Solved Checkup to make sure machine is clean!

trub · 2009/10/19

[Resolved] Checkup to make sure machine is clean!

Was hoping you would take a look to make sure this machine is clean.

DDS (Ver_09-10-13.01) - NTFSx86
Run by Steven at 23:04:19.43 on Mon 10/19/2009
Internet Explorer: 8.0.6001.18828 BrowserJavaVersion: 1.6.0_16
Microsoft® Windows Vistaâ„¢ Home Premium 6.0.6001.1.1252.1.1033.18.3069.1889 [GMT -5:00]

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Program Files\Microsoft Security Essentials\MsMpEng.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\agrsmsvc.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Acer\Mobility Center\MobilityService.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Acer\Acer VCM\RS_Service.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\notepad.exe
C:\Windows\Explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Steven\Downloads\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp32&d=1009&m=aspire_4730z
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp32&d=1009&m=aspire_4730z
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Canon Easy-WebPrint EX BHO: {3785d0ad-bfff-47f6-bf5b-a587c162fed9} - c:\program files\canon\easy-webprint ex\ewpexbho.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: ShowBarObj Class: {83a2f9b1-01a2-4aa5-87d1-45b6b8505e96} - c:\program files\acer\empowering technology\edatasecurity\x86\ActiveToolBand.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Acer eDataSecurity Management: {5cbe3b7c-1e47-477e-a7dd-396db0476e29} - c:\program files\acer\empowering technology\edatasecurity\x86\eDStoolbar.dll
TB: Canon Easy-WebPrint EX: {759d9886-0c6f-4498-bab6-4a5f47c6c72f} - c:\program files\canon\easy-webprint ex\ewpexhlp.dll
EB: Canon Easy-WebPrint EX: {21347690-ec41-4f9a-8887-1f4aee672439} - c:\program files\canon\easy-webprint ex\ewpexhlp.dll
uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup
mRun: [ePower_DMC] c:\program files\acer\empowering technology\epower\ePower_DMC.exe
mRun: [eDataSecurity Loader] c:\program files\acer\empowering technology\edatasecurity\x86\eDSloader.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [PLFSetI] c:\windows\PLFSetI.exe
mRun: [Acer Assist Launcher] c:\program files\acer\acer assist\launcher.exe
mRun: [Acer Product Registration] "c:\program files\acer\acer registration\ACE1.exe" /startup
mRun: [LManager] c:\progra~1\launch~1\LManager.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
mRun: [MSSE] "c:\program files\microsoft security essentials\msseces.exe" -hide
mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon
mRun: [CanonSolutionMenu] c:\program files\canon\solutionmenu\CNSLMAIN.exe /logon
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_803138DCE93649E4.dll/cmsidewiki.html
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
AppInit_DLLs: c:\progra~1\google\google~1\GoogleDesktopNetwork3.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\users\steven\appdata\roaming\mozilla\firefox\profiles\sao4jgiv.default\
FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/?_bc=1
FF - plugin: c:\program files\canon\easy-photoprint ex\NPEZFFPI.DLL
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-10-12 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-10-12 74480]
R2 ETService;Empowering Technology Service;c:\program files\acer\empowering technology\service\ETService.exe [2009-2-24 24576]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\newtech infosystems\nti backup now 5\SchedulerSvc.exe [2008-9-23 144632]
R2 RS_Service;Raw Socket Service;c:\program files\acer\acer vcm\RS_Service.exe [2009-10-17 233472]
R3 JMCR;JMCR;c:\windows\system32\drivers\jmcr.sys [2009-7-9 116064]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2009-6-18 42480]
R3 netr28;Ralink 802.11n Wireless Driver for Windows Vista;c:\windows\system32\drivers\netr28.sys [2009-8-3 569856]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-10-17 133104]
S3 GoogleDesktopManager-092308-165331;Google Desktop Manager 5.8.809.23506;c:\program files\google\google desktop search\GoogleDesktop.exe [2009-2-24 30192]
S3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\newtech infosystems\nti backup now 5\BackupSvc.exe [2008-9-23 50424]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-10-12 7408]

