QFE\wininet.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\update\spcustom.dll
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\update\update.exe
d:\documents and settings\Ours\Local Settings\Temp\IE73C6.tmp\update\updspapi.dll
d:\documents and settings\Ours\System
d:\documents and settings\Ours\System\win_qs8.jqx
d:\documents and settings\Ours\WINDOWS
d:\documents and settings\Ours\zlib.dll
d:\vgsvideopatchxp\vgsvideopatchxp.exe
d:\windows\patch.exe
d:\windows\system32\csrsss.exe
d:\windows\system32\s.bat
d:\windows\tempf.txt
H:\install.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-03-10 to 2011-04-10 )))))))))))))))))))))))))))))))
.
.
2011-04-10 03:11 . 2011-04-10 03:11	--------	d-----w-	d:\documents and settings\Administrator\Local Settings\Application Data\Google
2011-04-09 07:59 . 2011-04-09 07:59	--------	d-----w-	d:\documents and settings\Administrator\Local Settings\Application Data\Adobe
2011-04-09 07:25 . 2011-04-09 07:25	--------	d-----w-	d:\documents and settings\Administrator\Local Settings\Application Data\Symantec
2011-04-09 07:23 . 2011-04-09 07:23	--------	d-----w-	d:\documents and settings\Administrator\Application Data\Malwarebytes
2011-04-09 07:22 . 2011-04-09 07:22	--------	d-sh--w-	d:\documents and settings\Administrator\IETldCache
2011-03-24 04:20 . 2011-03-24 05:45	--------	d-----w-	d:\documents and settings\Ours\Local Settings\Application Data\AirVideoServer
2011-03-21 02:33 . 2011-03-21 02:33	--------	d-----w-	d:\program files\Western Digital
2011-03-21 02:32 . 2011-03-21 02:32	--------	d-----w-	d:\documents and settings\Ours\Local Settings\Application Data\Western Digital
2011-03-19 00:07 . 2011-03-19 01:36	--------	d-----w-	d:\documents and settings\Ours\Application Data\SmartDraw
2011-03-18 23:57 . 2011-03-18 23:58	--------	d-----w-	d:\program files\SmartDraw VP
2011-03-13 20:45 . 2011-03-13 20:45	--------	d-----w-	d:\documents and settings\Ours\fontconfig
2011-03-13 06:30 . 2009-07-07 01:57	49904	----a-r-	d:\windows\system32\drivers\BVRPMPR5.SYS
2011-03-13 06:29 . 2011-03-13 06:49	--------	d-----w-	D:\Netgear
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-09 13:53 . 2002-08-29 12:00	270848	----a-w-	d:\windows\system32\sbe.dll
2011-02-09 13:53 . 2002-08-29 12:00	186880	----a-w-	d:\windows\system32\encdec.dll
2011-02-02 07:58 . 2004-10-16 02:57	2067456	----a-w-	d:\windows\system32\mstscax.dll
2011-01-27 11:57 . 2004-10-16 02:57	677888	----a-w-	d:\windows\system32\mstsc.exe
2011-01-21 14:44 . 2002-08-29 12:00	439296	----a-w-	d:\windows\system32\shimgvw.dll
2009-02-24 19:34 . 2009-02-24 19:34	1044480	----a-w-	d:\program files\mozilla firefox\plugins\libdivx.dll
2009-02-24 19:34 . 2009-02-24 19:34	200704	----a-w-	d:\program files\mozilla firefox\plugins\ssldivx.dll
2007-06-26 03:18 . 2006-04-24 02:44	61038	----a-w-	d:\program files\mozilla firefox\components\jar50.dll
2007-06-26 03:18 . 2006-04-24 02:44	49256	----a-w-	d:\program files\mozilla firefox\components\jsd3250.dll
2007-06-26 03:18 . 2006-04-24 02:44	166000	----a-w-	d:\program files\mozilla firefox\components\xpinstal.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="d:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-17 3872080]
"Creative Detector"="d:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400]
"swg"="d:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-23 39408]
"Google Update"="d:\documents and settings\Ours\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-03-19 136176]
"AirVideoServer"="h:\program files\AirVideoServer\AirVideoServer.exe" [2010-09-22 4923784]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="d:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-05-29 790528]
"Lexmark 2200 Series"="d:\program files\Lexmark 2200 Series\lxbvbmgr.exe" [2004-02-13 57344]
"FaxCenterServer"="d:\program files\Lexmark Fax Solutions\fm3032.exe" [2004-02-04 294912]
"Microsoft Works Update Detection"="d:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-07 50688]
"CloudPlugin"="d:\program files\IMT Labs Messenger Plugin\Cloud.exe" [2005-01-26 81920]
"RemoteControl"="d:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-03 32768]
"SsAAD.exe"="d:\progra~1\Sony\SONICS~1\SsAAD.exe" [2005-01-25 81920]
"Athan"="d:\program files\Athan\Athan.exe" [2007-09-06 1003520]
"NeroFilterCheck"="d:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"ZoneAlarm Client"="d:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"ccApp"="d:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-07-20 52896]
"vptray"="d:\progra~1\SYMANT~1\VPTray.exe" [2006-09-28 125168]
"HP Software Update"="d:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 49152]
"AppleSyncNotifier"="d:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-22 47904]
"Adobe Reader Speed Launcher"="d:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792]
"SunJavaUpdateSched"="d:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"nwiz"="d:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-07-08 1753192]
"NvMediaCenter"="d:\windows\system32\NvMcTray.dll" [2010-07-09 110696]
"NvCplDaemon"="d:\windows\system32\NvCpl.dll" [2010-07-09 13923432]
"QuickTime Task"="d:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"iTunesHelper"="h:\program files\iTunes\iTunesHelper.exe" [2011-01-25 421160]
.
d:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - d:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
WDDMStatus.lnk - d:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe [2010-9-8 5185536]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ autocheck autochk *\0SsiEfr.e
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBCSSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Post-it® Software Notes Lite.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\Post-it® Software Notes Lite.lnk
backup=d:\windows\pss\Post-it® Software Notes Lite.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=d:\windows\pss\WinZip Quick Pick.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
2005-02-04 23:32	135168	----a-w-	d:\program files\Picasa2\PicasaMediaDetector.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
2005-08-19 23:34	3084288	----a-w-	d:\program files\Yahoo!\Messenger\ypager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\uTorrent\\uTorrent.exe"=
"d:\\Program Files\\Windows Home Server\\Discovery.exe"=
"h:\\Program Files\\TVersity\\Media Server\\MediaServer.exe"=
"h:\\Program Files\\TVersity\\Media Server\\MShare.exe"=
"d:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"d:\\Documents and Settings\\Ours\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"d:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"d:\\Program Files\\Messenger\\msmsgs.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"d:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"h:\\Program Files\\iTunes\\iTunes.exe"=
"h:\\Program Files\\Research In Motion\\BlackBerry Desktop\\Rim.Desktop.exe"=
"\\\\MyBookLive\\Public\\Software\\AirVideoServer\\AirVideoServer.exe"=
"h:\\Program Files\\AirVideoServer\\AirVideoServer.exe"=
"d:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R0 sptd;sptd;d:\windows\system32\drivers\sptd.sys [07/05/2006 3:39 PM 642560]
S2 eusk2par;EUTRON SmartKey Parallel Driver;d:\windows\system32\drivers\eusk2par.sys [07/06/2005 11:34 PM 16695]
S2 gupdate1ca597c7db22888;Google Update Service (gupdate1ca597c7db22888);d:\program files\Google\Update\GoogleUpdate.exe [30/10/2009 12:17 PM 133104]
S2 Vcs;Vcs support;d:\windows\system32\drivers\Vcs.sys [17/04/2005 5:33 PM 6852]
S2 WDDMService;WDDMService;d:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [08/09/2010 10:41 AM 237056]
S2 WHSConnector;Windows Home Server Connector Service;d:\program files\Windows Home Server\WHSConnector.exe [06/09/2007 6:53 PM 302112]
S3 ALSysIO;ALSysIO;\??\d:\docume~1\Ours\LOCALS~1\Temp\ALSysIO.sys --> d:\docume~1\Ours\LOCALS~1\Temp\ALSysIO.sys [?]
S3 cpuz129;cpuz129;\??\d:\docume~1\Ours\LOCALS~1\Temp\cpuz_x32.sys --> d:\docume~1\Ours\LOCALS~1\Temp\cpuz_x32.sys [?]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;d:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [28/05/2010 4:14 PM 102448]
S3 JL2005;JL2005A Toy Camera;d:\windows\system32\drivers\toywdm.sys [04/06/2004 1:21 PM 70888]
S3 SavRoam;SAVRoam;d:\program files\Symantec AntiVirus\SavRoam.exe [27/09/2006 9:33 PM 116464]
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-05 d:\windows\Tasks\AppleSoftwareUpdate.job
- d:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
.
2011-04-10 d:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- d:\program files\Google\Update\GoogleUpdate.exe [2009-10-30 16:17]
.
2011-04-09 d:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- d:\program files\Google\Update\GoogleUpdate.exe [2009-10-30 16:17]
.
2011-04-08 d:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1078081533-287218729-725345543-1004Core.job
- d:\documents and settings\Ours\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-08-26 05:03]
.
2011-04-10 d:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1078081533-287218729-725345543-1004UA.job
- d:\documents and settings\Ours\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-08-26 05:03]
.
2011-04-10 d:\windows\Tasks\SDMsgUpdate (TE).job
- h:\progra~1\SMARTD~1\Messages\SDNotify.exe [2011-03-19 17:29]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Download with Download Accelerator Lite - d:\program files\Download Accelerator Lite\dal.htm
IE: Google Sidewiki... - d:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
DPF: DirectAnimation Java Classes - file://d:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://d:\windows\Java\classes\xmldso.cab
FF - ProfilePath - d:\documents and settings\Ours\Application Data\Mozilla\Firefox\Profiles\s0mrbavn.default\
FF - prefs.js: browser.search.selectedEngine - Google
.
.
------- File Associations -------
.
.scr=AutoCADScriptFile
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-82A44D22-9452-49FB-00FB-CEC7DCAF7E23 - d:\program files\EA SPORTS\EA SPORTS online\EASOUNInstaller.exe
AddRemove-D2SRoBa - d:\program files\DVD2SVCD\Tylo\uninstall.exe
AddRemove-KeyRipper - d:\progra~1\DSSEVO~1.COM\KEYRIP~1\Setup.exe
AddRemove-Live Homework Help - d:\progra~1\TUTORD~1\UNWISE.EXE
AddRemove-Magic DVD Copier_is1 - d:\program files\MagicDVDCopier\unins000.exe
AddRemove-Magic DVD Ripper_is1 - d:\program files\MagicDVDRipper\unins000.exe
AddRemove-Netscape Browser - d:\program files\Netscape\Netscape Browser\NSUninst.exe
AddRemove-PartyPokerNet - d:\program files\PartyGaming.Net\PartyPokerNet\Uninstall.exe
AddRemove-RealJukebox 1.0 - d:\program files\Common Files\Real\Update_OB\r1puninst.exe
AddRemove-RealPlayer 6.0 - d:\program files\Common Files\Real\Update_OB\r1puninst.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-10 00:06
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
AirVideoServer = h:\program files\AirVideoServer\AirVideoServer.exe? 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1078081533-287218729-725345543-1004\Software\SecuROM\License information*]
"datasecu"=hex:c1,0c,b4,7c,8e,34,cc,da,07,e4,66,9e,b3,d0,08,44,d3,20,74,be,7e,
ca,56,f6,e4,32,db,67,f3,6e,ad,90,bd,65,2c,8c,52,55,34,55,10,b8,d9,c1,8d,7b,\
"rkeysecu"=hex:24,97,3a,90,3f,ce,3b,d4,da,0a,a0,9b,e2,13,5e,14
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(268)
d:\windows\system32\Ati2evxx.dll
.
Completion time: 2011-04-10 00:10:24
ComboFix-quarantined-files.txt 2011-04-10 04:10
ComboFix2.txt 2009-01-27 03:48
ComboFix3.txt 2007-11-13 16:31
.
Pre-Run: 4,016,308,224 bytes free
Post-Run: 4,563,730,432 bytes free
.
Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 00BC124543F114B9D9B6CD2AEDA99BD1


----------



## itrocks4u (Nov 27, 2004)

In addition, I had Western Digital My Book Live Network Attached Storage (NAS) connected to this computer. For some reason now it is not running. When I click on the mapped network folder it says the network path could not be found. I tried on the other computers, including ps3, and I was able to run off it once, but then it all disappeared and now I can't connect on any of the computers or ps3. 

Is this in anyway related to running ComboFix?


----------



## itrocks4u (Nov 27, 2004)

Can you please help me? I reinstalled the drivers to the drive and it started working. Restarted the computer and now its giving errors again. I have no idea how to fix this now.


----------



## Cookiegal (Aug 27, 2003)

I don't think it's related to ComboFix. What is the name of the driver file that you installed?


----------



## Cookiegal (Aug 27, 2003)

Also, please go to the following link and run TDSSKiller:

http://support.kaspersky.com/viruses/solutions?qid=208280684

Allow it cure anything if prompted.

Please post the log back here.


----------



## itrocks4u (Nov 27, 2004)

I'll run the above as soon as I'm home.

With regards to the NAS, No it didn't work after reboot. Everytime I restart, it gives me the error 'Microsoft error' that the program has closed down and whether I want to send a report to Microsoft or not (It's the usual error when something is not responding). The status device usually runs in the taskbar showing the amount I've used so far. But now it shows at 0% if the program runs. The program is located here: d:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe

the above mentioned .exe file is what needs to work but it does not work anymore. the only issue I'm having is that it was working fine until I ran the ComboFix. I'm not sure if it deleted anything or not. I tried restarting the computer, reinstalling the drivers etc. but no use. I don't know if its the hard drive (NAS) or is it this specific computer. Now it does not even run on ps3 or the other laptop I have at home (wireless connection). My main computer with the infection is the only one that I installed the hard drive on. 

Any ideas?


----------



## Cookiegal (Aug 27, 2003)

Please check to see that the WDDMService.exe file exists.

Also, please go to *Start *- *Run *- type in *eventvwr.msc* to open the event viewer. Look under both "Application" and "System" for recent (the last 48 hours or so) errors (shown in red) and if found, do this for each one.

Double-click the error to open it up and then click on the icon that looks like two pieces of paper. This will copy the full error. Then "paste" the error into Notepad. Do this for each one until you have them all listed in Notepad and then copy and paste the list in a reply here please.


----------



## itrocks4u (Nov 27, 2004)

Hi, 
In addition to the file I mentioned, WDDMStatus.exe also refers to Western Digital NAS - Sorry, I should have mentioned that before. I was able to run the applications errors and it mentions the error regarding the wddmstatus.exe:

Applications:

Event Type:	Error
Event Source:	Bonjour Service
Event Category:	None
Event ID:	100
Date: 14/04/2011
Time: 7:48:19 AM
User: N/A
Computer:	HUMAYUN
Description:
244: ERROR: read_msg errno 10054 (An existing connection was forcibly closed by the remote host.)

Event Type:	Error
Event Source:	MPSampleSubmission
Event Category:	None
Event ID:	5000
Date: 10/04/2011
Time: 12:23:24 AM
User: N/A
Computer:	HUMAYUN
Description:
EventType mptelemetry, P1 80080005, P2 updateservicemanager-_get_services, P3 fallbackcheck, P4 1.1.1593.0, P5 mpsigdwn.dll, P6 1.1.1593.0, P7 windows defender, P8 NIL, P9 NIL, P10 NIL.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 6d 00 70 00 74 00 65 00 m.p.t.e.
0008: 6c 00 65 00 6d 00 65 00 l.e.m.e.
0010: 74 00 72 00 79 00 2c 00 t.r.y.,.
0018: 20 00 38 00 30 00 30 00 .8.0.0.
0020: 38 00 30 00 30 00 30 00 8.0.0.0.
0028: 35 00 2c 00 20 00 75 00 5.,. .u.
0030: 70 00 64 00 61 00 74 00 p.d.a.t.
0038: 65 00 73 00 65 00 72 00 e.s.e.r.
0040: 76 00 69 00 63 00 65 00 v.i.c.e.
0048: 6d 00 61 00 6e 00 61 00 m.a.n.a.
0050: 67 00 65 00 72 00 2d 00 g.e.r.-.
0058: 5f 00 67 00 65 00 74 00 _.g.e.t.
0060: 5f 00 73 00 65 00 72 00 _.s.e.r.
0068: 76 00 69 00 63 00 65 00 v.i.c.e.
0070: 73 00 2c 00 20 00 66 00 s.,. .f.
0078: 61 00 6c 00 6c 00 62 00 a.l.l.b.
0080: 61 00 63 00 6b 00 63 00 a.c.k.c.
0088: 68 00 65 00 63 00 6b 00 h.e.c.k.
0090: 2c 00 20 00 31 00 2e 00 ,. .1...
0098: 31 00 2e 00 31 00 35 00 1...1.5.
00a0: 39 00 33 00 2e 00 30 00 9.3...0.
00a8: 2c 00 20 00 6d 00 70 00 ,. .m.p.
00b0: 73 00 69 00 67 00 64 00 s.i.g.d.
00b8: 77 00 6e 00 2e 00 64 00 w.n...d.
00c0: 6c 00 6c 00 2c 00 20 00 l.l.,. .
00c8: 31 00 2e 00 31 00 2e 00 1...1...
00d0: 31 00 35 00 39 00 33 00 1.5.9.3.
00d8: 2e 00 30 00 2c 00 20 00 ..0.,. .
00e0: 77 00 69 00 6e 00 64 00 w.i.n.d.
00e8: 6f 00 77 00 73 00 20 00 o.w.s. .
00f0: 64 00 65 00 66 00 65 00 d.e.f.e.
00f8: 6e 00 64 00 65 00 72 00 n.d.e.r.
0100: 2c 00 20 00 4e 00 49 00 ,. .N.I.
0108: 4c 00 2c 00 20 00 4e 00 L.,. .N.
0110: 49 00 4c 00 20 00 4e 00 I.L. .N.
0118: 49 00 4c 00 0d 00 0a 00 I.L.....

Event Type:	Error
Event Source:	MPSampleSubmission
Event Category:	None
Event ID:	5000
Date: 10/04/2011
Time: 12:24:43 AM
User: N/A
Computer:	HUMAYUN
Description:
EventType mptelemetry, P1 80080005, P2 updateservicemanager-_get_services, P3 fallbackcheck, P4 1.1.1593.0, P5 mpsigdwn.dll, P6 1.1.1593.0, P7 windows defender, P8 NIL, P9 NIL, P10 NIL.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 6d 00 70 00 74 00 65 00 m.p.t.e.
0008: 6c 00 65 00 6d 00 65 00 l.e.m.e.
0010: 74 00 72 00 79 00 2c 00 t.r.y.,.
0018: 20 00 38 00 30 00 30 00 .8.0.0.
0020: 38 00 30 00 30 00 30 00 8.0.0.0.
0028: 35 00 2c 00 20 00 75 00 5.,. .u.
0030: 70 00 64 00 61 00 74 00 p.d.a.t.
0038: 65 00 73 00 65 00 72 00 e.s.e.r.
0040: 76 00 69 00 63 00 65 00 v.i.c.e.
0048: 6d 00 61 00 6e 00 61 00 m.a.n.a.
0050: 67 00 65 00 72 00 2d 00 g.e.r.-.
0058: 5f 00 67 00 65 00 74 00 _.g.e.t.
0060: 5f 00 73 00 65 00 72 00 _.s.e.r.
0068: 76 00 69 00 63 00 65 00 v.i.c.e.
0070: 73 00 2c 00 20 00 66 00 s.,. .f.
0078: 61 00 6c 00 6c 00 62 00 a.l.l.b.
0080: 61 00 63 00 6b 00 63 00 a.c.k.c.
0088: 68 00 65 00 63 00 6b 00 h.e.c.k.
0090: 2c 00 20 00 31 00 2e 00 ,. .1...
0098: 31 00 2e 00 31 00 35 00 1...1.5.
00a0: 39 00 33 00 2e 00 30 00 9.3...0.
00a8: 2c 00 20 00 6d 00 70 00 ,. .m.p.
00b0: 73 00 69 00 67 00 64 00 s.i.g.d.
00b8: 77 00 6e 00 2e 00 64 00 w.n...d.
00c0: 6c 00 6c 00 2c 00 20 00 l.l.,. .
00c8: 31 00 2e 00 31 00 2e 00 1...1...
00d0: 31 00 35 00 39 00 33 00 1.5.9.3.
00d8: 2e 00 30 00 2c 00 20 00 ..0.,. .
00e0: 77 00 69 00 6e 00 64 00 w.i.n.d.
00e8: 6f 00 77 00 73 00 20 00 o.w.s. .
00f0: 64 00 65 00 66 00 65 00 d.e.f.e.
00f8: 6e 00 64 00 65 00 72 00 n.d.e.r.
0100: 2c 00 20 00 4e 00 49 00 ,. .N.I.
0108: 4c 00 2c 00 20 00 4e 00 L.,. .N.
0110: 49 00 4c 00 20 00 4e 00 I.L. .N.
0118: 49 00 4c 00 0d 00 0a 00 I.L.....

Event Type:	Error
Event Source:	Symantec AntiVirus
Event Category:	None
Event ID:	46
Date: 10/04/2011
Time: 2:16:16 AM
User: N/A
Computer:	HUMAYUN
Description:

Security Risk Found!Risk: Backdoor.Tidserv!inf in File: D:\Documents and Settings\Ours\DoctorWeb\Quarantine\TDSS966e.tmp by: Auto-Protect scan. Action: Clean failed : Quarantine failed. Action Description: The file was left unchanged.

Event Type:	Error
Event Source:	Symantec AntiVirus
Event Category:	None
Event ID:	5
Date: 10/04/2011
Time: 2:16:20 AM
User: N/A
Computer:	HUMAYUN
Description:

Risk Found!Risk: Backdoor.Tidserv!inf in File: D:\Documents and Settings\Ours\DoctorWeb\Quarantine\TDSS966e.tmp by: Auto-Protect scan. Action: Clean failed : Quarantine failed : Access denied. Action Description: The file was left unchanged.

Event Type:	Error
Event Source:	MPSampleSubmission
Event Category:	None
Event ID:	5000
Date: 10/04/2011
Time: 2:16:25 AM
User: N/A
Computer:	HUMAYUN
Description:
EventType mptelemetry, P1 80080005, P2 updateservicemanager-_get_services, P3 fallbackcheck, P4 1.1.1593.0, P5 mpsigdwn.dll, P6 1.1.1593.0, P7 windows defender, P8 NIL, P9 NIL, P10 NIL.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 6d 00 70 00 74 00 65 00 m.p.t.e.
0008: 6c 00 65 00 6d 00 65 00 l.e.m.e.
0010: 74 00 72 00 79 00 2c 00 t.r.y.,.
0018: 20 00 38 00 30 00 30 00 .8.0.0.
0020: 38 00 30 00 30 00 30 00 8.0.0.0.
0028: 35 00 2c 00 20 00 75 00 5.,. .u.
0030: 70 00 64 00 61 00 74 00 p.d.a.t.
0038: 65 00 73 00 65 00 72 00 e.s.e.r.
0040: 76 00 69 00 63 00 65 00 v.i.c.e.
0048: 6d 00 61 00 6e 00 61 00 m.a.n.a.
0050: 67 00 65 00 72 00 2d 00 g.e.r.-.
0058: 5f 00 67 00 65 00 74 00 _.g.e.t.
0060: 5f 00 73 00 65 00 72 00 _.s.e.r.
0068: 76 00 69 00 63 00 65 00 v.i.c.e.
0070: 73 00 2c 00 20 00 66 00 s.,. .f.
0078: 61 00 6c 00 6c 00 62 00 a.l.l.b.
0080: 61 00 63 00 6b 00 63 00 a.c.k.c.
0088: 68 00 65 00 63 00 6b 00 h.e.c.k.
0090: 2c 00 20 00 31 00 2e 00 ,. .1...
0098: 31 00 2e 00 31 00 35 00 1...1.5.
00a0: 39 00 33 00 2e 00 30 00 9.3...0.
00a8: 2c 00 20 00 6d 00 70 00 ,. .m.p.
00b0: 73 00 69 00 67 00 64 00 s.i.g.d.
00b8: 77 00 6e 00 2e 00 64 00 w.n...d.
00c0: 6c 00 6c 00 2c 00 20 00 l.l.,. .
00c8: 31 00 2e 00 31 00 2e 00 1...1...
00d0: 31 00 35 00 39 00 33 00 1.5.9.3.
00d8: 2e 00 30 00 2c 00 20 00 ..0.,. .
00e0: 77 00 69 00 6e 00 64 00 w.i.n.d.
00e8: 6f 00 77 00 73 00 20 00 o.w.s. .
00f0: 64 00 65 00 66 00 65 00 d.e.f.e.
00f8: 6e 00 64 00 65 00 72 00 n.d.e.r.
0100: 2c 00 20 00 4e 00 49 00 ,. .N.I.
0108: 4c 00 2c 00 20 00 4e 00 L.,. .N.
0110: 49 00 4c 00 20 00 4e 00 I.L. .N.
0118: 49 00 4c 00 0d 00 0a 00 I.L.....

Event Type:	Error
Event Source:	Symantec AntiVirus
Event Category:	None
Event ID:	51
Date: 10/04/2011
Time: 2:16:44 AM
User: N/A
Computer:	HUMAYUN
Description:

Security Risk Found!Risk: Backdoor.Tidserv!inf in File: D:\Documents and Settings\Ours\DoctorWeb\Quarantine\TDSS966e.tmp by: Auto-Protect scan. Action: Clean failed : Quarantine failed : Access denied. Action Description: Risk was partially removed.

Event Type:	Error
Event Source:	Bonjour Service
Event Category:	None
Event ID:	100
Date: 11/04/2011
Time: 2:09:46 AM
User: N/A
Computer:	HUMAYUN
Description:
384: ERROR: read_msg errno 10054 (An existing connection was forcibly closed by the remote host.)

Event Type:	Error
Event Source:	Symantec AntiVirus
Event Category:	None
Event ID:	45
Date: 11/04/2011
Time: 11:03:47 PM
User: HUMAYUN\Ours
Computer:	HUMAYUN
Description:

SYMANTEC TAMPER PROTECTION ALERT

Target: D:\Program Files\Symantec AntiVirus\VPTray.exe
Event Info: Terminate Process
Action Taken: Blocked
Actor Process: D:\32788R22FWJFW\License\iexplore.exe (PID 1744)
Time: 2011-04-11 23:03

Event Type:	Error
Event Source:	Symantec AntiVirus
Event Category:	None
Event ID:	45
Date: 11/04/2011
Time: 11:03:48 PM
User: N/A
Computer:	HUMAYUN
Description:

SYMANTEC TAMPER PROTECTION ALERT

Target: D:\Program Files\Symantec AntiVirus\VPTray.exe
Event Info: Terminate Process
Action Taken: Blocked
Actor Process: D:\32788R22FWJFW\pev.exe (PID 2240)
Time: 2011-04-11 23:03

Event Type:	Error
Event Source:	Symantec AntiVirus
Event Category:	None
Event ID:	45
Date: 11/04/2011
Time: 11:03:49 PM
User: N/A
Computer:	HUMAYUN
Description:

SYMANTEC TAMPER PROTECTION ALERT

Target: D:\Program Files\Symantec AntiVirus\VPTray.exe
Event Info: Terminate Process
Action Taken: Blocked
Actor Process: D:\32788R22FWJFW\pev.exe (PID 2612)
Time: 2011-04-11 23:03

Event Type:	Error
Event Source:	Symantec AntiVirus
Event Category:	None
Event ID:	45
Date: 11/04/2011
Time: 11:03:52 PM
User: HUMAYUN\Ours
Computer:	HUMAYUN
Description:

SYMANTEC TAMPER PROTECTION ALERT

Target: D:\Program Files\Symantec AntiVirus\VPTray.exe
Event Info: Terminate Process
Action Taken: Blocked
Actor Process: D:\32788R22FWJFW\License\firefox.exe (PID 3468)
Time: 2011-04-11 23:03

Event Type:	Error
Event Source:	Bonjour Service
Event Category:	None
Event ID:	100
Date: 12/04/2011
Time: 12:15:30 AM
User: N/A
Computer:	HUMAYUN
Description:
248: ERROR: read_msg errno 10054 (An existing connection was forcibly closed by the remote host.)

Event Type:	Error
Event Source:	MPSampleSubmission
Event Category:	None
Event ID:	5000
Date: 12/04/2011
Time: 10:09:31 PM
User: N/A
Computer:	HUMAYUN
Description:
EventType mptelemetry, P1 80080005, P2 updateservicemanager-_get_services, P3 fallbackcheck, P4 1.1.1593.0, P5 mpsigdwn.dll, P6 1.1.1593.0, P7 windows defender, P8 NIL, P9 NIL, P10 NIL.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 6d 00 70 00 74 00 65 00 m.p.t.e.
0008: 6c 00 65 00 6d 00 65 00 l.e.m.e.
0010: 74 00 72 00 79 00 2c 00 t.r.y.,.
0018: 20 00 38 00 30 00 30 00 .8.0.0.
0020: 38 00 30 00 30 00 30 00 8.0.0.0.
0028: 35 00 2c 00 20 00 75 00 5.,. .u.
0030: 70 00 64 00 61 00 74 00 p.d.a.t.
0038: 65 00 73 00 65 00 72 00 e.s.e.r.
0040: 76 00 69 00 63 00 65 00 v.i.c.e.
0048: 6d 00 61 00 6e 00 61 00 m.a.n.a.
0050: 67 00 65 00 72 00 2d 00 g.e.r.-.
0058: 5f 00 67 00 65 00 74 00 _.g.e.t.
0060: 5f 00 73 00 65 00 72 00 _.s.e.r.
0068: 76 00 69 00 63 00 65 00 v.i.c.e.
0070: 73 00 2c 00 20 00 66 00 s.,. .f.
0078: 61 00 6c 00 6c 00 62 00 a.l.l.b.
0080: 61 00 63 00 6b 00 63 00 a.c.k.c.
0088: 68 00 65 00 63 00 6b 00 h.e.c.k.
0090: 2c 00 20 00 31 00 2e 00 ,. .1...
0098: 31 00 2e 00 31 00 35 00 1...1.5.
00a0: 39 00 33 00 2e 00 30 00 9.3...0.
00a8: 2c 00 20 00 6d 00 70 00 ,. .m.p.
00b0: 73 00 69 00 67 00 64 00 s.i.g.d.
00b8: 77 00 6e 00 2e 00 64 00 w.n...d.
00c0: 6c 00 6c 00 2c 00 20 00 l.l.,. .
00c8: 31 00 2e 00 31 00 2e 00 1...1...
00d0: 31 00 35 00 39 00 33 00 1.5.9.3.
00d8: 2e 00 30 00 2c 00 20 00 ..0.,. .
00e0: 77 00 69 00 6e 00 64 00 w.i.n.d.
00e8: 6f 00 77 00 73 00 20 00 o.w.s. .
00f0: 64 00 65 00 66 00 65 00 d.e.f.e.
00f8: 6e 00 64 00 65 00 72 00 n.d.e.r.
0100: 2c 00 20 00 4e 00 49 00 ,. .N.I.
0108: 4c 00 2c 00 20 00 4e 00 L.,. .N.
0110: 49 00 4c 00 20 00 4e 00 I.L. .N.
0118: 49 00 4c 00 0d 00 0a 00 I.L.....

Event Type:	Error
Event Source:	Bonjour Service
Event Category:	None
Event ID:	100
Date: 13/04/2011
Time: 1:11:16 AM
User: N/A
Computer:	HUMAYUN
Description:
248: ERROR: read_msg errno 10054 (An existing connection was forcibly closed by the remote host.)

