1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Constant clicking sound online, pages try to open independently but fail

Discussion in 'Malware and Virus Removal Archive' started by imjhemp, 2009/01/05.

  1. 2009/01/05
    imjhemp

    imjhemp Inactive Thread Starter

    Joined:
    2007/03/26
    Messages:
    82
    Likes Received:
    0
    [Constant clicking sound online - pages try to open independently but fail]

    --------------------------------------------------------------------------------
    This is hard to explain but ill try because I have no idea whats going on.

    When im online there is a constant clicking like when you double click something with your mouse.
    The top tab will quickly show the round 'thinking' icon and the bottom bar will briefly show something as if its downloading a page and then show 'Done'.

    This happens all the time, consistantly.

    Please help me !!!


    I have Vista if that would help any with troubleshooting

    Logfile of random's system information tool 1.05 (written by random/random)
    Run by Joey Hemphill at 2009-01-05 01:26:02
    Microsoft® Windows Vistaâ„¢ Home Premium
    System drive C: has 179 GB (77%) free of 231 GB
    Total RAM: 894 MB (32% free)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 1:27:20 AM, on 1/5/2009
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16764)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\hp\support\hpsysdrv.exe
    C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
    C:\Windows\RtHDVCpl.exe
    C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\HP Multimedia Keyboard\Kmaestro.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
    C:\hp\kbd\kbd.exe
    C:\Windows\system32\wuauclt.exe
    C:\Program Files\Internet Explorer\ieuser.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe
    C:\Users\Joey Hemphill\Desktop\RSIT.exe
    C:\Program Files\trend micro\Joey Hemphill.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=desktop
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=desktop
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=desktop
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
    O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
    O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
    O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
    O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe "
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [Malwarebytes Anti-Malware Reboot] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [BtcMaestro] "C:\Program Files\HP Multimedia Keyboard\KMaestro.exe "
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
    O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe "
    O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
    O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
    O4 - HKCU\..\Run: [Comrade.exe] C:\Program Files\GameSpy\Comrade\Comrade.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKCU\..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\ARO.exe -rem
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
    O13 - Gopher Prefix:
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
    O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
    O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
    O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

    --
    End of file - 9600 bytes

    ======Scheduled tasks folder======

    C:\Windows\tasks\HPCeeScheduleForJoey Hemphill.job
    C:\Windows\tasks\Norton Internet Security - Run Full System Scan - Joey Hemphill.job
    C:\Windows\tasks\User_Feed_Synchronization-{AFF7285E-A754-41F2-9225-082E5682DE5C}.job

    ======Registry dump======

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
    Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-09-27 441408]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
    Adobe PDF Reader Link Helper - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-01-12 63128]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
    C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll [2008-06-30 349552]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
    Symantec Intrusion Prevention - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll [2008-07-25 116088]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
    Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2008-11-18 251504]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
    Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll [2008-11-19 657904]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
    Google Dictionary Compression sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll [2008-11-18 522224]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-09-27 441408]
    {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Show Norton Toolbar - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll [2008-06-30 349552]
    {2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2008-11-18 251504]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "Windows Defender "=C:\Program Files\Windows Defender\MSASCui.exe [2007-05-13 1006264]
    "hpsysdrv "=c:\hp\support\hpsysdrv.exe [2006-09-28 65536]
    "KBD "=C:\HP\KBD\KbdStub.EXE [2006-12-08 65536]
    "OsdMaestro "=C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe [2006-11-20 155648]
    "RtHDVCpl "=C:\Windows\RtHDVCpl.exe [2008-01-15 4874240]
    "HP Software Update "=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-05-08 54840]
    " "= []
    "HP Health Check Scheduler "=C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2007-03-12 50696]
    "NvSvc "=C:\Windows\system32\nvsvc.dll [2007-07-06 86016]
    "NvCplDaemon "=C:\Windows\system32\NvCpl.dll [2007-07-06 8466432]
    "NvMediaCenter "=C:\Windows\system32\NvMcTray.dll [2007-07-06 81920]
    "Malwarebytes Anti-Malware Reboot "=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2008-04-01 1191632]
    "QuickTime Task "=C:\Program Files\QuickTime\QTTask.exe [2008-03-28 413696]
    "iTunesHelper "=C:\Program Files\iTunes\iTunesHelper.exe [2008-03-30 267048]
    "BtcMaestro "=C:\Program Files\HP Multimedia Keyboard\KMaestro.exe [2005-02-20 245760]
    "ccApp "=C:\Program Files\Common Files\Symantec Shared\ccApp.exe [2008-10-17 51048]
    "osCheck "=C:\Program Files\Norton 360\osCheck.exe [2008-02-26 988512]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "Launcher "=C:\Windows\SMINST\launcher.exe [2006-11-24 44136]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar "=C:\Program Files\Windows Sidebar\sidebar.exe [2008-01-09 1232896]
    "HPAdvisor "=C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe [2006-11-23 1480296]
    "WindowsWelcomeCenter "=C:\Windows\system32\oobefldr.dll [2006-11-02 2159104]
    "ehTray.exe "=C:\Windows\ehome\ehTray.exe [2006-11-02 125440]
    "ISUSPM Startup "=C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe [2005-02-16 221184]
    "Comrade.exe "=C:\Program Files\GameSpy\Comrade\Comrade.exe [2007-05-27 36864]
    "updateMgr "=C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [2006-03-30 313472]
    "swg "=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-11-19 39408]
    "WMPNSCFG "=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2006-11-02 201728]
    "AROReminder "=C:\Program Files\Advanced Registry Optimizer\ARO.exe [2008-04-09 2084480]

