Solved unique win xp repair problem

[Resolved] unique win xp repair problem

I have never seen anything like this one! I think that a hacker compromised my system using sub7 or back orifice. He then used a keylogger to find out my administrative password. Nothing new there. So I used google to find a certain security hole on the win xp install disk involving the f10 key.

At the command prompt you are to enter nusrmgr.cpl to gain access to your user accounts. The author of this tutorial used this method on a machine that had sp1 installed, my machine has sp3. This did not work for me, windows did not recognize the user account that had gained access.

So I used the authors second suggestion and entered control userpasswords2 at the prompt. Success, or so I thought. My machine reverted back to sp1 and i cannot access the windows update site from ie, which also reverted back to version 6, the program freezes the instant I hit enter or go.

My developer programs, which require sp3, now give me the following error: entry point not found, the procedure entry point decodepointer could not be located in the dynamic link library kernel32.dll. That is no surprise as they require sp3, what baffles me is that the control panel, add/remove programs does not populate a list of programs, it comes up blank.

Is there a way to refresh add/remove programs? In the interest of this not happening again, I scanned my system using avast free edition's boot-time scanner, and it caught the following, here are the logs from the scan:

File C:\Documents and Settings\Richard\My Documents\Downloads\Globe7Setup2.0.0.0.exe\JMF2.1.1e\lib\jmf.jar Error 42146 {Installer archive is corrupted.}
File C:\Documents and Settings\Richard\My Documents\Downloads\Globe7Setup2.0.0.0.exe\Globe7Launcher.exe is infected by Win32:Agent-QXR [Trj], Moved to chest
File C:\Program Files\Autodesk\Acadm 2004 DX\Express\lspsurf.exe is infected by Win32:Malware-gen, Moved to chest
File C:\System Volume Information\_restore{468F58CF-E339-4577-8CF9-DE4E1A2A85C3}\RP2\A0001222.exe is infected by Win32:Malware-gen, Moved to chest

I also use sygates personal firewall, which has had its password changed as well. I know, you get what you pay for, right? Well I'll pay for them after I find a way to fix these issues without formatting my hdd. I have a lot installed on this machine and i don't look forward to reinstalling everything. Any suggestions will be very much appreciated.

I downloaded the DDS file mentioned in the posting rules. It came packaged as an AutoCAD script and was unreadable when double clicked.

I will try the windows update site after the security patch for ie is released on 1/21/10. thank you

 

downloaded malware bytes

Here is the log file from a quick scan, yes I updated before scanning. Everything looks clean to me. Next I will download hijack this and post those results also.

Malwarebytes' Anti-Malware 1.44
Database version: 3608
Windows 5.1.2600 Service Pack 1
Internet Explorer 6.0.2800.1106

1/21/2010 11:11:02 AM
mbam-log-2010-01-21 (11-11-02).txt

Scan type: Quick Scan
Objects scanned: 125314
Time elapsed: 7 minute(s), 50 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

 

hijack this log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:32:31 AM, on 1/21/2010
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\HPZipm12.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Voicent\Gateway\bin\vgate.exe
C:\Program Files\Voicent\Gateway\bin\vgate.exe
C:\Program Files\Voicent\Gateway\bin\spengine.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Voicent\Gateway\bin\vxengine.exe
C:\Program Files\Java\jre6\bin\javaw.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Java\jre6\bin\javaw.exe
C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\hphmon05.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe

R3 - URLSearchHook: Webzaam Toolbar - {07276820-6961-4d38-a2b9-60e42fc88424} - C:\Program Files\Webzaam\tbWeb1.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Webzaam Toolbar - {07276820-6961-4d38-a2b9-60e42fc88424} - C:\Program Files\Webzaam\tbWeb1.dll
O2 - BHO: ALOT Toolbar BHO - {14CEEAFF-96DD-4101-AE37-D5ECDC23C3F6} - C:\Program Files\alot\bin\alot.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Webzaam Toolbar - {07276820-6961-4d38-a2b9-60e42fc88424} - C:\Program Files\Webzaam\tbWeb1.dll
O3 - Toolbar: ALOT Toolbar - {5AA2BA46-9913-4dc7-9620-69AB0FA17AE7} - C:\Program Files\alot\bin\alot.dll
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe "
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\HP\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe "
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MoneyStartUp] C:\Program Files\Microsoft Money\System\Money Startup.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Fread Speak - C:\Program Files\Fread\plugin\ie_menu.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1260012255343
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Voicent Gateway (VoicentGateway) - Voicent Communications, Inc - C:\Program Files\Voicent\Gateway\bin\vgate.exe

--
End of file - 7903 bytes

 

revert question

Hi Broni,

I don't understand either. The author of the fix stated that "your programs should stay intact ", keyword, should.

I used my win xp home edition sp1 disc for this "fix ". The disk is an upgrade disc. I'm guessing that when the repair function saw sp3, it did not recognize
it as a valid win xp file and therefore repaired the install with sp1.

I am going to try the windows update site again in just a few minutes. Hopefully this will bring back my add/remove programs list, then i can remove autocad, allowing the dds to run properly. I will post back when I know more.

 

sp3 install

Sorry broni,

I didn't have time to check for a reply, went to the windows update site, had the same problem. I then went to the ms downloads center and got the iso for sp3, installed it, removed acad; the add/remove programs did populate a list, ran dds, and I am about to post the results.

I will check to make sure my windows firewall is up before doing so.

 

dds file

DDS (Ver_09-12-01.01) - NTFSx86
Run by Richard at 18:48:53.70 on Thu 01/21/2010
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.959.345 [GMT -5:00]

AV: avast! antivirus 4.8.1368 [VPS 100121-2] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Sygate Personal Firewall *enabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Sygate\SPF\smc.exe
svchost.exe
svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\HPZipm12.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Voicent\Gateway\bin\vgate.exe
C:\Program Files\Voicent\Gateway\bin\vgate.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\hphmon05.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Voicent\Gateway\bin\spengine.exe
C:\Program Files\Voicent\Gateway\bin\vxengine.exe
C:\Program Files\Java\jre6\bin\javaw.exe
C:\Program Files\Java\jre6\bin\javaw.exe
C:\Documents and Settings\Richard\My Documents\Downloads\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.aol.com/?customizeShortName=&inline=true&skin=abstract&.
mSearchAssistant =
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: {07276820-6961-4d38-a2b9-60e42fc88424} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: TextAloud: {f053c368-5458-45b2-9b4d-d8914bdddbff} - c:\progra~1\textal~1\TAForIE.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [MoneyStartUp] c:\program files\microsoft money\system\Money Startup.exe
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
mRun: [SmcService] c:\progra~1\sygate\spf\smc.exe -startgui
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [HP Software Update] "c:\program files\hp\hp software update\HPWuSchd.exe "
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
mRun: [WorksFUD] c:\program files\microsoft works\wkfud.exe
mRun: [Microsoft Works Update Detection] c:\program files\microsoft works\WkDetect.exe
mRun: [CamMonitor] c:\program files\hp\digital imaging\\unload\hpqcmon.exe
mRun: [Share-to-Web Namespace Daemon] c:\program files\hp\hp share-to-web\hpgs2wnd.exe
mRun: [HPHUPD05] c:\program files\hp\{45b6180b-dcab-4093-8ee8-6164457517f0}\hphupd05.exe
mRun: [HP Component Manager] "c:\program files\hp\hpcoretech\hpcmpmgr.exe "
mRun: [HPHmon05] c:\windows\system32\hphmon05.exe
mRun: [BCMSMMSG] BCMSMMSG.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\acroba~1.lnk - c:\program files\adobe\acrobat 5.0\distillr\AcroTray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
IE: Fread Speak - c:\program files\fread\plugin\ie_menu.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1260012255343
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll
Handler: ms-its51 - {F6F1E82D-DE4D-11D2-875C-0000F8105754} - c:\program files\common files\microsoft shared\information retrieval\itss51.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\richard\applic~1\mozilla\firefox\profiles\c8rxsv6l.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.aol.com/
FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\microsoft\web platform installer\NPWPIDetector.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npvlc.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - falsec:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl3.rsa_seed_sha ", true);