Event Type:	Error
Event Source:	Application Error
Event Category:	None
Event ID:	1000
Date: 13/04/2011
Time: 1:15:22 AM
User: N/A
Computer:	HUMAYUN
Description:
Faulting application wddmstatus.exe, version 3.1.0.11, faulting module kernel32.dll, version 5.1.2600.5781, fault address 0x00012afb.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 77 64 64 ure wdd
0018: 6d 73 74 61 74 75 73 2e mstatus.
0020: 65 78 65 20 33 2e 31 2e exe 3.1.
0028: 30 2e 31 31 20 69 6e 20 0.11 in 
0030: 6b 65 72 6e 65 6c 33 32 kernel32
0038: 2e 64 6c 6c 20 35 2e 31 .dll 5.1
0040: 2e 32 36 30 30 2e 35 37 .2600.57
0048: 38 31 20 61 74 20 6f 66 81 at of
0050: 66 73 65 74 20 30 30 30 fset 000
0058: 31 32 61 66 62 0d 0a 12afb..

Event Type:	Error
Event Source:	Bonjour Service
Event Category:	None
Event ID:	100
Date: 13/04/2011
Time: 1:29:01 AM
User: N/A
Computer:	HUMAYUN
Description:
240: ERROR: read_msg errno 10054 (An existing connection was forcibly closed by the remote host.)

Event Type:	Error
Event Source:	Application Error
Event Category:	None
Event ID:	1000
Date: 13/04/2011
Time: 8:06:08 PM
User: N/A
Computer:	HUMAYUN
Description:
Faulting application wddmstatus.exe, version 3.1.0.11, faulting module kernel32.dll, version 5.1.2600.5781, fault address 0x00012afb.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 77 64 64 ure wdd
0018: 6d 73 74 61 74 75 73 2e mstatus.
0020: 65 78 65 20 33 2e 31 2e exe 3.1.
0028: 30 2e 31 31 20 69 6e 20 0.11 in 
0030: 6b 65 72 6e 65 6c 33 32 kernel32
0038: 2e 64 6c 6c 20 35 2e 31 .dll 5.1
0040: 2e 32 36 30 30 2e 35 37 .2600.57
0048: 38 31 20 61 74 20 6f 66 81 at of
0050: 66 73 65 74 20 30 30 30 fset 000
0058: 31 32 61 66 62 0d 0a 12afb..

Event Type:	Error
Event Source:	Bonjour Service
Event Category:	None
Event ID:	100
Date: 14/04/2011
Time: 12:20:40 AM
User: N/A
Computer:	HUMAYUN
Description:
252: ERROR: read_msg errno 10054 (An existing connection was forcibly closed by the remote host.)

Event Type:	Error
Event Source:	MPSampleSubmission
Event Category:	None
Event ID:	5000
Date: 14/04/2011
Time: 1:33:04 AM
User: N/A
Computer:	HUMAYUN
Description:
EventType mptelemetry, P1 80080005, P2 updateservicemanager-_get_services, P3 fallbackcheck, P4 1.1.1593.0, P5 mpsigdwn.dll, P6 1.1.1593.0, P7 windows defender, P8 NIL, P9 NIL, P10 NIL.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 6d 00 70 00 74 00 65 00 m.p.t.e.
0008: 6c 00 65 00 6d 00 65 00 l.e.m.e.
0010: 74 00 72 00 79 00 2c 00 t.r.y.,.
0018: 20 00 38 00 30 00 30 00 .8.0.0.
0020: 38 00 30 00 30 00 30 00 8.0.0.0.
0028: 35 00 2c 00 20 00 75 00 5.,. .u.
0030: 70 00 64 00 61 00 74 00 p.d.a.t.
0038: 65 00 73 00 65 00 72 00 e.s.e.r.
0040: 76 00 69 00 63 00 65 00 v.i.c.e.
0048: 6d 00 61 00 6e 00 61 00 m.a.n.a.
0050: 67 00 65 00 72 00 2d 00 g.e.r.-.
0058: 5f 00 67 00 65 00 74 00 _.g.e.t.
0060: 5f 00 73 00 65 00 72 00 _.s.e.r.
0068: 76 00 69 00 63 00 65 00 v.i.c.e.
0070: 73 00 2c 00 20 00 66 00 s.,. .f.
0078: 61 00 6c 00 6c 00 62 00 a.l.l.b.
0080: 61 00 63 00 6b 00 63 00 a.c.k.c.
0088: 68 00 65 00 63 00 6b 00 h.e.c.k.
0090: 2c 00 20 00 31 00 2e 00 ,. .1...
0098: 31 00 2e 00 31 00 35 00 1...1.5.
00a0: 39 00 33 00 2e 00 30 00 9.3...0.
00a8: 2c 00 20 00 6d 00 70 00 ,. .m.p.
00b0: 73 00 69 00 67 00 64 00 s.i.g.d.
00b8: 77 00 6e 00 2e 00 64 00 w.n...d.
00c0: 6c 00 6c 00 2c 00 20 00 l.l.,. .
00c8: 31 00 2e 00 31 00 2e 00 1...1...
00d0: 31 00 35 00 39 00 33 00 1.5.9.3.
00d8: 2e 00 30 00 2c 00 20 00 ..0.,. .
00e0: 77 00 69 00 6e 00 64 00 w.i.n.d.
00e8: 6f 00 77 00 73 00 20 00 o.w.s. .
00f0: 64 00 65 00 66 00 65 00 d.e.f.e.
00f8: 6e 00 64 00 65 00 72 00 n.d.e.r.
0100: 2c 00 20 00 4e 00 49 00 ,. .N.I.
0108: 4c 00 2c 00 20 00 4e 00 L.,. .N.
0110: 49 00 4c 00 20 00 4e 00 I.L. .N.
0118: 49 00 4c 00 0d 00 0a 00 I.L.....

Event Type:	Error
Event Source:	Bonjour Service
Event Category:	None
Event ID:	100
Date: 14/04/2011
Time: 7:48:19 AM
User: N/A
Computer:	HUMAYUN
Description:
244: ERROR: read_msg errno 10054 (An existing connection was forcibly closed by the remote host.)

Systems:

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 10/04/2011
Time: 12:12:30 AM
User: NT AUTHORITY\SYSTEM
Computer:	HUMAYUN
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 10/04/2011
Time: 12:13:52 AM
User: N/A
Computer:	HUMAYUN
Description:
The Sunbelt CounterSpy Antispyware service failed to start due to the following error: 
The system cannot find the path specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 10/04/2011
Time: 12:13:52 AM
User: N/A
Computer:	HUMAYUN
Description:
The Secdrv service failed to start due to the following error: 
The system cannot find the file specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 10/04/2011
Time: 12:13:52 AM
User: N/A
Computer:	HUMAYUN
Description:
The Automatic Updates service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 10/04/2011
Time: 12:20:43 AM
User: N/A
Computer:	HUMAYUN
Description:
The Automatic Updates service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10010
Date: 10/04/2011
Time: 12:21:13 AM
User: HUMAYUN\Ours
Computer:	HUMAYUN
Description:
The server {E60687F7-01A1-40AA-86AC-DB1CBF673334} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 10/04/2011
Time: 12:21:13 AM
User: N/A
Computer:	HUMAYUN
Description:
The Automatic Updates service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10010
Date: 10/04/2011
Time: 12:21:43 AM
User: HUMAYUN\Ours
Computer:	HUMAYUN
Description:
The server {E60687F7-01A1-40AA-86AC-DB1CBF673334} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 10/04/2011
Time: 12:22:24 AM
User: N/A
Computer:	HUMAYUN
Description:
The Automatic Updates service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10010
Date: 10/04/2011
Time: 12:22:53 AM
User: HUMAYUN\Ours
Computer:	HUMAYUN
Description:
The server {E60687F7-01A1-40AA-86AC-DB1CBF673334} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 10/04/2011
Time: 12:22:54 AM
User: N/A
Computer:	HUMAYUN
Description:
The Automatic Updates service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10010
Date: 10/04/2011
Time: 12:23:23 AM
User: HUMAYUN\Ours
Computer:	HUMAYUN
Description:
The server {E60687F7-01A1-40AA-86AC-DB1CBF673334} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 10/04/2011
Time: 12:23:41 AM
User: N/A
Computer:	HUMAYUN
Description:
The Automatic Updates service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10010
Date: 10/04/2011
Time: 12:24:11 AM
User: HUMAYUN\Ours
Computer:	HUMAYUN
Description:
The server {E60687F7-01A1-40AA-86AC-DB1CBF673334} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 10/04/2011
Time: 12:24:11 AM
User: N/A
Computer:	HUMAYUN
Description:
The Automatic Updates service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10010
Date: 10/04/2011
Time: 12:24:41 AM
User: HUMAYUN\Ours
Computer:	HUMAYUN
Description:
The server {E60687F7-01A1-40AA-86AC-DB1CBF673334} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 10/04/2011
Time: 2:15:15 AM
User: N/A
Computer:	HUMAYUN
Description:
The Automatic Updates service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10010
Date: 10/04/2011
Time: 2:15:44 AM
User: NT AUTHORITY\SYSTEM
Computer:	HUMAYUN
Description:
The server {E60687F7-01A1-40AA-86AC-DB1CBF673334} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 10/04/2011
Time: 2:15:44 AM
User: N/A
Computer:	HUMAYUN
Description:
The Automatic Updates service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10010
Date: 10/04/2011
Time: 2:16:14 AM
User: NT AUTHORITY\SYSTEM
Computer:	HUMAYUN
Description:
The server {E60687F7-01A1-40AA-86AC-DB1CBF673334} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 11/04/2011
Time: 9:00:43 PM
User: N/A
Computer:	HUMAYUN
Description:
The Sunbelt CounterSpy Antispyware service failed to start due to the following error: 
The system cannot find the path specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 11/04/2011
Time: 9:00:43 PM
User: N/A
Computer:	HUMAYUN
Description:
The Secdrv service failed to start due to the following error: 
The system cannot find the file specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 11/04/2011
Time: 9:00:43 PM
User: N/A
Computer:	HUMAYUN
Description:
The Automatic Updates service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 12/04/2011
Time: 9:48:45 PM
User: N/A
Computer:	HUMAYUN
Description:
The Sunbelt CounterSpy Antispyware service failed to start due to the following error: 
The system cannot find the path specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 12/04/2011
Time: 9:48:45 PM
User: N/A
Computer:	HUMAYUN
Description:
The Secdrv service failed to start due to the following error: 
The system cannot find the file specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 12/04/2011
Time: 9:48:46 PM
User: N/A
Computer:	HUMAYUN
Description:
The Automatic Updates service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 12/04/2011
Time: 10:08:31 PM
User: N/A
Computer:	HUMAYUN
Description:
The Automatic Updates service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10010
Date: 12/04/2011
Time: 10:09:01 PM
User: NT AUTHORITY\SYSTEM
Computer:	HUMAYUN
Description:
The server {E60687F7-01A1-40AA-86AC-DB1CBF673334} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 12/04/2011
Time: 10:09:01 PM
User: N/A
Computer:	HUMAYUN
Description:
The Automatic Updates service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 12/04/2011
Time: 10:09:01 PM
User: N/A
Computer:	HUMAYUN
Description:
The Automatic Updates service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10010
Date: 12/04/2011
Time: 10:09:31 PM
User: NT AUTHORITY\SYSTEM
Computer:	HUMAYUN
Description:
The server {E60687F7-01A1-40AA-86AC-DB1CBF673334} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 12/04/2011
Time: 10:29:39 PM
User: N/A
Computer:	HUMAYUN
Description:
The Automatic Updates service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 12:52:48 AM
User: N/A
Computer:	HUMAYUN
Description:
The Automatic Updates service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 12:52:48 AM
User: N/A
Computer:	HUMAYUN
Description:
The Automatic Updates service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10010
Date: 13/04/2011
Time: 12:53:18 AM
User: HUMAYUN\Ours
Computer:	HUMAYUN
Description:
The server {E60687F7-01A1-40AA-86AC-DB1CBF673334} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:26 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:26 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:26 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:26 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:26 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:26 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:26 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:26 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:26 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:26 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:27 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:27 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:27 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:27 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:27 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:27 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:27 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:27 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:28 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:28 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:28 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:28 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:28 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:28 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:28 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:28 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:28 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:28 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:29 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:29 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:29 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:29 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:29 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:29 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:29 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:30 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:30 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:30 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:30 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:30 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:30 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:30 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:30 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:30 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:31 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:31 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:31 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:31 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:31 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:31 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:31 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:31 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:31 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:31 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:32 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:32 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:32 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:32 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:32 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:32 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:32 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:32 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:32 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:33 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:33 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:33 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:33 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:33 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:33 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:33 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:33 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:34 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:34 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:34 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Information
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7036
Date: 13/04/2011
Time: 1:00:34 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service entered the stopped state.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:34 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:34 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 13/04/2011
Time: 1:00:34 AM
User: N/A
Computer:	HUMAYUN
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


----------



## Cookiegal (Aug 27, 2003)

You haven't run TDSSKiller yet. Please do so and post the log.


----------



## itrocks4u (Nov 27, 2004)

Yes. Just getting home. Will do that asap. 

Did those help though? The kernel.dll error next to wddmstatus.exe. Does that indicate what the issue is?


----------



## Cookiegal (Aug 27, 2003)

I haven't checked on them yet. TDSSKiller may fix everything so I thought we'd do that first.


----------



## itrocks4u (Nov 27, 2004)

Hi - See below. It did not ask me to cure anything rather 2 suspicious files and default action was to skip. No option to cure, so I left it at skip.

2011/04/14 20:20:13.0140 2792	TDSS rootkit removing tool 2.4.21.0 Mar 10 2011 12:26:28
2011/04/14 20:20:15.0140 2792	================================================================================
2011/04/14 20:20:15.0140 2792	SystemInfo:
2011/04/14 20:20:15.0140 2792	
2011/04/14 20:20:15.0140 2792	OS Version: 5.1.2600 ServicePack: 3.0
2011/04/14 20:20:15.0140 2792	Product type: Workstation
2011/04/14 20:20:15.0140 2792	ComputerName: HUMAYUN
2011/04/14 20:20:15.0140 2792	UserName: Ours
2011/04/14 20:20:15.0140 2792	Windows directory: D:\WINDOWS
2011/04/14 20:20:15.0140 2792	System windows directory: D:\WINDOWS
2011/04/14 20:20:15.0140 2792	Processor architecture: Intel x86
2011/04/14 20:20:15.0140 2792	Number of processors: 1
2011/04/14 20:20:15.0140 2792	Page size: 0x1000
2011/04/14 20:20:15.0140 2792	Boot type: Normal boot
2011/04/14 20:20:15.0140 2792	================================================================================
2011/04/14 20:20:16.0421 2792	Initialize success
2011/04/14 20:20:41.0187 0980	================================================================================
2011/04/14 20:20:41.0187 0980	Scan started
2011/04/14 20:20:41.0187 0980	Mode: Manual; 
2011/04/14 20:20:41.0187 0980	================================================================================
2011/04/14 20:20:42.0171 0980	ACPI (8fd99680a539792a30e97944fdaecf17) D:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/04/14 20:20:42.0265 0980	ACPIEC (9859c0f6936e723e4892d7141b1327d5) D:\WINDOWS\system32\drivers\ACPIEC.sys
2011/04/14 20:20:42.0437 0980	aeaudio (e696e749bedcda8b23757b8b5ea93780) D:\WINDOWS\system32\drivers\aeaudio.sys
2011/04/14 20:20:42.0562 0980	aec (8bed39e3c35d6a489438b8141717a557) D:\WINDOWS\system32\drivers\aec.sys
2011/04/14 20:20:42.0640 0980	AFD (7e775010ef291da96ad17ca4b17137d7) D:\WINDOWS\System32\drivers\afd.sys
2011/04/14 20:20:42.0781 0980	agp440 (08fd04aa961bdc77fb983f328334e3d7) D:\WINDOWS\system32\DRIVERS\agp440.sys
2011/04/14 20:20:43.0781 0980	AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) D:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/04/14 20:20:43.0843 0980	atapi (9f3a2f5aa6875c72bf062c712cfa2674) D:\WINDOWS\system32\DRIVERS\atapi.sys
2011/04/14 20:20:44.0046 0980	ati2mtag (6d820e99cf360fdbb554af72f33c2052) D:\WINDOWS\system32\DRIVERS\ati2mtag.sys
2011/04/14 20:20:44.0171 0980	Atmarpc (9916c1225104ba14794209cfa8012159) D:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/04/14 20:20:44.0265 0980	audstub (d9f724aa26c010a217c97606b160ed68) D:\WINDOWS\system32\DRIVERS\audstub.sys
2011/04/14 20:20:44.0343 0980	Beep (da1f27d85e0d1525f6621372e7b685e9) D:\WINDOWS\system32\drivers\Beep.sys
2011/04/14 20:20:44.0484 0980	BVRPMPR5 (248dfa5762dde38dfddbbd44149e9d7a) D:\WINDOWS\system32\drivers\BVRPMPR5.SYS
2011/04/14 20:20:44.0671 0980	cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) D:\WINDOWS\system32\drivers\cbidf2k.sys
2011/04/14 20:20:44.0765 0980	CCDECODE (0be5aef125be881c4f854c554f2b025c) D:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2011/04/14 20:20:44.0921 0980	Cdaudio (c1b486a7658353d33a10cc15211a873b) D:\WINDOWS\system32\drivers\Cdaudio.sys
2011/04/14 20:20:45.0015 0980	Cdfs (c885b02847f5d2fd45a24e219ed93b32) D:\WINDOWS\system32\drivers\Cdfs.sys
2011/04/14 20:20:45.0125 0980	cdrbsvsd (7fc46240546c16c0448c29c9d233b915) D:\WINDOWS\system32\drivers\cdrbsvsd.sys
2011/04/14 20:20:45.0218 0980	Cdrom (1f4260cc5b42272d71f79e570a27a4fe) D:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/04/14 20:20:45.0750 0980	Disk (044452051f3e02e7963599fc8f4f3e25) D:\WINDOWS\system32\DRIVERS\disk.sys
2011/04/14 20:20:45.0875 0980	dmboot (d992fe1274bde0f84ad826acae022a41) D:\WINDOWS\system32\drivers\dmboot.sys
2011/04/14 20:20:46.0015 0980	dmio (7c824cf7bbde77d95c08005717a95f6f) D:\WINDOWS\system32\drivers\dmio.sys
2011/04/14 20:20:46.0078 0980	dmload (e9317282a63ca4d188c0df5e09c6ac5f) D:\WINDOWS\system32\drivers\dmload.sys
2011/04/14 20:20:46.0171 0980	DMusic (8a208dfcf89792a484e76c40e5f50b45) D:\WINDOWS\system32\drivers\DMusic.sys
2011/04/14 20:20:46.0312 0980	drmkaud (8f5fcff8e8848afac920905fbd9d33c8) D:\WINDOWS\system32\drivers\drmkaud.sys
2011/04/14 20:20:46.0406 0980	dtscsi (12aca694b50ea53563c1e7c99e7bb27d) D:\WINDOWS\System32\Drivers\dtscsi.sys
2011/04/14 20:20:46.0406 0980	Suspicious file (NoAccess): D:\WINDOWS\System32\Drivers\dtscsi.sys. md5: 12aca694b50ea53563c1e7c99e7bb27d
2011/04/14 20:20:46.0421 0980	dtscsi - detected Locked file (1)
2011/04/14 20:20:46.0546 0980	E100B (98b46b331404a951cabad8b4877e1276) D:\WINDOWS\system32\DRIVERS\e100b325.sys
2011/04/14 20:20:46.0671 0980	eeCtrl (089296aedb9b72b4916ac959752bdc89) D:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
2011/04/14 20:20:46.0765 0980	EraserUtilRebootDrv (850259334652d392e33ee3412562e583) D:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
2011/04/14 20:20:46.0875 0980	eusk2par (cb8eb214e5009782b6d3e16b4f479532) D:\WINDOWS\System32\Drivers\eusk2par.sys
2011/04/14 20:20:46.0984 0980	Fastfat (38d332a6d56af32635675f132548343e) D:\WINDOWS\system32\drivers\Fastfat.sys
2011/04/14 20:20:47.0093 0980	Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) D:\WINDOWS\system32\DRIVERS\fdc.sys
2011/04/14 20:20:47.0140 0980	Fips (d45926117eb9fa946a6af572fbe1caa3) D:\WINDOWS\system32\drivers\Fips.sys
2011/04/14 20:20:47.0234 0980	Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) D:\WINDOWS\system32\DRIVERS\flpydisk.sys
2011/04/14 20:20:47.0343 0980	FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) D:\WINDOWS\system32\drivers\fltmgr.sys
2011/04/14 20:20:47.0421 0980	Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) D:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/04/14 20:20:47.0515 0980	Ftdisk (6ac26732762483366c3969c9e4d2259d) D:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/04/14 20:20:47.0593 0980	GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) D:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
2011/04/14 20:20:47.0671 0980	Gpc (0a02c63c8b144bd8c86b103dee7c86a2) D:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/04/14 20:20:47.0765 0980	hidusb (ccf82c5ec8a7326c3066de870c06daf1) D:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/04/14 20:20:47.0953 0980	HTTP (f80a415ef82cd06ffaf0d971528ead38) D:\WINDOWS\system32\Drivers\HTTP.sys
2011/04/14 20:20:48.0171 0980	i8042prt (4a0b06aa8943c1e332520f7440c0aa30) D:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/04/14 20:20:48.0281 0980	Imapi (083a052659f5310dd8b6a6cb05edcf8e) D:\WINDOWS\system32\DRIVERS\imapi.sys
2011/04/14 20:20:48.0453 0980	intelppm (8c953733d8f36eb2133f5bb58808b66b) D:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/04/14 20:20:48.0562 0980	ip6fw (3bb22519a194418d5fec05d800a19ad0) D:\WINDOWS\system32\drivers\ip6fw.sys
2011/04/14 20:20:48.0625 0980	IpFilterDriver (731f22ba402ee4b62748adaf6363c182) D:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/04/14 20:20:48.0734 0980	IpInIp (b87ab476dcf76e72010632b5550955f5) D:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/04/14 20:20:48.0796 0980	IpNat (cc748ea12c6effde940ee98098bf96bb) D:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/04/14 20:20:48.0906 0980	IPSec (23c74d75e36e7158768dd63d92789a91) D:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/04/14 20:20:49.0000 0980	IRENUM (c93c9ff7b04d772627a3646d89f7bf89) D:\WINDOWS\system32\DRIVERS\irenum.sys
2011/04/14 20:20:49.0078 0980	isapnp (05a299ec56e52649b1cf2fc52d20f2d7) D:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/04/14 20:20:49.0156 0980	JL2005 (1b3453957b15ae77f3b7bbdfcd4e5438) D:\WINDOWS\system32\Drivers\toywdm.sys
2011/04/14 20:20:49.0250 0980	Kbdclass (463c1ec80cd17420a542b7f36a36f128) D:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/04/14 20:20:49.0312 0980	kbdhid (9ef487a186dea361aa06913a75b3fa99) D:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/04/14 20:20:49.0406 0980	kmixer (692bcf44383d056aed41b045a323d378) D:\WINDOWS\system32\drivers\kmixer.sys
2011/04/14 20:20:49.0500 0980	KSecDD (b467646c54cc746128904e1654c750c1) D:\WINDOWS\system32\drivers\KSecDD.sys
2011/04/14 20:20:49.0687 0980	MidiSyn (63c34814492aa65fc517b002de77b191) D:\WINDOWS\system32\drivers\MidiSyn.sys
2011/04/14 20:20:49.0781 0980	mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) D:\WINDOWS\system32\drivers\mnmdd.sys
2011/04/14 20:20:49.0875 0980	Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) D:\WINDOWS\system32\drivers\Modem.sys
2011/04/14 20:20:49.0984 0980	Mouclass (35c9e97194c8cfb8430125f8dbc34d04) D:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/04/14 20:20:50.0078 0980	mouhid (b1c303e17fb9d46e87a98e4ba6769685) D:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/04/14 20:20:50.0156 0980	MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) D:\WINDOWS\system32\drivers\MountMgr.sys
2011/04/14 20:20:50.0312 0980	MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) D:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/04/14 20:20:50.0406 0980	MRxSmb (f3aefb11abc521122b67095044169e98) D:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/04/14 20:20:50.0546 0980	Msfs (c941ea2454ba8350021d774daf0f1027) D:\WINDOWS\system32\drivers\Msfs.sys
2011/04/14 20:20:50.0656 0980	MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) D:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/04/14 20:20:50.0718 0980	MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) D:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/04/14 20:20:50.0812 0980	MSPQM (bad59648ba099da4a17680b39730cb3d) D:\WINDOWS\system32\drivers\MSPQM.sys
2011/04/14 20:20:50.0921 0980	mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) D:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/04/14 20:20:50.0984 0980	MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) D:\WINDOWS\system32\drivers\MSTEE.sys
2011/04/14 20:20:51.0078 0980	Mup (2f625d11385b1a94360bfc70aaefdee1) D:\WINDOWS\system32\drivers\Mup.sys
2011/04/14 20:20:51.0171 0980	NABTSFEC (5b50f1b2a2ed47d560577b221da734db) D:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2011/04/14 20:20:51.0328 0980	NAVENG (c34e2a884ccca8b5567d0c2752527073) D:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20110414.002\naveng.sys
2011/04/14 20:20:51.0546 0980	NAVEX15 (b3916eeec738dd4178f4fd6a44a32e36) D:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20110414.002\navex15.sys
2011/04/14 20:20:51.0750 0980	NDIS (1df7f42665c94b825322fae71721130d) D:\WINDOWS\system32\drivers\NDIS.sys
2011/04/14 20:20:51.0843 0980	NdisIP (7ff1f1fd8609c149aa432f95a8163d97) D:\WINDOWS\system32\DRIVERS\NdisIP.sys
2011/04/14 20:20:51.0921 0980	NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) D:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/04/14 20:20:52.0000 0980	Ndisuio (f927a4434c5028758a842943ef1a3849) D:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/04/14 20:20:52.0109 0980	NdisWan (edc1531a49c80614b2cfda43ca8659ab) D:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/04/14 20:20:52.0234 0980	NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) D:\WINDOWS\system32\drivers\NDProxy.sys
2011/04/14 20:20:52.0312 0980	NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) D:\WINDOWS\system32\DRIVERS\netbios.sys
2011/04/14 20:20:52.0421 0980	NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) D:\WINDOWS\system32\DRIVERS\netbt.sys
2011/04/14 20:20:52.0531 0980	Nokia USB Modem (fa1c0ca4b6004a8c1ab4465346459d04) D:\WINDOWS\system32\drivers\nmwcdcm.sys
2011/04/14 20:20:52.0640 0980	Nokia USB Phone Parent (55559482199d3c617013d0241c47cdb7) D:\WINDOWS\system32\drivers\nmwcd.sys
2011/04/14 20:20:52.0734 0980	Npfs (3182d64ae053d6fb034f44b6def8034a) D:\WINDOWS\system32\drivers\Npfs.sys
2011/04/14 20:20:52.0859 0980	Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) D:\WINDOWS\system32\drivers\Ntfs.sys
2011/04/14 20:20:52.0984 0980	Null (73c1e1f395918bc2c6dd67af7591a3ad) D:\WINDOWS\system32\drivers\Null.sys
2011/04/14 20:20:53.0359 0980	nv (ed9816dbaf6689542ea7d022631906a1) D:\WINDOWS\system32\DRIVERS\nv4_mini.sys
2011/04/14 20:20:53.0703 0980	NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) D:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/04/14 20:20:53.0765 0980	NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) D:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/04/14 20:20:53.0859 0980	Parport (5575faf8f97ce5e713d108c2a58d7c7c) D:\WINDOWS\system32\DRIVERS\parport.sys
2011/04/14 20:20:53.0937 0980	PartMgr (beb3ba25197665d82ec7065b724171c6) D:\WINDOWS\system32\drivers\PartMgr.sys
2011/04/14 20:20:54.0031 0980	ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) D:\WINDOWS\system32\drivers\ParVdm.sys
2011/04/14 20:20:54.0125 0980	PCI (a219903ccf74233761d92bef471a07b1) D:\WINDOWS\system32\DRIVERS\pci.sys
2011/04/14 20:20:54.0265 0980	PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) D:\WINDOWS\system32\DRIVERS\pciide.sys
2011/04/14 20:20:54.0375 0980	Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) D:\WINDOWS\system32\drivers\Pcmcia.sys
2011/04/14 20:20:54.0703 0980	pfc (da86016f0672ada925f589ede715f185) D:\WINDOWS\system32\drivers\pfc.sys
2011/04/14 20:20:54.0812 0980	PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) D:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/04/14 20:20:54.0875 0980	Processor (a32bebaf723557681bfc6bd93e98bd26) D:\WINDOWS\system32\DRIVERS\processr.sys
2011/04/14 20:20:54.0984 0980	PSched (09298ec810b07e5d582cb3a3f9255424) D:\WINDOWS\system32\DRIVERS\psched.sys
2011/04/14 20:20:55.0062 0980	Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) D:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/04/14 20:20:55.0140 0980	PxHelp20 (d86b4a68565e444d76457f14172c875a) D:\WINDOWS\system32\DRIVERS\PxHelp20.sys
2011/04/14 20:20:55.0468 0980	RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) D:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/04/14 20:20:55.0578 0980	Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) D:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/04/14 20:20:55.0671 0980	RasPppoe (5bc962f2654137c9909c3d4603587dee) D:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/04/14 20:20:55.0734 0980	Raspti (fdbb1d60066fcfbb7452fd8f9829b242) D:\WINDOWS\system32\DRIVERS\raspti.sys
2011/04/14 20:20:55.0828 0980	Rdbss (7ad224ad1a1437fe28d89cf22b17780a) D:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/04/14 20:20:55.0921 0980	RDPCDD (4912d5b403614ce99c28420f75353332) D:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/04/14 20:20:56.0031 0980	RDPWD (6728e45b66f93c08f11de2e316fc70dd) D:\WINDOWS\system32\drivers\RDPWD.sys
2011/04/14 20:20:56.0093 0980	redbook (f828dd7e1419b6653894a8f97a0094c5) D:\WINDOWS\system32\DRIVERS\redbook.sys
2011/04/14 20:20:56.0187 0980	RimUsb (92d33f76769a028ddc54a863eb7de4a2) D:\WINDOWS\system32\Drivers\RimUsb.sys
2011/04/14 20:20:56.0281 0980	RimVSerPort (2c4fb2e9f039287767c384e46ee91030) D:\WINDOWS\system32\DRIVERS\RimSerial.sys
2011/04/14 20:20:56.0359 0980	ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) D:\WINDOWS\system32\Drivers\RootMdm.sys
2011/04/14 20:20:56.0484 0980	SAVRT (12b6e269ef8ac8ea36122544c8a1b6d8) D:\Program Files\Symantec AntiVirus\savrt.sys
2011/04/14 20:20:56.0515 0980	SAVRTPEL (97e5b6f3f95465e1f59360b59d8ec64e) D:\Program Files\Symantec AntiVirus\Savrtpel.sys
2011/04/14 20:20:56.0687 0980	serenum (0f29512ccd6bead730039fb4bd2c85ce) D:\WINDOWS\system32\DRIVERS\serenum.sys
2011/04/14 20:20:56.0750 0980	Serial (cca207a8896d4c6a0c9ce29a4ae411a7) D:\WINDOWS\system32\DRIVERS\serial.sys
2011/04/14 20:20:56.0875 0980	sf (e8cc4ba7b2e962bd932c7bf678e762e0) D:\WINDOWS\system32\drivers\sf.sys
2011/04/14 20:20:56.0953 0980	Sfloppy (8e6b8c671615d126fdc553d1e2de5562) D:\WINDOWS\system32\drivers\Sfloppy.sys
2011/04/14 20:20:57.0109 0980	SLIP (866d538ebe33709a5c9f5c62b73b7d14) D:\WINDOWS\system32\DRIVERS\SLIP.sys
2011/04/14 20:20:57.0234 0980	smwdm (7d9b50329af9fd94b0529282530d2cb7) D:\WINDOWS\system32\drivers\smwdm.sys
2011/04/14 20:20:57.0343 0980	SONYPVU1 (a1eceeaa5c5e74b2499eb51d38185b84) D:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS
2011/04/14 20:20:57.0500 0980	SPBBCDrv (677b10906838d3bfb1c07ac9087e4bf7) D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys
2011/04/14 20:20:57.0640 0980	splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) D:\WINDOWS\system32\drivers\splitter.sys
2011/04/14 20:20:57.0765 0980	sptd (52d347671ced26cf1756453b521b67c5) D:\WINDOWS\system32\Drivers\sptd.sys
2011/04/14 20:20:57.0765 0980	Suspicious file (NoAccess): D:\WINDOWS\system32\Drivers\sptd.sys. md5: 52d347671ced26cf1756453b521b67c5
2011/04/14 20:20:57.0781 0980	sptd - detected Locked file (1)
2011/04/14 20:20:57.0875 0980	sr (76bb022c2fb6902fd5bdd4f78fc13a5d) D:\WINDOWS\system32\DRIVERS\sr.sys
2011/04/14 20:20:57.0984 0980	srescan (bda0ecc7cba1d3b9fd7ff2881bf9b463) D:\WINDOWS\system32\ZoneLabs\srescan.sys
2011/04/14 20:20:58.0125 0980	Srv (0f6aefad3641a657e18081f52d0c15af) D:\WINDOWS\system32\DRIVERS\srv.sys
2011/04/14 20:20:58.0234 0980	ss_bus (bd15182e9d2d3fabc1d1313badbd2415) D:\WINDOWS\system32\DRIVERS\ss_bus.sys
2011/04/14 20:20:58.0328 0980	ss_mdfl (67d1144f249a3c5e03ebd7a2304dee11) D:\WINDOWS\system32\DRIVERS\ss_mdfl.sys
2011/04/14 20:20:58.0390 0980	ss_mdm (954b7ce2d54c703d6a8471d6b05a5e13) D:\WINDOWS\system32\DRIVERS\ss_mdm.sys
2011/04/14 20:20:58.0484 0980	streamip (77813007ba6265c4b6098187e6ed79d2) D:\WINDOWS\system32\DRIVERS\StreamIP.sys
2011/04/14 20:20:58.0578 0980	swenum (3941d127aef12e93addf6fe6ee027e0f) D:\WINDOWS\system32\DRIVERS\swenum.sys
2011/04/14 20:20:58.0656 0980	swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) D:\WINDOWS\system32\drivers\swmidi.sys
2011/04/14 20:20:58.0875 0980	SymEvent (de6d1102d55926354171ae4e73936725) D:\Program Files\Symantec\SYMEVENT.SYS
2011/04/14 20:20:58.0968 0980	SYMREDRV (6c0a85982f4e0d672b85a2bfb50a24b5) D:\WINDOWS\System32\Drivers\SYMREDRV.SYS
2011/04/14 20:20:59.0031 0980	SYMTDI (cdda3ba3f7d5b63ff9f85cb478c11473) D:\WINDOWS\System32\Drivers\SYMTDI.SYS
2011/04/14 20:20:59.0281 0980	sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) D:\WINDOWS\system32\drivers\sysaudio.sys
2011/04/14 20:20:59.0375 0980	Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) D:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/04/14 20:20:59.0468 0980	TDPIPE (6471a66807f5e104e4885f5b67349397) D:\WINDOWS\system32\drivers\TDPIPE.sys
2011/04/14 20:20:59.0546 0980	TDTCP (c56b6d0402371cf3700eb322ef3aaf61) D:\WINDOWS\system32\drivers\TDTCP.sys
2011/04/14 20:20:59.0625 0980	TermDD (88155247177638048422893737429d9e) D:\WINDOWS\system32\DRIVERS\termdd.sys
2011/04/14 20:20:59.0812 0980	Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) D:\WINDOWS\system32\drivers\Udfs.sys
2011/04/14 20:20:59.0953 0980	Update (402ddc88356b1bac0ee3dd1580c76a31) D:\WINDOWS\system32\DRIVERS\update.sys
2011/04/14 20:21:00.0078 0980	USBAAPL (5c2bdc152bbab34f36473deaf7713f22) D:\WINDOWS\system32\Drivers\usbaapl.sys
2011/04/14 20:21:00.0171 0980	usbccgp (173f317ce0db8e21322e71b7e60a27e8) D:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/04/14 20:21:00.0265 0980	usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) D:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/04/14 20:21:00.0359 0980	usbhub (1ab3cdde553b6e064d2e754efe20285c) D:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/04/14 20:21:00.0421 0980	usbprint (a717c8721046828520c9edf31288fc00) D:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/04/14 20:21:00.0515 0980	usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) D:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/04/14 20:21:00.0578 0980	USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) D:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/04/14 20:21:00.0656 0980	usbuhci (26496f9dee2d787fc3e61ad54821ffe6) D:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/04/14 20:21:00.0734 0980	Vcs (ce9b7df9af5b01884beeab3f703c3bf6) D:\WINDOWS\System32\Drivers\Vcs.sys
2011/04/14 20:21:00.0828 0980	VgaSave (0d3a8fafceacd8b7625cd549757a7df1) D:\WINDOWS\System32\drivers\vga.sys
2011/04/14 20:21:00.0984 0980	VolSnap (4c8fcb5cc53aab716d810740fe59d025) D:\WINDOWS\system32\drivers\VolSnap.sys
2011/04/14 20:21:01.0078 0980	vsdatant (279761ad6562c0d4309cb1bbb260233f) D:\WINDOWS\system32\vsdatant.sys
2011/04/14 20:21:01.0281 0980	Wanarp (e20b95baedb550f32dd489265c1da1f6) D:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/04/14 20:21:01.0421 0980	Wdf01000 (d918617b46457b9ac28027722e30f647) D:\WINDOWS\system32\Drivers\wdf01000.sys
2011/04/14 20:21:01.0625 0980	wdmaud (6768acf64b18196494413695f0c3a00f) D:\WINDOWS\system32\drivers\wdmaud.sys
2011/04/14 20:21:01.0781 0980	WmBEnum (1abfd1399436e81c9d857f5fc76eaf98) D:\WINDOWS\system32\drivers\WmBEnum.sys
2011/04/14 20:21:01.0859 0980	WmFilter (b3cfcbcc91ff61ef82fc693b8b57e7f0) D:\WINDOWS\system32\drivers\WmFilter.sys
2011/04/14 20:21:01.0953 0980	WmVirHid (a40d2dd0f019423ef6c363f1295eb38d) D:\WINDOWS\system32\drivers\WmVirHid.sys
2011/04/14 20:21:02.0046 0980	WmXlCore (2bf505424f469155cd90d7b3301d7adc) D:\WINDOWS\system32\drivers\WmXlCore.sys
2011/04/14 20:21:02.0125 0980	WpdUsb (cf4def1bf66f06964dc0d91844239104) D:\WINDOWS\system32\Drivers\wpdusb.sys
2011/04/14 20:21:02.0203 0980	WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) D:\WINDOWS\System32\drivers\ws2ifsl.sys
2011/04/14 20:21:02.0312 0980	WSTCODEC (c98b39829c2bbd34e454150633c62c78) D:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2011/04/14 20:21:02.0406 0980	WudfPf (f15feafffbb3644ccc80c5da584e6311) D:\WINDOWS\system32\DRIVERS\WudfPf.sys
2011/04/14 20:21:02.0500 0980	WudfRd (28b524262bce6de1f7ef9f510ba3985b) D:\WINDOWS\system32\DRIVERS\wudfrd.sys
2011/04/14 20:21:02.0734 0980	================================================================================
2011/04/14 20:21:02.0734 0980	Scan finished
2011/04/14 20:21:02.0734 0980	================================================================================
2011/04/14 20:21:02.0750 0460	Detected object count: 2
2011/04/14 20:21:21.0218 0460	Locked file(dtscsi) - User select action: Skip 
2011/04/14 20:21:21.0218 0460	Locked file(sptd) - User select action: Skip 
2011/04/14 20:21:27.0781 3780	Deinitialize success