    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
    HP Digital Imaging Monitor.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "dontdisplaylastusername "=0
    "legalnoticecaption "=
    "legalnoticetext "=
    "shutdownwithoutlogon "=1
    "undockwithoutlogon "=1

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe "= "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink "

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

    ======File associations======

    .reg - open - regedit.exe "%1" %*
    .scr - open - "%1" %*

    ======List of files/folders created in the last 3 months======

    2009-01-05 01:26:15 ----D---- C:\Program Files\trend micro
    2009-01-05 01:26:02 ----D---- C:\rsit
    2008-12-19 03:01:05 ----A---- C:\Windows\system32\mshtml.dll
    2008-12-11 03:03:31 ----A---- C:\Windows\system32\tzres.dll
    2008-12-10 17:51:03 ----A---- C:\Windows\system32\WMVCORE.DLL
    2008-12-10 17:51:03 ----A---- C:\Windows\system32\mf.dll
    2008-12-10 17:51:02 ----A---- C:\Windows\system32\WMNetMgr.dll
    2008-12-10 17:51:01 ----A---- C:\Windows\system32\rrinstaller.exe
    2008-12-10 17:51:01 ----A---- C:\Windows\system32\mfps.dll
    2008-12-10 17:51:01 ----A---- C:\Windows\system32\mfpmp.exe
    2008-12-10 17:51:01 ----A---- C:\Windows\system32\mferror.dll
    2008-12-10 17:51:01 ----A---- C:\Windows\system32\logagent.exe
    2008-12-10 17:50:46 ----A---- C:\Windows\system32\shell32.dll
    2008-12-10 17:50:24 ----A---- C:\Windows\system32\gameux.dll
    2008-12-10 17:50:22 ----A---- C:\Windows\system32\Apphlpdm.dll
    2008-12-10 17:50:20 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll
    2008-12-10 17:50:16 ----A---- C:\Windows\system32\gdi32.dll
    2008-12-10 17:50:12 ----A---- C:\Windows\explorer.exe
    2008-12-10 17:50:06 ----A---- C:\Windows\system32\urlmon.dll
    2008-12-10 17:50:06 ----A---- C:\Windows\system32\ieframe.dll
    2008-12-10 17:50:05 ----A---- C:\Windows\system32\wininet.dll
    2008-12-10 17:50:04 ----A---- C:\Windows\system32\mstime.dll
    2008-12-10 17:50:04 ----A---- C:\Windows\system32\mshtmled.dll
    2008-12-10 17:50:04 ----A---- C:\Windows\system32\ieui.dll
    2008-12-10 17:50:04 ----A---- C:\Windows\system32\ieapfltr.dll
    2008-12-10 17:50:04 ----A---- C:\Windows\system32\ie4uinit.exe
    2008-12-10 17:50:04 ----A---- C:\Windows\system32\advpack.dll
    2008-12-10 17:50:03 ----A---- C:\Windows\system32\iesetup.dll
    2008-12-10 17:50:03 ----A---- C:\Windows\system32\iertutil.dll
    2008-12-10 17:50:03 ----A---- C:\Windows\system32\iernonce.dll
    2008-12-10 17:50:03 ----A---- C:\Windows\system32\icardie.dll
    2008-12-10 17:50:03 ----A---- C:\Windows\system32\dxtrans.dll
    2008-12-10 17:50:03 ----A---- C:\Windows\system32\dxtmsft.dll
    2008-12-10 17:50:02 ----A---- C:\Windows\system32\pngfilt.dll
    2008-12-10 17:50:02 ----A---- C:\Windows\system32\jsproxy.dll
    2008-12-10 17:50:02 ----A---- C:\Windows\system32\ieUnatt.exe
    2008-11-26 13:18:37 ----A---- C:\Windows\system32\PortableDeviceApi.dll
    2008-11-26 13:18:36 ----A---- C:\Windows\system32\PortableDeviceTypes.dll
    2008-11-26 13:18:36 ----A---- C:\Windows\system32\PortableDeviceClassExtension.dll
    2008-11-26 13:18:33 ----A---- C:\Windows\system32\WindowsCodecsExt.dll
    2008-11-26 13:18:33 ----A---- C:\Windows\system32\WindowsCodecs.dll
    2008-11-26 13:18:33 ----A---- C:\Windows\system32\PhotoMetadataHandler.dll
    2008-11-26 13:18:30 ----A---- C:\Windows\system32\connect.dll
    2008-11-24 09:06:22 ----D---- C:\ProgramData\HP Product Assistant
    2008-11-12 16:22:39 ----A---- C:\Windows\system32\msxml3r.dll
    2008-11-12 16:22:39 ----A---- C:\Windows\system32\msxml3.dll
    2008-11-12 16:22:36 ----A---- C:\Windows\system32\msxml6r.dll
    2008-11-12 16:22:36 ----A---- C:\Windows\system32\msxml6.dll
    2008-11-06 18:10:42 ----A---- C:\Windows\system32\wups2.dll
    2008-11-06 18:10:42 ----A---- C:\Windows\system32\wucltux.dll
    2008-11-06 18:10:42 ----A---- C:\Windows\system32\wuaueng.dll
    2008-11-06 18:10:42 ----A---- C:\Windows\system32\wuauclt.exe
    2008-11-06 18:09:54 ----A---- C:\Windows\system32\wuwebv.dll
    2008-11-06 18:09:53 ----A---- C:\Windows\system32\wuapp.exe
    2008-10-29 04:20:28 ----A---- C:\Windows\system32\win32spl.dll
    2008-10-29 04:20:27 ----A---- C:\Windows\system32\printcom.dll
    2008-10-27 23:17:02 ----A---- C:\Windows\system32\EncDec.dll
    2008-10-27 23:17:01 ----A---- C:\Windows\system32\psisdecd.dll
    2008-10-27 23:17:01 ----A---- C:\Windows\system32\mcmde.dll
    2008-10-24 05:05:10 ----A---- C:\Windows\system32\netapi32.dll
    2008-10-14 13:50:40 ----A---- C:\Windows\system32\ntoskrnl.exe
    2008-10-14 13:50:40 ----A---- C:\Windows\system32\ntkrnlpa.exe
    2008-10-06 16:12:50 ----A---- C:\Windows\system32\GEARAspi.dll
    2008-10-06 16:12:49 ----DC---- C:\Windows\system32\DRVSTORE
    2008-10-06 16:12:46 ----D---- C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