============= SERVICES / DRIVERS ===============

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-12-5 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-12-5 20560]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-12-5 138680]
R2 VoicentGateway;Voicent Gateway;c:\program files\voicent\gateway\bin\vgate.exe [2009-3-29 491520]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2009-12-5 254040]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2009-12-5 352920]
S2 clr_optimization_v4.0.21006_32;Microsoft .NET Framework NGEN v4.0.21006_X86;c:\windows\microsoft.net\framework\v4.0.21006\mscorsvw.exe [2009-10-7 129856]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-12-5 133104]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.21006\wpf\WPFFontCache_v0400.exe [2009-10-7 752984]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\microsoft sql server\100\shared\sqladhlp.exe [2009-3-31 47128]
S4 RsFx0103;RsFx0103 Driver;c:\windows\system32\drivers\RsFx0103.sys [2009-3-30 239336]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\microsoft sql server\mssql10.sqlexpress\mssql\binn\SQLAGENT.EXE [2009-3-30 366936]
S4 vsdatant;vsdatant; [x]

=============== Created Last 30 ================

2010-01-21 23:24:34 221184 ----a-w- c:\windows\system32\wmpns.dll
2010-01-21 23:14:31 0 d-----w- c:\windows\system32\wbem\Repository.001
2010-01-21 23:13:35 79872 -c----w- c:\windows\system32\dllcache\msxml6r.dll
2010-01-21 23:13:35 1306624 -c----w- c:\windows\system32\dllcache\msxml6.dll
2010-01-21 23:13:32 380416 ------w- c:\windows\system32\irprops.cpl
2010-01-21 23:13:30 162304 ------w- c:\windows\system32\wuaucpl.cpl
2010-01-21 23:05:26 19569 ----a-w- c:\windows\003187_.tmp
2010-01-21 16:26:42 0 d-----w- c:\program files\Trend Micro
2010-01-21 16:01:33 0 d-----w- c:\docume~1\richard\applic~1\Malwarebytes
2010-01-21 16:01:25 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-21 16:01:22 18520 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-21 16:01:22 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-01-21 16:01:21 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-21 11:18:17 0 ----a-w- c:\documents and settings\richard\netstat
2010-01-20 22:56:15 40960 ------w- c:\windows\system32\ChCfg.exe
2010-01-20 22:56:15 135168 ------w- c:\windows\system32\RtlCPAPI.dll
2010-01-20 22:55:33 0 d-----w- c:\program files\Realtek
2010-01-20 20:33:04 156672 -c--a-w- c:\windows\system32\dllcache\winzm.ime
2010-01-20 20:33:03 65536 -c--a-w- c:\windows\system32\dllcache\winime.ime
2010-01-20 20:33:03 156672 -c--a-w- c:\windows\system32\dllcache\winsp.ime
2010-01-20 20:33:03 156672 -c--a-w- c:\windows\system32\dllcache\winpy.ime
2010-01-20 20:33:02 79360 -c--a-w- c:\windows\system32\dllcache\winar30.ime
2010-01-20 20:33:02 72704 -c--a-w- c:\windows\system32\dllcache\wingb.ime
2010-01-20 20:33:01 41600 -c--a-w- c:\windows\system32\dllcache\weitekp9.dll
2010-01-20 20:33:01 31232 -c--a-w- c:\windows\system32\dllcache\weitekp9.sys
2010-01-20 20:31:53 10129408 -c--a-w- c:\windows\system32\dllcache\hwxkor.dll
2010-01-20 20:30:22 6272 ----a-w- c:\windows\system32\drivers\splitter.sys
2010-01-20 20:30:17 52864 ----a-w- c:\windows\system32\drivers\dmusic.sys
2010-01-20 20:29:24 488 ---ha-r- c:\windows\system32\logonui.exe.manifest
2010-01-20 20:29:18 749 ---ha-r- c:\windows\WindowsShell.Manifest
2010-01-20 20:29:18 749 ---ha-r- c:\windows\system32\wuaucpl.cpl.manifest
2010-01-20 20:29:18 749 ---ha-r- c:\windows\system32\sapi.cpl.manifest
2010-01-20 20:29:18 749 ---ha-r- c:\windows\system32\ncpa.cpl.manifest
2010-01-20 20:27:03 91648 ----a-w- c:\windows\system32\mtxoci.dll
2010-01-20 20:26:59 62464 ----a-w- c:\windows\system32\wbem\wmipjobj.dll
2010-01-20 20:23:04 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2010-01-20 20:22:28 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2010-01-20 20:22:15 57600 ----a-w- c:\windows\system32\drivers\redbook.sys
2010-01-20 20:19:26 40840 ----a-w- c:\windows\system32\drivers\termdd.sys
2010-01-20 20:18:05 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2010-01-20 20:18:05 24661 ----a-w- c:\windows\system32\spxcoins.dll
2010-01-20 20:18:05 146432 ----a-w- c:\windows\system\winspool.drv
2010-01-20 20:18:05 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll
2010-01-20 20:18:05 13312 ----a-w- c:\windows\system32\irclass.dll
2010-01-20 20:18:05 11264 ----a-w- c:\windows\system32\drivers\irenum.sys
2010-01-20 20:18:04 74752 ----a-w- c:\windows\system32\storprop.dll
2010-01-20 20:17:50 8574 -c--a-w- c:\windows\system32\dllcache\IASNT4.CAT
2010-01-20 20:17:50 797189 -c--a-w- c:\windows\system32\dllcache\NT5IIS.CAT
2010-01-20 20:17:50 7382 -c--a-w- c:\windows\system32\dllcache\OEMBIOS.CAT
2010-01-20 20:17:50 399645 -c--a-w- c:\windows\system32\dllcache\MAPIMIG.CAT
2010-01-20 20:17:50 37484 -c--a-w- c:\windows\system32\dllcache\MW770.CAT
2010-01-20 20:17:50 13472 -c--a-w- c:\windows\system32\dllcache\HPCRDP.CAT
2010-01-20 20:17:47 13608 ----a-r- c:\windows\SET9D.tmp
2010-01-20 20:17:43 1086182 ----a-r- c:\windows\SET91.tmp
2009-12-31 20:35:58 0 d-----w- c:\docume~1\richard\applic~1\Individual Software
2009-12-31 20:18:31 0 d-----w- c:\docume~1\alluse~1\applic~1\Individual Software
2009-12-31 20:15:06 0 d-----w- c:\program files\common files\Individual Software
2009-12-31 20:15:03 46080 ----a-w- c:\windows\system32\MCIWndx.OCX
2009-12-31 20:15:02 0 d-----w- c:\program files\Individual Software
2009-12-25 04:40:55 0 d-----w- c:\program files\Damon86.com
2009-12-24 22:14:44 0 d-----w- c:\docume~1\richard\applic~1\IObit
2009-12-24 22:14:43 0 d-----w- c:\program files\IObit
2009-12-24 20:35:16 108032 ------w- c:\windows\system32\sh33w32.dll
2009-12-24 20:32:56 314 ------w- c:\windows\system32\245.lic
2009-12-24 20:32:46 0 d-----w- c:\windows\COREL
2009-12-24 09:29:53 0 d-sh--w- c:\documents and settings\richard\IECompatCache
2009-12-24 08:40:44 0 d-----w- c:\program files\common files\Merge Modules
2009-12-23 22:34:52 0 d-----w- c:\program files\YoncaTV Plus