=============== Created Last 30 ================

2009-10-19 22:48 236,544 a------- c:\windows\PEV.exe
2009-10-19 22:48 161,792 a------- c:\windows\SWREG.exe
2009-10-19 22:48 98,816 a------- c:\windows\sed.exe
2009-10-19 22:48 <DIR> --d----- C:\ComboFix
2009-10-19 21:11 <DIR> --d----- c:\programdata\WinZip
2009-10-19 15:04 347,125,794 a------- c:\windows\MEMORY.DMP
2009-10-18 19:30 <DIR> --d-h--- c:\programdata\CanonIJEGV
2009-10-18 19:30 <DIR> --d-h--- c:\progra~2\CanonIJEGV
2009-10-18 19:30 <DIR> --d----- c:\programdata\CanonIJ
2009-10-18 19:30 <DIR> --d----- c:\progra~2\CanonIJ
2009-10-18 18:43 <DIR> --d-h--- c:\programdata\CanonIJSolutionMenu
2009-10-18 18:43 <DIR> --d-h--- c:\progra~2\CanonIJSolutionMenu
2009-10-18 18:35 <DIR> --d-h--- c:\programdata\CanonIJMyPrinter
2009-10-18 18:35 <DIR> --d-h--- c:\progra~2\CanonIJMyPrinter
2009-10-18 18:35 <DIR> --d----- c:\programdata\CanonIJPLM
2009-10-18 18:35 <DIR> --d----- c:\progra~2\CanonIJPLM
2009-10-18 18:30 <DIR> --d----- c:\program files\common files\CANON
2009-10-18 18:27 <DIR> --d-h--- c:\programdata\CanonBJ
2009-10-18 18:27 303,104 a------- c:\windows\system32\CNC250L.dll
2009-10-18 18:27 1,310,720 a------- c:\windows\system32\CNC250C.dll
2009-10-18 18:27 110,592 a------- c:\windows\system32\CNC250I.dll
2009-10-18 18:27 106,496 a------- c:\windows\system32\CNC250U.dll
2009-10-18 18:27 15,872 a------- c:\windows\system32\CNHMCA.dll
2009-10-18 18:27 12,288 a------- c:\windows\system32\CNC173AD.TBL
2009-10-18 18:26 272,384 a------- c:\windows\system32\CNMLM9W.DLL
2009-10-18 18:26 90,112 a------- c:\windows\system32\CNC250O.dll
2009-10-18 18:26 178,176 a------- c:\windows\system32\CNMIU9W.DLL
2009-10-18 18:24 <DIR> --d----- c:\program files\Canon
2009-10-18 14:10 0 a------- c:\users\steven\appdata\roaming\wklnhst.dat
2009-10-18 13:40 116,839 -------- c:\windows\hpqins00.dat.temp
2009-10-18 12:58 <DIR> --d----- c:\windows\pss
2009-10-18 01:58 116,839 a------- c:\windows\hpqins00.dat
2009-10-18 01:54 <DIR> --d----- c:\users\steven\appdata\roaming\HpUpdate
2009-10-18 01:54 <DIR> --d----- c:\windows\Hewlett-Packard
2009-10-18 01:37 <DIR> --d----- c:\program files\common files\HP
2009-10-18 01:13 <DIR> --d----- c:\program files\HP
2009-10-18 01:10 86,016 a------- c:\windows\unvise32.exe
2009-10-18 01:10 <DIR> --d----- c:\program files\QLP 2002 Deluxe
2009-10-18 01:02 8,224 a------- c:\windows\system32\GDIPFONTCACHEV1.DAT
2009-10-18 00:21 140,954 -------- c:\windows\hpoins14.dat.temp
2009-10-18 00:21 2,000 -------- c:\windows\hpomdl14.dat.temp
2009-10-18 00:18 <DIR> --d----- c:\program files\common files\Hewlett-Packard
2009-10-18 00:17 <DIR> --d----- c:\programdata\Hewlett-Packard
2009-10-18 00:14 117,760 a------- c:\windows\system32\hpzll5ha.dll
2009-10-18 00:04 <DIR> --d----- c:\windows\system32\Adobe
2009-10-17 23:55 <DIR> --d----- c:\program files\Trend Micro
2009-10-17 23:53 <DIR> --d----- c:\programdata\SUPERAntiSpyware.com
2009-10-17 23:53 <DIR> --d----- c:\progra~2\SUPERAntiSpyware.com
2009-10-17 23:53 <DIR> --d----- c:\users\steven\appdata\roaming\SUPERAntiSpyware.com
2009-10-17 23:53 <DIR> --d----- c:\program files\SUPERAntiSpyware
2009-10-17 23:52 <DIR> --d----- c:\program files\common files\Wise Installation Wizard
2009-10-17 23:51 <DIR> --d----- c:\users\steven\appdata\roaming\Malwarebytes
2009-10-17 23:51 <DIR> --d----- c:\programdata\HP
2009-10-17 23:51 38,224 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-17 23:51 19,160 a------- c:\windows\system32\drivers\mbam.sys
2009-10-17 23:51 <DIR> --d----- c:\programdata\Malwarebytes
2009-10-17 23:51 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-10-17 23:51 <DIR> --d----- c:\progra~2\Malwarebytes
2009-10-17 23:51 675,840 a------- c:\windows\system32\hpowiax3.dll
2009-10-17 23:51 569,344 a------- c:\windows\system32\hpotscl3.dll
2009-10-17 23:51 364,544 a------- c:\windows\system32\hppldcoi.dll
2009-10-17 23:51 303,104 a------- c:\windows\system32\hpovst10.dll
2009-10-17 23:51 267,864 a------- c:\windows\system32\hpzids01.dll
2009-10-17 23:51 309,760 a------- c:\windows\system32\difxapi.dll
2009-10-17 23:46 0 a------- c:\windows\ativpsrm.bin
2009-10-17 23:44 <DIR> --d----- c:\programdata\InstallShield
2009-10-17 23:44 626,688 a------- c:\windows\Image.dll
2009-10-17 23:44 550,912 a------- c:\windows\Acer Crystal Eye webcam.EXE
2009-10-17 23:44 222,382 a------- c:\windows\Acer Crystal Eye webcam.ico
2009-10-17 23:44 200,704 a------- c:\windows\PLFSetI.exe
2009-10-17 23:44 73,728 a------- c:\windows\system32\ISUSPM.cpl
2009-10-17 23:44 36 a------- c:\windows\PidList.ini
2009-10-17 23:44 <DIR> --d----- c:\program files\SuYin