----------



## Cookiegal (Aug 27, 2003)

Please update MalwareBytes and run a full scan and post the log.


----------



## Cookiegal (Aug 27, 2003)

Also, please do this:

Please download DDS by sUBs to your desktop from one of the following locations:

http://www.techsupportforum.com/sectools/sUBs/dds
http://download.bleepingcomputer.com/sUBs/dds.scr
http://www.forospyware.com/sUBs/dds

Disable any script blocker you may have as they may interfere and then double-click the DDS.scr to run the tool.

When DDS has finished scanning, it will open two logs named as follows:

DDS.txt
Attach.txt

Save them both to your desktop. Copy and paste the contents of the DDS.txt and Attach.txt files in your reply please.

Please download GMER from: http://gmer.net/index.php

Click on the "Download EXE" button and save the randomly named .exe file to your desktop.

*Note: You must uninstall any CD Emulation programs that you have before running GMER as they can cause conflicts and give false results.*

Double click the GMER .exe file on your desktop to run the tool and it will automatically do a quick scan.

If the tool warns of rootkit activity and asks if you want to run a full scan, click on No and make sure the following are *unchecked *on the right-hand side:

IAT/EAT
Any drive letter other than the primary system drive (which is generally C).

Click the *Scan *button and when the scan is finished, click *Save* and save the log in Notepad with the name ark.txt to your desktop.

*Note: It's important that all other windows be closed and that you don't touch the mouse or do anything with the computer during the scan as it may cause it to freeze. You should disable your screen saver as if it comes on it may cause the program to freeze.*

Open the ark.txt file and copy and paste the contents of the log here please.


----------



## itrocks4u (Nov 27, 2004)

Hi, what would you like me to do first? Malwarebytes or DDS/GMER?

Malwarebytes tend to take really long.


----------



## Cookiegal (Aug 27, 2003)

I'm signing off for the night now so it doesn't matter. Please do them all and I'll check them in the morning.

Also, I think the problem with the WD drive (which I assume is the "h" drive) may be the firewall. This looks like it's related:

"\\\\MyBookLive\\Public\\Software\\AirVideoServer\\AirVideoServer.exe"=

But it doesn't have a proper path in front of My Book Live. Can you tell me where that is located, is it on the D drive in a folder called MyBookLive? Or is it on the "h" drive?

Why is your main drive D rather than C?


----------



## itrocks4u (Nov 27, 2004)

Here are the drives I have, I honestly have no idea why D is the main drive. That was always the case since I bought the computer quite a few years ago. 

In addition, I have another internal drive installed i.e. H.

My Book Live (Western Digital) is connected to my router and the shortcut is mapped currently as "S:" for the public folder at mybooklive.

AirVideoServer is what I installed so I can stream music/movies from the computer to my iphone.


----------



## itrocks4u (Nov 27, 2004)

Attach.txt

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_11-03-05.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 15/10/2004 11:03:08 PM
System Uptime: 15/04/2011 12:49:22 AM (1 hours ago)
.
Motherboard: Intel Corporation | | D865GBF 
Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz | J2E1 | 2793/133mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (FAT32) - 5 GiB total, 0.943 GiB free.
D: is FIXED (NTFS) - 70 GiB total, 4.1 GiB free.
E: is CDROM ()
F: is CDROM ()
G: is CDROM (CDFS)
H: is FIXED (NTFS) - 466 GiB total, 154.531 GiB free.
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP677: 25/03/2011 8:36:51 PM - System Checkpoint
RP678: 26/03/2011 9:24:53 PM - System Checkpoint
RP679: 27/03/2011 3:17:02 AM - Software Distribution Service 3.0
RP680: 28/03/2011 5:06:30 PM - System Checkpoint
RP681: 29/03/2011 11:12:34 PM - System Checkpoint
RP682: 01/04/2011 2:45:00 PM - System Checkpoint
RP683: 03/04/2011 1:26:54 AM - System Checkpoint
RP684: 04/04/2011 12:29:21 PM - System Checkpoint
RP685: 05/04/2011 12:59:15 PM - System Checkpoint
RP686: 06/04/2011 1:37:15 PM - System Checkpoint
RP687: 07/04/2011 2:07:15 PM - System Checkpoint
RP688: 08/04/2011 3:03:51 PM - System Checkpoint
RP689: 09/04/2011 4:26:41 PM - System Checkpoint
RP690: 10/04/2011 12:20:27 AM - Installed Windows Defender
RP691: 10/04/2011 1:34:09 PM - Windows Defender Checkpoint
RP692: 11/04/2011 10:25:43 PM - System Checkpoint
RP693: 12/04/2011 12:48:50 AM - Installed HiJackThis
RP694: 13/04/2011 12:58:19 AM - Removed WD SmartWare Drive Manager
RP695: 13/04/2011 1:08:09 AM - Installed SES Driver
RP696: 14/04/2011 3:14:47 AM - System Checkpoint
.
==== Installed Programs ======================
.
"Transport Canada - CDE Sample"
µTorrent
AAC Decoder
Abacast Distributed Live
Ace DivX Player
Ad-Aware SE Personal
Adobe Acrobat 5.0
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Photoshop CS
Adobe Reader 8.1.1
Adobe Shockwave Player 11
Aimersoft DVD to iPhone Converter(Build 1.0.21)
Aimersoft iPhone Converter Suite(Build 1.0.23)
Aimersoft iPhone Video Converter(Build 1.1.0)
Air Video Server 2.4.3
AndreaMosaic 3.21
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ArcSoft PhotoImpression 4
Athan Basic 3.3
ATI - Software Uninstall Utility
ATI Display Driver
ATI HydraVision
AutoCAD 2005 - English
AutoCAD LT 2002
AutoUpdate
AV Voice Changer Software DIAMOND 4.0
AviSynth 2.5
AXIS Media Control Embedded
Before You Know It 3.5 Lite 
BFC Private Reference Library
BlackBerry Desktop Software 6.0.1
Blaze Audio Voice Cloak Trial
Bonjour
Bubble Struggle 1.2
CANTAX T2Plus Educational 08.2
CCH Library 4.7
CCleaner (remove only)
CGPA Calculator 2.0
Channel Master
Cinema Craft Encoder SP Version 2.50
Compatibility Pack for the 2007 Office system
CorelDRAW 10
Coupon Printer for Windows
Creative MediaSource
Creative Removable Disk Manager
Creative System Information
Creative Zen MicroPhoto
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Version Checker
DivX Web Player
DVDx 2.2
DVDx 2.3
EAX4 Unified Redist
ESET Online Scanner v3
F-22 Lightning 3
Facebook Plug-In
ffdshow [rev 1723] [2007-12-24]
Flight Log 4.9
GameSpy Arcade
Google Chrome
Google Earth
Google SketchUp
Google Talk (remove only)
Google Talk Plugin
Google Toolbar for Internet Explorer
Google Update Helper
Graphing Calculator Viewer
Graphmatica
H.264 Decoder
HiJackThis
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB954708)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
HP MediaSmart Server
HP Update
Huffyuv AVI lossless video codec (Remove Only)
HyperLoad - Multiplayer Billiards
IMT Labs Plugin
Intel(R) PRO Network Adapters and Drivers
iTunes
Java Auto Updater
Java(TM) 6 Update 20
Java(TM) 6 Update 3
Junk Mail filter update
Lexmark 2200 Series
Lexmark Fax Solutions
LimeWire 4.10.9
LiveUpdate 3.1 (Symantec Corporation)
Logitech Gaming Software
Macromedia Extension Manager
Macromedia Flash 8
Macromedia Flash 8 Video Encoder
Malwarebytes' Anti-Malware
Medal of Honor Allied Assault
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Games for Windows - LIVE 
Microsoft Games for Windows - LIVE Redistributable
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
Microsoft Money 2004
Microsoft Money 2004 System Pack
Microsoft National Language Support Downlevel APIs
Microsoft Office 2000 Premium
Microsoft Office Live Web Folder Connector
Microsoft Picture It! Photo Premium 9
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Streets and Trips 2004
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Word 2002
Microsoft Works
Microsoft Works 2004 Setup Launcher
Microsoft Works Suite Add-in for Microsoft Word
MKV Splitter
MobileMe Control Panel
Move Networks Media Player for Internet Explorer
Mozilla Firefox (1.5.0.12)
MSN Toolbar
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser (KB925673)
MSXML4SP2
Need for Speed™ Undercover
Nero OEM
Netscape (7.2)
Nokia Connectivity Cable Driver
NOMAD MuVo
Norton PC Checkup
NVIDIA Display Control Panel
NVIDIA Drivers
NVIDIA DVD Decoder
NVIDIA nView Desktop Manager
OpenMG Limited Patch 4.1-05-13-31-01
OpenMG Secure Module 4.1.00
Panda ActiveScan
PHStat2
Picasa 2
Picture Package
Post-it® Software Notes Lite
PowerDVD
PS3 Media Server
PunkBuster Services
QuickTime
Rockstar Games Social Club
SAMSUNG CDMA Modem Driver Set
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software
Samsung PC Studio
Samsung PC Studio 3 USB Driver Installer
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 7 (KB974455)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Internet Explorer 7 (KB978207)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Segoe UI
SES Driver
Shockwave
ShortKeys Lite
SIW version 2008-12-16
Skype web features
Skype™ 4.1
SmartDraw VP
Soap 3.0 Toolkit
SonicStage 3.0
Sony USB Driver
SoundMAX
Spybot - Search & Destroy 1.4
Symantec AntiVirus
System Requirements Lab
Turing
TVersity Codec Pack 1.2
TVersity Media Server 1.5 Beta
UFile 2009
UFile 2010
UFile Updater 2009
UFile Updater 2010
Uninstall JL2005A Toy Camera
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 7 (KB976749)
Update for Windows Internet Explorer 7 (KB980182)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows Internet Explorer 8 (KB980302)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VC80CRTRedist - 8.0.50727.762
VFR Plus 1.1
Videora iPod Converter 5.04
VLC media player 0.9.9
Vodafone 804SS USB driver Software
VoiceSFX Trial
WD SmartWare Drive Manager
WebFldrs XP
Winamp (remove only)
Windows Defender
Windows Genuine Advantage Validation Tool (KB892130)
Windows Home Server Connector
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live OneCare safety scanner
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Upload Tool
Windows Live Writer
Windows Media Format 11 runtime
Windows Media Player 10
Windows Presentation Foundation
Windows XP Service Pack 3
WinMX
WinRAR archiver
WinZip
XML Paper Specification Shared Components Pack 1.0
Yahoo! Address AutoComplete
Yahoo! Install Manager
Yahoo! Internet Mail
Yahoo! Messenger
ZoneAlarm
.
==== Event Viewer Messages From Past Week ========
.
15/04/2011 12:50:00 AM, error: Dhcp [1002] - The IP address lease 192.168.1.9 for the Network Card with network address 000CF1ED3B89 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
14/04/2011 2:46:18 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the nvsvc service.
13/04/2011 8:26:59 PM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer OMERHUMAYUN-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{728CE3A6-0C29. The master browser is stopping or an election is being forced.
13/04/2011 8:03:59 PM, error: Dhcp [1002] - The IP address lease 192.168.1.6 for the Network Card with network address 000CF1ED3B89 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
13/04/2011 1:00:26 AM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
11/04/2011 9:00:43 PM, error: Service Control Manager [7023] - The Automatic Updates service terminated with the following error: The specified module could not be found.
11/04/2011 9:00:43 PM, error: Service Control Manager [7000] - The Sunbelt CounterSpy Antispyware service failed to start due to the following error: The system cannot find the path specified.
11/04/2011 9:00:43 PM, error: Service Control Manager [7000] - The Secdrv service failed to start due to the following error: The system cannot find the file specified.
10/04/2011 12:12:30 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
09/04/2011 4:55:18 PM, error: Service Control Manager [7034] - The SonicStage SCSI Service service terminated unexpectedly. It has done this 1 time(s).
09/04/2011 4:55:18 PM, error: Service Control Manager [7034] - The iPod Service service terminated unexpectedly. It has done this 1 time(s).
09/04/2011 4:12:32 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
09/04/2011 4:07:26 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
09/04/2011 3:22:33 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD eeCtrl Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss SAVRTPEL sf SPBBCDrv SYMTDI Tcpip vsdatant WS2IFSL
09/04/2011 11:46:06 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
09/04/2011 11:37:42 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
09/04/2011 11:10:32 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD eeCtrl Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss SAVRTPEL sf SYMTDI Tcpip vsdatant WS2IFSL
09/04/2011 11:10:32 PM, error: Service Control Manager [7001] - The Windows Home Server Connector Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
09/04/2011 11:10:32 PM, error: Service Control Manager [7001] - The TrueVector Internet Monitor service depends on the vsdatant service which failed to start because of the following error: A device attached to the system is not functioning.
09/04/2011 11:10:32 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD Networking Support Environment service which failed to start because of the following error: A device attached to the system is not functioning.
09/04/2011 11:10:32 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
09/04/2011 11:10:32 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
09/04/2011 11:10:32 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
09/04/2011 11:10:32 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
09/04/2011 11:10:32 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
09/04/2011 11:07:20 PM, error: Service Control Manager [7034] - The Bonjour Service service terminated unexpectedly. It has done this 1 time(s).
09/04/2011 10:37:25 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Apple Mobile Device service to connect.
09/04/2011 10:37:25 PM, error: Service Control Manager [7000] - The Apple Mobile Device service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
09/04/2011 10:36:47 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Symantec Settings Manager service to connect.
09/04/2011 10:36:27 PM, error: Service Control Manager [7034] - The Symantec Event Manager service terminated unexpectedly. It has done this 1 time(s).
09/04/2011 10:36:27 PM, error: Service Control Manager [7034] - The LexBce Server service terminated unexpectedly. It has done this 1 time(s).
09/04/2011 10:36:27 PM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
09/04/2011 10:36:27 PM, error: Service Control Manager [7034] - The IMAPI CD-Burning COM Service service terminated unexpectedly. It has done this 1 time(s).
09/04/2011 10:36:27 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Windows Home Server Connector Service service to connect.
09/04/2011 10:36:27 PM, error: Service Control Manager [7000] - The Windows Home Server Connector Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
09/04/2011 10:36:26 PM, error: Service Control Manager [7034] - The TVersityMediaServer service terminated unexpectedly. It has done this 1 time(s).
09/04/2011 10:36:26 PM, error: Service Control Manager [7034] - The Symantec Settings Manager service terminated unexpectedly. It has done this 1 time(s).
09/04/2011 10:36:26 PM, error: Service Control Manager [7034] - The Symantec AntiVirus Definition Watcher service terminated unexpectedly. It has done this 1 time(s).
09/04/2011 10:36:26 PM, error: Service Control Manager [7034] - The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s).
09/04/2011 10:36:26 PM, error: Service Control Manager [7031] - The Windows Home Server Connector Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
09/04/2011 10:36:26 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the SonicStage SCSI Service service to connect.
09/04/2011 10:36:26 PM, error: Service Control Manager [7000] - The SonicStage SCSI Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
09/04/2011 10:36:26 PM, error: Service Control Manager [7000] - The iPod Service service failed to start due to the following error: Access is denied.
09/04/2011 10:36:26 PM, error: DCOM [10005] - DCOM got error "%5" attempting to start the service iPod Service with arguments "" in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}
09/04/2011 10:36:26 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service SSScsiSV with arguments "-Service" in order to run the server: {C671F780-ADB4-4D15-A97C-F0F5596DB6C9}
09/04/2011 10:36:25 PM, error: Service Control Manager [7034] - The WDDMService service terminated unexpectedly. It has done this 1 time(s).
09/04/2011 10:36:25 PM, error: Service Control Manager [7031] - The Symantec AntiVirus service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.
09/04/2011 10:36:24 PM, error: Service Control Manager [7034] - The SoundMAX Agent Service service terminated unexpectedly. It has done this 1 time(s).
09/04/2011 10:36:24 PM, error: Service Control Manager [7034] - The PunkBuster service terminated unexpectedly. It has done this 1 time(s).
09/04/2011 10:36:24 PM, error: Service Control Manager [7034] - The Creative Service for CDROM Access service terminated unexpectedly. It has done this 1 time(s).
09/04/2011 10:36:24 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
09/04/2011 10:34:42 PM, error: Service Control Manager [7024] - The Symantec SPBBCSvc service terminated with service-specific error 4294967295 (0xFFFFFFFF).
.
==== End Of File ===========================


----------



## itrocks4u (Nov 27, 2004)

DDS.txt

.
DDS (Ver_11-03-05.01) - NTFSx86 
Run by Ours at 1:53:31.23 on 15/04/2011
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.180 [GMT -4:00]
.
AV: Symantec AntiVirus Corporate Edition *Disabled/Updated* {FB06448E-52B8-493A-90F3-E43226D3305C}
FW: ZoneAlarm Firewall *Disabled* 
.
============== Running Processes ===============
.
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
D:\Program Files\Windows Defender\MsMpEng.exe
D:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
D:\WINDOWS\system32\LEXBCES.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\LEXPPS.EXE
svchost.exe
D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
D:\WINDOWS\System32\CTsvcCDA.exe
D:\Program Files\Symantec AntiVirus\DefWatch.exe
D:\Program Files\Java\jre6\bin\jqs.exe
H:\Program Files\EA Games\Need for Speed Undercover\PB\PnkBstrA.exe
D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
D:\WINDOWS\System32\svchost.exe -k imgsvc
D:\Program Files\Symantec AntiVirus\Rtvscan.exe
D:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
D:\Program Files\Windows Home Server\WHSConnector.exe
D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
D:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe
D:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
D:\Program Files\IMT Labs Messenger Plugin\Cloud.exe
D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
D:\Program Files\Lexmark 2200 Series\lxbvbmon.exe
D:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
D:\Program Files\Athan\Athan.exe
D:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
D:\Program Files\Common Files\Symantec Shared\ccApp.exe
D:\PROGRA~1\SYMANT~1\VPTray.exe
D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
D:\Program Files\Common Files\Java\Java Update\jusched.exe
D:\WINDOWS\system32\RUNDLL32.EXE
H:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\Windows Live\Messenger\msnmsgr.exe
D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
H:\Program Files\AirVideoServer\AirVideoServer.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\WINDOWS\System32\svchost.exe -k HTTPFilter
D:\WINDOWS\system32\wscntfy.exe
D:\Program Files\Google\Chrome\Application\chrome.exe
D:\Program Files\Google\Chrome\Application\chrome.exe
D:\Program Files\Google\Chrome\Application\chrome.exe
D:\Documents and Settings\Ours\Desktop\dds.pif
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - d:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - d:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - d:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: BrowserHelper Class: {9a065c65-4ee7-4ddd-9918-f129089a894a} - d:\program files\windows home server\WHSDeskBands.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - d:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - d:\program files\google\googletoolbarnotifier\5.6.6209.1142\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - d:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - d:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Home Server Banner: {d73e76a3-f902-45bd-8fc8-95ae8e014671} - d:\program files\windows home server\WHSDeskBands.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - d:\program files\google\google toolbar\GoogleToolbar_32.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
uRun: [msnmsgr] "d:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [Creative Detector] "d:\program files\creative\mediasource\detector\CTDetect.exe" /R
uRun: [swg] "d:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [Google Update] "d:\documents and settings\ours\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [AirVideoServer] h:\program files\airvideoserver\AirVideoServer.exe
uRun: [ctfmon.exe] d:\windows\system32\ctfmon.exe
mRun: [SoundMAXPnP] d:\program files\analog devices\soundmax\SMax4PNP.exe
mRun: [Lexmark 2200 Series] "d:\program files\lexmark 2200 series\lxbvbmgr.exe"
mRun: [FaxCenterServer] "d:\program files\lexmark fax solutions\fm3032.exe" /s
mRun: [Microsoft Works Update Detection] d:\program files\common files\microsoft shared\works shared\WkUFind.exe
mRun: [CloudPlugin] "d:\program files\imt labs messenger plugin\Cloud.exe"
mRun: [RemoteControl] "d:\program files\cyberlink\powerdvd\PDVDServ.exe"
mRun: [SsAAD.exe] d:\progra~1\sony\sonics~1\SsAAD.exe
mRun: [Athan] d:\program files\athan\Athan.exe
mRun: [NeroFilterCheck] d:\windows\system32\NeroCheck.exe
mRun: [ZoneAlarm Client] "d:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [ccApp] "d:\program files\common files\symantec shared\ccApp.exe"
mRun: [vptray] d:\progra~1\symant~1\VPTray.exe
mRun: [HP Software Update] d:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [AppleSyncNotifier] d:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [Adobe Reader Speed Launcher] "d:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [SunJavaUpdateSched] "d:\program files\common files\java\java update\jusched.exe"
mRun: [nwiz] d:\program files\nvidia corporation\nview\nwiz.exe /installquiet
mRun: [NvMediaCenter] RUNDLL32.EXE d:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE d:\windows\system32\NvCpl.dll,NvStartup
mRun: [QuickTime Task] "d:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "h:\program files\itunes\iTunesHelper.exe"
StartupFolder: d:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - d:\program files\microsoft office\office\OSA9.EXE
StartupFolder: d:\docume~1\alluse~1\startm~1\programs\startup\wddmst~1.lnk - d:\program files\western digital\wd smartware\wd drive manager\WDDMStatus.exe
IE: &Download with Download Accelerator Lite - d:\program files\download accelerator lite\dal.htm
IE: Google Sidewiki... - d:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - d:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - d:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {5067A26B-1337-4436-8AFE-EE169C2DA79F} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - d:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - d:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
DPF: DirectAnimation Java Classes - file://d:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://d:\windows\java\classes\xmldso.cab
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {983A9C21-8207-4B58-BBB8-0EBC3D7C5505} - hxxp://beowulf.schulich.yorku.ca/dwa8W.cab
DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} - hxxp://www.crucial.com/controls/cpcScanner.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - d:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: NavLogon - d:\windows\system32\NavLogon.dll
Notify: WRNotifier - WRLogonNTF.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - d:\windows\system32\WPDShServiceObj.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - d:\progra~1\wifd1f~1\MpShHook.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - d:\docume~1\ours\applic~1\mozilla\firefox\profiles\s0mrbavn.default\
FF - prefs.js: browser.search.selectedEngine - Google
.
============= SERVICES / DRIVERS ===============
.
R1 SAVRTPEL;SAVRTPEL;d:\program files\symantec antivirus\Savrtpel.sys [2006-9-6 54968]
R1 vsdatant;vsdatant;d:\windows\system32\vsdatant.sys [2006-4-22 394952]
R2 ccEvtMgr;Symantec Event Manager;d:\program files\common files\symantec shared\ccEvtMgr.exe [2006-7-19 192160]
R2 ccSetMgr;Symantec Settings Manager;d:\program files\common files\symantec shared\ccSetMgr.exe [2006-7-19 169632]
R2 eusk2par;EUTRON SmartKey Parallel Driver;d:\windows\system32\drivers\eusk2par.sys [2005-6-7 16695]
R2 Symantec AntiVirus;Symantec AntiVirus;d:\program files\symantec antivirus\Rtvscan.exe [2006-9-27 1813232]
R2 Vcs;Vcs support;d:\windows\system32\drivers\Vcs.sys [2005-4-17 6852]
R2 WDDMService;WDDMService;d:\program files\western digital\wd smartware\wd drive manager\WDDMService.exe [2010-9-8 237056]
R2 WHSConnector;Windows Home Server Connector Service;d:\program files\windows home server\WHSConnector.exe [2007-9-6 302112]
R2 WinDefend;Windows Defender;d:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;d:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-5-28 102448]
R3 NAVENG;NAVENG;d:\progra~1\common~1\symant~1\virusd~1\20110414.002\naveng.sys [2011-4-14 86136]
R3 NAVEX15;NAVEX15;d:\progra~1\common~1\symant~1\virusd~1\20110414.002\navex15.sys [2011-4-14 1393144]
R3 SAVRT;SAVRT;d:\program files\symantec antivirus\savrt.sys [2006-9-6 337592]
S2 gupdate1ca597c7db22888;Google Update Service (gupdate1ca597c7db22888);d:\program files\google\update\GoogleUpdate.exe [2009-10-30 133104]
S2 vsmon;TrueVector Internet Monitor;d:\windows\system32\zonelabs\vsmon.exe -service --> d:\windows\system32\zonelabs\vsmon.exe -service [?]
S3 ALSysIO;ALSysIO;\??\d:\docume~1\ours\locals~1\temp\alsysio.sys --> d:\docume~1\ours\locals~1\temp\ALSysIO.sys [?]
S3 cpuz129;cpuz129;\??\d:\docume~1\ours\locals~1\temp\cpuz_x32.sys --> d:\docume~1\ours\locals~1\temp\cpuz_x32.sys [?]
S3 JL2005;JL2005A Toy Camera;d:\windows\system32\drivers\toywdm.sys [2004-6-4 70888]
S3 SavRoam;SAVRoam;d:\program files\symantec antivirus\SavRoam.exe [2006-9-27 116464]
.
=============== File Associations ===============
.
.scr=AutoCADScriptFile
.
=============== Created Last 30 ================
.
2011-04-13 05:02:42	--------	d-----w-	d:\program files\Western Digital
2011-04-12 04:48:52	388096	----a-r-	d:\docume~1\ours\applic~1\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-04-10 19:35:33	--------	d-----w-	d:\program files\ESET
2011-04-10 04:28:43	6792528	----a-w-	d:\docume~1\alluse~1\applic~1\microsoft\windows defender\definition updates\{dc194a78-5bef-4757-bb0d-7ab01defa6fc}\mpengine.dll
2011-04-10 04:28:05	6792528	----a-w-	d:\docume~1\alluse~1\applic~1\microsoft\windows defender\definition updates\backup\mpengine.dll
2011-04-10 04:27:58	222080	------w-	d:\windows\system32\MpSigStub.exe
2011-04-10 04:21:43	--------	d-----w-	d:\docume~1\ours\locals~1\applic~1\PCHealth
2011-04-10 03:47:40	89088	----a-w-	d:\windows\MBR.exe
2011-04-10 03:47:40	256512	----a-w-	d:\windows\PEV.exe
2011-04-10 03:47:24	--------	d-----w-	D:\ComboFix
2011-03-24 04:20:34	--------	d-----w-	d:\docume~1\ours\locals~1\applic~1\AirVideoServer
2011-03-21 02:32:16	--------	d-----w-	d:\docume~1\ours\locals~1\applic~1\Western Digital
2011-03-19 00:07:43	--------	d-----w-	d:\docume~1\ours\applic~1\SmartDraw
2011-03-18 23:57:12	--------	d-----w-	d:\program files\SmartDraw VP
.
==================== Find3M ====================
.
2011-02-09 13:53:52	270848	----a-w-	d:\windows\system32\sbe.dll
2011-02-09 13:53:52	186880	----a-w-	d:\windows\system32\encdec.dll
2011-02-02 07:58:35	2067456	----a-w-	d:\windows\system32\mstscax.dll
2011-01-27 11:57:06	677888	----a-w-	d:\windows\system32\mstsc.exe
2011-01-21 14:44:37	439296	----a-w-	d:\windows\system32\shimgvw.dll
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: WDC_WD800BB-00JKA0 rev.05.01C05 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntoskrnl.exe >>UNKNOWN [0x86F8BC78]<< 
_asm { MOV EAX, 0x86f8bb98; XCHG [ESP], EAX; PUSH EAX; PUSH 0x86fd7684; RET ; ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL; }
1 nt!IofCallDriver[0x804E37D5] -> \Device\Harddisk0\DR0[0x86EE1AB8]
\Driver\Disk[0x86F60A08] -> IRP_MJ_CREATE -> 0x86F8BC78
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
detected hooks:
\Driver\Disk -> 0x86f8bc78
user & kernel MBR OK 
Warning: possible MBR rootkit infection !
.
============= FINISH: 1:55:27.32 ===============


----------



## itrocks4u (Nov 27, 2004)

the "gmer" has been running since last night at 2AM, its 11AM now. is that normal? lol


----------



## Cookiegal (Aug 27, 2003)

No it's not. Let's try a different one.