==================== Find3M ====================

2010-01-20 20:28:04 23348 ----a-w- c:\windows\system32\emptyregdb.dat
2009-12-20 22:27:32 18269 ----a-w- c:\windows\HPHins01.dat
2009-12-11 18:58:56 249856 ------w- c:\windows\Setup1.exe
2009-12-11 18:58:55 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-12-06 17:05:47 139264 ----a-w- c:\windows\system32\hpzjrd01.dll
2009-12-05 15:54:24 245088 ----a-w- c:\windows\WINSTRUN.EXE
2009-12-05 15:08:00 112885 ----a-w- c:\windows\hpoins07.dat

============= FINISH: 18:49:43.14 ===============

 

attach file

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-12-01.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 1/20/2010 3:33:09 PM
System Uptime: 1/21/2010 6:20:00 PM (0 hours ago)

Motherboard: Hewleet-Packard | | Asterope
Processor: Intel(R) Celeron(R) CPU 2.93GHz | CPU 1 | 2933/133mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 112 GiB total, 86.778 GiB free.
D: is FIXED (NTFS) - 57 GiB total, 13.742 GiB free.
E: is CDROM ()
F: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Video Controller (VGA Compatible)
Device ID: PCI\VEN_1002&DEV_5A61&SUBSYS_2A31103C&REV_00\4&1CF2FBB4&0&2808
Manufacturer:
Name: Video Controller (VGA Compatible)
PNP Device ID: PCI\VEN_1002&DEV_5A61&SUBSYS_2A31103C&REV_00\4&1CF2FBB4&0&2808
Service:

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: SM Bus Controller
Device ID: PCI\VEN_1002&DEV_4372&SUBSYS_2A31103C&REV_81\3&267A616A&0&A0
Manufacturer:
Name: SM Bus Controller
PNP Device ID: PCI\VEN_1002&DEV_4372&SUBSYS_2A31103C&REV_81\3&267A616A&0&A0
Service:

==== System Restore Points ===================

RP1: 1/20/2010 3:49:44 PM - System Checkpoint
RP2: 1/20/2010 5:55:33 PM - Installed Realtek High Definition Audio Driver
RP3: 1/21/2010 6:06:01 PM - Installed Windows XP Service Pack 3.
RP4: 1/21/2010 6:27:30 PM - Removed AutoCAD Express Tools Volumes 1-9
RP5: 1/21/2010 6:30:54 PM - Removed AutoCAD Mechanical 2004 DX