2009-10-17 23:44 125 a------- c:\windows\xUninstall.bat
2009-10-17 23:44 110,080 a------- c:\windows\system32\JmCrIcon.dll
2009-10-17 23:44 <DIR> --d----- c:\windows\JMCR_DIR
2009-10-17 23:42 <DIR> --d----- c:\program files\ATI
2009-10-17 23:42 <DIR> --d----- c:\program files\ATI Technologies
2009-10-17 23:34 56 a---h--- c:\programdata\ezsidmv.dat
2009-10-17 23:34 56 a---h--- c:\progra~2\ezsidmv.dat
2009-10-17 23:30 <DIR> --d--r-- c:\program files\Skype
2009-10-17 23:30 <DIR> --d----- c:\programdata\Skype
2009-10-17 23:23 <DIR> --d----- c:\program files\PokerStars
2009-10-17 23:21 <DIR> --d----- c:\program files\SopCast
2009-10-17 22:44 2,048 a------- c:\windows\system32\tzres.dll
2009-10-17 22:34 195,440 -------- c:\windows\system32\MpSigStub.exe
2009-10-17 22:31 <DIR> --d----- c:\program files\Microsoft Security Essentials
2009-10-17 22:15 97,800 a------- c:\windows\system32\infocardapi.dll
2009-10-17 22:15 622,080 a------- c:\windows\system32\icardagt.exe
2009-10-17 22:15 105,016 a------- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-10-17 22:15 43,544 a------- c:\windows\system32\PresentationHostProxy.dll
2009-10-17 22:15 37,384 a------- c:\windows\system32\infocardcpl.cpl
2009-10-17 22:15 11,264 a------- c:\windows\system32\icardres.dll
2009-10-17 22:15 781,344 a------- c:\windows\system32\PresentationNative_v0300.dll
2009-10-17 22:15 326,160 a------- c:\windows\system32\PresentationHost.exe
2009-10-17 22:15 0 a---h--- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2009-10-17 22:11 96,760 a------- c:\windows\system32\dfshim.dll
2009-10-17 22:11 282,112 a------- c:\windows\system32\mscoree.dll
2009-10-17 22:11 41,984 a------- c:\windows\system32\netfxperf.dll
2009-10-17 22:11 158,720 a------- c:\windows\system32\mscorier.dll
2009-10-17 22:11 83,968 a------- c:\windows\system32\mscories.dll
2009-10-17 22:10 71,680 a------- c:\windows\system32\atl.dll
2009-10-17 22:10 213,504 a------- c:\windows\system32\msv1_0.dll
2009-10-17 22:10 28,672 a------- c:\windows\system32\Apphlpdm.dll
2009-10-17 22:10 4,240,384 a------- c:\windows\system32\GameUXLegacyGDFs.dll
2009-10-17 22:08 313,344 a------- c:\windows\system32\wmpdxm.dll
2009-10-17 22:08 8,147,456 a------- c:\windows\system32\wmploc.DLL
2009-10-17 22:08 7,680 a------- c:\windows\system32\spwmp.dll
2009-10-17 22:08 4,096 a------- c:\windows\system32\msdxm.ocx
2009-10-17 22:08 4,096 a------- c:\windows\system32\dxmasf.dll
2009-10-17 22:08 43,520 a------- c:\windows\system32\msdxm.tlb
2009-10-17 22:08 18,432 a------- c:\windows\system32\amcompat.tlb
2009-10-17 22:08 562,176 a------- c:\windows\system32\msdtcprx.dll
2009-10-17 22:08 38,912 a------- c:\windows\system32\xolehlp.dll
2009-10-17 22:05 636,928 a------- c:\windows\system32\localspl.dll
2009-10-17 22:05 784,896 a------- c:\windows\system32\rpcrt4.dll
2009-10-17 22:05 91,136 a------- c:\windows\system32\avifil32.dll
2009-10-17 22:05 61,440 a------- c:\windows\system32\msasn1.dll
2009-10-17 22:05 604,672 a------- c:\windows\system32\WMSPDMOD.DLL
2009-10-17 22:05 144,896 a------- c:\windows\system32\drivers\srv2.sys
2009-10-17 21:59 1,524,736 a------- c:\windows\system32\wucltux.dll
2009-10-17 21:59 83,456 a------- c:\windows\system32\wudriver.dll
2009-10-17 21:59 162,064 a------- c:\windows\system32\wuwebv.dll
2009-10-17 21:59 31,232 a------- c:\windows\system32\wuapp.exe
2009-10-17 21:34 <DIR> --d----- c:\users\steven\appdata\roaming\SoftDMA
2009-10-17 21:05 43,711,460 a------- c:\windows\system32\acer.exe
2009-10-17 21:05 83,554,304 a------- c:\windows\system32\acer.scr
2009-10-17 21:05 <DIR> --d----- c:\program files\Acer Incorporated
2009-10-17 21:05 <DIR> --d----- c:\windows\ACER
2009-10-17 21:03 44,544 a------- c:\windows\system32\msxml4a.dll
2009-10-17 21:00 <DIR> --d----- c:\program files\Acer Arcade Deluxe
2009-10-17 21:00 <DIR> --d----- c:\programdata\CyberLink
2009-10-17 21:00 <DIR> --d----- c:\programdata\Temp
2009-10-17 20:59 0 a------- c:\windows\system32\LogConfigTemp.xml
2009-10-17 20:58 92 a------- c:\windows\GridV.UNI
2009-10-17 20:58 <DIR> --d----- c:\program files\Acer Inc
2009-10-17 20:57 0 a---h--- c:\windows\system32\drivers\Msft_Kernel_SynTP_01000.Wdf
2009-10-17 20:57 <DIR> --d----- c:\program files\Synaptics
2009-10-17 20:56 <DIR> --d----- c:\programdata\ATI
2009-10-17 20:56 83 a------- c:\windows\LManager.UNI
2009-10-17 20:56 <DIR> --d----- c:\program files\Launch Manager
2009-10-17 20:56 <DIR> --d----- c:\users\steven\appdata\roaming\Acer
2009-10-17 20:56 <DIR> --d----- C:\$RECYCLE.BIN
2009-10-17 20:54 <DIR> --d----- c:\users\steven\appdata\roaming\Acer GameZone Console
2009-10-17 20:54 <DIR> --d----- c:\users\Steven