Download RootRepeal from the following location and save it to your desktop.
*Zip Mirrors*
Primary Mirror
Secondary Mirror
Secondary Mirror


Extract RootRepeal.exe from the archive.
Open RootRepeal on your desktop.

Run a full scan.

Be sure to close all other browser windows and let the scan run without interference.

Also, please do this:

Please download *MBRCheck.exe* to your desktop.

Be sure to disable your security programs prior to running the tool. 
Double click on MBRCheck.exe to run it. Please allow any prompts popped by Windows in order to run the tool.
_(Vista and Windows 7 users will have to confirm the UAC prompt)_
A command window will pop open and run. If any unknown MBR Code is found, you will have further options prompted, at this time please press *N* then press *Enter*.
Press *Enter* again to exit the program.
If nothing unusual is found, you will be shown the machine MBR status. Just press *Enter* to exit.
A text file named *MBRCheck_mm.dd.yy_hh.mm.ss* should appear on your deskop. Please post the contents of that file.


----------



## itrocks4u (Nov 27, 2004)

ok finally it stopped. Here's ark.txt. I'm runing malwarebytes now. Will post that log shortly as well:

GMER 1.0.15.15570 - http://www.gmer.net
Rootkit scan 2011-04-15 12:26:20
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD800BB-00JKA0 rev.05.01C05
Running: l2y50v4i.exe; Driver: D:\DOCUME~1\Ours\LOCALS~1\Temp\ffldipow.sys

---- System - GMER 1.0.15 ----

SSDT 86D2D0E8 ZwAlertResumeThread
SSDT 86CF7860 ZwAlertThread
SSDT 86E2B398 ZwAllocateVirtualMemory
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwConnectPort [0xF286A040]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreateFile [0xF2866930]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreateKey [0xF2871A80]
SSDT 86F4D300 ZwCreateMutant
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreatePort [0xF286A510]
SSDT 86D63220 ZwCreateThread
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreateWaitablePort [0xF286A600]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwDeleteFile [0xF2866F20]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwDeleteKey [0xF28726E0]
SSDT \??\D:\Program Files\Symantec\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteValueKey [0xF28D3350]
SSDT sptd.sys ZwEnumerateKey [0xF7537C7E]
SSDT sptd.sys ZwEnumerateValueKey [0xF7537FF6]
SSDT 86DBAA90 ZwFreeVirtualMemory
SSDT 86D2F2F8 ZwImpersonateAnonymousToken
SSDT 86CF70E8 ZwImpersonateThread
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwLoadKey [0xF28728B0]
SSDT 86D83960 ZwMapViewOfSection
SSDT 86DB5B48 ZwOpenEvent
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwOpenFile [0xF2866D70]
SSDT sptd.sys ZwOpenKey [0xF7537A18]
SSDT 86DC47C0 ZwOpenProcessToken
SSDT 86D83118 ZwOpenThreadToken
SSDT sptd.sys ZwQueryKey [0xF75380C0]
SSDT 86DAD440 ZwQueryValueKey
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwRenameKey [0xF2873250]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwReplaceKey [0xF2872CB0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwRequestWaitReplyPort [0xF2869C00]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwRestoreKey [0xF2873080]
SSDT 86C5E2C8 ZwResumeThread
SSDT 86DA71F0 ZwSetContextThread
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwSetInformationFile [0xF2867120]
SSDT 86D2EB00 ZwSetInformationProcess
SSDT 86D42808 ZwSetInformationThread
SSDT \??\D:\Program Files\Symantec\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwSetValueKey [0xF28D3580]
SSDT 86D9B3A0 ZwSuspendProcess
SSDT 86C8C2C0 ZwSuspendThread
SSDT 86DEAF28 ZwTerminateProcess
SSDT 86D31A08 ZwTerminateThread
SSDT 86D3CC10 ZwUnmapViewOfSection
SSDT 86E35E98 ZwWriteVirtualMemory

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!_abnormal_termination + 7C 804E26E8 8 Bytes CALL E0D4F9BD 
.text ntoskrnl.exe!_abnormal_termination + 1B8 804E2824 4 Bytes CALL 50D4F799 
? D:\WINDOWS\system32\drivers\sptd.sys The process cannot access the file because it is being used by another process.
? D:\WINDOWS\System32\Drivers\SPTD2253.SYS The process cannot access the file because it is being used by another process.
? srescan.sys The system cannot find the file specified. !
.text D:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF60573A0, 0x59FFE5, 0xE8000020]
.text dtscsi.sys!A0DB34FC6FE35D429A28ADDE5467D4D7 F5E524D0 16 Bytes [10, D0, F9, ED, B8, 91, C3, ...]
.text dtscsi.sys!A0DB34FC6FE35D429A28ADDE5467D4D7 + 11 F5E524E1 31 Bytes [10, E5, F5, 51, 78, FE, 29, ...]
? D:\WINDOWS\System32\Drivers\dtscsi.sys The process cannot access the file because it is being used by another process.
? D:\DOCUME~1\Ours\LOCALS~1\Temp\mbr.sys The system cannot find the file specified. !

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 86F8BA40

AttachedDevice \FileSystem\Ntfs \Ntfs SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)

Device \FileSystem\Fastfat \FatCdrom 86B71EB0
Device \Driver\Tcpip \Device\Ip vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
Device \Driver\00000140 \Device\00000051 sptd.sys
Device \Driver\Tcpip \Device\Tcp vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
Device \Driver\Ftdisk \Device\HarddiskVolume1 86F8B0E8
Device \Driver\Ftdisk \Device\HarddiskVolume2 86F8B0E8
Device \Driver\Cdrom \Device\CdRom0 86CF7700
Device \FileSystem\Rdbss \Device\FsWrap 86D63A70
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 [F74ADB40] atapi.sys[unknown section] {MOV EAX, 0x86f8bdd0; XCHG [ESP], EAX; PUSH EAX; PUSH 0xf7548442; RET }
Device \Driver\atapi \Device\Ide\IdePort0 [F74ADB40] atapi.sys[unknown section] {MOV EAX, 0x86f8bdd0; XCHG [ESP], EAX; PUSH EAX; PUSH 0xf7548442; RET }
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-24  [F74ADB40] atapi.sys[unknown section] {MOV EAX, 0x86f8bdd0; XCHG [ESP], EAX; PUSH EAX; PUSH 0xf7548442; RET }
Device \Driver\atapi \Device\Ide\IdePort1 [F74ADB40] atapi.sys[unknown section] {MOV EAX, 0x86f8bdd0; XCHG [ESP], EAX; PUSH EAX; PUSH 0xf7548442; RET }
Device \Driver\atapi \Device\Ide\IdePort2 [F74ADB40] atapi.sys[unknown section] {MOV EAX, 0x86f8bdd0; XCHG [ESP], EAX; PUSH EAX; PUSH 0xf7548442; RET }
Device \Driver\atapi \Device\Ide\IdePort3 [F74ADB40] atapi.sys[unknown section] {MOV EAX, 0x86f8bdd0; XCHG [ESP], EAX; PUSH EAX; PUSH 0xf7548442; RET }
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-1c [F74ADB40] atapi.sys[unknown section] {MOV EAX, 0x86f8bdd0; XCHG [ESP], EAX; PUSH EAX; PUSH 0xf7548442; RET }
Device \Driver\atapi \Device\Ide\IdeDeviceP3T0L0-10 [F74ADB40] atapi.sys[unknown section] {MOV EAX, 0x86f8bdd0; XCHG [ESP], EAX; PUSH EAX; PUSH 0xf7548442; RET }
Device \Driver\Ftdisk \Device\HarddiskVolume3 86F8B0E8
Device \Driver\Cdrom \Device\CdRom1 86CF7700
Device \Driver\Cdrom \Device\CdRom2 86CF7700
Device \Driver\NetBT \Device\NetBt_Wins_Export 86D890E8
Device \Driver\NetBT \Device\NetbiosSmb 86D890E8
Device \Driver\NetBT \Device\NetBT_Tcpip_{728CE3A6-0C29-4AED-B2E7-BDDDEB9BFB5A} 86D890E8
Device \Driver\Tcpip \Device\Udp vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
Device \Driver\Disk \Device\Harddisk0\DR0 86F8BC78
Device \Driver\Tcpip \Device\RawIp vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
Device \Driver\Disk \Device\Harddisk1\DR1 86F8BC78
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 86D3F0E8
Device \Driver\Tcpip \Device\IPMULTICAST vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
Device \FileSystem\MRxSmb \Device\LanmanRedirector 86D3F0E8
Device \FileSystem\Npfs \Device\NamedPipe 86C1E0E8
Device \Driver\Ftdisk \Device\FtControl 86F8B0E8
Device \FileSystem\Msfs \Device\Mailslot 86B9D0E8
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port4Path0Target0Lun0 86D2E0E8
Device \Driver\dtscsi \Device\Scsi\dtscsi1  86D2E0E8
Device \FileSystem\Fastfat \Fat 86B71EB0

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \FileSystem\Cdfs \Cdfs 86B28EB0

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\[email protected] -1306225502
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\[email protected] 1232483542
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\[email protected] -1975637897
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\[email protected] 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\[email protected] D:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\[email protected] 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\[email protected] 0x2B 0xCB 0x9A 0xA7 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\[email protected] 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\[email protected] 0xE3 0xF6 0xA5 0x1E ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\[email protected] 0x54 0x50 0x6F 0x6E ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) 
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\[email protected] D:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\[email protected] 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\[email protected] 0x2B 0xCB 0x9A 0xA7 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet) 
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\[email protected] 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\[email protected] 0xE3 0xF6 0xA5 0x1E ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) 
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\[email protected] 0x40 0xD2 0x46 0x68 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) 
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\[email protected] D:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\[email protected] 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\[email protected] 0x2B 0xCB 0x9A 0xA7 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet) 
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\[email protected] 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\[email protected] 0xE3 0xF6 0xA5 0x1E ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) 
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\[email protected] 0x40 0xD2 0x46 0x68 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) 
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\[email protected] D:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\[email protected] 0
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\[email protected] 0x2B 0xCB 0x9A 0xA7 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet) 
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\[email protected] 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\[email protected] 0xE3 0xF6 0xA5 0x1E ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) 
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\[email protected] 0x54 0x50 0x6F 0x6E ...

---- EOF - GMER 1.0.15 ----


----------



## Cookiegal (Aug 27, 2003)

Please post the MBRCheck log as well.

Also, you should uninstall Daemon Tools as it will cause conflicts with the rootkit scanners.


----------



## itrocks4u (Nov 27, 2004)

Here's Malwarebytes. Running MBR now.. IT seems like my computer has become wayy slower than before. Are there a lot of infections...

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6366

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

15/04/2011 6:37:26 PM
mbam-log-2011-04-15 (18-37-26).txt

Scan type: Full scan (C:\|D:\|H:\|)
Objects scanned: 371238
Time elapsed: 5 hour(s), 3 minute(s), 27 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 6

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUP.EXE (Heuristics.Shuriken) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8B498502-1218-11CF-ADC4-00A0D100041B} (Malware.Packer.Gen) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
d:\autocad 2002 lt\SETUP.EXE (Heuristics.Shuriken) -> Quarantined and deleted successfully.
d:\qoobox\quarantine\D\WINDOWS\softwareprotection\windows external security update.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
d:\WINDOWS\softwareprotection\cod4 serial database.ptn (Trojan.Agent) -> Quarantined and deleted successfully.
d:\WINDOWS\system32\ecesq.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully.
d:\WINDOWS\system32\t5rdv.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully.
d:\END (Trojan.FakeAlert) -> Quarantined and deleted successfully.


----------



## itrocks4u (Nov 27, 2004)

Do you want me to run Rootrepeal.exe as well in addition to MBR?


----------



## itrocks4u (Nov 27, 2004)

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line: 
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x000400fd

Kernel Drivers (total 140):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EF000 \WINDOWS\system32\hal.dll
0xF7B23000 \WINDOWS\system32\KDCOM.DLL
0xF7A33000 \WINDOWS\system32\BOOTVID.dll
0xF7623000 nppee.sys
0xF7532000 sptd.sys
0xF7B25000 \WINDOWS\System32\Drivers\WMILIB.SYS
0xF751A000 \WINDOWS\System32\Drivers\SPTD2253.SYS
0xF74EC000 ACPI.sys
0xF74DB000 pci.sys
0xF7633000 isapnp.sys
0xF7BEB000 pciide.sys
0xF78A3000 \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
0xF7643000 MountMgr.sys
0xF74BC000 ftdisk.sys
0xF78AB000 PartMgr.sys
0xF7653000 VolSnap.sys
0xF74A4000 atapi.sys
0xF7663000 disk.sys
0xF7673000 \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
0xF7484000 fltmgr.sys
0xF7472000 sr.sys
0xF7683000 PxHelp20.sys
0xF745B000 KSecDD.sys
0xF73CE000 Ntfs.sys
0xF73A1000 NDIS.sys
0xF738D000 srescan.sys
0xF7373000 Mup.sys
0xF7693000 agp440.sys
0xF76D3000 \SystemRoot\System32\DRIVERS\intelppm.sys
0xF60B5000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xF6006000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF79C3000 \SystemRoot\System32\DRIVERS\usbuhci.sys
0xF5FE2000 \SystemRoot\System32\DRIVERS\USBPORT.SYS
0xF79D3000 \SystemRoot\System32\DRIVERS\usbehci.sys
0xF5FBE000 \SystemRoot\System32\DRIVERS\e100b325.sys
0xF7713000 \SystemRoot\System32\DRIVERS\i8042prt.sys
0xF7A13000 \SystemRoot\System32\DRIVERS\kbdclass.sys
0xF7A1B000 \SystemRoot\System32\DRIVERS\fdc.sys
0xF7733000 \SystemRoot\System32\DRIVERS\serial.sys
0xF6C0E000 \SystemRoot\System32\DRIVERS\serenum.sys
0xF5FAA000 \SystemRoot\System32\DRIVERS\parport.sys
0xF6C0A000 \SystemRoot\System32\Drivers\cdrbsvsd.SYS
0xF7743000 \SystemRoot\System32\DRIVERS\imapi.sys
0xF6C06000 \SystemRoot\system32\drivers\pfc.sys
0xF7763000 \SystemRoot\System32\DRIVERS\cdrom.sys
0xF6B62000 \SystemRoot\System32\DRIVERS\redbook.sys
0xF5F87000 \SystemRoot\System32\DRIVERS\ks.sys
0xF78DB000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0xF5550000 \SystemRoot\system32\drivers\smwdm.sys
0xF552C000 \SystemRoot\system32\drivers\portcls.sys
0xF6AF2000 \SystemRoot\system32\drivers\drmk.sys
0xF5514000 \SystemRoot\system32\drivers\aeaudio.sys
0xF78F3000 \SystemRoot\system32\drivers\sf.sys
0xF3C33000 \SystemRoot\System32\Drivers\dtscsi.sys
0xF25C3000 \SystemRoot\System32\Drivers\SCSIPORT.SYS
0xF7D70000 \SystemRoot\System32\DRIVERS\audstub.sys
0xF7BAD000 \SystemRoot\System32\Drivers\RootMdm.sys
0xF7983000 \SystemRoot\System32\Drivers\Modem.SYS
0xF7833000 \SystemRoot\System32\DRIVERS\rasl2tp.sys
0xF47F8000 \SystemRoot\System32\DRIVERS\ndistapi.sys
0xF0B3C000 \SystemRoot\System32\DRIVERS\ndiswan.sys
0xF7853000 \SystemRoot\System32\DRIVERS\raspppoe.sys
0xF7793000 \SystemRoot\System32\DRIVERS\raspptp.sys
0xF7A03000 \SystemRoot\System32\DRIVERS\TDI.SYS
0xF09DE000 \SystemRoot\System32\DRIVERS\psched.sys
0xF77B3000 \SystemRoot\System32\DRIVERS\msgpc.sys
0xF7A0B000 \SystemRoot\System32\DRIVERS\ptilink.sys
0xF799B000 \SystemRoot\System32\DRIVERS\raspti.sys
0xF7993000 \SystemRoot\system32\DRIVERS\RimSerial.sys
0xF77E3000 \SystemRoot\System32\DRIVERS\termdd.sys
0xF79A3000 \SystemRoot\System32\DRIVERS\mouclass.sys
0xF7BAF000 \SystemRoot\System32\DRIVERS\swenum.sys
0xF0813000 \SystemRoot\System32\DRIVERS\update.sys
0xF47F0000 \SystemRoot\system32\drivers\WmBEnum.sys
0xF7703000 \SystemRoot\system32\drivers\WmXlCore.sys
0xF47EC000 \SystemRoot\System32\DRIVERS\mssmbios.sys
0xF7883000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF4773000 \SystemRoot\System32\DRIVERS\usbhub.sys
0xF7BDF000 \SystemRoot\System32\DRIVERS\USBD.SYS
0xF09C6000 \SystemRoot\System32\DRIVERS\flpydisk.sys
0xF7B41000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7C58000 \SystemRoot\System32\Drivers\Null.SYS
0xF7B2B000 \SystemRoot\System32\Drivers\Beep.SYS
0xF79DB000 \SystemRoot\System32\DRIVERS\HIDPARSE.SYS
0xF7A2B000 \SystemRoot\System32\drivers\vga.sys
0xF7B33000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7B43000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF78E3000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF7A23000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF6C1E000 \SystemRoot\System32\DRIVERS\rasacd.sys
0xECD6F000 \SystemRoot\System32\DRIVERS\ipsec.sys
0xECCC1000 \SystemRoot\System32\DRIVERS\tcpip.sys
0xECC6B000 \SystemRoot\System32\Drivers\SYMTDI.SYS
0xECC0D000 \??\D:\Program Files\Symantec\SYMEVENT.SYS
0xECBB1000 \SystemRoot\System32\DRIVERS\netbt.sys
0xECB08000 \SystemRoot\System32\vsdatant.sys
0xED381000 \SystemRoot\System32\drivers\ws2ifsl.sys
0xEB0B4000 \SystemRoot\System32\drivers\afd.sys
0xF6B12000 \SystemRoot\System32\DRIVERS\netbios.sys
0xEE249000 \??\D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys
0xEB08E000 \SystemRoot\System32\DRIVERS\ipnat.sys
0xF6AD2000 \SystemRoot\System32\DRIVERS\wanarp.sys
0xF796B000 \SystemRoot\System32\DRIVERS\usbccgp.sys
0xEB049000 \SystemRoot\System32\DRIVERS\hidusb.sys
0xF77C3000 \SystemRoot\System32\DRIVERS\HIDCLASS.SYS
0xEB1C1000 \??\D:\Program Files\Symantec AntiVirus\Savrtpel.sys
0xEB196000 \SystemRoot\System32\DRIVERS\rdbss.sys
0xEB126000 \SystemRoot\System32\DRIVERS\mrxsmb.sys
0xF043D000 \SystemRoot\System32\Drivers\Fips.SYS
0xEC28D000 \??\D:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
0xEB109000 \??\D:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
0xF0753000 \SystemRoot\System32\DRIVERS\usbscan.sys
0xEE096000 \SystemRoot\System32\DRIVERS\usbprint.sys
0xF073F000 \SystemRoot\System32\DRIVERS\mouhid.sys
0xEB0E5000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xF06E1000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xEC275000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF7B4F000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF116D000 \SystemRoot\System32\drivers\Dxapi.sys
0xF790B000 \SystemRoot\System32\watchdog.sys
0xBD000000 \SystemRoot\System32\drivers\dxg.sys
0xF7C91000 \SystemRoot\System32\drivers\dxgthk.sys
0xBD012000 \SystemRoot\System32\nv4_disp.dll
0xBD61F000 \SystemRoot\System32\ATMFD.DLL
0xEE072000 \SystemRoot\System32\DRIVERS\ndisuio.sys
0xB78C1000 \SystemRoot\System32\DRIVERS\mrxdav.sys
0xB78AC000 \SystemRoot\system32\drivers\wdmaud.sys
0xF07E3000 \SystemRoot\system32\drivers\sysaudio.sys
0xB7807000 \SystemRoot\system32\drivers\kmixer.sys
0xF7B97000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xB7952000 \??\D:\WINDOWS\System32\Drivers\eusk2par.sys
0xB745F000 \SystemRoot\System32\DRIVERS\srv.sys
0xF7B2D000 \??\D:\WINDOWS\System32\Drivers\Vcs.sys
0xB648C000 \SystemRoot\System32\Drivers\HTTP.sys
0xB5FF2000 \??\D:\Program Files\Symantec AntiVirus\savrt.sys
0xB5DFF000 \??\D:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20110414.002\navex15.sys
0xB5DEB000 \??\D:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20110414.002\naveng.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 54):
0 System Idle Process
4 System
700 D:\WINDOWS\system32\smss.exe
764 csrss.exe
788 D:\WINDOWS\system32\winlogon.exe
836 D:\WINDOWS\system32\services.exe
848 D:\WINDOWS\system32\lsass.exe
1012 D:\WINDOWS\system32\nvsvc32.exe
1092 D:\WINDOWS\system32\svchost.exe
1176 svchost.exe
1268 D:\Program Files\Windows Defender\MsMpEng.exe
1312 D:\WINDOWS\system32\svchost.exe
1416 svchost.exe
1556 svchost.exe
304 D:\WINDOWS\system32\LEXBCES.EXE
336 D:\WINDOWS\system32\spoolsv.exe
344 D:\WINDOWS\system32\LEXPPS.EXE
752 svchost.exe
1260 D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1392 D:\Program Files\Bonjour\mDNSResponder.exe
1344 D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
1504 D:\WINDOWS\system32\CTSVCCDA.EXE
1580 D:\Program Files\Symantec AntiVirus\DefWatch.exe
1968 D:\Program Files\Java\jre6\bin\jqs.exe
564 H:\Program Files\EA Games\Need for Speed Undercover\PB\PnkBstrA.exe
1532 D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
1656 D:\WINDOWS\explorer.exe
1864 D:\WINDOWS\system32\svchost.exe
1816 D:\Program Files\Symantec AntiVirus\Rtvscan.exe
1636 D:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
1008 D:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe
2088 D:\Program Files\Lexmark 2200 Series\lxbvbmon.exe
2084 D:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
2112 D:\Program Files\IMT Labs Messenger Plugin\Cloud.exe
2132 D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
2152 D:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
2260 D:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
2312 D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
2328 D:\Program Files\Common Files\Symantec Shared\ccApp.exe
2344 D:\PROGRA~1\SYMANT~1\VPTray.exe
2368 D:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
2400 D:\Program Files\Common Files\Java\Java Update\jusched.exe
2432 D:\WINDOWS\system32\rundll32.exe
2524 H:\Program Files\iTunes\iTunesHelper.exe
2572 D:\Program Files\Windows Live\Messenger\msnmsgr.exe
2612 D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
2648 D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
2700 D:\WINDOWS\system32\ctfmon.exe
3632 D:\WINDOWS\system32\wscntfy.exe
3896 D:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
3972 D:\Program Files\Windows Home Server\WHSConnector.exe
4072 D:\Program Files\iPod\bin\iPodService.exe
2808 alg.exe
3620 D:\Documents and Settings\Ours\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000011`81056800 (FAT32)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\H: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: WDCWD800BB-00JKA0, Rev: 05.01C05
PhysicalDrive1 Model Number: HitachiHDP725050GLA360, Rev: GM4OA52A

Size Device Name MBR Status
--------------------------------------------
74 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A
465 GB \\.\PhysicalDrive1 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Done!


----------



## Cookiegal (Aug 27, 2003)

Download *OTS.exe * to your Desktop. 

Close any open browsers.
If your Real protection or Antivirus interferes with OTS, allow it to run.
Double-click on *OTS.exe* to start the program.
In *Additional Scans *section put a check in Disabled MS Config Items and EventViewer logs
Now click the *Run Scan *button on the toolbar.
Let it run unhindered until it finishes.
When the scan is complete Notepad will open with the report file loaded in it.
Save that notepad file.
Use the *Reply* button, scroll down to the attachments section and attach the notepad file here.


----------



## itrocks4u (Nov 27, 2004)

As requested, I have attached the file.

My computer is now awfully slow. Even google chrome takes a while to load which in the past would take just a few seconds. Every right click takes a while to actually display whats there. 

Is my computer dying? lol


----------



## Cookiegal (Aug 27, 2003)

I had a minor emergency today (and it may not be over yet) so I won't be able to check that log until tomorrow as they take some time to review but just wanted to let you know.


----------



## itrocks4u (Nov 27, 2004)

okay no worries - hope everything get better.


----------



## Cookiegal (Aug 27, 2003)

Start *OTS*. Copy/Paste the information in the code box below into the pane where it says *"Paste fix here"* and then click the "Run Fix" button.