    ======List of files/folders modified in the last 3 months======

    2009-01-05 01:26:55 ----D---- C:\Windows\Temp
    2009-01-05 01:26:17 ----D---- C:\Windows\Prefetch
    2009-01-05 01:26:15 ----RD---- C:\Program Files
    2009-01-04 20:06:07 ----SHD---- C:\System Volume Information
    2009-01-04 19:03:53 ----SHD---- C:\Windows\Installer
    2009-01-04 19:03:42 ----D---- C:\Windows\System32
    2009-01-04 19:03:41 ----HD---- C:\Config.Msi
    2008-12-28 08:58:45 ----D---- C:\Windows\inf
    2008-12-28 08:58:45 ----A---- C:\Windows\system32\PerfStringBackup.INI
    2008-12-26 20:25:09 ----A---- C:\Windows\win.ini
    2008-12-25 18:03:04 ----D---- C:\Windows\Tasks
    2008-12-25 18:03:04 ----D---- C:\Windows\system32\Tasks
    2008-12-19 03:10:08 ----D---- C:\Windows\Minidump
    2008-12-19 03:09:30 ----D---- C:\Windows
    2008-12-19 03:02:13 ----D---- C:\Windows\winsxs
    2008-12-19 03:01:34 ----D---- C:\Windows\system32\catroot
    2008-12-11 03:17:30 ----ASH---- C:\Program Files\desktop.ini
    2008-12-11 03:16:14 ----D---- C:\Windows\system32\en-US
    2008-12-11 03:16:14 ----D---- C:\Windows\AppPatch
    2008-12-11 03:16:14 ----D---- C:\Program Files\Windows Mail
    2008-12-11 03:16:12 ----D---- C:\Windows\system32\migration
    2008-12-11 03:16:12 ----D---- C:\Program Files\Internet Explorer
    2008-12-11 03:04:06 ----D---- C:\Windows\system32\catroot2
    2008-12-09 17:24:37 ----A---- C:\Windows\system32\mrt.exe
    2008-11-27 03:28:57 ----D---- C:\ProgramData\Symantec
    2008-11-24 09:06:22 ----HD---- C:\ProgramData
    2008-11-19 05:51:05 ----D---- C:\Program Files\Google
    2008-11-18 22:29:03 ----D---- C:\ProgramData\Google
    2008-11-13 03:13:41 ----D---- C:\Windows\system32\drivers
    2008-11-11 18:34:25 ----SD---- C:\Windows\Downloaded Program Files
    2008-11-07 17:43:15 ----D---- C:\Windows\twain_32
    2008-11-07 17:41:00 ----D---- C:\Program Files\Norton 360
    2008-10-30 20:40:04 ----D---- C:\Program Files\Common Files\Symantec Shared
    2008-10-28 02:04:52 ----D---- C:\Windows\Microsoft.NET
    2008-10-28 02:04:51 ----RSD---- C:\Windows\assembly
    2008-10-28 02:01:43 ----D---- C:\Windows\ehome

    ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [2008-09-02 371248]
    R1 IDSvix86;Symantec Intrusion Prevention Driver; \??\C:\PROGRA~2\Symantec\DEFINI~1\SymcData\ipsdefs\20081220.001\IDSvix86.sys [2008-09-12 270384]
    R1 SPBBCDrv;SPBBCDrv; \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys [2008-09-05 447024]
    R1 SRTSPX;SRTSPX; C:\Windows\System32\Drivers\SRTSPX.SYS [2008-01-31 43696]
    R1 SymIM;Symantec Network Security Intermediate Filter Driver; C:\Windows\system32\DRIVERS\SymIMv.sys [2008-06-13 24112]
    R1 SYMTDI;SYMTDI; C:\Windows\System32\Drivers\SYMTDI.SYS [2008-06-13 184240]
    R2 CO_Mon;CO_Mon; \??\C:\Windows\system32\drivers\CO_Mon.sys [2007-08-08 36056]
    R2 KeyMaestro;KeyMaestro; C:\Windows\system32\DRIVERS\Maestro1.sys [2003-07-17 7850]
    R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-19 12672]
    R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2007-10-18 8704]
    R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-09-02 99376]
    R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]
    R3 HSF_DP;HSF_DP; C:\Windows\system32\DRIVERS\HSX_DP.sys [2008-05-08 980992]
    R3 HSXHWBS2;HSXHWBS2; C:\Windows\system32\DRIVERS\HSXHWBS2.sys [2008-05-08 266752]
    R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-01-15 2047576]
    R3 NAVENG;NAVENG; \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20090104.020\NAVENG.SYS [2008-11-12 89104]
    R3 NAVEX15;NAVEX15; \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20090104.020\NAVEX15.SYS [2008-11-12 876112]
    R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvmfdx32.sys [2007-05-04 1065384]
    R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2007-07-06 7568832]
    R3 SRTSP;SRTSP; C:\Windows\System32\Drivers\SRTSP.SYS [2008-01-31 279088]
    R3 SYMDNS;SYMDNS; C:\Windows\System32\Drivers\SYMDNS.SYS [2008-06-13 13616]
    R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT.SYS [2008-08-30 123952]
    R3 SYMFW;SYMFW; C:\Windows\System32\Drivers\SYMFW.SYS [2008-06-13 96432]
    R3 SYMNDISV;SYMNDISV; C:\Windows\System32\Drivers\SYMNDISV.SYS [2008-06-13 41008]
    R3 SYMREDRV;SYMREDRV; C:\Windows\System32\Drivers\SYMREDRV.SYS [2008-06-13 22320]
    R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2008-05-08 661504]
    R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2006-11-02 82560]
    S3 COH_Mon;COH_Mon; \??\C:\Windows\system32\Drivers\COH_Mon.sys [2008-07-30 23888]
    S3 Dot4;MS IEEE-1284.4 Driver; C:\Windows\system32\DRIVERS\Dot4.sys [2006-11-02 131584]
    S3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2006-11-02 16384]
    S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2006-11-02 36864]
    S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2006-11-02 5632]
    S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
    S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2006-11-02 8192]
    S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2006-11-02 5888]
    S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2006-11-02 5504]
    S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2006-11-02 6016]
    S3 Ps2;PS2; C:\Windows\system32\DRIVERS\PS2.sys [2005-12-12 19072]
    S3 SRTSPL;SRTSPL; C:\Windows\System32\Drivers\SRTSPL.SYS [2008-01-31 317616]
    S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2006-11-02 35328]
    S3 VST_DPV;VST_DPV; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2006-11-02 987648]
    S3 VSTHWBS2;VSTHWBS2; C:\Windows\system32\DRIVERS\VSTBS23.SYS [2006-11-02 251904]
    S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

    ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-02-18 110592]
    R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe [2008-02-21 238968]
    R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2007-07-24 229376]
    R2 ccEvtMgr;Symantec Event Manager; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-10-17 149352]
    R2 ccSetMgr;Symantec Settings Manager; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-10-17 149352]
    R2 CLTNetCnService;Symantec Lic NetConnect service; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-10-17 149352]
    R2 HP Health Check Service;HP Health Check Service; C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [2007-03-14 62984]
    R2 hpqddsvc;HP CUE DeviceDiscovery Service; C:\Windows\system32\svchost.exe [2006-11-02 22016]
    R2 LightScribeService;LightScribeService Direct Disc Labeling Service; c:\Program Files\Common Files\LightScribe\LSSrvc.exe [2006-12-14 61440]
    R2 LiveUpdate Notice;LiveUpdate Notice; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-10-17 149352]
    R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2006-11-02 22016]
    R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2007-10-18 386560]
    R3 comHost;COM Host; C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe [2007-08-22 55640]
    R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2006-11-02 22016]
    R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-03-30 504104]
    R3 Symantec Core LC;Symantec Core LC; C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe [2008-07-22 1245064]
    S2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2006-11-02 22016]
    S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-19 137200]
    S3 IDriverT;InstallDriver Table Manager; c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
    S3 LiveUpdate;LiveUpdate; C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE [2008-08-04 3220856]
    S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
    S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
    S3 RoxMediaDB9;RoxMediaDB9; c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe [2006-11-01 887544]
    S3 stllssvr;stllssvr; c:\Program Files\Common Files\SureThing Shared\stllssvr.exe [2006-11-01 78752]