==== Installed Programs ======================

1500
1500_Help
1500Trb
Absolute Beginner's Series VWD VB Lesson 1
Absolute Beginner's Series VWD VB Lesson 10
Absolute Beginner's Series VWD VB Lesson 11
Absolute Beginner's Series VWD VB Lesson 12
Absolute Beginner's Series VWD VB Lesson 13
Absolute Beginner's Series VWD VB Lesson 2
Absolute Beginner's Series VWD VB Lesson 3
Absolute Beginner's Series VWD VB Lesson 4
Absolute Beginner's Series VWD VB Lesson 5
Absolute Beginner's Series VWD VB Lesson 6
Absolute Beginner's Series VWD VB Lesson 7
Absolute Beginner's Series VWD VB Lesson 8
Absolute Beginner's Series VWD VB Lesson 9
Acrobat.com
Adobe Acrobat 5.0
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe PageMaker 7.0
Adobe Photoshop 6.0
Adobe Reader 9.2
Adobe Type Manager 4.1
Advanced SystemCare 3
AiO_Scan
AiOSoftware
Art Explosion Publisher Pro
Autodesk Express Viewer
avast! Antivirus
AVS Update Manager 1.0
AVS Video Converter 6
AVS4YOU Software Navigator 1.3
BCM V.92 56K Modem
Beginning Web Site Development Module 1 - Visual Basic
Beginning Web Site Development Module 2 - Visual Basic
Beneton Movie GIF 1.1.2
BIGSPEED Voice Chat SDK Free (remove only)
BufferChm
C4F Developer Kit 2008
C4F Vista P2P Toolkit
ClickArt 750,000
ClickArt Fonts 4
ClickArt Photo
CP_Package_Variety1
CP_Package_Variety2
CP_Package_Variety3
CraigsCrawl 2.0
CyberTweak Version 1.3 Final
Destinations
DeviceManagementQFolder
DigitImg
DocProc
E-Text Reader IGT
eAssistant
eBay Icon
eSupportQFolder
FastTouch Typing Teacher
Fax
FoneSync
Free NaturalReader
Google Chrome
Google Update Helper
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB945282)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB946040)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB946308)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB946344)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB947540)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB947789)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB948127)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB951708)
Hotfix for Microsoft Visual C# 2008 Express Edition with SP1 - ENU (KB945282)
Hotfix for Microsoft Visual C# 2008 Express Edition with SP1 - ENU (KB946040)
Hotfix for Microsoft Visual C# 2008 Express Edition with SP1 - ENU (KB946308)
Hotfix for Microsoft Visual C# 2008 Express Edition with SP1 - ENU (KB947540)
Hotfix for Microsoft Visual C# 2008 Express Edition with SP1 - ENU (KB947789)
Hotfix for Microsoft Visual C++ 2008 Express Edition with SP1 - ENU (KB945282)
Hotfix for Microsoft Visual C++ 2008 Express Edition with SP1 - ENU (KB946040)
Hotfix for Microsoft Visual C++ 2008 Express Edition with SP1 - ENU (KB946308)
Hotfix for Microsoft Visual C++ 2008 Express Edition with SP1 - ENU (KB947540)
Hotfix for Microsoft Visual C++ 2008 Express Edition with SP1 - ENU (KB947789)
Hotfix for Microsoft Visual C++ 2008 Express Edition with SP1 - ENU (KB948127)
Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946040)
Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946308)
Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946344)
Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947540)
Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947789)
Hotfix for Microsoft Visual Web Developer 2008 Express Edition with SP1 - ENU (KB945282)
Hotfix for Microsoft Visual Web Developer 2008 Express Edition with SP1 - ENU (KB946040)
Hotfix for Microsoft Visual Web Developer 2008 Express Edition with SP1 - ENU (KB946308)
Hotfix for Microsoft Visual Web Developer 2008 Express Edition with SP1 - ENU (KB946344)
Hotfix for Microsoft Visual Web Developer 2008 Express Edition with SP1 - ENU (KB946581)
Hotfix for Microsoft Visual Web Developer 2008 Express Edition with SP1 - ENU (KB947540)
Hotfix for Microsoft Visual Web Developer 2008 Express Edition with SP1 - ENU (KB947789)
Hotfix for Microsoft Visual Web Developer 2008 Express Edition with SP1 - ENU (KB951708)
Hotfix for Office (KB950278)
HP Image Zone Express
HP Imaging Device Functions 5.3
HP Memories Disc
HP Photo and Imaging 2.0 - Photosmart Cameras
HP PSC & OfficeJet 5.3.B
HP Software Update
HP Solution Center & Imaging Support Tools 5.3
HP Update
HPProductAssistant
Ignite
Internet Information Services (IIS) 7 Manager
Introduction to Visual Web Developer 2008 Express Edition
Java DB 10.5.3.0
Java(TM) 6 Update 17
Lernout & Hauspie TruVoice American English TTS Engine
Malwarebytes' Anti-Malware
MGI PhotoSuite 4 (Remove Only)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile Beta 2
Microsoft .NET Framework 4 Extended Beta 2
Microsoft Application Error Reporting
Microsoft ASP.NET MVC 1.0
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Encarta Encyclopedia 2000
Microsoft GIF Animator
Microsoft Money 2001
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Visual Web Developer 2007
Microsoft Office Visual Web Developer MUI (English) 2007
Microsoft Publisher 2002
Microsoft Silverlight
Microsoft Silverlight 3 SDK
Microsoft Silverlight 3 Toolkit October 2009
Microsoft Silverlight 3 Tools for Visual Web Developer Express 2008 SP1 - ENU
Microsoft SQL Server 2008
Microsoft SQL Server 2008 Browser
Microsoft SQL Server 2008 Common Files
Microsoft SQL Server 2008 Database Engine Services
Microsoft SQL Server 2008 Database Engine Shared
Microsoft SQL Server 2008 Management Objects
Microsoft SQL Server 2008 Management Studio
Microsoft SQL Server 2008 Native Client
Microsoft SQL Server 2008 Policies
Microsoft SQL Server 2008 RsFx Driver
Microsoft SQL Server 2008 Setup Support Files
Microsoft SQL Server Compact 3.5 SP1 Design Tools English
Microsoft SQL Server Compact 3.5 SP1 English
Microsoft SQL Server Compact 3.5 SP1 Query Tools English
Microsoft SQL Server Database Publishing Wizard 1.3
Microsoft SQL Server VSS Writer
Microsoft Streets and Trips 2001
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual Basic 2008 Express Edition with SP1 - ENU
Microsoft Visual Basic PowerPacks 2.0
Microsoft Visual C# 2008 Express Edition with SP1 - ENU
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Express Edition with SP1 - ENU
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
Microsoft Visual Studio Tools for Applications 2.0 - ENU
Microsoft Visual Studio Web Authoring Component
Microsoft Visual Web Developer 2008 Express Edition with SP1 - ENU
Microsoft Web Platform Installer 2.0
Microsoft Windows SDK for Visual Studio 2008 Headers and Libraries
Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for .NET Framework - enu
Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for Web - enu
Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for Win32
Microsoft Word 2000 SR-1
Microsoft Works 2001 Setup Launcher
Microsoft Works 6.0
Microsoft Works Suite Add-in for Microsoft Word
Mozilla Firefox (3.5.7)
Mozilla Thunderbird (2.0.0.23)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
NewCopy
OpenOffice.org 3.1
Photosmart 140,240,7200,7600,7700,7900 Series
Popims Animator
PortalGroove SpeechPlayer Free Edition
ProductContext
Professor Answers
Professor Teaches HTML Advanced
Professor Teaches HTML Fundamentals
Professor Teaches Web Design Fundamentals
PSShortcuts
PSUsage
QuarkXPress 4.0
Read Aloud 2
Readiris Pro 9
Readme
Realtek High Definition Audio Driver
Roadkil's Unstoppable Copier Version 4.2
SAPI 5.1 Text-to-Speech
SayO'Clock
Scan
ScannerCopy
SCICA Speech
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB923789)
Service Pack 1 for SQL Server 2008 (KB968369)
SFX Compiler
SI Works Application Development Toolkit
SmartRead
SolutionCenter
Speak-A-Message
SpeechZilla 1.0
Spesoft Text To MP3 Speaker 1.00
Spybot - Search & Destroy
Sql Server Customer Experience Improvement Program
SQL Server System CLR Types
SQLphone Designer
Status
Sygate Personal Firewall
Text-Reader Speaker component
Text2Speech
TextAloud
TrayApp
TTSReader 1.30
Tweak UI
Unload
Unlocker 1.8.8
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Visual Studio Web Authoring Component (KB945140)
Update for Microsoft Visual Web Developer 2008 Express Edition with SP1 - ENU (KB967144)
VideoLAN VLC media player 0.8.5
Voicent AgentDialer
Voicent AutoReminder
Voicent BroadcastByPhone
Voicent Flex PBX
Voicent Gateway
Voicent IVR Studio
WCF RIA Services Beta
Web Easy 4.01
WebFldrs XP
WebReg
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
Windows PowerShell(TM) 1.0
Windows XP Service Pack 3
Works Suite OS Pack
Works Synchronization
XP Codec Pack
Xvid 1.1.2 final uninstall
Yahoo! Messenger
Yeosoft Text to MP3 Speaker 3.5
yRead3

==== Event Viewer Messages From Past Week ========

1/21/2010 6:24:10 PM, error: Service Control Manager [7023] - The Portable Media Serial Number service terminated with the following error: The specified module could not be found.
1/20/2010 4:32:52 PM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
1/20/2010 3:47:40 PM, error: Service Control Manager [7001] - The SSDP Discovery Service service depends on the HTTP service which failed to start because of the following error: The specified procedure could not be found.
1/20/2010 3:47:40 PM, error: Service Control Manager [7000] - The HTTP service failed to start due to the following error: The specified procedure could not be found.
1/20/2010 3:47:00 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: FltMgr
1/20/2010 3:46:56 PM, error: Service Control Manager [7024] - The Wireless Zero Configuration service terminated with service-specific error 11 (0xB).
1/20/2010 3:46:56 PM, error: Service Control Manager [7022] - The DCOM Server Process Launcher service hung on starting.
1/20/2010 3:46:56 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Microsoft .NET Framework NGEN v4.0.21006_X86 service to connect.
1/20/2010 3:46:56 PM, error: Service Control Manager [7001] - The aswFsBlk service depends on the FltMgr service which failed to start because of the following error: A device attached to the system is not functioning.
1/20/2010 3:46:56 PM, error: Service Control Manager [7000] - The Security Center service failed to start due to the following error: The executable program that this service is configured to run in does not implement the service.
1/20/2010 3:46:21 PM, error: Print [23] - Printer Generic PostScript Printer failed to initialize because a suitable AdobePSGenericPostScriptPrinter driver could not be found.
1/20/2010 3:46:21 PM, error: Print [23] - Printer Acrobat Distiller failed to initialize because a suitable AdobePS Acrobat Distiller driver could not be found.
1/20/2010 3:43:22 PM, error: Setup [60055] - Windows Setup encountered non-fatal errors during installation. Please check the setuperr.log found in your Windows directory for more information.
1/20/2010 3:30:04 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service SENS with arguments " " in order to run the server: {D3938AB0-5B9D-11D1-8DD2-00AA004ABD5E}

==== End Of File ===========================

 

log files requested by broni

Thanks so much Broni, you have an awful long file to go over here. I'll definitely visit your site in the future.