The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the OK button and Notepad will open with a log of actions taken during the fix. Post that information back here along with a new HijackThis log please.


```
[Kill All Processes]
[Unregister Dlls]
[Registry - Safe List]
< Internet Explorer Settings [HKEY_CURRENT_USER\] > -> 
YN -> HKEY_CURRENT_USER\: Main\\"Search Page_bak" -> prosearching.com
< HOSTS File > ([2011/04/10 00:06:25 | 000,000,027 | ---- | M] - 1 lines) -> D:\WINDOWS\system32\drivers\etc\hosts
YN -> Reset Hosts -> 
< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar
YN -> "" [HKLM] -> Reg Error: Key error. []
< Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
YN -> WRNotifier -> 
[Files/Folders - Created Within 30 Days]
NY ->  3 D:\WINDOWS\*.tmp files -> D:\WINDOWS\*.tmp
[Files/Folders - Modified Within 30 Days]
NY ->  7 D:\WINDOWS\Temp\*.tmp files -> D:\WINDOWS\Temp\*.tmp
NY ->  3 D:\WINDOWS\*.tmp files -> D:\WINDOWS\*.tmp
[Files - No Company Name]
NY ->  msjt32.dll -> D:\WINDOWS\msjt32.dll
NY ->  crwq.dll -> D:\WINDOWS\crwq.dll
[Empty Temp Folders]
[Start Explorer]
[Reboot]
```


----------



## itrocks4u (Nov 27, 2004)

OTS log:

All Processes Killed
[Registry - Safe List]
Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Main not found.
HOSTS file reset successfully!
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier\ deleted successfully.
[Files/Folders - Created Within 30 Days]
D:\WINDOWS\002323_.tmp deleted successfully.
D:\WINDOWS\005294_.tmp deleted successfully.
D:\WINDOWS\NV7681140.TMP\default.tvp deleted successfully.
D:\WINDOWS\NV7681140.TMP folder deleted successfully.
[Files/Folders - Modified Within 30 Days]
D:\WINDOWS\Temp\CR_12.tmp\SETUP_PATCH.PACKED.7Z deleted successfully.
D:\WINDOWS\Temp\CR_12.tmp folder deleted successfully.
File delete failed. D:\WINDOWS\Temp\ZLT02c93.TMP scheduled to be deleted on reboot.
File delete failed. D:\WINDOWS\Temp\ZLT02c99.TMP scheduled to be deleted on reboot.
D:\WINDOWS\Temp\ZLT0328c.TMP deleted successfully.
D:\WINDOWS\Temp\ZLT04945.TMP deleted successfully.
D:\WINDOWS\Temp\ZLT04948.TMP deleted successfully.
D:\WINDOWS\Temp\ZLT06e64.TMP deleted successfully.
D:\WINDOWS\Temp\ZLT06e68.TMP deleted successfully.
[Files - No Company Name]
LoadLibrary failed for D:\WINDOWS\msjt32.dll
D:\WINDOWS\msjt32.dll moved successfully.
LoadLibrary failed for D:\WINDOWS\crwq.dll
D:\WINDOWS\crwq.dll moved successfully.
[Empty Temp Folders]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->FireFox cache emptied: 715891 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 17088 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: Ours
->Temp folder emptied: 3251992335 bytes
->Temporary Internet Files folder emptied: 1240382 bytes
->Java cache emptied: 83646896 bytes
->FireFox cache emptied: 57507024 bytes
->Google Chrome cache emptied: 261290244 bytes
->Flash cache emptied: 633291 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 558536 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 49286 bytes
RecycleBin emptied: 889633 bytes

Total Files Cleaned = 3,489.00 mb

< End of fix log >
OTS by OldTimer - Version 3.1.42.0 fix logfile created on 04182011_220748

Files\Folders moved on Reboot...
File\Folder D:\WINDOWS\Temp\ZLT02c93.TMP not found!
File\Folder D:\WINDOWS\Temp\ZLT02c99.TMP not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERfffe.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERfffe.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERfffe.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERfffe.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERff69.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERff69.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERff69.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERff69.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERff5c.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERff5c.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERff5c.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERff5c.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERfe60.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERfe60.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERfe60.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERfe60.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERfcb3.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERfcb3.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERfcb3.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERfcb3.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERfc16.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERfc16.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERfc16.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERfc16.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERfa16.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERfa16.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERfa16.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERfa16.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERf8f0.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERf8f0.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERf8f0.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERf8f0.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERf8ae.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERf8ae.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERf8ae.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERf8ae.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERf786.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERf786.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERf786.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERf786.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERf72f.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERf72f.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERf72f.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERf72f.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERf47c.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERf47c.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERf47c.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERf47c.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERf3d3.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERf3d3.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERf3d3.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERf3d3.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERf0e4.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERf0e4.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERf0e4.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERf0e4.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERefed.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERefed.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERefed.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERefed.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERed81.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERed81.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERed81.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERed81.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERec56.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERec56.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERec56.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERec56.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERea82.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERea82.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERea82.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERea82.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe8e9.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe8e9.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe8e9.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe8e9.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe6c9.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe6c9.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe6c9.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe6c9.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe68e.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe68e.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe68e.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe68e.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe604.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe604.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe604.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe604.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe3a7.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe3a7.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe3a7.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe3a7.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe233.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe233.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe233.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe233.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe224.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe224.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe224.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe224.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe1d4.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe1d4.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe1d4.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe1d4.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe0ff.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe0ff.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe0ff.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERe0ff.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERdfa6.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERdfa6.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERdfa6.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERdfa6.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERdd48.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERdd48.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERdd48.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERdd48.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERdcf9.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERdcf9.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERdcf9.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERdcf9.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERdceb.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERdceb.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERdceb.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERdceb.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERdcc6.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERdcc6.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERdcc6.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERdcc6.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERdc3a.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERdc3a.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERdc3a.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERdc3a.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERdb45.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERdb45.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERdb45.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERdb45.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERd8ed.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERd8ed.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERd8ed.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERd8ed.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERd5d8.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERd5d8.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERd5d8.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERd5d8.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERcefe.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERcefe.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERcefe.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERcefe.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERce2f.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERce2f.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERce2f.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERce2f.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERcc78.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERcc78.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERcc78.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERcc78.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERcc74.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERcc74.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERcc74.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERcc74.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERc74a.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERc74a.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERc74a.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERc74a.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERc6ef.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERc6ef.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERc6ef.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERc6ef.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERc1d9.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERc1d9.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERc1d9.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERc1d9.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERbf8e.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERbf8e.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERbf8e.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERbf8e.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERbeb5.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERbeb5.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERbeb5.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERbeb5.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERba28.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERba28.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERba28.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERba28.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERb995.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERb995.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERb995.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERb995.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERb8e2.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERb8e2.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERb8e2.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERb8e2.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERadd2.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERadd2.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERadd2.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERadd2.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERac26.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERac26.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERac26.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERac26.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERa991.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERa991.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERa991.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERa991.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERa96f.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERa96f.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERa96f.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERa96f.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERa695.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERa695.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERa695.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERa695.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERa4a3.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERa4a3.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERa4a3.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERa4a3.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERa47e.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERa47e.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERa47e.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERa47e.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERa188.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERa188.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERa188.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WERa188.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER9f96.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER9f96.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER9f96.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER9f96.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER9f6a.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER9f6a.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER9f6a.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER9f6a.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER9e86.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER9e86.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER9e86.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER9e86.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER9d0d.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER9d0d.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER9d0d.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER9d0d.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER9afe.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER9afe.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER9afe.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER9afe.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER956f.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER956f.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER956f.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER956f.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8f21.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8f21.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8f21.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8f21.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8e80.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8e80.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8e80.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8e80.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8e73.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8e73.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8e73.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8e73.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8b49.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8b49.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8b49.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8b49.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8905.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8905.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8905.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8905.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8399.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8399.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8399.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8399.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8321.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8321.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8321.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8321.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8251.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8251.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8251.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8251.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER81fd.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER81fd.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER81fd.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER81fd.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER81c9.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER81c9.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER81c9.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER81c9.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8113.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8113.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8113.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER8113.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7eb8.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7eb8.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7eb8.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7eb8.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7d61.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7d61.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7d61.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7d61.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7c76.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7c76.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7c76.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7c76.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7a00.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7a00.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7a00.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7a00.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER792e.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER792e.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER792e.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER792e.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7818.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7818.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7818.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7818.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7746.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7746.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7746.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7746.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7736.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7736.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7736.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7736.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7403.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7403.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7403.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7403.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7283.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7283.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7283.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER7283.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER6b91.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER6b91.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER6b91.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER6b91.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER667e.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER667e.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER667e.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER667e.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER6573.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER6573.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER6573.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER6573.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER6567.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER6567.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER6567.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER6567.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER64f9.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER64f9.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER64f9.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER64f9.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER5ff4.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER5ff4.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER5ff4.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER5ff4.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER5f16.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER5f16.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER5f16.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER5f16.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER5dbb.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER5dbb.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER5dbb.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER5dbb.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER5c6d.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER5c6d.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER5c6d.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER5c6d.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER5ae0.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER5ae0.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER5ae0.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER5ae0.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER58fb.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER58fb.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER58fb.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER58fb.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER58e0.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER58e0.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER58e0.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER58e0.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER5894.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER5894.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER5894.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER5894.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER5723.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER5723.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER5723.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER5723.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER53c5.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER53c5.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER53c5.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER53c5.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER508f.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER508f.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER508f.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER508f.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER4d6a.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER4d6a.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER4d6a.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER47a0.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER47a0.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER47a0.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER47a0.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER4768.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER4768.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER4768.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER4768.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER468d.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER468d.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER468d.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER468d.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER467a.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER467a.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER467a.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER467a.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER4481.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER4481.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER4481.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER4481.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER3fc6.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER3fc6.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER3fc6.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER3fc6.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER3d45.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER3d45.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER3d45.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER3d45.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER3b39.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER3b39.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER3b39.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER3b39.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER3a13.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER3a13.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER3a13.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER3a13.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER39d4.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER39d4.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER39d4.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER39d4.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER39be.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER39be.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER39be.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER39be.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER3328.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER3328.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER3328.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER3328.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER32d6.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER32d6.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER32d6.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER32d6.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER326c.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER326c.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER326c.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER326c.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER322e.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER322e.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER322e.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER322e.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER311b.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER311b.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER311b.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER311b.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER2f46.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER2f46.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER2f46.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER2f46.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER2c22.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER2c22.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER2c22.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER2c22.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER2326.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER2326.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER2326.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER2326.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER2314.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER2314.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER2314.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER2314.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER22c8.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER22c8.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER22c8.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER22c8.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER2295.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER2295.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER2295.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER2295.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER1ff5.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER1ff5.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER1ff5.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER1ff5.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER1ed0.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER1ed0.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER1ed0.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER1ed0.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER1d30.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER1d30.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER1d30.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER1d30.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER197a.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER197a.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER197a.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER197a.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER1847.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER1847.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER1847.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER1847.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER179e.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER179e.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER179e.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER179e.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER16c7.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER16c7.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER16c7.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER16c7.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER135e.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER135e.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER135e.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER135e.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER1319.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER1319.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER1319.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER1319.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER10ed.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER10ed.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER10ed.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER10ed.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER0f9e.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER0f9e.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER0f9e.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER0f9e.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER0d25.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER0d25.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER0d25.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER0d25.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER0c9f.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER0c9f.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER0c9f.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER0c9f.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER0b3d.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER0b3d.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER0b3d.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER0b3d.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER093c.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER093c.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER093c.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER093c.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER070c.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER070c.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER070c.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER070c.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER06a8.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER06a8.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER06a8.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER06a8.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER05a3.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER05a3.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER05a3.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER05a3.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER03ef.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER03ef.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER03ef.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER03ef.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER0269.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER0269.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER0269.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER0269.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER0160.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER0160.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER0160.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER0160.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER00bf.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER00bf.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER00bf.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER00bf.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER0025.dir00\appcompat.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER0025.dir00\manifest.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER0025.dir00\MediaServer.exe.hdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\WER0025.dir00\MediaServer.exe.mdmp not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\IE73C6.tmp\update\branches.inf not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\IE73C6.tmp\update\eula.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\IE73C6.tmp\update\KB958215-IE7.CAT not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\IE73C6.tmp\update\update.ver not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\IE73C6.tmp\update\updatebr.inf not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\IE73C6.tmp\update\update_SP2GDR.inf not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\IE73C6.tmp\update\update_SP2QFE.inf not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\IE7363.tmp\update\branches.inf not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\IE7363.tmp\update\eula.txt not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\IE7363.tmp\update\KB956390-IE7.CAT not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\IE7363.tmp\update\update.ver not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\IE7363.tmp\update\updatebr.inf not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\IE7363.tmp\update\update_SP2GDR.inf not found!
File\Folder D:\Documents and Settings\Ours\Local Settings\Temp\IE7363.tmp\update\update_SP2QFE.inf not found!
File\Folder D:\WINDOWS\temp\TMP0000001F2B5FD18B43305559 not found!

Registry entries deleted on Reboot...

HJT Log file:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:55:20 PM, on 18/04/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Windows Defender\MsMpEng.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\LEXBCES.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\LEXPPS.EXE
D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
D:\WINDOWS\System32\CTsvcCDA.exe
D:\Program Files\Symantec AntiVirus\DefWatch.exe
D:\Program Files\Java\jre6\bin\jqs.exe
H:\Program Files\EA Games\Need for Speed Undercover\PB\PnkBstrA.exe
D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Symantec AntiVirus\Rtvscan.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
D:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe
D:\Program Files\Lexmark 2200 Series\lxbvbmon.exe
D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
D:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
D:\Program Files\IMT Labs Messenger Plugin\Cloud.exe
D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
D:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
D:\Program Files\Athan\Athan.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\Common Files\Symantec Shared\ccApp.exe
D:\PROGRA~1\SYMANT~1\VPTray.exe
D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
D:\Program Files\Common Files\Java\Java Update\jusched.exe
D:\WINDOWS\system32\RUNDLL32.EXE
H:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\Windows Live\Messenger\msnmsgr.exe
D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
H:\Program Files\AirVideoServer\AirVideoServer.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
D:\Program Files\Windows Home Server\WHSConnector.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\WINDOWS\system32\ZoneLabs\vsmon.exe
D:\WINDOWS\system32\NOTEPAD.EXE
H:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
D:\Program Files\Windows Defender\MpCmdRun.exe
D:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
N3 - Netscape 7: # Mozilla User Preferences

/* Do not edit this file.
*
* If you make changes to this file while the browser is running,
* the changes will be overwritten when the browser exits.
*
* To make a manual change to preferences, you can visit the URL about:config
* For more information, see http://www.mozilla.org/unix/customizing.html#prefs
*/

user_pref("__000.aim.general.im.enterCR", false);
user_pref("__000.aim.general.im.tabKey", false);
user_pref("__000.aim.general.im.timeStamp", false);
user_pref("__sys.aim.filexfer.location", "");
user_pref("__sys.aim.general.im.enterCR", false);
user_pref("__sys.aim.general.im.smilies", false);
user_pref("__sys.aim.general.im.tabKey", false);
user_pref("__sys.aim.general.im.timeStamp", false);
user_pref("__sys.aim.general.snsautosignon", false);
user_pref("__sys.aim.general.today", false);
user_pref("aim.session.firsttime", false);
user_pref("browser.activation.checkedNNFlag", true);
user_pref("browser.bookmarks.added_static_root", true);
user_pref("
N3 - Netscape 7: # Mozilla User Preferences

/* Do not edit this file.
*
* If you make changes to this file while the browser is running,
* the changes will be overwritten when the browser exits.
*
* To make a manual change to preferences, you can visit the URL about:config
* For more information, see http://www.mozilla.org/unix/customizing.html#prefs
*/

user_pref("__000.aim.general.im.enterCR", false);
user_pref("__000.aim.general.im.tabKey", false);
user_pref("__000.aim.general.im.timeStamp", false);
user_pref("__sys.aim.filexfer.location", "");
user_pref("__sys.aim.general.im.enterCR", false);
user_pref("__sys.aim.general.im.smilies", false);
user_pref("__sys.aim.general.im.tabKey", false);
user_pref("__sys.aim.general.im.timeStamp", false);
user_pref("__sys.aim.general.snsautosignon", false);
user_pref("__sys.aim.general.today", false);
user_pref("aim.session.firsttime", false);
user_pref("browser.activation.checkedNNFlag", true);
user_pref("browser.bookmarks.added_static_root", true);
user_pref("
O1 - Hosts: ÿþ127.0.0.1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: BrowserHelper Class - {9A065C65-4EE7-4DDD-9918-F129089A894A} - D:\Program Files\Windows Home Server\WHSDeskBands.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - D:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Home Server Banner - {D73E76A3-F902-45BD-8FC8-95AE8E014671} - D:\Program Files\Windows Home Server\WHSDeskBands.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - D:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [SoundMAXPnP] D:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [Lexmark 2200 Series] "D:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "D:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [Microsoft Works Update Detection] D:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [CloudPlugin] "D:\Program Files\IMT Labs Messenger Plugin\Cloud.exe"
O4 - HKLM\..\Run: [RemoteControl] "D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SsAAD.exe] D:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [Athan] D:\Program Files\Athan\Athan.exe
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] D:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [HP Software Update] D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] D:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [nwiz] D:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "H:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Creative Detector] "D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [swg] "D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Google Update] "D:\Documents and Settings\Ours\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [AirVideoServer] H:\Program Files\AirVideoServer\AirVideoServer.exe
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Download with Download Accelerator Lite - D:\Program Files\Download Accelerator Lite\dal.htm
O8 - Extra context menu item: Google Sidewiki... - res://D:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O16 - DPF: {983A9C21-8207-4B58-BBB8-0EBC3D7C5505} (Domino Web Access 8 Control) - http://beowulf.schulich.yorku.ca/dwa8W.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\System32\browseui.dll
O23 - Service: Adobe LM Service - Unknown owner - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - D:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - D:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - D:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Update Service (gupdate1ca597c7db22888) (gupdate1ca597c7db22888) - Google Inc. - D:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - D:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - D:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - H:\Program Files\EA Games\Need for Speed Undercover\PB\PnkBstrA.exe
O23 - Service: SAVRoam (SavRoam) - symantec - D:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Sunbelt CounterSpy Antispyware (SBCSSvc) - Unknown owner - D:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - D:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TVersityMediaServer - Unknown owner - H:\Program Files\TVersity\Media Server\MediaServer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - D:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 16038 bytes


----------



## itrocks4u (Nov 27, 2004)

Cookiegal, something is really wrong with the computer still. It's really really slow. Even moving the mouse around lags. For e.g. I wanted to search on this website for 'my posts' and it took quite a few seconds to display the dropdown menu for search. This is not normal. Copying pasting from a file like notepad takes a long while as well.


----------



## itrocks4u (Nov 27, 2004)

Hi, I posted the requested logs above. Is there something else I'm supposed to do?


----------



## Cookiegal (Aug 27, 2003)

Please run DDS again and post both logs.


----------



## itrocks4u (Nov 27, 2004)

.
DDS (Ver_11-03-05.01) - NTFSx86 
Run by Ours at 2:51:17.73 on 22/04/2011
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.255 [GMT -4:00]
.
AV: Symantec AntiVirus Corporate Edition *Disabled/Updated* {FB06448E-52B8-493A-90F3-E43226D3305C}
FW: ZoneAlarm Firewall *Disabled* 
.
============== Running Processes ===============
.
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
D:\Program Files\Windows Defender\MsMpEng.exe
D:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
D:\WINDOWS\system32\LEXBCES.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\LEXPPS.EXE
svchost.exe
D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
D:\WINDOWS\System32\CTsvcCDA.exe
D:\Program Files\Symantec AntiVirus\DefWatch.exe
D:\Program Files\Java\jre6\bin\jqs.exe
H:\Program Files\EA Games\Need for Speed Undercover\PB\PnkBstrA.exe
D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
D:\WINDOWS\System32\svchost.exe -k imgsvc
D:\Program Files\Symantec AntiVirus\Rtvscan.exe
D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
D:\Program Files\Windows Home Server\WHSConnector.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
D:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe
D:\Program Files\Lexmark 2200 Series\lxbvbmon.exe
D:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
D:\Program Files\IMT Labs Messenger Plugin\Cloud.exe
D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
D:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
D:\Program Files\Athan\Athan.exe
D:\Program Files\Common Files\Symantec Shared\ccApp.exe
D:\PROGRA~1\SYMANT~1\VPTray.exe
D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
D:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
D:\Program Files\Common Files\Java\Java Update\jusched.exe
D:\WINDOWS\system32\RUNDLL32.EXE
H:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\Windows Live\Messenger\msnmsgr.exe
D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
D:\Program Files\Symantec AntiVirus\DoScan.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\WINDOWS\System32\svchost.exe -k HTTPFilter
D:\Program Files\Symantec AntiVirus\DWHWIZRD.EXE
D:\WINDOWS\system32\wscntfy.exe
D:\Program Files\Windows Live\Photo Gallery\WLXQuickTimeControlHost.exe
D:\Documents and Settings\Ours\Desktop\dds.pif
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - d:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - d:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - d:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: BrowserHelper Class: {9a065c65-4ee7-4ddd-9918-f129089a894a} - d:\program files\windows home server\WHSDeskBands.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - d:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - d:\program files\google\googletoolbarnotifier\5.6.6209.1142\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - d:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - d:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Home Server Banner: {d73e76a3-f902-45bd-8fc8-95ae8e014671} - d:\program files\windows home server\WHSDeskBands.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - d:\program files\google\google toolbar\GoogleToolbar_32.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
uRun: [msnmsgr] "d:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [Creative Detector] "d:\program files\creative\mediasource\detector\CTDetect.exe" /R
uRun: [swg] "d:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [Google Update] "d:\documents and settings\ours\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [AirVideoServer] h:\program files\airvideoserver\AirVideoServer.exe
uRun: [ctfmon.exe] d:\windows\system32\ctfmon.exe
mRun: [SoundMAXPnP] d:\program files\analog devices\soundmax\SMax4PNP.exe
mRun: [Lexmark 2200 Series] "d:\program files\lexmark 2200 series\lxbvbmgr.exe"
mRun: [FaxCenterServer] "d:\program files\lexmark fax solutions\fm3032.exe" /s
mRun: [Microsoft Works Update Detection] d:\program files\common files\microsoft shared\works shared\WkUFind.exe
mRun: [CloudPlugin] "d:\program files\imt labs messenger plugin\Cloud.exe"
mRun: [RemoteControl] "d:\program files\cyberlink\powerdvd\PDVDServ.exe"
mRun: [SsAAD.exe] d:\progra~1\sony\sonics~1\SsAAD.exe
mRun: [Athan] d:\program files\athan\Athan.exe
mRun: [NeroFilterCheck] d:\windows\system32\NeroCheck.exe
mRun: [ZoneAlarm Client] "d:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [ccApp] "d:\program files\common files\symantec shared\ccApp.exe"
mRun: [vptray] d:\progra~1\symant~1\VPTray.exe
mRun: [HP Software Update] d:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [AppleSyncNotifier] d:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [Adobe Reader Speed Launcher] "d:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [SunJavaUpdateSched] "d:\program files\common files\java\java update\jusched.exe"
mRun: [nwiz] d:\program files\nvidia corporation\nview\nwiz.exe /installquiet
mRun: [NvMediaCenter] RUNDLL32.EXE d:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE d:\windows\system32\NvCpl.dll,NvStartup
mRun: [QuickTime Task] "d:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "h:\program files\itunes\iTunesHelper.exe"
StartupFolder: d:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - d:\program files\microsoft office\office\OSA9.EXE
IE: &Download with Download Accelerator Lite - d:\program files\download accelerator lite\dal.htm
IE: Google Sidewiki... - d:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - d:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - d:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {5067A26B-1337-4436-8AFE-EE169C2DA79F} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - d:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - d:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
DPF: DirectAnimation Java Classes - file://d:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://d:\windows\java\classes\xmldso.cab
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {983A9C21-8207-4B58-BBB8-0EBC3D7C5505} - hxxp://beowulf.schulich.yorku.ca/dwa8W.cab
DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} - hxxp://www.crucial.com/controls/cpcScanner.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - d:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: NavLogon - d:\windows\system32\NavLogon.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - d:\windows\system32\WPDShServiceObj.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - d:\progra~1\wifd1f~1\MpShHook.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - d:\docume~1\ours\applic~1\mozilla\firefox\profiles\s0mrbavn.default\
FF - prefs.js: browser.search.selectedEngine - Google
.
============= SERVICES / DRIVERS ===============
.
R1 SAVRTPEL;SAVRTPEL;d:\program files\symantec antivirus\Savrtpel.sys [2006-9-6 54968]
R1 vsdatant;vsdatant;d:\windows\system32\vsdatant.sys [2006-4-22 394952]
R2 ccEvtMgr;Symantec Event Manager;d:\program files\common files\symantec shared\ccEvtMgr.exe [2006-7-19 192160]
R2 ccSetMgr;Symantec Settings Manager;d:\program files\common files\symantec shared\ccSetMgr.exe [2006-7-19 169632]
R2 eusk2par;EUTRON SmartKey Parallel Driver;d:\windows\system32\drivers\eusk2par.sys [2005-6-7 16695]
R2 Vcs;Vcs support;d:\windows\system32\drivers\Vcs.sys [2005-4-17 6852]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;d:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-5-28 102448]
R3 NAVENG;NAVENG;d:\progra~1\common~1\symant~1\virusd~1\20110416.003\naveng.sys [2011-4-17 86136]
R3 NAVEX15;NAVEX15;d:\progra~1\common~1\symant~1\virusd~1\20110416.003\navex15.sys [2011-4-17 1393144]
R3 SAVRT;SAVRT;d:\program files\symantec antivirus\savrt.sys [2006-9-6 337592]
S2 gupdate1ca597c7db22888;Google Update Service (gupdate1ca597c7db22888);d:\program files\google\update\GoogleUpdate.exe [2009-10-30 133104]
S3 ALSysIO;ALSysIO;\??\d:\docume~1\ours\locals~1\temp\alsysio.sys --> d:\docume~1\ours\locals~1\temp\ALSysIO.sys [?]
S3 cpuz129;cpuz129;\??\d:\docume~1\ours\locals~1\temp\cpuz_x32.sys --> d:\docume~1\ours\locals~1\temp\cpuz_x32.sys [?]
S3 JL2005;JL2005A Toy Camera;d:\windows\system32\drivers\toywdm.sys [2004-6-4 70888]
S3 rootrepeal;rootrepeal;\??\d:\windows\system32\drivers\rootrepeal.sys --> d:\windows\system32\drivers\rootrepeal.sys [?]
S3 SavRoam;SAVRoam;d:\program files\symantec antivirus\SavRoam.exe [2006-9-27 116464]
.
=============== File Associations ===============
.
.scr=AutoCADScriptFile
.
=============== Created Last 30 ================
.
2011-04-19 02:07:48	--------	d-----w-	D:\_OTS
2011-04-12 04:48:52	388096	----a-r-	d:\docume~1\ours\applic~1\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-04-10 19:35:33	--------	d-----w-	d:\program files\ESET
2011-04-10 04:28:43	6792528	----a-w-	d:\docume~1\alluse~1\applic~1\microsoft\windows defender\definition updates\{dc194a78-5bef-4757-bb0d-7ab01defa6fc}\mpengine.dll
2011-04-10 04:28:05	6792528	----a-w-	d:\docume~1\alluse~1\applic~1\microsoft\windows defender\definition updates\backup\mpengine.dll
2011-04-10 04:27:58	222080	------w-	d:\windows\system32\MpSigStub.exe
2011-04-10 04:21:43	--------	d-----w-	d:\docume~1\ours\locals~1\applic~1\PCHealth
2011-04-10 03:47:40	89088	----a-w-	d:\windows\MBR.exe
2011-04-10 03:47:40	256512	----a-w-	d:\windows\PEV.exe
2011-04-10 03:47:24	--------	d-----w-	D:\ComboFix
2011-03-24 04:20:34	--------	d-----w-	d:\docume~1\ours\locals~1\applic~1\AirVideoServer
.
==================== Find3M ====================
.
2011-02-09 13:53:52	270848	----a-w-	d:\windows\system32\sbe.dll
2011-02-09 13:53:52	186880	----a-w-	d:\windows\system32\encdec.dll
2011-02-02 07:58:35	2067456	----a-w-	d:\windows\system32\mstscax.dll
2011-01-27 11:57:06	677888	----a-w-	d:\windows\system32\mstsc.exe
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: WDC_WD800BB-00JKA0 rev.05.01C05 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntoskrnl.exe >>UNKNOWN [0x86F8BA40]<< 
_asm { MOV EAX, 0x86f8b960; XCHG [ESP], EAX; PUSH EAX; PUSH 0x86f8e0d4; RET ; ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL; }
1 nt!IofCallDriver[0x804E37D5] -> \Device\Harddisk0\DR0[0x86F17AB8]
\Driver\Disk[0x86FE0130] -> IRP_MJ_CREATE -> 0x86F8BA40
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
detected hooks:
\Driver\Disk -> 0x86f8ba40
user & kernel MBR OK 
Warning: possible MBR rootkit infection !
.
============= FINISH: 2:55:44.67 ===============