    -----------------EOF-----------------

    info.txt logfile of random's system information tool 1.05 2009-01-05 01:27:26

    ======Uninstall list======

    --> "C:\Program Files\HP Games\Bejeweled 2 Deluxe\Uninstall.exe "
    --> "C:\Program Files\HP Games\Bistro Stars\Uninstall.exe "
    --> "C:\Program Files\HP Games\Blackhawk Striker 2\Uninstall.exe "
    --> "C:\Program Files\HP Games\Blasterball 2 Revolution\Uninstall.exe "
    --> "C:\Program Files\HP Games\Blasterball 3\Uninstall.exe "
    --> "C:\Program Files\HP Games\Boggle Supreme\Uninstall.exe "
    --> "C:\Program Files\HP Games\Bookworm Deluxe\Uninstall.exe "
    --> "C:\Program Files\HP Games\Chuzzle Deluxe\Uninstall.exe "
    --> "C:\Program Files\HP Games\Crystal Maze\Uninstall.exe "
    --> "C:\Program Files\HP Games\Diner Dash\Uninstall.exe "
    --> "C:\Program Files\HP Games\Family Feud\Uninstall.exe "
    --> "C:\Program Files\HP Games\FATE\Uninstall.exe "
    --> "C:\Program Files\HP Games\Final Drive Nitro\Uninstall.exe "
    --> "C:\Program Files\HP Games\Insaniquarium Deluxe\Uninstall.exe "
    --> "C:\Program Files\HP Games\JEOPARDY\Uninstall.exe "
    --> "C:\Program Files\HP Games\Jewel Quest\Uninstall.exe "
    --> "C:\Program Files\HP Games\LEGO Builder Bots\Uninstall.exe "
    --> "C:\Program Files\HP Games\Mahjong Journey of Enlightenment\Uninstall.exe "
    --> "C:\Program Files\HP Games\My HP Game Console\Uninstall.exe "
    --> "C:\Program Files\HP Games\Ocean Express\Uninstall.exe "
    --> "C:\Program Files\HP Games\Penguins!\Uninstall.exe "
    --> "C:\Program Files\HP Games\Polar Bowler\Uninstall.exe "
    --> "C:\Program Files\HP Games\Polar Golfer Pineapple Cup\Uninstall.exe "
    --> "C:\Program Files\HP Games\Polar Golfer\Uninstall.exe "
    --> "C:\Program Files\HP Games\SCRABBLE\Uninstall.exe "
    --> "C:\Program Files\HP Games\Slingo Deluxe\Uninstall.exe "
    --> "C:\Program Files\HP Games\Super Granny\Uninstall.exe "
    --> "C:\Program Files\HP Games\The Apprentice\Uninstall.exe "
    --> "C:\Program Files\HP Games\Tornado Jockey\Uninstall.exe "
    --> "C:\Program Files\HP Games\Tradewinds\Uninstall.exe "
    --> "C:\Program Files\HP Games\Wheel of Fortune\Uninstall.exe "
    --> "C:\Program Files\HP Games\Zuma Deluxe\Uninstall.exe "
    --> "C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
    -->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
    -->MsiExec.exe /I{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}
    32 Bit HP CIO Components Installer-->MsiExec.exe /I{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}
    Activation Assistant for the 2007 Microsoft Office suites--> "C:\ProgramData\{623D32E9-0C62-4453-AD44-98B31F52A5E1}\Microsoft Office Activation Assistant.exe" REMOVE=TRUE MODIFY=FALSE
    Adobe Flash Player ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
    Adobe Reader 7.0.8-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70800000002}
    Advanced Registry Optimizer--> "C:\Program Files\Advanced Registry Optimizer\unins000.exe" /silent
    AppCore-->MsiExec.exe /I{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}
    Apple Mobile Device Support-->MsiExec.exe /I{44734179-8A79-4DEE-BB08-73037F065543}
    Apple Software Update-->MsiExec.exe /I{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}
    Backup-->MsiExec.exe /I{24DF7221-644B-4C3A-A478-459502D40522}
    Bonjour-->MsiExec.exe /I{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}
    ccCommon-->MsiExec.exe /I{B24E05CC-46FF-4787-BBB8-5CD516AFB118}
    DivX-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
    Enhanced Multimedia Keyboard Solution-->C:\HP\KBD\Install.exe /u
    GearDrvs-->MsiExec.exe /I{206FD69B-F9FE-4164-81BD-D52552BC9C23}
    GearDrvs-->MsiExec.exe /I{CB84F0F2-927B-458D-9DC5-87832E3DC653}
    Google Toolbar for Internet Explorer--> "C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_11CB06797F2F038A.exe" /uninstall
    Hardware Diagnostic Tools-->C:\Program Files\PC-Doctor 5 for Windows\uninst.exe
    Hewlett-Packard Active Check for Health Check-->MsiExec.exe /X{254C37AA-6B72-4300-84F6-98A82419187E}
    Hewlett-Packard Asset Agent for Health Check-->MsiExec.exe /X{669D4A35-146B-4314-89F1-1AC3D7B88367}
    HijackThis 2.0.2--> "C:\Program Files\trend micro\HijackThis.exe" /uninstall
    HP Active Support Library 32 bit components-->MsiExec.exe /I{FAB0C302-CB18-4A7A-BA03-C3DC23101A68}
    HP Active Support Library-->C:\Program Files\InstallShield Installation Information\{290B83AA-093A-45BF-A917-D1C4A1E8D917}\setup.exe -runfromtemp -l0x0409
    HP Customer Experience Enhancements-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AB5E289E-76BF-4251-9F3F-9B763F681AE0}\setup.exe" -l0x9 -removeonly
    HP Customer Feedback-->MsiExec.exe /I{9DBA770F-BF73-4D39-B1DF-6035D95268FC}
    HP Customer Participation Program 8.0-->C:\Program Files\Hewlett-Packard\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat
    HP Easy Setup - Core-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F94234DB-FD06-42C3-B88D-6FC4DC9F988C}\setup.exe" -l0x9
    HP Easy Setup - Frontend-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{40F7AED3-0C7D-4582-99F6-484A515C73F2}\setup.exe" -l0x9 -removeonly
    HP Imaging Device Functions 8.0-->C:\Program Files\Hewlett-Packard\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat
    HP Multimedia Keyboard Driver V1.6 (2.0.W-137A9 MUL)-->C:\Windows\system32\KmRemove.exe
    HP OCR Software 8.0-->C:\Program Files\Hewlett-Packard\Digital Imaging\OCR\hpzscr01.exe -datfile hpqbud11.dat
    HP On-Screen Caps/Num/Scroll Lock Indicator-->C:\Windows\system32\OsdRemove.exe