ComboFix 10-01-21.02 - Richard 01/21/2010 22:40:31.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.959.506 [GMT -5:00]
Running from: c:\documents and settings\Richard\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100122-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Sygate Personal Firewall *enabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Richard\Application Data\Desktopicon
c:\documents and settings\Richard\Application Data\Desktopicon\eBay.ico
c:\documents and settings\Richard\Application Data\Desktopicon\uninst.exe
c:\windows\system32\twain.dll
c:\windows\system32\twain_32.dll
c:\windows\winhelp.ini

.
((((((((((((((((((((((((( Files Created from 2009-12-22 to 2010-01-22 )))))))))))))))))))))))))))))))
.

2010-01-22 02:46 . 2009-12-21 19:14 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-01-22 02:46 . 2009-12-21 19:14 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2010-01-22 02:46 . 2009-12-21 19:14 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-01-22 02:46 . 2009-12-21 19:14 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-01-22 02:46 . 2009-12-21 19:14 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll
2010-01-22 02:46 . 2009-12-21 19:14 11070464 -c----w- c:\windows\system32\dllcache\ieframe.dll
2010-01-22 02:45 . 2009-10-15 16:28 81920 -c----w- c:\windows\system32\dllcache\fontsub.dll
2010-01-22 02:45 . 2009-10-15 16:28 119808 -c----w- c:\windows\system32\dllcache\t2embed.dll
2010-01-22 02:45 . 2009-11-21 15:51 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-01-22 02:42 . 2009-06-21 21:44 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2010-01-22 02:41 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2010-01-22 02:38 . 2008-10-24 11:21 455296 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-01-22 02:38 . 2009-07-31 04:35 1172480 -c----w- c:\windows\system32\dllcache\msxml3.dll
2010-01-22 02:38 . 2008-10-15 16:34 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2010-01-22 02:38 . 2008-05-01 14:33 331776 -c----w- c:\windows\system32\dllcache\msadce.dll
2010-01-22 02:37 . 2008-04-11 19:04 691712 -c----w- c:\windows\system32\dllcache\inetcomm.dll
2010-01-22 02:37 . 2008-05-08 14:02 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2010-01-21 23:24 . 2008-04-14 00:12 221184 ----a-w- c:\windows\system32\wmpns.dll
2010-01-21 23:14 . 2010-01-21 23:20 -------- d-----w- c:\windows\system32\wbem\Repository.001
2010-01-21 23:13 . 2009-07-31 15:05 1372672 -c----w- c:\windows\system32\dllcache\msxml6.dll
2010-01-21 23:13 . 2008-04-14 03:57 79872 -c----w- c:\windows\system32\dllcache\msxml6r.dll
2010-01-21 16:26 . 2010-01-21 16:26 -------- d-----w- c:\program files\Trend Micro
2010-01-21 16:01 . 2010-01-21 16:01 -------- d-----w- c:\documents and settings\Richard\Application Data\Malwarebytes
2010-01-21 16:01 . 2010-01-07 21:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-21 16:01 . 2010-01-21 16:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-21 16:01 . 2010-01-07 21:07 18520 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-21 16:01 . 2010-01-21 16:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-20 22:56 . 2005-07-15 22:48 40960 ------w- c:\windows\system32\ChCfg.exe
2010-01-20 20:33 . 2003-03-31 12:00 41600 -c--a-w- c:\windows\system32\dllcache\weitekp9.dll
2010-01-20 20:33 . 2003-03-31 12:00 31232 -c--a-w- c:\windows\system32\dllcache\weitekp9.sys
2010-01-20 20:31 . 2003-03-31 12:00 10129408 -c--a-w- c:\windows\system32\dllcache\hwxkor.dll
2010-01-20 20:30 . 2008-04-14 05:15 6272 ----a-w- c:\windows\system32\drivers\splitter.sys
2010-01-20 20:30 . 2008-04-14 05:15 52864 ----a-w- c:\windows\system32\drivers\dmusic.sys
2010-01-20 20:27 . 2008-06-12 14:23 91648 ----a-w- c:\windows\system32\mtxoci.dll
2010-01-20 20:26 . 2008-04-14 10:42 62464 ----a-w- c:\windows\system32\wbem\wmipjobj.dll
2010-01-20 20:23 . 2008-04-14 05:17 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2010-01-20 20:22 . 2008-04-14 05:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2010-01-20 20:22 . 2008-04-14 05:10 57600 ----a-w- c:\windows\system32\drivers\redbook.sys
2010-01-20 20:19 . 2008-04-14 10:43 40840 ----a-w- c:\windows\system32\drivers\termdd.sys
2010-01-20 20:18 . 2008-04-14 10:42 146432 ----a-w- c:\windows\system\winspool.drv
2010-01-20 20:18 . 2008-04-14 05:24 11264 ----a-w- c:\windows\system32\drivers\irenum.sys
2010-01-20 20:18 . 2003-03-31 12:00 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2010-01-20 20:18 . 2003-03-31 12:00 24661 ----a-w- c:\windows\system32\spxcoins.dll
2010-01-20 20:18 . 2003-03-31 12:00 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll
2010-01-20 20:18 . 2003-03-31 12:00 13312 ----a-w- c:\windows\system32\irclass.dll
2010-01-20 20:18 . 2008-04-14 10:42 74752 ----a-w- c:\windows\system32\storprop.dll
2010-01-20 16:45 . 2010-01-20 16:45 -------- d-----w- c:\documents and settings\Lorelei\Application Data\Speak-A-Message
2010-01-20 16:32 . 2010-01-20 16:32 164024 ----a-w- c:\documents and settings\Lorelei\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-19 14:16 . 2010-01-19 14:16 -------- d-----w- c:\documents and settings\Lorelei\Local Settings\Application Data\Identities
2010-01-19 14:12 . 2010-01-19 14:12 -------- d-----w- c:\documents and settings\Lorelei\Local Settings\Application Data\Mozilla
2010-01-19 14:10 . 2010-01-19 14:11 -------- d-----w- c:\documents and settings\Lorelei
2009-12-31 20:35 . 2010-01-02 22:44 -------- d-----w- c:\documents and settings\Richard\Application Data\Individual Software
2009-12-31 20:35 . 2004-01-21 17:08 125822 ----a-w- c:\documents and settings\All Users\Application Data\Individual Software\Professor Answers\UnInstall.EXE
2009-12-31 20:35 . 2001-11-05 14:30 129088 ----a-w- c:\documents and settings\All Users\Application Data\Individual Software\Professor Answers\UNWISE.EXE
2009-12-31 20:34 . 2001-09-19 13:39 119291 ----a-w- c:\documents and settings\All Users\Application Data\Individual Software\Professor Teaches HTML Advanced\UnInstall.EXE
2009-12-31 20:34 . 2001-11-05 14:30 165376 ----a-w- c:\documents and settings\All Users\Application Data\Individual Software\Professor Teaches HTML Advanced\UNWISE.EXE
2009-12-31 20:31 . 2001-11-05 14:30 165376 ----a-w- c:\documents and settings\All Users\Application Data\Individual Software\Professor Teaches HTML Fundamentals\UNWISE.EXE
2009-12-31 20:31 . 2001-09-19 13:39 119291 ----a-w- c:\documents and settings\All Users\Application Data\Individual Software\Professor Teaches HTML Fundamentals\UnInstall.EXE
2009-12-31 20:18 . 2009-12-31 20:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Individual Software
2009-12-31 20:18 . 2001-11-05 14:30 165376 ----a-w- c:\documents and settings\All Users\Application Data\Individual Software\Professor Teaches Web Design Fundamentals\UNWISE.EXE
2009-12-31 20:18 . 2001-09-19 13:39 119291 ----a-w- c:\documents and settings\All Users\Application Data\Individual Software\Professor Teaches Web Design Fundamentals\UnInstall.EXE
2009-12-31 20:15 . 2009-12-31 20:15 -------- d-----w- c:\program files\Common Files\Individual Software
2009-12-31 20:15 . 2009-12-31 20:35 -------- d-----w- c:\program files\Individual Software
2009-12-25 04:40 . 2009-12-25 04:40 -------- d-----w- c:\program files\Damon86.com
2009-12-24 22:14 . 2009-12-24 22:14 -------- d-----w- c:\documents and settings\Richard\Application Data\IObit
2009-12-24 22:14 . 2009-12-24 22:14 -------- d-----w- c:\program files\IObit
2009-12-24 20:35 . 1997-06-03 02:31 108032 ------w- c:\windows\system32\sh33w32.dll
2009-12-24 20:32 . 2009-12-24 21:55 -------- d-----w- c:\windows\COREL
2009-12-24 09:29 . 2009-12-24 09:29 -------- d-sh--w- c:\documents and settings\Richard\IECompatCache
2009-12-24 09:02 . 2009-12-24 09:02 187328 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VCSExpress\9.0\1033\ResourceCache.dll
2009-12-24 08:43 . 2009-12-24 08:43 112640 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VCExpress\9.0\1033\ResourceCache.dll
2009-12-24 08:40 . 2009-12-24 08:41 -------- d-----w- c:\program files\Common Files\Merge Modules
2009-12-24 08:01 . 2009-12-24 08:01 193824 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VBExpress\9.0\1033\ResourceCache.dll
2009-12-23 22:34 . 2009-12-23 22:43 -------- d-----w- c:\program files\YoncaTV Plus