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_11-03-05.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 15/10/2004 11:03:08 PM
System Uptime: 22/04/2011 12:45:30 AM (2 hours ago)
.
Motherboard: Intel Corporation | | D865GBF 
Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz | J2E1 | 2793/133mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (FAT32) - 5 GiB total, 0.935 GiB free.
D: is FIXED (NTFS) - 70 GiB total, 7.178 GiB free.
E: is CDROM ()
F: is CDROM ()
G: is CDROM (CDFS)
H: is FIXED (NTFS) - 466 GiB total, 149.589 GiB free.
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP677: 25/03/2011 8:36:51 PM - System Checkpoint
RP678: 26/03/2011 9:24:53 PM - System Checkpoint
RP679: 27/03/2011 3:17:02 AM - Software Distribution Service 3.0
RP680: 28/03/2011 5:06:30 PM - System Checkpoint
RP681: 29/03/2011 11:12:34 PM - System Checkpoint
RP682: 01/04/2011 2:45:00 PM - System Checkpoint
RP683: 03/04/2011 1:26:54 AM - System Checkpoint
RP684: 04/04/2011 12:29:21 PM - System Checkpoint
RP685: 05/04/2011 12:59:15 PM - System Checkpoint
RP686: 06/04/2011 1:37:15 PM - System Checkpoint
RP687: 07/04/2011 2:07:15 PM - System Checkpoint
RP688: 08/04/2011 3:03:51 PM - System Checkpoint
RP689: 09/04/2011 4:26:41 PM - System Checkpoint
RP690: 10/04/2011 12:20:27 AM - Installed Windows Defender
RP691: 10/04/2011 1:34:09 PM - Windows Defender Checkpoint
RP692: 11/04/2011 10:25:43 PM - System Checkpoint
RP693: 12/04/2011 12:48:50 AM - Installed HiJackThis
RP694: 13/04/2011 12:58:19 AM - Removed WD SmartWare Drive Manager
RP695: 13/04/2011 1:08:09 AM - Installed SES Driver
RP696: 14/04/2011 3:14:47 AM - System Checkpoint
RP697: 15/04/2011 5:15:56 AM - System Checkpoint
RP698: 17/04/2011 4:28:35 AM - System Checkpoint
RP699: 18/04/2011 1:10:35 AM - Removed WD SmartWare Drive Manager
RP700: 19/04/2011 10:44:16 PM - System Checkpoint
.
==== Installed Programs ======================
.
"Transport Canada - CDE Sample"
µTorrent
AAC Decoder
Abacast Distributed Live
Ace DivX Player
Ad-Aware SE Personal
Adobe Acrobat 5.0
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Photoshop CS
Adobe Reader 8.1.1
Adobe Shockwave Player 11
Aimersoft DVD to iPhone Converter(Build 1.0.21)
Aimersoft iPhone Converter Suite(Build 1.0.23)
Aimersoft iPhone Video Converter(Build 1.1.0)
Air Video Server 2.4.3
AndreaMosaic 3.21
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ArcSoft PhotoImpression 4
Athan Basic 3.3
ATI - Software Uninstall Utility
ATI Display Driver
ATI HydraVision
AutoCAD 2005 - English
AutoCAD LT 2002
AutoUpdate
AV Voice Changer Software DIAMOND 4.0
AviSynth 2.5
AXIS Media Control Embedded
Before You Know It 3.5 Lite 
BFC Private Reference Library
BlackBerry Desktop Software 6.0.1
Blaze Audio Voice Cloak Trial
Bonjour
Bubble Struggle 1.2
CANTAX T2Plus Educational 08.2
CCH Library 4.7
CCleaner (remove only)
CGPA Calculator 2.0
Channel Master
Cinema Craft Encoder SP Version 2.50
Compatibility Pack for the 2007 Office system
CorelDRAW 10
Coupon Printer for Windows
Creative MediaSource
Creative Removable Disk Manager
Creative System Information
Creative Zen MicroPhoto
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Version Checker
DivX Web Player
DVDx 2.2
DVDx 2.3
EAX4 Unified Redist
ESET Online Scanner v3
F-22 Lightning 3
Facebook Plug-In
ffdshow [rev 1723] [2007-12-24]
Flight Log 4.9
GameSpy Arcade
Google Chrome
Google Earth
Google SketchUp
Google Talk (remove only)
Google Talk Plugin
Google Toolbar for Internet Explorer
Google Update Helper
Graphing Calculator Viewer
Graphmatica
H.264 Decoder
HiJackThis
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB954708)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
HP MediaSmart Server
HP Update
Huffyuv AVI lossless video codec (Remove Only)
HyperLoad - Multiplayer Billiards
IMT Labs Plugin
Intel(R) PRO Network Adapters and Drivers
iTunes
Java Auto Updater
Java(TM) 6 Update 20
Java(TM) 6 Update 3
Junk Mail filter update
Lexmark 2200 Series
Lexmark Fax Solutions
LimeWire 4.10.9
LiveUpdate 3.1 (Symantec Corporation)
Logitech Gaming Software
Macromedia Extension Manager
Macromedia Flash 8
Macromedia Flash 8 Video Encoder
Malwarebytes' Anti-Malware
Medal of Honor Allied Assault
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Games for Windows - LIVE 
Microsoft Games for Windows - LIVE Redistributable
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
Microsoft Money 2004
Microsoft Money 2004 System Pack
Microsoft National Language Support Downlevel APIs
Microsoft Office 2000 Premium
Microsoft Office Live Web Folder Connector
Microsoft Picture It! Photo Premium 9
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Streets and Trips 2004
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Word 2002
Microsoft Works
Microsoft Works 2004 Setup Launcher
Microsoft Works Suite Add-in for Microsoft Word
MKV Splitter
MobileMe Control Panel
Move Networks Media Player for Internet Explorer
Mozilla Firefox (1.5.0.12)
MSN Toolbar
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser (KB925673)
MSXML4SP2
Need for Speed™ Undercover
Nero OEM
Netscape (7.2)
Nokia Connectivity Cable Driver
NOMAD MuVo
Norton PC Checkup
NVIDIA Display Control Panel
NVIDIA Drivers
NVIDIA DVD Decoder
NVIDIA nView Desktop Manager
OpenMG Limited Patch 4.1-05-13-31-01
OpenMG Secure Module 4.1.00
Panda ActiveScan
PHStat2
Picasa 2
Picture Package
Post-it® Software Notes Lite
PowerDVD
PS3 Media Server
PunkBuster Services
QuickTime
Rockstar Games Social Club
SAMSUNG CDMA Modem Driver Set
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software
Samsung PC Studio
Samsung PC Studio 3 USB Driver Installer
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 7 (KB974455)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Internet Explorer 7 (KB978207)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Segoe UI
SES Driver
Shockwave
ShortKeys Lite
SIW version 2008-12-16
Skype web features
Skype™ 4.1
SmartDraw VP
Soap 3.0 Toolkit
SonicStage 3.0
Sony USB Driver
SoundMAX
Spybot - Search & Destroy 1.4
Symantec AntiVirus
System Requirements Lab
Turing
TVersity Codec Pack 1.2
TVersity Media Server 1.5 Beta
UFile 2009
UFile 2010
UFile Updater 2009
UFile Updater 2010
Uninstall JL2005A Toy Camera
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 7 (KB976749)
Update for Windows Internet Explorer 7 (KB980182)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows Internet Explorer 8 (KB980302)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VC80CRTRedist - 8.0.50727.762
VFR Plus 1.1
Videora iPod Converter 5.04
VLC media player 0.9.9
Vodafone 804SS USB driver Software
VoiceSFX Trial
WebFldrs XP
Winamp (remove only)
Windows Defender
Windows Genuine Advantage Validation Tool (KB892130)
Windows Home Server Connector
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live OneCare safety scanner
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Upload Tool
Windows Live Writer
Windows Media Format 11 runtime
Windows Media Player 10
Windows Presentation Foundation
Windows XP Service Pack 3
WinMX
WinRAR archiver
WinZip
XML Paper Specification Shared Components Pack 1.0
Yahoo! Address AutoComplete
Yahoo! Install Manager
Yahoo! Internet Mail
Yahoo! Messenger
ZoneAlarm
.
==== Event Viewer Messages From Past Week ========
.
22/04/2011 12:51:49 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the nvsvc service.
18/04/2011 9:24:11 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Application Layer Gateway Service service to connect.
18/04/2011 9:24:11 PM, error: Service Control Manager [7000] - The Application Layer Gateway Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
18/04/2011 10:08:03 PM, error: Service Control Manager [7034] - The SonicStage SCSI Service service terminated unexpectedly. It has done this 1 time(s).
18/04/2011 10:08:03 PM, error: Service Control Manager [7034] - The iPod Service service terminated unexpectedly. It has done this 1 time(s).
18/04/2011 10:07:54 PM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
18/04/2011 10:07:53 PM, error: Service Control Manager [7034] - The SoundMAX Agent Service service terminated unexpectedly. It has done this 1 time(s).
18/04/2011 10:07:53 PM, error: Service Control Manager [7034] - The PunkBuster service terminated unexpectedly. It has done this 1 time(s).
18/04/2011 10:07:52 PM, error: Service Control Manager [7034] - The Creative Service for CDROM Access service terminated unexpectedly. It has done this 1 time(s).
18/04/2011 10:07:51 PM, error: Service Control Manager [7034] - The Bonjour Service service terminated unexpectedly. It has done this 1 time(s).
18/04/2011 10:07:51 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
18/04/2011 10:07:50 PM, error: Service Control Manager [7034] - The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s).
18/04/2011 10:07:50 PM, error: Service Control Manager [7034] - The LexBce Server service terminated unexpectedly. It has done this 1 time(s).
18/04/2011 10:07:50 PM, error: Service Control Manager [7031] - The Windows Defender service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 15000 milliseconds: Restart the service.
18/04/2011 1:16:33 AM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
17/04/2011 4:04:39 AM, error: Print [6161] - The document https://patriotmem.4myrebate.com/Document/RebateHTMLReceipt?Tra owned by Ours failed to print on printer Lexmark 2200 Series. Data type: LEMF. Size of the spool file in bytes: 832915. Number of bytes printed: 832915. Total number of pages in the document: 1. Number of pages printed: 0. Client machine: \\HUMAYUN. Win32 error code returned by the print processor: 126 (0x7e). 
17/04/2011 3:25:51 AM, error: Service Control Manager [7024] - The Symantec SPBBCSvc service terminated with service-specific error 4294967295 (0xFFFFFFFF).
17/04/2011 3:25:51 AM, error: Service Control Manager [7023] - The Automatic Updates service terminated with the following error: The specified module could not be found.
17/04/2011 3:25:51 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the TrueVector Internet Monitor service to connect.
17/04/2011 3:25:51 AM, error: Service Control Manager [7000] - The TrueVector Internet Monitor service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
17/04/2011 3:25:51 AM, error: Service Control Manager [7000] - The Sunbelt CounterSpy Antispyware service failed to start due to the following error: The system cannot find the path specified.
17/04/2011 3:25:51 AM, error: Service Control Manager [7000] - The Secdrv service failed to start due to the following error: The system cannot find the file specified.
16/04/2011 12:33:41 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Symantec Event Manager service to connect.
15/04/2011 8:26:01 AM, error: Service Control Manager [7000] - The LiveUpdate service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
15/04/2011 8:26:00 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the LiveUpdate service to connect.
15/04/2011 8:25:59 AM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service LiveUpdate with arguments "" in order to run the server: {03E0E6C2-363B-11D3-B536-00902771A435}
15/04/2011 8:20:29 AM, error: Service Control Manager [7034] - The LiveUpdate service terminated unexpectedly. It has done this 1 time(s).
15/04/2011 6:49:29 PM, error: Service Control Manager [7031] - The Windows Home Server Connector Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
15/04/2011 6:49:28 PM, error: Service Control Manager [7022] - The Windows Home Server Connector Service service hung on starting.
15/04/2011 4:31:09 AM, error: atapi [11] - The driver detected a controller error on \Device\Ide\IdePort0.
15/04/2011 2:14:49 AM, error: Service Control Manager [7034] - The WDDMService service terminated unexpectedly. It has done this 1 time(s).
15/04/2011 12:50:00 AM, error: Dhcp [1002] - The IP address lease 192.168.1.9 for the Network Card with network address 000CF1ED3B89 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
15/04/2011 11:44:11 AM, error: atapi [9] - The device, \Device\Ide\IdePort0, did not respond within the timeout period.
.
==== End Of File ===========================


----------



## Cookiegal (Aug 27, 2003)

Please navigate to the following file and double-click on it to run it. 

d:\windows\MBR.exe

Then copy and paste the contents of the resulting log please. It should be located at C:\windows\mbr.log.


----------



## itrocks4u (Nov 27, 2004)

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: WDC_WD800BB-00JKA0 rev.05.01C05 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK


----------



## Cookiegal (Aug 27, 2003)

Did you not uninstall Daemon Tools yet? Because it interferes with the results with some of the tools we're using.


----------



## itrocks4u (Nov 27, 2004)

Yes I deleted it, from it's directory. It doesn't appear in add remove programs either. Is there a specific way to uninstall it?


----------



## Cookiegal (Aug 27, 2003)

Please follow the instructions at the following site to uninstall Daemon Tools and it's driver:

http://thespykiller.co.uk/index.php/topic,8973.0.html

Once you've done that, pleae reboot and run DDS again and post that log.


----------



## itrocks4u (Nov 27, 2004)

.
DDS (Ver_11-03-05.01) - NTFSx86 
Run by Ours at 23:40:50.76 on 23/04/2011
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.344 [GMT -4:00]
.
AV: Symantec AntiVirus Corporate Edition *Disabled/Updated* {FB06448E-52B8-493A-90F3-E43226D3305C}
FW: ZoneAlarm Firewall *Disabled* 
.
============== Running Processes ===============
.
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
D:\Program Files\Windows Defender\MsMpEng.exe
D:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
D:\WINDOWS\system32\LEXBCES.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\LEXPPS.EXE
svchost.exe
D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
D:\WINDOWS\System32\CTsvcCDA.exe
D:\Program Files\Symantec AntiVirus\DefWatch.exe
D:\Program Files\Java\jre6\bin\jqs.exe
H:\Program Files\EA Games\Need for Speed Undercover\PB\PnkBstrA.exe
D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
D:\WINDOWS\System32\svchost.exe -k imgsvc
D:\Program Files\Symantec AntiVirus\Rtvscan.exe
D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
D:\Program Files\Windows Home Server\WHSConnector.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
D:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe
D:\Program Files\Lexmark 2200 Series\lxbvbmon.exe
D:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
D:\Program Files\IMT Labs Messenger Plugin\Cloud.exe
D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
D:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
D:\Program Files\Athan\Athan.exe
D:\Program Files\Common Files\Symantec Shared\ccApp.exe
D:\PROGRA~1\SYMANT~1\VPTray.exe
D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
D:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
D:\Program Files\Common Files\Java\Java Update\jusched.exe
D:\WINDOWS\system32\RUNDLL32.EXE
H:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\Windows Live\Messenger\msnmsgr.exe
D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
D:\Program Files\Symantec AntiVirus\DoScan.exe
H:\Program Files\AirVideoServer\AirVideoServer.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
D:\WINDOWS\system32\wscntfy.exe
D:\Documents and Settings\Ours\Desktop\dds.pif
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - d:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - d:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - d:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: BrowserHelper Class: {9a065c65-4ee7-4ddd-9918-f129089a894a} - d:\program files\windows home server\WHSDeskBands.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - d:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - d:\program files\google\googletoolbarnotifier\5.7.6406.1642\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - d:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - d:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Home Server Banner: {d73e76a3-f902-45bd-8fc8-95ae8e014671} - d:\program files\windows home server\WHSDeskBands.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - d:\program files\google\google toolbar\GoogleToolbar_32.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
uRun: [msnmsgr] "d:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [Creative Detector] "d:\program files\creative\mediasource\detector\CTDetect.exe" /R
uRun: [swg] "d:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [Google Update] "d:\documents and settings\ours\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [AirVideoServer] h:\program files\airvideoserver\AirVideoServer.exe
uRun: [ctfmon.exe] d:\windows\system32\ctfmon.exe
mRun: [SoundMAXPnP] d:\program files\analog devices\soundmax\SMax4PNP.exe
mRun: [Lexmark 2200 Series] "d:\program files\lexmark 2200 series\lxbvbmgr.exe"
mRun: [FaxCenterServer] "d:\program files\lexmark fax solutions\fm3032.exe" /s
mRun: [Microsoft Works Update Detection] d:\program files\common files\microsoft shared\works shared\WkUFind.exe
mRun: [CloudPlugin] "d:\program files\imt labs messenger plugin\Cloud.exe"
mRun: [RemoteControl] "d:\program files\cyberlink\powerdvd\PDVDServ.exe"
mRun: [SsAAD.exe] d:\progra~1\sony\sonics~1\SsAAD.exe
mRun: [Athan] d:\program files\athan\Athan.exe
mRun: [NeroFilterCheck] d:\windows\system32\NeroCheck.exe
mRun: [ZoneAlarm Client] "d:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [ccApp] "d:\program files\common files\symantec shared\ccApp.exe"
mRun: [vptray] d:\progra~1\symant~1\VPTray.exe
mRun: [HP Software Update] d:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [AppleSyncNotifier] d:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [Adobe Reader Speed Launcher] "d:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [SunJavaUpdateSched] "d:\program files\common files\java\java update\jusched.exe"
mRun: [nwiz] d:\program files\nvidia corporation\nview\nwiz.exe /installquiet
mRun: [NvMediaCenter] RUNDLL32.EXE d:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE d:\windows\system32\NvCpl.dll,NvStartup
mRun: [QuickTime Task] "d:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "h:\program files\itunes\iTunesHelper.exe"
StartupFolder: d:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - d:\program files\microsoft office\office\OSA9.EXE
StartupFolder: d:\docume~1\alluse~1\startm~1\programs\startup\wddmst~1.lnk - d:\program files\western digital\wd smartware\wd drive manager\WDDMStatus.exe
IE: &Download with Download Accelerator Lite - d:\program files\download accelerator lite\dal.htm
IE: Google Sidewiki... - d:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_D1E1F7ED622A0E5D.dll/cmsidewiki.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - d:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - d:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {5067A26B-1337-4436-8AFE-EE169C2DA79F} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - d:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - d:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
DPF: DirectAnimation Java Classes - file://d:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://d:\windows\java\classes\xmldso.cab
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {983A9C21-8207-4B58-BBB8-0EBC3D7C5505} - hxxp://beowulf.schulich.yorku.ca/dwa8W.cab
DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} - hxxp://www.crucial.com/controls/cpcScanner.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - d:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: NavLogon - d:\windows\system32\NavLogon.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - d:\windows\system32\WPDShServiceObj.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - d:\progra~1\wifd1f~1\MpShHook.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - d:\docume~1\ours\applic~1\mozilla\firefox\profiles\s0mrbavn.default\
FF - prefs.js: browser.search.selectedEngine - Google
.
============= SERVICES / DRIVERS ===============
.
R1 SAVRTPEL;SAVRTPEL;d:\program files\symantec antivirus\Savrtpel.sys [2006-9-6 54968]
R1 vsdatant;vsdatant;d:\windows\system32\vsdatant.sys [2006-4-22 394952]
R2 ccEvtMgr;Symantec Event Manager;d:\program files\common files\symantec shared\ccEvtMgr.exe [2006-7-19 192160]
R2 ccSetMgr;Symantec Settings Manager;d:\program files\common files\symantec shared\ccSetMgr.exe [2006-7-19 169632]
R2 eusk2par;EUTRON SmartKey Parallel Driver;d:\windows\system32\drivers\eusk2par.sys [2005-6-7 16695]
R2 Symantec AntiVirus;Symantec AntiVirus;d:\program files\symantec antivirus\Rtvscan.exe [2006-9-27 1813232]
R2 Vcs;Vcs support;d:\windows\system32\drivers\Vcs.sys [2005-4-17 6852]
R2 WHSConnector;Windows Home Server Connector Service;d:\program files\windows home server\WHSConnector.exe [2007-9-6 302112]
R2 WinDefend;Windows Defender;d:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;d:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-5-28 102448]
R3 NAVENG;NAVENG;d:\progra~1\common~1\symant~1\virusd~1\20110422.003\naveng.sys [2011-4-23 86136]
R3 NAVEX15;NAVEX15;d:\progra~1\common~1\symant~1\virusd~1\20110422.003\navex15.sys [2011-4-23 1393144]
R3 SAVRT;SAVRT;d:\program files\symantec antivirus\savrt.sys [2006-9-6 337592]
S2 gupdate1ca597c7db22888;Google Update Service (gupdate1ca597c7db22888);d:\program files\google\update\GoogleUpdate.exe [2009-10-30 133104]
S2 vsmon;TrueVector Internet Monitor;d:\windows\system32\zonelabs\vsmon.exe -service --> d:\windows\system32\zonelabs\vsmon.exe -service [?]
S2 WDDMService;WDDMService;d:\program files\western digital\wd smartware\wd drive manager\WDDMService.exe [2010-9-8 237056]
S3 ALSysIO;ALSysIO;\??\d:\docume~1\ours\locals~1\temp\alsysio.sys --> d:\docume~1\ours\locals~1\temp\ALSysIO.sys [?]
S3 cpuz129;cpuz129;\??\d:\docume~1\ours\locals~1\temp\cpuz_x32.sys --> d:\docume~1\ours\locals~1\temp\cpuz_x32.sys [?]
S3 JL2005;JL2005A Toy Camera;d:\windows\system32\drivers\toywdm.sys [2004-6-4 70888]
S3 rootrepeal;rootrepeal;\??\d:\windows\system32\drivers\rootrepeal.sys --> d:\windows\system32\drivers\rootrepeal.sys [?]
S3 SavRoam;SAVRoam;d:\program files\symantec antivirus\SavRoam.exe [2006-9-27 116464]
.
=============== File Associations ===============
.
.scr=AutoCADScriptFile
.
=============== Created Last 30 ================
.
2011-04-23 07:14:48	--------	d-----w-	d:\program files\Western Digital
2011-04-19 02:07:48	--------	d-----w-	D:\_OTS
2011-04-12 04:48:52	388096	----a-r-	d:\docume~1\ours\applic~1\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-04-10 19:35:33	--------	d-----w-	d:\program files\ESET
2011-04-10 04:28:43	6792528	----a-w-	d:\docume~1\alluse~1\applic~1\microsoft\windows defender\definition updates\{dc194a78-5bef-4757-bb0d-7ab01defa6fc}\mpengine.dll
2011-04-10 04:28:05	6792528	----a-w-	d:\docume~1\alluse~1\applic~1\microsoft\windows defender\definition updates\backup\mpengine.dll
2011-04-10 04:27:58	222080	------w-	d:\windows\system32\MpSigStub.exe
2011-04-10 04:21:43	--------	d-----w-	d:\docume~1\ours\locals~1\applic~1\PCHealth
2011-04-10 03:47:40	89088	----a-w-	d:\windows\MBR.exe
2011-04-10 03:47:40	256512	----a-w-	d:\windows\PEV.exe
2011-04-10 03:47:24	--------	d-----w-	D:\ComboFix
.
==================== Find3M ====================
.
2011-02-09 13:53:52	270848	----a-w-	d:\windows\system32\sbe.dll
2011-02-09 13:53:52	186880	----a-w-	d:\windows\system32\encdec.dll
2011-02-02 07:58:35	2067456	----a-w-	d:\windows\system32\mstscax.dll
2011-01-27 11:57:06	677888	----a-w-	d:\windows\system32\mstsc.exe
.
============= FINISH: 23:44:46.95 ===============

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_11-03-05.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 15/10/2004 11:03:08 PM
System Uptime: 23/04/2011 11:22:43 PM (0 hours ago)
.
Motherboard: Intel Corporation | | D865GBF 
Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz | J2E1 | 2793/133mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (FAT32) - 5 GiB total, 0.933 GiB free.
D: is FIXED (NTFS) - 70 GiB total, 7.053 GiB free.
E: is CDROM ()
F: is CDROM ()
H: is FIXED (NTFS) - 466 GiB total, 156.085 GiB free.
Q: is NetworkDisk (NTFS) - 1851 GiB total, 1758.553 GiB free.
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP677: 25/03/2011 8:36:51 PM - System Checkpoint
RP678: 26/03/2011 9:24:53 PM - System Checkpoint
RP679: 27/03/2011 3:17:02 AM - Software Distribution Service 3.0
RP680: 28/03/2011 5:06:30 PM - System Checkpoint
RP681: 29/03/2011 11:12:34 PM - System Checkpoint
RP682: 01/04/2011 2:45:00 PM - System Checkpoint
RP683: 03/04/2011 1:26:54 AM - System Checkpoint
RP684: 04/04/2011 12:29:21 PM - System Checkpoint
RP685: 05/04/2011 12:59:15 PM - System Checkpoint
RP686: 06/04/2011 1:37:15 PM - System Checkpoint
RP687: 07/04/2011 2:07:15 PM - System Checkpoint
RP688: 08/04/2011 3:03:51 PM - System Checkpoint
RP689: 09/04/2011 4:26:41 PM - System Checkpoint
RP690: 10/04/2011 12:20:27 AM - Installed Windows Defender
RP691: 10/04/2011 1:34:09 PM - Windows Defender Checkpoint
RP692: 11/04/2011 10:25:43 PM - System Checkpoint
RP693: 12/04/2011 12:48:50 AM - Installed HiJackThis
RP694: 13/04/2011 12:58:19 AM - Removed WD SmartWare Drive Manager
RP695: 13/04/2011 1:08:09 AM - Installed SES Driver
RP696: 14/04/2011 3:14:47 AM - System Checkpoint
RP697: 15/04/2011 5:15:56 AM - System Checkpoint
RP698: 17/04/2011 4:28:35 AM - System Checkpoint
RP699: 18/04/2011 1:10:35 AM - Removed WD SmartWare Drive Manager
RP700: 19/04/2011 10:44:16 PM - System Checkpoint
RP701: 22/04/2011 5:44:48 AM - System Checkpoint
RP702: 23/04/2011 7:05:31 AM - System Checkpoint
.
==== Installed Programs ======================
.
"Transport Canada - CDE Sample"
µTorrent
AAC Decoder
Abacast Distributed Live
Ace DivX Player
Ad-Aware SE Personal
Adobe Acrobat 5.0
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Photoshop CS
Adobe Reader 8.1.1
Adobe Shockwave Player 11
Aimersoft DVD to iPhone Converter(Build 1.0.21)
Aimersoft iPhone Converter Suite(Build 1.0.23)
Aimersoft iPhone Video Converter(Build 1.1.0)
Air Video Server 2.4.3
AndreaMosaic 3.21
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ArcSoft PhotoImpression 4
Athan Basic 3.3
ATI - Software Uninstall Utility
ATI Display Driver
ATI HydraVision
AutoCAD 2005 - English
AutoCAD LT 2002
AutoUpdate
AV Voice Changer Software DIAMOND 4.0
AviSynth 2.5
AXIS Media Control Embedded
Before You Know It 3.5 Lite 
BFC Private Reference Library
BlackBerry Desktop Software 6.0.1
Blaze Audio Voice Cloak Trial
Bonjour
Bubble Struggle 1.2
CANTAX T2Plus Educational 08.2
CCH Library 4.7
CCleaner (remove only)
CGPA Calculator 2.0
Channel Master
Cinema Craft Encoder SP Version 2.50
Compatibility Pack for the 2007 Office system
CorelDRAW 10
Coupon Printer for Windows
Creative MediaSource
Creative Removable Disk Manager
Creative System Information
Creative Zen MicroPhoto
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Version Checker
DivX Web Player
DVDx 2.2
DVDx 2.3
EAX4 Unified Redist
ESET Online Scanner v3
F-22 Lightning 3
Facebook Plug-In
ffdshow [rev 1723] [2007-12-24]
Flight Log 4.9
GameSpy Arcade
Google Chrome
Google Earth
Google SketchUp
Google Talk (remove only)
Google Talk Plugin
Google Toolbar for Internet Explorer
Google Update Helper
Graphing Calculator Viewer
Graphmatica
H.264 Decoder
HiJackThis
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB954708)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
HP MediaSmart Server
HP Update
Huffyuv AVI lossless video codec (Remove Only)
HyperLoad - Multiplayer Billiards
IMT Labs Plugin
Intel(R) PRO Network Adapters and Drivers
iTunes
Java Auto Updater
Java(TM) 6 Update 20
Java(TM) 6 Update 3
Junk Mail filter update
Lexmark 2200 Series
Lexmark Fax Solutions
LimeWire 4.10.9
LiveUpdate 3.1 (Symantec Corporation)
Logitech Gaming Software
Macromedia Extension Manager
Macromedia Flash 8
Macromedia Flash 8 Video Encoder
Malwarebytes' Anti-Malware
Medal of Honor Allied Assault
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Games for Windows - LIVE 
Microsoft Games for Windows - LIVE Redistributable
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
Microsoft Money 2004
Microsoft Money 2004 System Pack
Microsoft National Language Support Downlevel APIs
Microsoft Office 2000 Premium
Microsoft Office Live Web Folder Connector
Microsoft Picture It! Photo Premium 9
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Streets and Trips 2004
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Word 2002
Microsoft Works
Microsoft Works 2004 Setup Launcher
Microsoft Works Suite Add-in for Microsoft Word
MKV Splitter
MobileMe Control Panel
Move Networks Media Player for Internet Explorer
Mozilla Firefox (1.5.0.12)
MSN Toolbar
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser (KB925673)
MSXML4SP2
Need for Speed™ Undercover
Nero OEM
Netscape (7.2)
Nokia Connectivity Cable Driver
NOMAD MuVo
Norton PC Checkup
NVIDIA Display Control Panel
NVIDIA Drivers
NVIDIA DVD Decoder
NVIDIA nView Desktop Manager
OpenMG Limited Patch 4.1-05-13-31-01
OpenMG Secure Module 4.1.00
Panda ActiveScan
PHStat2
Picasa 2
Picture Package
Post-it® Software Notes Lite
PowerDVD
PS3 Media Server
PunkBuster Services
QuickTime
Rockstar Games Social Club
SAMSUNG CDMA Modem Driver Set
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software
Samsung PC Studio
Samsung PC Studio 3 USB Driver Installer
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 7 (KB974455)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Internet Explorer 7 (KB978207)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Segoe UI
SES Driver
Shockwave
ShortKeys Lite
SIW version 2008-12-16
Skype web features
Skype™ 4.1
SmartDraw VP
Soap 3.0 Toolkit
SonicStage 3.0
Sony USB Driver
SoundMAX
Spybot - Search & Destroy 1.4
Symantec AntiVirus
System Requirements Lab
Turing
TVersity Codec Pack 1.2
TVersity Media Server 1.5 Beta
UFile 2009
UFile 2010
UFile Updater 2009
UFile Updater 2010
Uninstall JL2005A Toy Camera
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 7 (KB976749)
Update for Windows Internet Explorer 7 (KB980182)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows Internet Explorer 8 (KB980302)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VC80CRTRedist - 8.0.50727.762
VFR Plus 1.1
Videora iPod Converter 5.04
VLC media player 0.9.9
Vodafone 804SS USB driver Software
VoiceSFX Trial
WD SmartWare Drive Manager
WebFldrs XP
Winamp (remove only)
Windows Defender
Windows Genuine Advantage Validation Tool (KB892130)
Windows Home Server Connector
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live OneCare safety scanner
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Upload Tool
Windows Live Writer
Windows Media Format 11 runtime
Windows Media Player 10
Windows Presentation Foundation
Windows XP Service Pack 3
WinMX
WinRAR archiver
WinZip
XML Paper Specification Shared Components Pack 1.0
Yahoo! Address AutoComplete
Yahoo! Install Manager
Yahoo! Internet Mail
Yahoo! Messenger
ZoneAlarm
.
==== Event Viewer Messages From Past Week ========
.
23/04/2011 11:31:54 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the PlugPlay service.
23/04/2011 11:31:54 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the WDDMService service to connect.
23/04/2011 11:31:54 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the TVersityMediaServer service to connect.
23/04/2011 11:31:54 PM, error: Service Control Manager [7000] - The WDDMService service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
22/04/2011 12:51:49 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the nvsvc service.
18/04/2011 9:24:11 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Application Layer Gateway Service service to connect.
18/04/2011 9:24:11 PM, error: Service Control Manager [7000] - The Application Layer Gateway Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
18/04/2011 10:38:40 PM, error: Service Control Manager [7022] - The Windows Home Server Connector Service service hung on starting.
18/04/2011 10:08:03 PM, error: Service Control Manager [7034] - The SonicStage SCSI Service service terminated unexpectedly. It has done this 1 time(s).
18/04/2011 10:08:03 PM, error: Service Control Manager [7034] - The iPod Service service terminated unexpectedly. It has done this 1 time(s).
18/04/2011 10:07:57 PM, error: Service Control Manager [7031] - The Windows Home Server Connector Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
18/04/2011 10:07:54 PM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
18/04/2011 10:07:53 PM, error: Service Control Manager [7034] - The SoundMAX Agent Service service terminated unexpectedly. It has done this 1 time(s).
18/04/2011 10:07:53 PM, error: Service Control Manager [7034] - The PunkBuster service terminated unexpectedly. It has done this 1 time(s).
18/04/2011 10:07:52 PM, error: Service Control Manager [7034] - The Creative Service for CDROM Access service terminated unexpectedly. It has done this 1 time(s).
18/04/2011 10:07:51 PM, error: Service Control Manager [7034] - The Bonjour Service service terminated unexpectedly. It has done this 1 time(s).
18/04/2011 10:07:51 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
18/04/2011 10:07:50 PM, error: Service Control Manager [7034] - The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s).
18/04/2011 10:07:50 PM, error: Service Control Manager [7034] - The LexBce Server service terminated unexpectedly. It has done this 1 time(s).
18/04/2011 10:07:50 PM, error: Service Control Manager [7031] - The Windows Defender service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 15000 milliseconds: Restart the service.
18/04/2011 1:16:37 AM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
18/04/2011 1:00:44 AM, error: Service Control Manager [7023] - The Automatic Updates service terminated with the following error: The specified module could not be found.
17/04/2011 4:04:39 AM, error: Print [6161] - The document https://patriotmem.4myrebate.com/Document/RebateHTMLReceipt?Tra owned by Ours failed to print on printer Lexmark 2200 Series. Data type: LEMF. Size of the spool file in bytes: 832915. Number of bytes printed: 832915. Total number of pages in the document: 1. Number of pages printed: 0. Client machine: \\HUMAYUN. Win32 error code returned by the print processor: 126 (0x7e). 
17/04/2011 3:38:09 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the TrueVector Internet Monitor service to connect.
17/04/2011 3:38:09 AM, error: Service Control Manager [7000] - The TrueVector Internet Monitor service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
17/04/2011 3:25:51 AM, error: Service Control Manager [7024] - The Symantec SPBBCSvc service terminated with service-specific error 4294967295 (0xFFFFFFFF).
17/04/2011 3:25:51 AM, error: Service Control Manager [7000] - The Sunbelt CounterSpy Antispyware service failed to start due to the following error: The system cannot find the path specified.
17/04/2011 3:25:51 AM, error: Service Control Manager [7000] - The Secdrv service failed to start due to the following error: The system cannot find the file specified.
16/04/2011 12:33:41 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Symantec Event Manager service to connect.
.
==== End Of File ===========================

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: WDC_WD800BB-00JKA0 rev.05.01C05 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK


----------



## Cookiegal (Aug 27, 2003)

Please open HijackThis.
Click on *Open Misc Tools Section*
Make sure that both boxes beside "Generate StartupList Log" are checked:

*List all minor sections(Full)*
*List Empty Sections(Complete)*
Click *Generate StartupList Log*.
Click *Yes* at the prompt.
It will open a text file. Please copy the entire contents of that page and paste it here.