    HP Photosmart Essential-->MsiExec.exe /X{EB21A812-671B-4D08-B974-2A347F0D8F70}
    HP Photosmart.All-In-One Driver Software 8.0 .A-->C:\Program Files\Hewlett-Packard\Digital Imaging\{282E5AB2-8E47-4571-B6FA-6B512555B557}\setup\hpzscr01.exe -datfile hposcr18.dat -onestop -showdisconnect -forcereboot
    HP Picasso Media Center Add-In-->MsiExec.exe /I{55979C41-7D6A-49CC-B591-64AC1BBE2C8B}
    HP Product Assistant-->MsiExec.exe /I{36FDBE6E-6684-462B-AE98-9A39A1B200CC}
    HP Solution Center 8.0-->C:\Program Files\Hewlett-Packard\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
    HP Total Care Advisor-->MsiExec.exe /X{CBFEEA43-2B94-44AF-8325-B413E62D2A5D}
    HP Update-->MsiExec.exe /X{FE57DE70-95DE-4B64-9266-84DA811053DB}
    HPSSupply-->MsiExec.exe /X{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}
    iTunes-->MsiExec.exe /I{585776BC-4BD6-4BD2-A19A-1D6CB44A403B}
    LiveUpdate (Symantec Corporation)-->MsiExec.exe /x {E80F62FF-5D3C-4A19-8409-9721F2928206} /l*v "C:\ProgramData\LuUninstall.LiveUpdate "
    LiveUpdate (Symantec Corporation)-->MsiExec.exe /X{E80F62FF-5D3C-4A19-8409-9721F2928206}
    LiveUpdate Notice (Symantec Corporation)-->MsiExec.exe /X{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}
    Malwarebytes' Anti-Malware--> "C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe "
    Microsoft .NET Framework 1.1 Hotfix (KB929729)--> "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\M929729\M929729Uninstall.msp "
    Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
    Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
    Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
    Microsoft Office Home and Student 2007--> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL
    Microsoft Office Home and Student 2007-->MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE}
    Microsoft Office OneNote MUI (English) 2007-->MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
    Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
    Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
    Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
    Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
    Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
    Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
    Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
    Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
    Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
    Microsoft Works-->MsiExec.exe /I{6D52C408-B09A-4520-9B18-475B81D393F1}
    MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
    MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
    MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
    MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
    muvee autoProducer 5.0-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{77CA976C-403C-47E2-940B-733ECAB6F62B}\setup.exe" -l0x9
    My HP Games--> "C:\Program Files\HP Games\Uninstall.exe "
    Norton 360 (Symantec Corporation)--> "C:\Program Files\Common Files\Symantec Shared\SymSetup\{2D617065-1C52-4240-B5BC-C0AE12157777}_2_2_0_2\Setup.exe" /X
    Norton 360 HTMLHelp-->MsiExec.exe /I{0BDD3FAD-61CD-4BF3-B9C4-4CEFD43F53F8}
    Norton 360-->MsiExec.exe /I{21829177-4DED-4209-AD08-490B3AC9C01A}
    Norton 360-->MsiExec.exe /I{2D617065-1C52-4240-B5BC-C0AE12157777}
    Norton 360-->MsiExec.exe /I{40DA9A54-48CA-4A2C-AEAF-F67715BB046E}
    Norton Confidential Core-->MsiExec.exe /I{55A6283C-638A-4EE0-B491-51118554BDA2}
    NVIDIA Drivers-->C:\Windows\system32\NVUNINST.EXE UninstallGUI
    Python 2.4.3-->MsiExec.exe /I{75E71ADD-042C-4F30-BFAC-A9EC42351313}
    QuickTime-->MsiExec.exe /I{1838C5A2-AB32-4145-85C1-BB9B8DFA24CD}
    RealPlayer-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
    Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x9 -removeonly
    Rhapsody Player Engine-->MsiExec.exe /I{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}
    Rhapsody-->C:\PROGRA~1\Rhapsody\Unwise32.exe /A C:\PROGRA~1\Rhapsody\install.log
    Roxio Creator Audio-->MsiExec.exe /X{83FFCFC7-88C6-41c6-8752-958A45325C82}
    Roxio Creator Basic v9-->MsiExec.exe /X{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}
    Roxio Creator Copy-->MsiExec.exe /X{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}
    Roxio Creator Data-->MsiExec.exe /X{0D397393-9B50-4c52-84D5-77E344289F87}
    Roxio Creator EasyArchive-->MsiExec.exe /X{11F93B4B-48F0-4A4E-AE77-DFA96A99664B}
    Roxio Creator Tools-->MsiExec.exe /X{0394CDC8-FABD-4ed8-B104-03393876DFDF}
    Roxio Express Labeler 3-->MsiExec.exe /X{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
    Roxio MyDVD Basic v9-->MsiExec.exe /X{E4A02A3F-4F8A-4D94-BB99-68BC1D1CF6DB}
    Sid Meier's Civilization 4 - Beyond the Sword-->C:\Program Files\InstallShield Installation Information\{32E4F0D2-C135-475E-A841-1D59A0D22989}\setup.exe -runfromtemp -l0x0009 -removeonly
    Sid Meier's Civilization 4-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}\setup.exe" -l0x9 -removeonly
    SimCity 4 Deluxe-->C:\Program Files\Maxis\SimCity 4 Deluxe\EAUninstall.exe
    Soft Data Fax Modem with SmartCP-->C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1\UIU32m.exe -U -ITrx200Cz.INF
    SPBBC 32bit-->MsiExec.exe /I{77772678-817F-4401-9301-ED1D01A8DA56}
    Symantec Real Time Storage Protection Component-->MsiExec.exe /I{D6E6FA4A-5445-4850-8365-CF216C1CBB7A}
    Symantec Technical Support Controls-->MsiExec.exe /I{45690715-80A6-4445-B61D-ADEC5888E8CD}
    Yahoo! Toolbar for Internet Explorer-->C:\PROGRA~1\Yahoo!\Common\unyt.exe