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-22 02:29 . 2009-12-07 05:43 -------- d-----w- c:\program files\Conduit
2010-01-21 23:36 . 2009-12-05 16:11 -------- d-----w- c:\program files\Autodesk
2010-01-20 22:55 . 2010-01-20 22:55 -------- d-----w- c:\program files\Realtek
2010-01-20 22:55 . 2009-12-05 15:13 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-20 22:55 . 2009-12-05 15:12 -------- d-----w- c:\program files\Common Files\InstallShield
2010-01-20 20:28 . 2009-12-05 10:21 23348 ----a-w- c:\windows\system32\emptyregdb.dat
2010-01-19 14:11 . 2010-01-19 14:11 -------- d-----w- c:\documents and settings\Lorelei\Application Data\Share-to-Web Upload Folder
2010-01-19 13:56 . 2009-12-11 21:20 1015720 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-01-10 14:07 . 2009-12-07 12:01 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-12-31 15:08 . 2009-12-07 11:45 1 ----a-w- c:\documents and settings\Richard\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-12-25 04:41 . 2009-12-05 11:43 164024 ----a-w- c:\documents and settings\Richard\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-24 09:02 . 2009-12-11 21:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-12-24 09:01 . 2009-12-11 21:57 416 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\MSDN\9.0\1033\ResourceCache.dll
2009-12-24 08:59 . 2009-12-11 21:30 -------- d-----w- c:\program files\Microsoft Visual Studio 9.0
2009-12-23 07:50 . 2009-12-21 17:02 -------- d-----w- c:\program files\SoftPhone
2009-12-21 19:14 . 2003-03-31 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-20 22:54 . 2009-12-20 22:54 -------- d-----w- c:\program files\MSXML 4.0
2009-12-20 22:27 . 2009-12-20 22:23 18269 ----a-w- c:\windows\HPHins01.dat
2009-12-20 22:27 . 2009-12-05 14:58 -------- d-----w- c:\program files\HP
2009-12-20 22:19 . 2009-12-20 22:19 -------- d-----w- c:\documents and settings\Richard\Application Data\Share-to-Web Upload Folder
2009-12-20 22:18 . 2009-12-20 22:18 -------- d-----w- c:\program files\Hewlett-Packard
2009-12-17 01:48 . 2009-12-17 01:47 -------- d-----w- c:\program files\SQLphone
2009-12-16 18:54 . 2009-12-11 19:42 -------- d-----w- c:\program files\Voicent
2009-12-14 19:23 . 2009-12-14 19:23 -------- d-----w- c:\documents and settings\Richard\Application Data\Speak-A-Message
2009-12-12 03:39 . 2009-12-12 03:39 -------- d-----w- c:\program files\Text2mp3
2009-12-12 03:38 . 2009-12-12 03:38 -------- d-----w- c:\program files\yRead3
2009-12-11 22:50 . 2009-12-11 22:50 348256 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VSTAHost\SSIS_ScriptComponent\9.0\1033\ResourceCache.dll
2009-12-11 22:50 . 2009-12-11 22:50 348256 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VSTAHost\SSIS_ScriptTask\9.0\1033\ResourceCache.dll
2009-12-11 22:39 . 2009-12-11 22:39 -------- d-----w- c:\program files\Microsoft Synchronization Services
2009-12-11 22:38 . 2009-12-11 22:38 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2009-12-11 22:38 . 2009-12-11 21:27 -------- d-----w- c:\program files\Microsoft SQL Server
2009-12-11 22:28 . 2009-12-11 21:58 570624 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VWDExpress\9.0\1033\ResourceCache.dll
2009-12-11 22:26 . 2009-12-11 22:26 -------- d-----w- c:\program files\Microsoft ASP.NET
2009-12-11 22:22 . 2009-12-11 21:59 -------- d-----w- c:\program files\Microsoft Silverlight
2009-12-11 22:12 . 2009-12-11 21:30 -------- d-----w- c:\program files\Microsoft.NET
2009-12-11 22:09 . 2009-12-11 22:09 -------- d-----w- c:\program files\IIS
2009-12-11 22:05 . 2009-12-11 21:51 -------- d-----w- c:\program files\Microsoft SDKs
2009-12-11 21:53 . 2009-12-11 21:52 -------- d-----w- c:\program files\Microsoft Web Designer Tools
2009-12-11 20:32 . 2009-12-11 20:32 -------- d-----w- c:\program files\Microsoft
2009-12-11 19:32 . 2009-12-11 19:32 -------- d-----w- c:\program files\TTSReader
2009-12-11 19:30 . 2009-12-11 19:30 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-12-11 19:27 . 2009-12-11 19:26 -------- d-----w- c:\program files\TextAloud
2009-12-11 19:21 . 2009-12-11 19:21 71152 ----a-r- c:\documents and settings\Richard\Application Data\Microsoft\Installer\{1F2DF2C6-08F7-40BD-8E85-D16CB436E7F0}\NewShortcut21_C207166A39DE4B35B3CE8F35C423973B.exe
2009-12-11 19:21 . 2009-12-11 19:21 71152 ----a-r- c:\documents and settings\Richard\Application Data\Microsoft\Installer\{1F2DF2C6-08F7-40BD-8E85-D16CB436E7F0}\NewShortcut2_8D2B9DEE2E7249CEB360F463F3370804.exe
2009-12-11 19:21 . 2009-12-11 19:21 71152 ----a-r- c:\documents and settings\Richard\Application Data\Microsoft\Installer\{1F2DF2C6-08F7-40BD-8E85-D16CB436E7F0}\NewShortcut11_9D70A61FD7214BC585565549793FFA8A.exe
2009-12-11 19:21 . 2009-12-11 19:21 71152 ----a-r- c:\documents and settings\Richard\Application Data\Microsoft\Installer\{1F2DF2C6-08F7-40BD-8E85-D16CB436E7F0}\NewShortcut1_9F88E99FAF234356849120C5725C6B5F.exe
2009-12-11 19:21 . 2009-12-11 19:21 58864 ----a-r- c:\documents and settings\Richard\Application Data\Microsoft\Installer\{1F2DF2C6-08F7-40BD-8E85-D16CB436E7F0}\ARPPRODUCTICON.exe
2009-12-11 19:21 . 2009-12-11 19:21 54768 ----a-r- c:\documents and settings\Richard\Application Data\Microsoft\Installer\{1F2DF2C6-08F7-40BD-8E85-D16CB436E7F0}\UNINST_Uninstall_F_CF49ABBD814F419BA60B0CCC15F0A1F0.exe
2009-12-11 19:21 . 2009-12-11 19:21 -------- d-----w- c:\program files\NaturalSoft