----------



## itrocks4u (Nov 27, 2004)

Here you go (FYI - the two startup files with WDDMxxxx.exe are both related to the network storage drive that I have)

StartupList report, 24/04/2011, 7:04:18 PM
StartupList version: 1.52.2
Started from : H:\Program Files\Trend Micro\HiJackThis\HiJackThis.EXE
Detected: Windows XP SP3 (WinNT 5.01.2600)
Detected: Internet Explorer v8.00 (8.00.6001.18702)
* Using default options
* Including empty and uninteresting sections
* Showing rarely important sections
==================================================

Running processes:

D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Windows Defender\MsMpEng.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\LEXBCES.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\LEXPPS.EXE
D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
D:\WINDOWS\System32\CTsvcCDA.exe
D:\Program Files\Symantec AntiVirus\DefWatch.exe
D:\Program Files\Java\jre6\bin\jqs.exe
H:\Program Files\EA Games\Need for Speed Undercover\PB\PnkBstrA.exe
D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Symantec AntiVirus\Rtvscan.exe
D:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
D:\Program Files\Windows Home Server\WHSConnector.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
D:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe
D:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
D:\Program Files\IMT Labs Messenger Plugin\Cloud.exe
D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
D:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
D:\Program Files\Athan\Athan.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\Common Files\Symantec Shared\ccApp.exe
D:\PROGRA~1\SYMANT~1\VPTray.exe
D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
D:\Program Files\Lexmark 2200 Series\lxbvbmon.exe
D:\Program Files\Common Files\Java\Java Update\jusched.exe
D:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
D:\WINDOWS\system32\RUNDLL32.EXE
D:\Program Files\Windows Live\Messenger\msnmsgr.exe
D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
H:\Program Files\AirVideoServer\AirVideoServer.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
D:\WINDOWS\system32\ZoneLabs\vsmon.exe
D:\WINDOWS\System32\svchost.exe
H:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[D:\Documents and Settings\Ours\Start Menu\Programs\Startup]
*No files*

Shell folders AltStartup:
*Folder not found*

User shell folders Startup:
*Folder not found*

User shell folders AltStartup:
*Folder not found*

Shell folders Common Startup:
[D:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
WDDMStatus.lnk = D:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe

Shell folders Common AltStartup:
*Folder not found*

User shell folders Common Startup:
*Folder not found*

User shell folders Alternate Common Startup:
*Folder not found*

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = D:\WINDOWS\system32\userinit.exe,

[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
*Registry value not found*

[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

SoundMAXPnP = D:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
Lexmark 2200 Series = "D:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe"
FaxCenterServer = "D:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
Microsoft Works Update Detection = D:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
CloudPlugin = "D:\Program Files\IMT Labs Messenger Plugin\Cloud.exe"
RemoteControl = "D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
SsAAD.exe = D:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
Athan = D:\Program Files\Athan\Athan.exe
NeroFilterCheck = D:\WINDOWS\system32\NeroCheck.exe
ZoneAlarm Client = "D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
ccApp = "D:\Program Files\Common Files\Symantec Shared\ccApp.exe"
vptray = D:\PROGRA~1\SYMANT~1\VPTray.exe
HP Software Update = D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
AppleSyncNotifier = D:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
Adobe Reader Speed Launcher = "D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
SunJavaUpdateSched = "D:\Program Files\Common Files\Java\Java Update\jusched.exe"
nwiz = D:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
NvMediaCenter = RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
NvCplDaemon = RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
QuickTime Task = "D:\Program Files\QuickTime\qttask.exe" -atboottime
iTunesHelper = "H:\Program Files\iTunes\iTunesHelper.exe"

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

msnmsgr = "D:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
Creative Detector = "D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
swg = "D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
Google Update = "D:\Documents and Settings\Ours\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
AirVideoServer = H:\Program Files\AirVideoServer\AirVideoServer.exe
ctfmon.exe = D:\WINDOWS\system32\ctfmon.exe

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

[OptionalComponents]
=

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

File association entry for .EXE:
HKEY_CLASSES_ROOT\exefile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .COM:
HKEY_CLASSES_ROOT\ComFile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .BAT:
HKEY_CLASSES_ROOT\batfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .PIF:
HKEY_CLASSES_ROOT\piffile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .SCR:
HKEY_CLASSES_ROOT\AutoCADScriptFile\shell\open\command

(Default) = "D:\WINDOWS\notepad.exe" "%1"

--------------------------------------------------

File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = D:\WINDOWS\system32\mshta.exe "%1" %*

--------------------------------------------------

File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command

(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] *
StubPath = D:\WINDOWS\system32\ieudinit.exe

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
StubPath = D:\WINDOWS\inf\unregmp2.exe /ShowWMP

[>{26923b43-4d38-484f-9b9e-de460746276c}] *
StubPath = D:\WINDOWS\system32\ie4uinit.exe -UserIconConfig

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

[>{f548df6a-9bbd-4268-a68b-92f1e425c085}] *
StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection D:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

[{5945c046-1e7d-11d1-bc44-00c04fd912be}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection D:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection D:\WINDOWS\INF\wmp.inf,PerUserStub

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = D:\WINDOWS\system32\ie4uinit.exe -BaseSettings

[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *
StubPath = D:\WINDOWS\system32\Rundll32.exe D:\WINDOWS\system32\mscories.dll,Install

--------------------------------------------------

Enumerating ICQ Agent Autostart apps:
HKCU\Software\Mirabilis\ICQ\Agent\Apps

*Registry key not found*

--------------------------------------------------

Load/Run keys from D:\WINDOWS\WIN.INI:

load=*INI section not found*
run=*INI section not found*

Load/Run keys from Registry:

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=

--------------------------------------------------

Shell & screensaver key from D:\WINDOWS\SYSTEM.INI:

Shell=
SCRNSAVE.EXE=D:\WINDOWS\System32\MAGICW~1.SCR
drivers=

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=D:\WINDOWS\System32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Checking for EXPLORER.EXE instances:

D:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
D:\WINDOWS\Explorer\Explorer.exe: not present
D:\WINDOWS\System\Explorer.exe: not present
D:\WINDOWS\System32\Explorer.exe: not present
D:\WINDOWS\Command\Explorer.exe: not present
D:\WINDOWS\Fonts\Explorer.exe: not present

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

--------------------------------------------------

Verifying REGEDIT.EXE integrity:

- Regedit.exe found in D:\WINDOWS
- .reg open command is normal (regedit.exe %1)
- Company name OK: 'Microsoft Corporation'
- Original filename OK: 'REGEDIT.EXE'
- File description: 'Registry Editor'

Registry check passed

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
Skype add-on (mastermind) - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll - {22BF413B-C6D2-4d91-82A9-A0F997BA588C}
(no name) - (no file) - {5C255C8A-E604-49b4-9D64-90988571CECB}
(no name) - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll - {9030D464-4C02-4ABF-8ECC-5164760863C6}
(no name) - D:\Program Files\Windows Home Server\WHSDeskBands.dll - {9A065C65-4EE7-4DDD-9918-F129089A894A}
(no name) - D:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll - {AA58ED58-01DD-4d91-8333-CF10577473F7}
(no name) - D:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}
(no name) - D:\Program Files\Java\jre6\bin\jp2ssv.dll - {DBC80044-A445-435b-BC74-9C25C1C588A9}
JQSIEStartDetectorImpl - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll - {E7E6F031-17CE-4C07-BC86-EABFE594F69C}

--------------------------------------------------

Enumerating Task Scheduler jobs:

AppleSoftwareUpdate.job
GoogleUpdateTaskMachineCore.job
GoogleUpdateTaskMachineUA.job
GoogleUpdateTaskUserS-1-5-21-1078081533-287218729-725345543-1004Core.job
GoogleUpdateTaskUserS-1-5-21-1078081533-287218729-725345543-1004UA.job
MP Scheduled Scan.job
SDMsgUpdate (TE).job

--------------------------------------------------

Enumerating Download Program Files:

[DirectAnimation Java Classes]
CODEBASE = file://D:\WINDOWS\Java\classes\dajava.cab
OSD = D:\WINDOWS\Downloaded Program Files\DirectAnimation Java Classes.osd

[Microsoft XML Parser for Java]
CODEBASE = file://D:\WINDOWS\Java\classes\xmldso.cab
OSD = D:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd

[Facebook Photo Uploader 5 Control]
InProcServer32 = D:\WINDOWS\Downloaded Program Files\PhotoUploader5.ocx
CODEBASE = http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab

[Windows Genuine Advantage Validation Tool]
InProcServer32 = D:\WINDOWS\System32\LegitCheckControl.DLL
CODEBASE = http://go.microsoft.com/fwlink/?linkid=39204

[System Requirements Lab Class]
InProcServer32 = D:\WINDOWS\Downloaded Program Files\sysreqlab_srl.dll
CODEBASE = http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
OSD = D:\WINDOWS\Downloaded Program Files\sysreqlab.osd

[System Requirements Lab Class]
InProcServer32 = D:\WINDOWS\Downloaded Program Files\sysreqlab_nvd.dll
CODEBASE = http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
OSD = D:\WINDOWS\Downloaded Program Files\sysreqlab.osd

[{33564D57-0000-0010-8000-00AA00389B71}]
CODEBASE = http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB

[MSN Photo Upload Tool]
InProcServer32 = D:\WINDOWS\Downloaded Program Files\MsnPUpld.dll
CODEBASE = http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab

[Facebook Photo Uploader 5 Control]
InProcServer32 = D:\WINDOWS\Downloaded Program Files\PhotoUploader55.ocx
CODEBASE = http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab

[Java Plug-in 1.6.0_20]
InProcServer32 = D:\Program Files\Java\jre6\bin\jp2iexp.dll
CODEBASE = http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

[{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}]
CODEBASE = http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

[Domino Web Access 8 Control]
InProcServer32 = D:\WINDOWS\DOWNLO~1\dwa8W.dll
CODEBASE = http://beowulf.schulich.yorku.ca/dwa8W.cab

[Crucial cpcScan]
InProcServer32 = D:\WINDOWS\Downloaded Program Files\cpcScan.dll
CODEBASE = http://www.crucial.com/controls/cpcScanner.cab

[Java Plug-in 1.6.0_03]
InProcServer32 = D:\Program Files\Java\jre6\bin\jp2iexp.dll
CODEBASE = http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

[Java Plug-in 1.6.0_20]
InProcServer32 = D:\Program Files\Java\jre6\bin\jp2iexp.dll
CODEBASE = http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

[Java Plug-in 1.6.0_20]
InProcServer32 = D:\Program Files\Java\jre6\bin\npjpi160_20.dll
CODEBASE = http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

[Shockwave Flash Object]
InProcServer32 = D:\WINDOWS\System32\Macromed\Flash\Flash10b.ocx
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

--------------------------------------------------

Enumerating Winsock LSP files:

NameSpace #1: D:\WINDOWS\System32\mswsock.dll
NameSpace #2: D:\WINDOWS\System32\winrnr.dll
NameSpace #3: D:\WINDOWS\System32\mswsock.dll
NameSpace #4: D:\Program Files\Bonjour\mdnsNSP.dll
Protocol #1: D:\WINDOWS\system32\mswsock.dll
Protocol #2: D:\WINDOWS\system32\mswsock.dll
Protocol #3: D:\WINDOWS\system32\mswsock.dll
Protocol #4: D:\WINDOWS\system32\rsvpsp.dll
Protocol #5: D:\WINDOWS\system32\rsvpsp.dll
Protocol #6: D:\WINDOWS\system32\mswsock.dll
Protocol #7: D:\WINDOWS\system32\mswsock.dll
Protocol #8: D:\WINDOWS\system32\mswsock.dll
Protocol #9: D:\WINDOWS\system32\mswsock.dll
Protocol #10: D:\WINDOWS\system32\mswsock.dll
Protocol #11: D:\WINDOWS\system32\mswsock.dll
Protocol #12: D:\WINDOWS\system32\mswsock.dll
Protocol #13: D:\WINDOWS\system32\mswsock.dll

--------------------------------------------------

Enumerating Windows NT/2000/XP services

Microsoft ACPI Driver: System32\DRIVERS\ACPI.sys (system)
Adobe LM Service: "D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe" (manual start)
aeaudio: system32\drivers\aeaudio.sys (manual start)
Microsoft Kernel Acoustic Echo Canceller: system32\drivers\aec.sys (manual start)
AFD Networking Support Environment: \SystemRoot\System32\drivers\afd.sys (system)
Intel AGP Bus Filter: System32\DRIVERS\agp440.sys (system)
Alerter: %SystemRoot%\System32\svchost.exe -k LocalService (disabled)
Application Layer Gateway Service: %SystemRoot%\System32\alg.exe (manual start)
ALSysIO: \??\D:\DOCUME~1\Ours\LOCALS~1\Temp\ALSysIO.sys (manual start)
Apple Mobile Device: "D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe" (autostart)
Application Management: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
ASP.NET State Service: %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (manual start)
RAS Asynchronous Media Driver: system32\DRIVERS\asyncmac.sys (manual start)
Standard IDE/ESDI Hard Disk Controller: System32\DRIVERS\atapi.sys (system)
Ati HotKey Poller: %SystemRoot%\System32\Ati2evxx.exe (autostart)
ATI Smart: D:\WINDOWS\system32\ati2sgag.exe (autostart)
ati2mtag: System32\DRIVERS\ati2mtag.sys (manual start)
ATM ARP Client Protocol: System32\DRIVERS\atmarpc.sys (manual start)
Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Audio Stub Driver: System32\DRIVERS\audstub.sys (manual start)
Autodesk Licensing Service: "D:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe" (manual start)
Background Intelligent Transfer Service: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Bonjour Service: "D:\Program Files\Bonjour\mDNSResponder.exe" (autostart)
Computer Browser: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
BVRPMPR5 NDIS Protocol Driver: \??\D:\WINDOWS\system32\drivers\BVRPMPR5.SYS (manual start)
catchme: \??\D:\DOCUME~1\Ours\LOCALS~1\Temp\catchme.sys (manual start)
Closed Caption Decoder: System32\DRIVERS\CCDECODE.sys (manual start)
Symantec Event Manager: "D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe" (autostart)
Symantec Settings Manager: "D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe" (autostart)
CD-ROM Driver: System32\DRIVERS\cdrom.sys (system)
Indexing Service: %SystemRoot%\system32\cisvc.exe (manual start)
ClipBook: %SystemRoot%\system32\clipsrv.exe (manual start)
.NET Runtime Optimization Service v2.0.50727_X86: D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (manual start)
COM+ System Application: %SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start)
cpuz129: \??\D:\DOCUME~1\Ours\LOCALS~1\Temp\cpuz_x32.sys (manual start)
Creative Service for CDROM Access: D:\WINDOWS\System32\CTsvcCDA.exe (autostart)
CryptSvc: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
DCOM Server Process Launcher: %SystemRoot%\system32\svchost.exe -k DcomLaunch (autostart)
Symantec AntiVirus Definition Watcher: "D:\Program Files\Symantec AntiVirus\DefWatch.exe" (autostart)
DHCP Client: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Disk Driver: System32\DRIVERS\disk.sys (system)
Logical Disk Manager Administrative Service: %SystemRoot%\System32\dmadmin.exe /com (manual start)
dmboot: System32\drivers\dmboot.sys (disabled)
dmio: System32\drivers\dmio.sys (disabled)
dmload: System32\drivers\dmload.sys (disabled)
Logical Disk Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Microsoft Kernel DLS Syntheiszer: system32\drivers\DMusic.sys (manual start)
DNS Client: %SystemRoot%\System32\svchost.exe -k NetworkService (autostart)
Wired AutoConfig: %SystemRoot%\System32\svchost.exe -k dot3svc (manual start)
Microsoft Kernel DRM Audio Descrambler: system32\drivers\drmkaud.sys (manual start)
dtscsi: \SystemRoot\System32\Drivers\dtscsi.sys (manual start)
dwshd: \SystemRoot\System32\drivers\dwshd.sys (disabled)
Intel(R) PRO Adapter Driver: System32\DRIVERS\e100b325.sys (manual start)
Extensible Authentication Protocol Service: %SystemRoot%\System32\svchost.exe -k eapsvcs (manual start)
Symantec Eraser Control driver: \??\D:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (system)
EraserUtilRebootDrv: \??\D:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (manual start)
Error Reporting Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
EUTRON SmartKey Parallel Driver: \??\D:\WINDOWS\System32\Drivers\eusk2par.sys (autostart)
Event Log: %SystemRoot%\system32\services.exe (autostart)
COM+ Event System: D:\WINDOWS\System32\svchost.exe -k netsvcs (manual start)
Fast User Switching Compatibility: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Floppy Disk Controller Driver: System32\DRIVERS\fdc.sys (manual start)
Floppy Disk Driver: System32\DRIVERS\flpydisk.sys (manual start)
FltMgr: system32\drivers\fltmgr.sys (system)
Windows Presentation Foundation Font Cache 3.0.0.0: D:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (manual start)
Volume Manager Driver: System32\DRIVERS\ftdisk.sys (system)
GEAR ASPI Filter Driver: system32\DRIVERS\GEARAspiWDM.sys (manual start)
Generic Packet Classifier: System32\DRIVERS\msgpc.sys (manual start)
Google Update Service (gupdate1ca597c7db22888): "D:\Program Files\Google\Update\GoogleUpdate.exe" /svc (autostart)
Google Software Updater: "D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe" (manual start)
Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Human Interface Device Access: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
Microsoft HID Class Driver: System32\DRIVERS\hidusb.sys (manual start)
Health Key and Certificate Management Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
HTTP: System32\Drivers\HTTP.sys (manual start)
HTTP SSL: %SystemRoot%\System32\svchost.exe -k HTTPFilter (manual start)
i8042 Keyboard and PS/2 Mouse Port Driver: System32\DRIVERS\i8042prt.sys (system)
Windows CardSpace: "D:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe" (manual start)
CD-Burning Filter Driver: System32\DRIVERS\imapi.sys (system)
IMAPI CD-Burning COM Service: %systemroot%\system32\imapi.exe (manual start)
Intel Processor Driver: System32\DRIVERS\intelppm.sys (system)
IPv6 Windows Firewall Driver: system32\drivers\ip6fw.sys (manual start)
IP Traffic Filter Driver: System32\DRIVERS\ipfltdrv.sys (manual start)
IP in IP Tunnel Driver: System32\DRIVERS\ipinip.sys (manual start)
IP Network Address Translator: System32\DRIVERS\ipnat.sys (manual start)
iPod Service: "D:\Program Files\iPod\bin\iPodService.exe" (manual start)
IPSEC driver: System32\DRIVERS\ipsec.sys (system)
IR Enumerator Service: System32\DRIVERS\irenum.sys (manual start)
PnP ISA/EISA Bus Driver: System32\DRIVERS\isapnp.sys (system)
Java Quick Starter: "D:\Program Files\Java\jre6\bin\jqs.exe" -service -config "D:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf" (autostart)
JL2005A Toy Camera: System32\Drivers\toywdm.sys (manual start)
Keyboard Class Driver: System32\DRIVERS\kbdclass.sys (system)
Keyboard HID Driver: System32\DRIVERS\kbdhid.sys (system)
Microsoft Kernel Wave Audio Mixer: system32\drivers\kmixer.sys (manual start)
Server: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Workstation: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
LexBce Server: D:\WINDOWS\system32\LEXBCES.EXE (autostart)
LiveUpdate: "D:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE" (manual start)
TCP/IP NetBIOS Helper: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
Messenger: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)
MidiSyn: system32\drivers\MidiSyn.sys (manual start)
NetMeeting Remote Desktop Sharing: D:\WINDOWS\System32\mnmsrvc.exe (manual start)
Mouse Class Driver: System32\DRIVERS\mouclass.sys (system)
Mouse HID Driver: System32\DRIVERS\mouhid.sys (manual start)
WebDav Client Redirector: System32\DRIVERS\mrxdav.sys (manual start)
MRXSMB: System32\DRIVERS\mrxsmb.sys (system)
MSCSPTISRV: D:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe (manual start)
Distributed Transaction Coordinator: D:\WINDOWS\System32\msdtc.exe (manual start)
Windows Installer: %systemroot%\system32\msiexec.exe /V (manual start)
Microsoft Streaming Service Proxy: system32\drivers\MSKSSRV.sys (manual start)
Microsoft Streaming Clock Proxy: system32\drivers\MSPCLOCK.sys (manual start)
Microsoft Streaming Quality Manager Proxy: system32\drivers\MSPQM.sys (manual start)
Microsoft System Management BIOS Driver: System32\DRIVERS\mssmbios.sys (manual start)
Microsoft Streaming Tee/Sink-to-Sink Converter: system32\drivers\MSTEE.sys (manual start)
NABTS/FEC VBI Codec: System32\DRIVERS\NABTSFEC.sys (manual start)
Network Access Protection Agent: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
NAVENG: \??\D:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20110424.002\naveng.sys (manual start)
NAVEX15: \??\D:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20110424.002\navex15.sys (manual start)
Microsoft TV/Video Connection: System32\DRIVERS\NdisIP.sys (manual start)
Remote Access NDIS TAPI Driver: System32\DRIVERS\ndistapi.sys (manual start)
NDIS Usermode I/O Protocol: System32\DRIVERS\ndisuio.sys (manual start)
Remote Access NDIS WAN Driver: System32\DRIVERS\ndiswan.sys (manual start)
NetBIOS Interface: System32\DRIVERS\netbios.sys (system)
NetBios over Tcpip: System32\DRIVERS\netbt.sys (system)
Network DDE: %SystemRoot%\system32\netdde.exe (disabled)
Network DDE DSDM: %SystemRoot%\system32\netdde.exe (disabled)
Net Logon: %SystemRoot%\system32\lsass.exe (manual start)
Network Connections: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Net.Tcp Port Sharing Service: "D:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe" (disabled)
Network Location Awareness (NLA): %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Nokia USB Modem: system32\drivers\nmwcdcm.sys (manual start)
Nokia USB Phone Parent: system32\drivers\nmwcd.sys (manual start)
NT LM Security Support Provider: %SystemRoot%\System32\lsass.exe (manual start)
Removable Storage: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
nv: system32\DRIVERS\nv4_mini.sys (manual start)
NVIDIA Display Driver Service: D:\WINDOWS\system32\nvsvc32.exe (autostart)
IPX Traffic Filter Driver: System32\DRIVERS\nwlnkflt.sys (manual start)
IPX Traffic Forwarder Driver: System32\DRIVERS\nwlnkfwd.sys (manual start)
PACSPTISVR: D:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe (manual start)
Parallel port driver: System32\DRIVERS\parport.sys (manual start)
PCI Bus Driver: System32\DRIVERS\pci.sys (system)
PCIIde: System32\DRIVERS\pciide.sys (system)
Padus ASPI Shell: system32\drivers\pfc.sys (manual start)
Plug and Play: %SystemRoot%\system32\services.exe (autostart)
PunkBuster: "H:\Program Files\EA Games\Need for Speed Undercover\PB\PnkBstrA.exe" (autostart)
IPSEC Services: %SystemRoot%\system32\lsass.exe (autostart)
WAN Miniport (PPTP): System32\DRIVERS\raspptp.sys (manual start)
Processor Driver: System32\DRIVERS\processr.sys (system)
Protected Storage: %SystemRoot%\system32\lsass.exe (autostart)
QoS Packet Scheduler: System32\DRIVERS\psched.sys (manual start)
Direct Parallel Link Driver: System32\DRIVERS\ptilink.sys (manual start)
PxHelp20: System32\DRIVERS\PxHelp20.sys (system)
Remote Access Auto Connection Driver: System32\DRIVERS\rasacd.sys (system)
Remote Access Auto Connection Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
WAN Miniport (L2TP): System32\DRIVERS\rasl2tp.sys (manual start)
Remote Access Connection Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Remote Access PPPOE Driver: System32\DRIVERS\raspppoe.sys (manual start)
Direct Parallel: System32\DRIVERS\raspti.sys (manual start)
Rdbss: System32\DRIVERS\rdbss.sys (system)
RDPCDD: System32\DRIVERS\RDPCDD.sys (system)
Remote Desktop Help Session Manager: D:\WINDOWS\system32\sessmgr.exe (manual start)
Digital CD Audio Playback Filter Driver: System32\DRIVERS\redbook.sys (system)
Routing and Remote Access: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
BlackBerry Smartphone: System32\Drivers\RimUsb.sys (manual start)
RIM Virtual Serial Port v2: system32\DRIVERS\RimSerial.sys (manual start)
Microsoft Legacy Modem Driver: System32\Drivers\RootMdm.sys (manual start)
rootrepeal: \??\D:\WINDOWS\system32\drivers\rootrepeal.sys (manual start)
Remote Procedure Call (RPC) Locator: %SystemRoot%\System32\locator.exe (manual start)
Remote Procedure Call (RPC): %SystemRoot%\system32\svchost.exe -k rpcss (autostart)
QoS RSVP: %SystemRoot%\System32\rsvp.exe (manual start)
Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)
SAVRoam: "D:\Program Files\Symantec AntiVirus\SavRoam.exe" (manual start)
SAVRT: \??\D:\Program Files\Symantec AntiVirus\savrt.sys (manual start)
SAVRTPEL: \??\D:\Program Files\Symantec AntiVirus\Savrtpel.sys (system)
Sunbelt CounterSpy Antispyware: "D:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe" (autostart)
Smart Card: %SystemRoot%\System32\SCardSvr.exe (manual start)
Task Scheduler: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Secdrv: System32\DRIVERS\secdrv.sys (autostart)
Secondary Logon: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Serenum Filter Driver: System32\DRIVERS\serenum.sys (manual start)
Serial port driver: System32\DRIVERS\serial.sys (system)
SFI Service: system32\drivers\sf.sys (system)
Windows Firewall/Internet Connection Sharing (ICS): %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Shell Hardware Detection: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
BDA Slip De-Framer: System32\DRIVERS\SLIP.sys (manual start)
smwdm: system32\drivers\smwdm.sys (manual start)
Symantec Network Drivers Service: "D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe" (manual start)
Sony USB Filter Driver (SONYPVU1): System32\DRIVERS\SONYPVU1.SYS (manual start)
SoundMAX Agent Service: D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (autostart)
SPBBCDrv: \??\D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (system)
Symantec SPBBCSvc: "D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe" (autostart)
Microsoft Kernel Audio Splitter: system32\drivers\splitter.sys (manual start)
Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)
sptd: System32\Drivers\sptd.sys (disabled)
Sony SPTI Service: D:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe (manual start)
System Restore Filter Driver: System32\DRIVERS\sr.sys (system)
srescan: System32\ZoneLabs\srescan.sys (system)
System Restore Service: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Srv: System32\DRIVERS\srv.sys (manual start)
SSDP Discovery Service: %SystemRoot%\System32\svchost.exe -k LocalService (manual start)
SonicStage SCSI Service: D:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe (manual start)
SAMSUNG Mobile USB Device 1.0 driver (WDM): System32\DRIVERS\ss_bus.sys (manual start)
SAMSUNG Mobile USB Modem 1.0 Filter: System32\DRIVERS\ss_mdfl.sys (manual start)
SAMSUNG Mobile USB Modem 1.0 Drivers: System32\DRIVERS\ss_mdm.sys (manual start)
Windows Image Acquisition (WIA): %SystemRoot%\System32\svchost.exe -k imgsvc (autostart)
BDA IPSink: System32\DRIVERS\StreamIP.sys (manual start)
Software Bus Driver: System32\DRIVERS\swenum.sys (manual start)
Microsoft Kernel GS Wavetable Synthesizer: system32\drivers\swmidi.sys (manual start)
MS Software Shadow Copy Provider: D:\WINDOWS\System32\dllhost.exe /Processid:{877F5D84-EAE3-4A9D-A5D4-7008BD58130C} (manual start)
Symantec AntiVirus: "D:\Program Files\Symantec AntiVirus\Rtvscan.exe" (autostart)
SymEvent: \??\D:\Program Files\Symantec\SYMEVENT.SYS (manual start)
SYMREDRV: \SystemRoot\System32\Drivers\SYMREDRV.SYS (manual start)
SYMTDI: \SystemRoot\System32\Drivers\SYMTDI.SYS (system)
Microsoft Kernel System Audio Device: system32\drivers\sysaudio.sys (manual start)
Performance Logs and Alerts: %SystemRoot%\system32\smlogsvc.exe (manual start)
Telephony: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
TCP/IP Protocol Driver: System32\DRIVERS\tcpip.sys (system)
Terminal Device Driver: System32\DRIVERS\termdd.sys (system)
Terminal Services: %SystemRoot%\System32\svchost.exe -k DComLaunch (manual start)
Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Distributed Link Tracking Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
TVersityMediaServer: "H:\Program Files\TVersity\Media Server\MediaServer.exe" (autostart)
Microcode Update Driver: System32\DRIVERS\update.sys (manual start)
Universal Plug and Play Device Host: %SystemRoot%\System32\svchost.exe -k LocalService (manual start)
Uninterruptible Power Supply: %SystemRoot%\System32\ups.exe (manual start)
Apple Mobile USB Driver: System32\Drivers\usbaapl.sys (manual start)
Microsoft USB Generic Parent Driver: System32\DRIVERS\usbccgp.sys (manual start)
Microsoft USB 2.0 Enhanced Host Controller Miniport Driver: System32\DRIVERS\usbehci.sys (manual start)
Microsoft USB Standard Hub Driver: System32\DRIVERS\usbhub.sys (manual start)
Microsoft USB PRINTER Class: System32\DRIVERS\usbprint.sys (manual start)
USB Scanner Driver: System32\DRIVERS\usbscan.sys (manual start)
USB Mass Storage Driver: System32\DRIVERS\USBSTOR.SYS (manual start)
Microsoft USB Universal Host Controller Miniport Driver: System32\DRIVERS\usbuhci.sys (manual start)
Vcs support: \??\D:\WINDOWS\System32\Drivers\Vcs.sys (autostart)
VGA Display Controller.: \SystemRoot\System32\drivers\vga.sys (system)
vsdatant: System32\vsdatant.sys (system)
TrueVector Internet Monitor: D:\WINDOWS\system32\ZoneLabs\vsmon.exe -service (autostart)
Volume Shadow Copy: %SystemRoot%\System32\vssvc.exe (manual start)
Windows Time: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Remote Access IP ARP Driver: System32\DRIVERS\wanarp.sys (manual start)
WDDMService: "D:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe" (autostart)
Kernel Mode Driver Frameworks service: System32\Drivers\wdf01000.sys (manual start)
Microsoft WINMM WDM Audio Compatibility Driver: system32\drivers\wdmaud.sys (manual start)
WebClient: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
Windows Home Server Connector Service: "D:\Program Files\Windows Home Server\WHSConnector.exe" (autostart)
Windows Defender: "D:\Program Files\Windows Defender\MsMpEng.exe" (autostart)
Windows Management Instrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Logitech Virtual Bus Enumerator Driver: system32\drivers\WmBEnum.sys (manual start)
Portable Media Serial Number Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Logitech Gaming HID Filter Driver: system32\drivers\WmFilter.sys (manual start)
WMI Performance Adapter: D:\WINDOWS\System32\wbem\wmiapsrv.exe (manual start)
Logitech Virtual Hid Device Driver: system32\drivers\WmVirHid.sys (manual start)
Logitech WingMan Translation Layer Driver: system32\drivers\WmXlCore.sys (manual start)
WpdUsb: System32\Drivers\wpdusb.sys (manual start)
Windows Socket 2.0 Non-IFS Service Provider Support Environment: \SystemRoot\System32\drivers\ws2ifsl.sys (system)
Security Center: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
World Standard Teletext Codec: System32\DRIVERS\WSTCODEC.SYS (manual start)
Automatic Updates: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Windows Driver Foundation - User-mode Driver Framework Platform Driver: system32\DRIVERS\WudfPf.sys (manual start)
Windows Driver Foundation - User-mode Driver Framework Reflector: system32\DRIVERS\wudfrd.sys (manual start)
Windows Driver Foundation - User-mode Driver Framework: %SystemRoot%\system32\svchost.exe -k WudfServiceGroup (manual start)
Wireless Zero Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Network Provisioning Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

--------------------------------------------------

Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*

Windows NT checkdisk command:
BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':
PendingFileRenameOperations: *Registry value not found*

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: D:\WINDOWS\system32\shell32.dll
CDBurn: D:\WINDOWS\system32\SHELL32.dll
WebCheck: D:\WINDOWS\system32\webcheck.dll
SysTray: D:\WINDOWS\system32\stobject.dll
WPDShServiceObj: D:\WINDOWS\system32\WPDShServiceObj.dll

--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*No values found*

--------------------------------------------------

End of report, 44,491 bytes
Report generated in 0.234 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only


----------



## Cookiegal (Aug 27, 2003)

Is the network storage drive now working?


----------



## itrocks4u (Nov 27, 2004)

Yes it is. I reinstalled all the required drivers, so far its working fine.

The only issue seems like the computer is pretty slow still, especially internet explorer and chrome. Chrome has generally been pretty fast in the past. Is the computer clean now? Should i start uninstalling the programs i downloaded?


----------



## Cookiegal (Aug 27, 2003)

Click Start and My Computer. Right-click the hard drive you want to check, and click Properties. Select the Tools tab and click Check Now. Check both boxes. Click Start. You'll get a message that the computer must be rebooted to run a complete check. Click Yes and reboot. Chkdsk will take a while, so run it when you don't need to use the computer for something else.

To view results log:

Go to *Start *- *Run *and type in *eventvwr.msc*, and hit enter.
When Event Viewer opens, click on "Application", then scroll
down to "Winlogon" and double-click on it to open it up. This is the log
created after running chkdsk. Click on the icon that looks like two pieces of paper to copy it and then paste it here please.


----------



## itrocks4u (Nov 27, 2004)

I ran both the main drives, third one is drive H: Should I run that as well?

Event Type:	Information
Event Source:	Winlogon
Event Category:	None
Event ID:	1001
Date: 27/04/2011
Time: 2:04:17 PM
User: N/A
Computer:	HUMAYUN
Description:
Checking file system on C:
The type of the file system is FAT32.

A disk check has been scheduled.
Windows will now check the disk. 
Volume Serial Number is B88F-A963
Windows is verifying free space...
Free space verification is complete.
Windows has checked the file system and found no problems.
4721892 KB total disk space.
1571284 KB in 22 hidden files.
424 KB in 102 folders.
2185760 KB in 1709 files.
964420 KB are available.