    ======Security center information======

    AV: Norton 360
    FW: Norton 360
    AS: Windows Defender
    AS: Norton 360

    System event log

    Computer Name: JoeyHemphill-PC
    Event Code: 4201
    Message: The system detected that network adapter Local Area Connection was connected to the network, and has initiated normal operation.
    Record Number: 205252
    Source Name: Tcpip
    Time Written: 20090105064507.423000-000
    Event Type: Information
    User:

    Computer Name: JoeyHemphill-PC
    Event Code: 4201
    Message: The system detected that network adapter Local Area Connection was connected to the network, and has initiated normal operation.
    Record Number: 205253
    Source Name: Tcpip
    Time Written: 20090105064507.427000-000
    Event Type: Information
    User:

    Computer Name: JoeyHemphill-PC
    Event Code: 7036
    Message: The Windows Image Acquisition (WIA) service entered the running state.
    Record Number: 205254
    Source Name: Service Control Manager
    Time Written: 20090105064513.000000-000
    Event Type: Information
    User:

    Computer Name: JoeyHemphill-PC
    Event Code: 1
    Message: The system has resumed from sleep.

    Sleep Time: 2009-01-05T06:44:33.508Z
    Wake Time: 2009-01-05T06:45:07.603Z

    Wake Source: Device -NVIDIA nForce Networking Controller
    Record Number: 205255
    Source Name: Microsoft-Windows-Power-Troubleshooter
    Time Written: 20090105064513.178000-000
    Event Type: Information
    User: NT AUTHORITY\LOCAL SERVICE

    Computer Name: JoeyHemphill-PC
    Event Code: 20003
    Message: Driver Management has concluded the process to add Service tunnel for Device Instance ID ROOT\*6TO4MP\0016 with the following status: 0.
    Record Number: 205256
    Source Name: Microsoft-Windows-User-PnP
    Time Written: 20090105064524.267000-000
    Event Type: Information
    User: NT AUTHORITY\SYSTEM

    Application event log

    Computer Name: JoeyHemphill-PC
    Event Code: 8224
    Message: The VSS service is shutting down due to idle timeout.
    Record Number: 58858
    Source Name: VSS
    Time Written: 20090105061118.000000-000
    Event Type: Information
    User:

    Computer Name: JoeyHemphill-PC
    Event Code: 101
    Message: Information Level: success

    Scheduler launched Automatic LiveUpdate.
    Record Number: 58859
    Source Name: Automatic LiveUpdate Scheduler
    Time Written: 20090105064134.000000-000
    Event Type: Information
    User: NT AUTHORITY\SYSTEM

    Computer Name: JoeyHemphill-PC
    Event Code: 101
    Message: Information Level: success

    Automatic LiveUpdate has terminated.
    Record Number: 58860
    Source Name: Automatic LiveUpdate Scheduler
    Time Written: 20090105064218.000000-000
    Event Type: Information
    User: NT AUTHORITY\SYSTEM

    Computer Name: JoeyHemphill-PC
    Event Code: 101
    Message: Information Level: success

    The next run has been scheduled to occur at approximately 1:39 AM.
    Record Number: 58861
    Source Name: Automatic LiveUpdate Scheduler
    Time Written: 20090105064218.000000-000
    Event Type: Information
    User: NT AUTHORITY\SYSTEM

    Computer Name: JoeyHemphill-PC
    Event Code: 5
    Message: Unsupported service control request (see data below)
    Record Number: 58862
    Source Name: LightScribeService
    Time Written: 20090105072724.000000-000
    Event Type: Information
    User:

    Security event log

    Computer Name: JoeyHemphill-PC
    Event Code: 4904
    Message: An attempt was made to register a security event source.

    Subject :
    Security ID: S-1-5-18
    Account Name: JOEYHEMPHILL-PC$
    Account Domain: WORKGROUP
    Logon ID: 0x3e7

    Process:
    Process ID: 0x19f4
    Process Name: C:\Windows\System32\VSSVC.exe

    Event Source:
    Source Name: VSSAudit
    Event Source ID: 0x8d0ca3c2
    Record Number: 18169
    Source Name: Microsoft-Windows-Security-Auditing
    Time Written: 20090105020706.445000-000
    Event Type: Audit Success
    User:

    Computer Name: JoeyHemphill-PC
    Event Code: 4905
    Message: An attempt was made to unregister a security event source.