2009-12-11 19:20 . 2009-12-11 19:20 -------- d-----w- c:\documents and settings\Richard\Application Data\Spesoft Text To MP3
2009-12-11 19:20 . 2009-12-11 19:20 -------- d-----w- c:\program files\Spesoft Text To MP3 Speaker
2009-12-11 19:18 . 2009-12-11 19:18 -------- d-----w- c:\program files\SpeechZilla
2009-12-11 19:17 . 2009-12-11 19:17 -------- d-----w- c:\program files\PortalGroove SpeechPlayer Free Edition
2009-12-11 19:16 . 2009-12-11 19:16 -------- d-----w- c:\program files\Speak-A-Message
2009-12-11 19:14 . 2009-12-11 19:14 -------- d-----w- c:\documents and settings\Richard\Application Data\Inventivio
2009-12-11 19:12 . 2009-12-11 19:12 45056 ----a-r- c:\documents and settings\Richard\Application Data\Microsoft\Installer\{B342025C-B2F7-4ADC-8F8B-1FFC45DB67CD}\NewShortcut2_B342025CB2F74ADC8F8B1FFC45DB67CD_1.exe
2009-12-11 19:12 . 2009-12-11 19:12 40960 ----a-r- c:\documents and settings\Richard\Application Data\Microsoft\Installer\{B342025C-B2F7-4ADC-8F8B-1FFC45DB67CD}\NewShortcut6_B342025CB2F74ADC8F8B1FFC45DB67CD.exe
2009-12-11 19:12 . 2009-12-11 19:12 40960 ----a-r- c:\documents and settings\Richard\Application Data\Microsoft\Installer\{B342025C-B2F7-4ADC-8F8B-1FFC45DB67CD}\NewShortcut5_B342025CB2F74ADC8F8B1FFC45DB67CD_1.exe
2009-12-11 19:12 . 2009-12-11 19:12 40960 ----a-r- c:\documents and settings\Richard\Application Data\Microsoft\Installer\{B342025C-B2F7-4ADC-8F8B-1FFC45DB67CD}\NewShortcut1_B342025CB2F74ADC8F8B1FFC45DB67CD_1.exe
2009-12-11 19:12 . 2009-12-11 19:12 40960 ----a-r- c:\documents and settings\Richard\Application Data\Microsoft\Installer\{B342025C-B2F7-4ADC-8F8B-1FFC45DB67CD}\ARPPRODUCTICON.exe
2009-12-11 19:12 . 2009-12-11 19:12 -------- d-----w- c:\program files\SmartySoft
2009-12-11 19:07 . 2009-12-11 19:07 -------- d-----w- c:\program files\Common Files\Synthigence
2009-12-11 19:07 . 2009-12-11 19:07 -------- d-----w- c:\program files\Synthigence
2009-12-11 19:05 . 2009-12-11 19:05 -------- d-----w- c:\program files\Text-Reader programs
2009-12-11 18:59 . 2009-12-11 18:59 -------- d-----w- c:\program files\SayO'Clock
2009-12-11 18:58 . 2009-12-11 18:58 249856 ------w- c:\windows\Setup1.exe
2009-12-11 18:58 . 2009-12-11 18:58 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-12-11 18:50 . 2009-12-11 18:50 -------- d-----w- c:\program files\BIGSPEED Voice Chat SDK
2009-12-11 17:04 . 2009-12-11 17:04 -------- d-----w- c:\program files\Sun
2009-12-11 17:03 . 2009-12-11 17:03 -------- d-----w- c:\program files\eAssistant
2009-12-11 16:53 . 2009-12-11 16:41 -------- d-----w- c:\program files\Premier AT
2009-12-11 16:52 . 2009-12-11 16:52 -------- d-----w- c:\program files\Chant
2009-12-11 16:26 . 2009-12-11 16:26 -------- d-----w- c:\documents and settings\Richard\Application Data\vlc
2009-12-10 15:15 . 2009-12-10 14:58 -------- d-----w- c:\program files\Fread
2009-12-08 22:33 . 2009-12-08 21:55 -------- d-----w- c:\program files\Broderbund
2009-12-08 22:16 . 2009-12-08 22:16 -------- d-----w- c:\program files\Common Files\Nova Development
2009-12-08 22:15 . 2009-12-08 22:15 -------- d-----w- c:\program files\Common Files\Crystal Decisions
2009-12-08 22:12 . 2009-12-08 22:12 -------- d-----w- c:\program files\Nova Development
2009-12-08 21:57 . 2009-12-08 21:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Broderbund LLC
2009-12-08 21:55 . 2009-12-08 21:55 -------- d-----w- c:\program files\Common Files\Broderbund
2009-12-08 21:55 . 2009-12-08 21:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Broderbund Software
2009-12-08 21:52 . 2009-12-08 21:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Hemera
2009-12-08 21:52 . 2009-12-08 21:52 -------- d-----w- c:\program files\RiverDeep
2009-12-08 21:24 . 2009-12-08 21:24 -------- d-----w- c:\program files\Common Files\MGI Shared
2009-12-08 21:24 . 2009-12-08 21:24 -------- d-----w- c:\program files\MGI
2009-12-08 21:24 . 2009-12-08 21:24 -------- d-----w- c:\documents and settings\Richard\Application Data\MGI
2009-12-08 21:17 . 2009-12-08 21:17 -------- d-----w- c:\program files\Microsoft Encarta
2009-12-08 20:58 . 2009-12-08 20:57 -------- d-----w- c:\program files\Microsoft Streets & Trips
2009-12-08 20:55 . 2009-12-08 20:55 16384 ----a-r- c:\documents and settings\Richard\Application Data\Microsoft\Installer\{D085A1B6-90A4-11D3-82B7-00C04FA309DE}\MnyIco.exe
2009-12-08 20:55 . 2009-12-08 20:54 -------- d-----w- c:\program files\Microsoft Money
2009-12-08 20:51 . 2009-12-08 20:44 -------- d-----w- c:\program files\Microsoft Works
2009-12-08 20:49 . 2009-12-08 20:49 -------- d-----w- c:\documents and settings\Richard\Application Data\Microsoft Web Folders
2009-12-08 20:46 . 2009-12-08 20:46 -------- d-----w- c:\program files\FoneSync
2009-12-08 20:40 . 2009-12-08 20:40 -------- d-----w- c:\program files\Microsoft Works Suite 2001
2009-12-08 01:43 . 2009-12-07 05:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-12-08 00:37 . 2009-12-07 06:07 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-12-07 11:43 . 2009-12-07 11:43 -------- d-----w- c:\documents and settings\Richard\Application Data\OpenOffice.org
2009-12-07 06:10 . 2009-12-05 16:50 -------- d-----w- c:\program files\Common Files\Adobe
2009-12-07 06:08 . 2009-12-07 06:08 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-12-07 06:07 . 2009-12-07 06:07 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2006-05-06 16:42 . 2009-12-07 05:51 7260160 ----a-w- c:\program files\mozilla firefox\plugins\libvlc.dll
.