4096 bytes in each allocation unit.
1180473 total allocation units on disk.
241105 allocation units available on disk.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Information
Event Source:	Winlogon
Event Category:	None
Event ID:	1001
Date: 27/04/2011
Time: 10:02:30 AM
User: N/A
Computer:	HUMAYUN
Description:
Checking file system on D:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk. 
Cleaning up minor inconsistencies on the drive.
Cleaning up 2565 unused index entries from index $SII of file 0x9.
Cleaning up 2565 unused index entries from index $SDH of file 0x9.
Cleaning up 2565 unused security descriptors.
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
Windows has made corrections to the file system.

73417018 KB total disk space.
65794112 KB in 168781 files.
67668 KB in 14537 indexes.
0 KB in bad sectors.
376738 KB in use by the system.
65536 KB occupied by the log file.
7178500 KB available on disk.

4096 bytes in each allocation unit.
18354254 total allocation units on disk.
1794625 allocation units available on disk.

Internal Info:
50 1d 03 00 21 cc 02 00 e2 42 04 00 00 00 00 00 P...!....B......
28 23 00 00 02 00 00 00 e4 11 00 00 00 00 00 00 (#..............
66 b9 b5 75 00 00 00 00 a8 77 64 43 01 00 00 00 f..u.....wdC....
e8 69 d3 d4 00 00 00 00 86 f9 a1 af 83 00 00 00 .i..............
9c e7 8f 1d 01 00 00 00 ea 48 dd df 87 00 00 00 .........H......
99 9e 36 00 00 00 00 00 c8 3a 07 00 4d 93 02 00 ..6......:..M...
00 00 00 00 00 00 c1 af 0f 00 00 00 c9 38 00 00 .............8..

Windows has finished checking your disk.
Please wait while your computer restarts.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


----------



## itrocks4u (Nov 27, 2004)

Done for all the main drives (See above as well). Here's H:

Event Type:	Information
Event Source:	Winlogon
Event Category:	None
Event ID:	1001
Date: 28/04/2011
Time: 1:10:09 AM
User: N/A
Computer:	HUMAYUN
Description:
Checking file system on H:
The type of the file system is NTFS.
Volume label is New Volume.

A disk check has been scheduled.
Windows will now check the disk. 
Cleaning up minor inconsistencies on the drive.
Cleaning up 50 unused index entries from index $SII of file 0x9.
Cleaning up 50 unused index entries from index $SDH of file 0x9.
Cleaning up 50 unused security descriptors.
CHKDSK is verifying file data (stage 4 of 5)...
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
Free space verification is complete.

488384000 KB total disk space.
229437240 KB in 33254 files.
13648 KB in 4749 indexes.
0 KB in bad sectors.
119176 KB in use by the system.
65536 KB occupied by the log file.
258813936 KB available on disk.

4096 bytes in each allocation unit.
122096000 total allocation units on disk.
64703484 allocation units available on disk.

Internal Info:
a0 95 00 00 7e 94 00 00 8a e5 00 00 00 00 00 00 ....~...........
04 12 00 00 00 00 00 00 46 00 00 00 00 00 00 00 ........F.......
1c a8 70 02 00 00 00 00 ce 2f a5 2a 00 00 00 00 ..p....../.*....
50 a9 ab 00 00 00 00 00 7a b3 89 32 07 00 00 00 P.......z..2....
04 ba 26 54 08 00 00 00 80 60 7c bb 0f 00 00 00 ..&T.....`|.....
99 9e 36 00 00 00 00 00 c8 3a 07 00 e6 81 00 00 ..6......:......
00 00 00 00 00 e0 bc b3 36 00 00 00 8d 12 00 00 ........6.......

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


----------



## Cookiegal (Aug 27, 2003)

Please post a new HIjackThis log.


----------



## itrocks4u (Nov 27, 2004)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 1:16:08 PM, on 28/04/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Windows Defender\MsMpEng.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\LEXBCES.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\LEXPPS.EXE
D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
D:\WINDOWS\System32\CTsvcCDA.exe
D:\Program Files\Symantec AntiVirus\DefWatch.exe
D:\Program Files\Java\jre6\bin\jqs.exe
H:\Program Files\EA Games\Need for Speed Undercover\PB\PnkBstrA.exe
D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Symantec AntiVirus\Rtvscan.exe
D:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
D:\Program Files\Windows Home Server\WHSConnector.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
D:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe
D:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
D:\Program Files\Lexmark 2200 Series\lxbvbmon.exe
D:\Program Files\IMT Labs Messenger Plugin\Cloud.exe
D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
D:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
D:\Program Files\Athan\Athan.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\Common Files\Symantec Shared\ccApp.exe
D:\PROGRA~1\SYMANT~1\VPTray.exe
D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
D:\Program Files\Common Files\Java\Java Update\jusched.exe
D:\WINDOWS\system32\RUNDLL32.EXE
H:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\Windows Live\Messenger\msnmsgr.exe
D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
H:\Program Files\AirVideoServer\AirVideoServer.exe
D:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\WINDOWS\system32\ZoneLabs\vsmon.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\mmc.exe
D:\WINDOWS\system32\NOTEPAD.EXE
H:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
N3 - Netscape 7: # Mozilla User Preferences

/* Do not edit this file.
*
* If you make changes to this file while the browser is running,
* the changes will be overwritten when the browser exits.
*
* To make a manual change to preferences, you can visit the URL about:config
* For more information, see http://www.mozilla.org/unix/customizing.html#prefs
*/

user_pref("__000.aim.general.im.enterCR", false);
user_pref("__000.aim.general.im.tabKey", false);
user_pref("__000.aim.general.im.timeStamp", false);
user_pref("__sys.aim.filexfer.location", "");
user_pref("__sys.aim.general.im.enterCR", false);
user_pref("__sys.aim.general.im.smilies", false);
user_pref("__sys.aim.general.im.tabKey", false);
user_pref("__sys.aim.general.im.timeStamp", false);
user_pref("__sys.aim.general.snsautosignon", false);
user_pref("__sys.aim.general.today", false);
user_pref("aim.session.firsttime", false);
user_pref("browser.activation.checkedNNFlag", true);
user_pref("browser.bookmarks.added_static_root", true);
user_pref("
N3 - Netscape 7: # Mozilla User Preferences

/* Do not edit this file.
*
* If you make changes to this file while the browser is running,
* the changes will be overwritten when the browser exits.
*
* To make a manual change to preferences, you can visit the URL about:config
* For more information, see http://www.mozilla.org/unix/customizing.html#prefs
*/

user_pref("__000.aim.general.im.enterCR", false);
user_pref("__000.aim.general.im.tabKey", false);
user_pref("__000.aim.general.im.timeStamp", false);
user_pref("__sys.aim.filexfer.location", "");
user_pref("__sys.aim.general.im.enterCR", false);
user_pref("__sys.aim.general.im.smilies", false);
user_pref("__sys.aim.general.im.tabKey", false);
user_pref("__sys.aim.general.im.timeStamp", false);
user_pref("__sys.aim.general.snsautosignon", false);
user_pref("__sys.aim.general.today", false);
user_pref("aim.session.firsttime", false);
user_pref("browser.activation.checkedNNFlag", true);
user_pref("browser.bookmarks.added_static_root", true);
user_pref("
O1 - Hosts: ÿþ127.0.0.1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: BrowserHelper Class - {9A065C65-4EE7-4DDD-9918-F129089A894A} - D:\Program Files\Windows Home Server\WHSDeskBands.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - D:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Home Server Banner - {D73E76A3-F902-45BD-8FC8-95AE8E014671} - D:\Program Files\Windows Home Server\WHSDeskBands.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - D:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [SoundMAXPnP] D:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [Lexmark 2200 Series] "D:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "D:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [Microsoft Works Update Detection] D:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [CloudPlugin] "D:\Program Files\IMT Labs Messenger Plugin\Cloud.exe"
O4 - HKLM\..\Run: [RemoteControl] "D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SsAAD.exe] D:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [Athan] D:\Program Files\Athan\Athan.exe
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] D:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [HP Software Update] D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] D:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [nwiz] D:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "H:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Creative Detector] "D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [swg] "D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Google Update] "D:\Documents and Settings\Ours\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [AirVideoServer] H:\Program Files\AirVideoServer\AirVideoServer.exe
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WDDMStatus.lnk = D:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
O8 - Extra context menu item: &Download with Download Accelerator Lite - D:\Program Files\Download Accelerator Lite\dal.htm
O8 - Extra context menu item: Google Sidewiki... - res://D:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D1E1F7ED622A0E5D.dll/cmsidewiki.html
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O16 - DPF: {983A9C21-8207-4B58-BBB8-0EBC3D7C5505} (Domino Web Access 8 Control) - http://beowulf.schulich.yorku.ca/dwa8W.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\System32\browseui.dll
O23 - Service: Adobe LM Service - Unknown owner - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - D:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - D:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - D:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Update Service (gupdate1ca597c7db22888) (gupdate1ca597c7db22888) - Google Inc. - D:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - D:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - D:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - H:\Program Files\EA Games\Need for Speed Undercover\PB\PnkBstrA.exe
O23 - Service: SAVRoam (SavRoam) - symantec - D:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Sunbelt CounterSpy Antispyware (SBCSSvc) - Unknown owner - D:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - D:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TVersityMediaServer - Unknown owner - H:\Program Files\TVersity\Media Server\MediaServer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - D:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WDDMService - WDC - D:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe

--
End of file - 16465 bytes


----------



## Cookiegal (Aug 27, 2003)

Download the *HostsXpert*.

Unzip HostsXpert 4.3 - Hosts File Manager to a convenient folder such as C:\HostsXpert 4.3 - Hosts File Manager
Run HostsXpert 4.3 - Hosts File Manager from its new home
Click on "File Handling".
Click on "Restore MS Hosts File".
Click OK on the Confirmation box.
Click on "Make Read Only?"
Click the X to exit the program.
Note: If you were using a custom Hosts file you will need to replace any of those entries yourself.

After running the above please post a new HijackThis log.

I'm going to as one of our Trusted Advisors to assist you with reducing the startups as you have way too many running and then we'll reevaluate how the computer is performing as that should speed things up.


----------



## flavallee (May 12, 2002)

itrocks4u:

Close all open windows, including all open browser windows, then start HiJackThis, then click "Do a system scan and save a log file", then save the new log that appears, then submit it here.

That bloated startup load definitely needs trimming down.

I'm going to read your thread from the beginning so I can familiarize myself with it and see what's been done.

-----------------------------------------------------------------


----------



## Cookiegal (Aug 27, 2003)

Thank you flavallee.


----------



## flavallee (May 12, 2002)

Cookiegal said:


> Thank you flavallee.


No problem.  :up:

P.S. Profile photo has been updated.

----------------------------------------------------------------------

itrocks4u:

Let's see what needs to be uninstalled, updated, or replaced. We may do that first before working on that bloated startup load.

Start HiJackThis, but don't run a scan.

Click on the "Open The Misc Tools Section" button.

Click on the "Open Uninstall Manager" button.

Click on the "Save List" button.

Save the "uninstall_list.txt" file somewhere.

It'll then open in Notepad.

Return here to your thread, then copy-and-paste the entire file here.

----------------------------------------------------------------------


----------



## itrocks4u (Nov 27, 2004)

Hi Flavallee - Thank you so much for helping me out, you have no idea how much I appreciate this.
In this post are both the latest hijack this log as well as the uninstall list that you request. Please note that the HJT log was ran after running HostXperts as Cookiegal requested.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 3:01:54 AM, on 30/04/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Windows Defender\MsMpEng.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\LEXBCES.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\LEXPPS.EXE
D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
D:\WINDOWS\System32\CTsvcCDA.exe
D:\Program Files\Symantec AntiVirus\DefWatch.exe
D:\Program Files\Java\jre6\bin\jqs.exe
H:\Program Files\EA Games\Need for Speed Undercover\PB\PnkBstrA.exe
D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Symantec AntiVirus\Rtvscan.exe
D:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
D:\Program Files\Windows Home Server\WHSConnector.exe
D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
D:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe
D:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
D:\Program Files\Lexmark 2200 Series\lxbvbmon.exe
D:\Program Files\IMT Labs Messenger Plugin\Cloud.exe
D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
D:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
D:\Program Files\Athan\Athan.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\Common Files\Symantec Shared\ccApp.exe
D:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
D:\PROGRA~1\SYMANT~1\VPTray.exe
D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
D:\Program Files\Common Files\Java\Java Update\jusched.exe
H:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\Windows Live\Messenger\msnmsgr.exe
D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
H:\Program Files\AirVideoServer\AirVideoServer.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
D:\Program Files\Symantec AntiVirus\DoScan.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\WINDOWS\system32\ZoneLabs\vsmon.exe
H:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
N3 - Netscape 7: # Mozilla User Preferences

/* Do not edit this file.
*
* If you make changes to this file while the browser is running,
* the changes will be overwritten when the browser exits.
*
* To make a manual change to preferences, you can visit the URL about:config
* For more information, see http://www.mozilla.org/unix/customizing.html#prefs
*/

user_pref("__000.aim.general.im.enterCR", false);
user_pref("__000.aim.general.im.tabKey", false);
user_pref("__000.aim.general.im.timeStamp", false);
user_pref("__sys.aim.filexfer.location", "");
user_pref("__sys.aim.general.im.enterCR", false);
user_pref("__sys.aim.general.im.smilies", false);
user_pref("__sys.aim.general.im.tabKey", false);
user_pref("__sys.aim.general.im.timeStamp", false);
user_pref("__sys.aim.general.snsautosignon", false);
user_pref("__sys.aim.general.today", false);
user_pref("aim.session.firsttime", false);
user_pref("browser.activation.checkedNNFlag", true);
user_pref("browser.bookmarks.added_static_root", true);
user_pref("
N3 - Netscape 7: # Mozilla User Preferences

/* Do not edit this file.
*
* If you make changes to this file while the browser is running,
* the changes will be overwritten when the browser exits.
*
* To make a manual change to preferences, you can visit the URL about:config
* For more information, see http://www.mozilla.org/unix/customizing.html#prefs
*/

user_pref("__000.aim.general.im.enterCR", false);
user_pref("__000.aim.general.im.tabKey", false);
user_pref("__000.aim.general.im.timeStamp", false);
user_pref("__sys.aim.filexfer.location", "");
user_pref("__sys.aim.general.im.enterCR", false);
user_pref("__sys.aim.general.im.smilies", false);
user_pref("__sys.aim.general.im.tabKey", false);
user_pref("__sys.aim.general.im.timeStamp", false);
user_pref("__sys.aim.general.snsautosignon", false);
user_pref("__sys.aim.general.today", false);
user_pref("aim.session.firsttime", false);
user_pref("browser.activation.checkedNNFlag", true);
user_pref("browser.bookmarks.added_static_root", true);
user_pref("
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: BrowserHelper Class - {9A065C65-4EE7-4DDD-9918-F129089A894A} - D:\Program Files\Windows Home Server\WHSDeskBands.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - D:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Home Server Banner - {D73E76A3-F902-45BD-8FC8-95AE8E014671} - D:\Program Files\Windows Home Server\WHSDeskBands.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - D:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [SoundMAXPnP] D:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [Lexmark 2200 Series] "D:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "D:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [Microsoft Works Update Detection] D:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [CloudPlugin] "D:\Program Files\IMT Labs Messenger Plugin\Cloud.exe"
O4 - HKLM\..\Run: [RemoteControl] "D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SsAAD.exe] D:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [Athan] D:\Program Files\Athan\Athan.exe
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] D:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [HP Software Update] D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] D:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [nwiz] D:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "H:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Creative Detector] "D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [swg] "D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Google Update] "D:\Documents and Settings\Ours\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [AirVideoServer] H:\Program Files\AirVideoServer\AirVideoServer.exe
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WDDMStatus.lnk = D:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
O8 - Extra context menu item: &Download with Download Accelerator Lite - D:\Program Files\Download Accelerator Lite\dal.htm
O8 - Extra context menu item: Google Sidewiki... - res://D:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D1E1F7ED622A0E5D.dll/cmsidewiki.html
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O16 - DPF: {983A9C21-8207-4B58-BBB8-0EBC3D7C5505} (Domino Web Access 8 Control) - http://beowulf.schulich.yorku.ca/dwa8W.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\System32\browseui.dll
O23 - Service: Adobe LM Service - Unknown owner - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - D:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - D:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - D:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Update Service (gupdate1ca597c7db22888) (gupdate1ca597c7db22888) - Google Inc. - D:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - D:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - D:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - H:\Program Files\EA Games\Need for Speed Undercover\PB\PnkBstrA.exe
O23 - Service: SAVRoam (SavRoam) - symantec - D:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Sunbelt CounterSpy Antispyware (SBCSSvc) - Unknown owner - D:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - D:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TVersityMediaServer - Unknown owner - H:\Program Files\TVersity\Media Server\MediaServer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - D:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WDDMService - WDC - D:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe

--
End of file - 16349 bytes

"Transport Canada - CDE Sample"
Ace DivX Player
Ad-Aware SE Personal
Adobe Acrobat 5.0
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Photoshop CS
Adobe Reader 8.1.1
Adobe Shockwave Player 11
Aimersoft DVD to iPhone Converter(Build 1.0.21)
Aimersoft iPhone Converter Suite(Build 1.0.23)
Aimersoft iPhone Video Converter(Build 1.1.0)
Air Video Server 2.4.3
AndreaMosaic 3.21
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ArcSoft PhotoImpression 4
Athan Basic 3.3
ATI - Software Uninstall Utility
ATI Display Driver
ATI HydraVision
AutoCAD 2005 - English
AutoCAD LT 2002
AV Voice Changer Software DIAMOND 4.0
AviSynth 2.5
AXIS Media Control Embedded
Before You Know It 3.5 Lite 
BFC Private Reference Library
BlackBerry Desktop Software 6.0.1
BlackBerry Desktop Software 6.0.1
Blaze Audio Voice Cloak Trial
Bonjour
Bubble Struggle 1.2
CANTAX T2Plus Educational 08.2
CCH Library 4.7
CCleaner (remove only)
CGPA Calculator 2.0
Channel Master
Channel Master
Cinema Craft Encoder SP Version 2.50
Compatibility Pack for the 2007 Office system
CorelDRAW 10
CorelDRAW 10
Coupon Printer for Windows
Creative MediaSource
Creative Removable Disk Manager
Creative System Information
Creative Zen MicroPhoto
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Web Player
DVDx 2.2
DVDx 2.3
EAX4 Unified Redist
ESET Online Scanner v3
F-22 Lightning 3
ffdshow [rev 1723] [2007-12-24]
Flight Log 4.9
GameSpy Arcade
Google Chrome
Google Earth
Google SketchUp
Google Talk (remove only)
Google Talk Plugin
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
Google Update Helper
Graphing Calculator Viewer
Graphmatica
HiJackThis
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954708)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
HP MediaSmart Server
HP Update
Huffyuv AVI lossless video codec (Remove Only)
HyperLoad - Multiplayer Billiards
IMT Labs Plugin
Intel(R) PRO Network Adapters and Drivers
iTunes
Java(TM) 6 Update 20
Java(TM) 6 Update 3
Junk Mail filter update
Lexmark 2200 Series
Lexmark Fax Solutions
LimeWire 4.10.9
LiveUpdate 3.1 (Symantec Corporation)
Logitech Gaming Software
Macromedia Extension Manager
Macromedia Flash 8
Macromedia Flash 8 Video Encoder
Malwarebytes' Anti-Malware
Medal of Honor Allied Assault
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Choice Guard
Microsoft Games for Windows - LIVE 
Microsoft Games for Windows - LIVE Redistributable
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
Microsoft Money 2004
Microsoft Money 2004 System Pack
Microsoft National Language Support Downlevel APIs
Microsoft Office 2000 Premium
Microsoft Office Live Web Folder Connector
Microsoft Picture It! Photo Premium 9
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Streets and Trips 2004
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Word 2002
Microsoft Works
Microsoft Works 2004 Setup Launcher
Microsoft Works Suite Add-in for Microsoft Word
Mozilla Firefox (1.5.0.12)
MSN Toolbar
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser (KB925673)
MSXML4SP2
Need for Speed™ Undercover
Nero OEM
Netscape (7.2)
Nokia Connectivity Cable Driver
NOMAD MuVo
Norton PC Checkup
NVIDIA Display Control Panel
NVIDIA Drivers
NVIDIA DVD Decoder
NVIDIA nView Desktop Manager
OpenMG Limited Patch 4.1-05-13-31-01
OpenMG Secure Module 4.1.00
Panda ActiveScan
PHStat2
Picasa 2
Picture Package
Post-it® Software Notes Lite
PowerDVD
PS3 Media Server
PunkBuster Services
QuickTime
Rockstar Games Social Club
SAMSUNG CDMA Modem Driver Set
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software
Samsung PC Studio
Samsung PC Studio 3 USB Driver Installer
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 7 (KB974455)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Internet Explorer 7 (KB978207)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Segoe UI
SES Driver
Shockwave
ShortKeys Lite
SIW version 2008-12-16
Skype web features
Skype™ 4.1
SmartDraw VP
Soap 3.0 Toolkit
SonicStage 3.0
Sony USB Driver
SoundMAX
Spybot - Search & Destroy 1.4
Symantec AntiVirus
System Requirements Lab
Turing
TVersity Codec Pack 1.2
TVersity Media Server 1.5 Beta
UFile 2009
UFile 2010
UFile Updater 2009
UFile Updater 2010
Uninstall JL2005A Toy Camera
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 7 (KB976749)
Update for Windows Internet Explorer 7 (KB980182)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows Internet Explorer 8 (KB980302)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VC80CRTRedist - 8.0.50727.762
VFR Plus 1.1
Videora iPod Converter 5.04
VLC media player 0.9.9
Vodafone 804SS USB driver Software
VoiceSFX Trial
WD SmartWare Drive Manager
Winamp (remove only)
Windows Defender
Windows Home Server Connector
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live OneCare safety scanner
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Upload Tool
Windows Live Writer
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 10
Windows Presentation Foundation
Windows XP Service Pack 3
WinMX
WinRAR archiver
WinZip
Yahoo! Address AutoComplete
Yahoo! Install Manager
Yahoo! Internet Mail
Yahoo! Messenger
ZoneAlarm


----------



## flavallee (May 12, 2002)

Uninstall

*Ad-Aware SE Personal

Spybot - Search & Destroy 1.4

Windows Defender*

because they are either very outdated or have better and more user-friendly replacements:

*Malwarebytes Anti-Malware 1.50.1.1100* (which you already have)

*SUPERAntiSpyware 4.51.0.1000* (download and install it)

----------------------------------------------------

*Adobe Reader 8.1.1*

is very outdated and needs to be replaced with

*Adobe Reader 10.0.1*

The install of the new version should overwrite and replace the old version, so there's no need to uninstall it first.

----------------------------------------------------

*Java(TM) 6 Update 20*

is outdated and needs to be replaced with

*Java Runtime Environment 1.6.0.25*

The install of the new version will overwrite and replace the old version, so there's no need to uninstall it first.

----------------------------------------------------

*Skype 4.1*

is very outdated and should be replaced with

*Skype 5.3.0*

The install of the new version should overwrite and replace the old version, so there's no need to uninstall it first.

If you don't use it, uninstall it instead.

----------------------------------------------------

*VLC Media Player 0.9.9*

is very outdated and should be replaced with

*VLC Media Player 1.1.9*

The install of the new version should overwrite and replace the old version, so there's no need to uninstall it first.

If you don't use it, uninstall it instead.

----------------------------------------------------

Uninstall these programs and add-ons because they're not needed:

*Apple Software Update

Coupon Printer For Windows* (unless you actually use it)

*ESET Online Scanner v3

Google Update Helper

HiJackThis 2.0.2* (you only need HiJackThis 2.0.4)

*HP Update

Java(TM) 6 Update 3

LimeWire 4.10.9*

Everything that starts with *Macromedia - - -*

*Microsoft Money 2004

Microsoft Streets And Trips 2004* (unless you actually still use these 2004 versions)

*Mozilla Firefox 1.5.0.12

Netscape 7.2* (unless you actually still use it)

*Picasa 2*

Everything that starts with *Shockwave - - -*

*System Requirements Lab

Windows Live OneCare Safety Scanner*

----------------------------------------------------


----------



## flavallee (May 12, 2002)

I edited and added to my last reply, so make sure to read it carefully so you don't miss anything.

-----------------------------------------------------------------

You have a LOT of multimedia and graphical programs and add-ons in that computer, and I question if you need or use half of them. 

If you see anything in the Add Or Remove Programs list that you don't recognize or feel you need, advise me what the names are so we can determine if it's safe to uninstall them.

-----------------------------------------------------------------


----------



## itrocks4u (Nov 27, 2004)

Hi, 
Sorry about the extremely delayed reply. I ran your instructions. It actually took REALLY long to uninstall first.

Here's the list. I have highlighted items in bold which I think I can further uninstall. What do you think?

"Transport Canada - CDE Sample"
Ace DivX Player
Adobe Acrobat 5.0
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Photoshop CS
Adobe Reader X (10.0.1)
Adobe Shockwave Player 11
Air Video Server 2.4.3
AndreaMosaic 3.21
Apple Application Support
Apple Mobile Device Support
*Apple Software Update* < - Did not uninstall this. Do I not need this to detect further updates?
Athan Basic 3.3
ATI - Software Uninstall Utility
ATI Display Driver
ATI HydraVision
*AutoCAD LT 2002*
AviSynth 2.5
AXIS Media Control Embedded
BFC Private Reference Library
BlackBerry Desktop Software 6.0.1
BlackBerry Desktop Software 6.0.1
Bonjour
Bubble Struggle 1.2
CANTAX T2Plus Educational 08.2
CCH Library 4.7
*CCleaner (remove only)*
Cinema Craft Encoder SP Version 2.50
Compatibility Pack for the 2007 Office system
*CorelDRAW 10* I already tried uninstalling this but its still there.
*Creative MediaSource*
Creative Removable Disk Manager
Creative System Information
*Creative Zen MicroPhoto*
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Web Player
*EAX4 Unified Redist*
F-22 Lightning 3
ffdshow [rev 1723] [2007-12-24]
Flight Log 4.9
Google Chrome
Google Earth
Google SketchUp
Google Talk (remove only)
Google Talk Plugin
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
Google Update Helper
Graphing Calculator Viewer
Graphmatica
HiJackThis
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954708)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
Huffyuv AVI lossless video codec (Remove Only)
HyperLoad - Multiplayer Billiards
IMT Labs Plugin
Intel(R) PRO Network Adapters and Drivers
iTunes
Java(TM) 6 Update 25
Junk Mail filter update
Lexmark 2200 Series
Lexmark Fax Solutions
LiveUpdate 3.1 (Symantec Corporation)
Logitech Gaming Software
Malwarebytes' Anti-Malware
Medal of Honor Allied Assault
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Choice Guard
Microsoft Games for Windows - LIVE 
Microsoft Games for Windows - LIVE Redistributable
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
Microsoft National Language Support Downlevel APIs
Microsoft Office 2000 Premium
Microsoft Office Live Web Folder Connector
Microsoft Picture It! Photo Premium 9
*Microsoft Silverlight*
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Word 2002
*Microsoft Works
Microsoft Works 2004 Setup Launcher*
Microsoft Works Suite Add-in for Microsoft Word
MSN Toolbar
M*SVCRT*
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser (KB925673)
MSXML4SP2
Nero OEM
Nokia Connectivity Cable Driver
NVIDIA Display Control Panel
NVIDIA Drivers
NVIDIA DVD Decoder
NVIDIA nView Desktop Manager
OpenMG Limited Patch 4.1-05-13-31-01
OpenMG Secure Module 4.1.00
*Panda ActiveScan
PHStat2*
Post-it® Software Notes Lite
PowerDVD
PS3 Media Server
QuickTime
*SAMSUNG CDMA Modem Driver Set
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software*
Samsung PC Studio 3 USB Driver Installer
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 7 (KB974455)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Internet Explorer 7 (KB978207)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Segoe UI
SES Driver
SIW version 2008-12-16
Skype Toolbars
Skype 5.3
SmartDraw VP
Soap 3.0 Toolkit
SonicStage 3.0
Sony USB Driver
SoundMAX
*Spybot - Search & Destroy 1.4* Do I need this still?
Symantec AntiVirus
Turing
TVersity Codec Pack 1.2
TVersity Media Server 1.5 Beta
UFile 2009
UFile 2010
UFile Updater 2009
UFile Updater 2010
Uninstall JL2005A Toy Camera
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 7 (KB976749)
Update for Windows Internet Explorer 7 (KB980182)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows Internet Explorer 8 (KB980302)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
*VC80CRTRedist - 8.0.50727.762*
VFR Plus 1.1
Videora iPod Converter 5.04
VLC media player 1.1.9
Vodafone 804SS USB driver Software
WD SmartWare Drive Manager
Winamp (remove only)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
*Windows Live Essentials
Windows Live Essentials*
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Upload Tool
Windows Live Writer
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 10
Windows Presentation Foundation
Windows XP Service Pack 3
WinMX
WinRAR archiver
WinZip
Yahoo! Address AutoComplete
Yahoo! Install Manager
Yahoo! Internet Mail
ZoneAlarm


----------



## flavallee (May 12, 2002)

You are uninstalling programs and add-ons in the Add Or Remove Programs list and not by some other method, correct?

-------------------------------------------------

*Apple Software Update* isn't needed and can be uninstalled.

*AutoCAD LT 2002* is extremely outdated and can be uninstalled if you don't need it.

*CCleaner* isn't needed and can be uninstalled.

*CorelDRAW 10* can be uninstalled if you don't need it.

*Creative MediaSource* can be uninstalled if you don't need it.

*Creative Zen MicroPhoto* can be uninstalled if you don't need it.

*EAX4 Unified Redist* is associated with Creative, so you can uninstall it if you don't need it.

*Microsoft Silverlight* should NOT be uninstalled. It's an add-on(like Adobe Flash Player and Java Runtime Environment) that's needed to view all the multimedia content of webpages.

*Microsoft Works 2002* is very outdated and can be uninstalled if you don't need it.

*Panda ActiveScan* isn't needed and can be uninstalled.

*Spybot - Search & Destroy 1.4* is very outdated and can be uninstalled. There are better and more user-friendly replacements for it anyway.

*Windows Live Essentials* and all the other "Windows Live" add-ons can be uninstalled if you don't use Windows Live Messenger for on-chat text chatting.

Leave the others you highlighted alone.

---------------------------------------------------

I'm going to be up front and honest with you.

With all the clutter and unused/unneeded programs and add-ons that you have in that computer, you really should format the hard drive and then do a clean reinstall of Windows XP and get a fresh start.

---------------------------------------------------


----------



## itrocks4u (Nov 27, 2004)

Hmm alright I see your point. It's still awfully slow. If I format it, I need the original XP cd or can I do it without it? I have Windows 7 but not sure if I should install that given the specs of the system (Pentium 4, 2.8Ghz, 2GB Ram). Also is there a way to install XP without cd?

Secondly, I have a second hard drive installed. When I format the drive with cd, it doesn't erase the data on THAT cd right?


----------



## flavallee (May 12, 2002)

I've never owned nor worked on a desktop that has 2 separate internal hard drives, so I'm not familiar at all with a hard drive format and clean reinstall of Windows XP in that situation.

From what I can tell, the D drive is the 74 GB(approximate size) one that contains Windows XP and most of your programs, and the H drive is the 465 GB(approximate size) one that contains other programs and your personal data.

I'm guessing you installed the larger drive after buying that desktop with the smaller drive.

Personally, I would remove the smaller drive and keep just the larger drive, then format it into a single partition, then do a clean reinstall of Windows XP in it.

Of course, you would need to copy and back up all your personal data to an external USB hard drive and/or CD-R's/DVD-R's first.

According to what you say and submitted, that computer has an Intel D865GBF motherboard, an Intel Pentium IV 2.80 GHz processor, 2048 MB(2 GB) of RAM, and a NVIDIA GeForce 6200 video card.

That motherboard has 4 slots and supports up to 4096 MB(4 GB) of DDR PC2700 or DDR PC3200 RAM.

If you decide to remove the smaller drive and then format the larger drive and do a clean install of Windows 7, it should handle it just fine. 

With all the problems you're still having with that desktop, I really think we're beating our heads against the wall here.

------------------------------------------------------------------


----------