    Subject
    Security ID: S-1-5-18
    Account Name: JOEYHEMPHILL-PC$
    Account Domain: WORKGROUP
    Logon ID: 0x3e7

    Process:
    Process ID: 0x19f4
    Process Name: C:\Windows\System32\VSSVC.exe

    Event Source:
    Source Name: VSSAudit
    Event Source ID: 0x8d0ca3c2
    Record Number: 18170
    Source Name: Microsoft-Windows-Security-Auditing
    Time Written: 20090105020706.445000-000
    Event Type: Audit Success
    User:

    Computer Name: JoeyHemphill-PC
    Event Code: 4648
    Message: A logon was attempted using explicit credentials.

    Subject:
    Security ID: S-1-5-18
    Account Name: JOEYHEMPHILL-PC$
    Account Domain: WORKGROUP
    Logon ID: 0x3e7
    Logon GUID: {00000000-0000-0000-0000-000000000000}

    Account Whose Credentials Were Used:
    Account Name: SYSTEM
    Account Domain: NT AUTHORITY
    Logon GUID: {00000000-0000-0000-0000-000000000000}

    Target Server:
    Target Server Name: localhost
    Additional Information: localhost

    Process Information:
    Process ID: 0x260
    Process Name: C:\Windows\System32\services.exe

    Network Information:
    Network Address: -
    Port: -

    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
    Record Number: 18171
    Source Name: Microsoft-Windows-Security-Auditing
    Time Written: 20090105022153.572000-000
    Event Type: Audit Success
    User:

    Computer Name: JoeyHemphill-PC
    Event Code: 4624
    Message: An account was successfully logged on.

    Subject:
    Security ID: S-1-5-18
    Account Name: JOEYHEMPHILL-PC$
    Account Domain: WORKGROUP
    Logon ID: 0x3e7

    Logon Type: 5

    New Logon:
    Security ID: S-1-5-18
    Account Name: SYSTEM
    Account Domain: NT AUTHORITY
    Logon ID: 0x3e7
    Logon GUID: {00000000-0000-0000-0000-000000000000}

    Process Information:
    Process ID: 0x260
    Process Name: C:\Windows\System32\services.exe

    Network Information:
    Workstation Name:
    Source Network Address: -
    Source Port: -

    Detailed Authentication Information:
    Logon Process: Advapi
    Authentication Package: Negotiate
    Transited Services: -
    Package Name (NTLM only): -
    Key Length: 0

    This event is generated when a logon session is created. It is generated on the computer that was accessed.

    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

    The authentication information fields provide detailed information about this specific logon request.
    - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
    - Transited services indicate which intermediate services have participated in this logon request.
    - Package name indicates which sub-protocol was used among the NTLM protocols.
    - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
    Record Number: 18172
    Source Name: Microsoft-Windows-Security-Auditing
    Time Written: 20090105022153.572000-000
    Event Type: Audit Success
    User:

    Computer Name: JoeyHemphill-PC
    Event Code: 4672
    Message: Special privileges assigned to new logon.

    Subject:
    Security ID: S-1-5-18
    Account Name: SYSTEM
    Account Domain: NT AUTHORITY
    Logon ID: 0x3e7

    Privileges: SeAssignPrimaryTokenPrivilege
    SeTcbPrivilege
    SeSecurityPrivilege
    SeTakeOwnershipPrivilege
    SeLoadDriverPrivilege
    SeBackupPrivilege
    SeRestorePrivilege
    SeDebugPrivilege
    SeAuditPrivilege
    SeSystemEnvironmentPrivilege
    SeImpersonatePrivilege
    Record Number: 18173
    Source Name: Microsoft-Windows-Security-Auditing
    Time Written: 20090105022153.572000-000
    Event Type: Audit Success
    User:

    ======Environment variables======

    "ComSpec "=%SystemRoot%\system32\cmd.exe
    "FP_NO_HOST_CHECK "=NO
    "OS "=Windows_NT
    "Path "=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\hp\bin\Python;c:\Program Files\Common Files\Roxio Shared\DLLShared\;c:\Program Files\Common Files\Roxio Shared\DLLShared\;c:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\;C:\Program Files\QuickTime\QTSystem\
    "PATHEXT "=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
    "PROCESSOR_ARCHITECTURE "=x86
    "TEMP "=%SystemRoot%\TEMP
    "TMP "=%SystemRoot%\TEMP
    "USERNAME "=SYSTEM
    "windir "=%SystemRoot%
    "PROCESSOR_LEVEL "=15
    "PROCESSOR_IDENTIFIER "=x86 Family 15 Model 75 Stepping 2, AuthenticAMD
    "PROCESSOR_REVISION "=4b02
    "NUMBER_OF_PROCESSORS "=2
    "RoxioCentral "=c:\Program Files\Common Files\Roxio Shared\9.0\Roxio Central33\
    "PLATFORM "=HPD
    "PCBRAND "=Pavilion
    "OnlineServices "=Online Services
    "CLASSPATH "=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip
    "QTJAVA "=C:\Program Files\QuickTime\QTSystem\QTJava.zip

    -----------------EOF-----------------

    Here is both of the logs from Hijackthis.

    Thank you.
     
  2. 2009/01/05
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    I don't see any signs of malware. Check this out. There is a setting in IE to allow or disallow meta refresh.
    Tools > Internet Options > Security Tab > Internet > Custom level
    See if disabling that stops it. You may have to close all open browsers then open a new one for it to take effect.
     

  3. to hide this advert.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.