------- Sigcheck -------

[7] 2008-04-14 00:12 . C7E39EA41233E9F5B86C8DA3A9F1E4A8 . 52224 . . [9.0.1.56] . . c:\windows\$NtUninstallWMFDist11$\mspmsnsv.dll
[-] 2006-10-19 02:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer "= "c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"MoneyStartUp "= "c:\program files\Microsoft Money\System\Money Startup.exe" [2000-07-19 24625]
"MSMSGS "= "c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmcService "= "c:\progra~1\Sygate\SPF\smc.exe" [2004-10-16 2577632]
"avast! "= "c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"HP Software Update "= "c:\program files\HP\HP Software Update\HPWuSchd.exe" [2003-06-25 49152]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"WorksFUD "= "c:\program files\Microsoft Works\wkfud.exe" [2000-08-08 24576]
"Microsoft Works Update Detection "= "c:\program files\Microsoft Works\WkDetect.exe" [2000-08-08 28739]
"CamMonitor "= "c:\program files\HP\Digital Imaging\\Unload\hpqcmon.exe" [2002-10-07 90112]
"Share-to-Web Namespace Daemon "= "c:\program files\HP\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 69632]
"HPHUPD05 "= "c:\program files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-08-20 49152]
"HP Component Manager "= "c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2003-08-20 221184]
"HPHmon05 "= "c:\windows\system32\hphmon05.exe" [2003-08-20 483328]
"BCMSMMSG "= "BCMSMMSG.exe" [2003-08-29 122880]
"RTHDCPL "= "RTHDCPL.EXE" [2009-02-03 18085888]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe [2009-12-5 82026]
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-12-5 113664]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe "=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
"c:\\Program Files\\Speak-A-Message\\bin\\SpeakAMessage.exe "=
"c:\\Program Files\\Speak-A-Message\\updater.exe "=
"c:\\Program Files\\Messenger\\msmsgs.exe "=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [12/5/2009 8:36 AM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [12/5/2009 8:36 AM 20560]
R2 VoicentGateway;Voicent Gateway;c:\program files\Voicent\Gateway\bin\vgate.exe [3/29/2009 8:30 PM 491520]
S2 clr_optimization_v4.0.21006_32;Microsoft .NET Framework NGEN v4.0.21006_X86;c:\windows\Microsoft.NET\Framework\v4.0.21006\mscorsvw.exe [10/7/2009 2:44 AM 129856]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12/5/2009 8:36 AM 133104]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.21006\WPF\WPFFontCache_v0400.exe [10/7/2009 2:44 AM 752984]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\sqladhlp.exe [3/31/2009 3:44 AM 47128]
S4 RsFx0103;RsFx0103 Driver;c:\windows\system32\drivers\RsFx0103.sys [3/30/2009 3:09 AM 239336]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [3/30/2009 3:23 AM 366936]
.
Contents of the 'Scheduled Tasks' folder

2010-01-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-05 13:36]

2010-01-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-05 13:36]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.aol.com/?customizeShortName=&inline=true&skin=abstract&.
IE: Fread Speak - c:\program files\Fread\plugin\ie_menu.htm
Handler: ms-its51 - {F6F1E82D-DE4D-11D2-875C-0000F8105754} - c:\program files\Common Files\Microsoft Shared\Information Retrieval\itss51.dll
FF - ProfilePath - c:\documents and settings\Richard\Application Data\Mozilla\Firefox\Profiles\c8rxsv6l.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.aol.com/
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Web Platform Installer\NPWPIDetector.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npvlc.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - false.
- - - - ORPHANS REMOVED - - - -

BHO-{07276820-6961-4d38-a2b9-60e42fc88424} - (no file)
AddRemove-eBay Icon - c:\documents and settings\Richard\Application Data\Desktopicon\uninst.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-21 22:45
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\vsdatant]
"ImagePath "=" "
.
Completion time: 2010-01-21 22:48:54
ComboFix-quarantined-files.txt 2010-01-22 03:48

Pre-Run: 92,259,360,768 bytes free
Post-Run: 92,563,050,496 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

Current=2 Default=2 Failed=0 LastKnownGood=5 Sets=1,2,3,4,5
- - End Of File - - C083252A1E01BAAE2FCC5D54D5F25B77


HJT


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:54:39 PM, on 1/21/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\HPZipm12.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Voicent\Gateway\bin\vgate.exe
C:\Program Files\Voicent\Gateway\bin\vgate.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Voicent\Gateway\bin\spengine.exe
C:\Program Files\Voicent\Gateway\bin\vxengine.exe
C:\Program Files\Java\jre6\bin\javaw.exe
C:\Program Files\Java\jre6\bin\javaw.exe
C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {07276820-6961-4d38-a2b9-60e42fc88424} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe "
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\HP\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe "
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MoneyStartUp] C:\Program Files\Microsoft Money\System\Money Startup.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Fread Speak - C:\Program Files\Fread\plugin\ie_menu.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1260012255343
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Voicent Gateway (VoicentGateway) - Voicent Communications, Inc - C:\Program Files\Voicent\Gateway\bin\vgate.exe

--
End of file - 7048 bytes

 

quick question: exactly what does combofix do?

 

waiting on approval to post

Hey Broni,

Signed up at your site, waiting on administrative approval to post the last log file you requested.