==================== Find3M ====================

2009-10-18 18:27 51,200 a------- c:\windows\inf\infpub.dat
2009-10-18 18:27 86,016 a------- c:\windows\inf\infstrng.dat
2009-10-18 18:27 86,016 a------- c:\windows\inf\infstor.dat
2009-10-17 22:29 411,368 a------- c:\windows\system32\deploytk.dll
2009-09-02 03:09 176,128 a------- c:\windows\system32\drivers\Rtlh86.sys
2009-08-31 08:55 293,376 a------- c:\windows\system32\psisdecd.dll
2009-08-31 08:55 428,544 a------- c:\windows\system32\EncDec.dll
2009-08-28 07:39 173,056 a------- c:\windows\apppatch\AcXtrnal.dll
2009-08-28 07:38 2,153,984 a------- c:\windows\apppatch\AcGenral.dll
2009-08-28 07:38 541,696 a------- c:\windows\apppatch\AcLayers.dll
2009-08-28 07:38 459,776 a------- c:\windows\apppatch\AcSpecfc.dll
2009-08-27 00:22 916,480 a------- c:\windows\system32\wininet.dll
2009-08-27 00:17 109,056 a------- c:\windows\system32\iesysprep.dll
2009-08-27 00:17 71,680 a------- c:\windows\system32\iesetup.dll
2009-08-26 22:42 133,632 a------- c:\windows\system32\ieUnatt.exe
2009-08-17 23:33 1,193,832 a------- c:\windows\system32\FM20.DLL
2009-08-14 11:29 104,960 a------- c:\windows\system32\netiohlp.dll
2009-08-14 11:29 17,920 a------- c:\windows\system32\netevent.dll
2009-08-14 09:16 17,920 a------- c:\windows\system32\ROUTE.EXE
2009-08-14 09:16 9,728 a------- c:\windows\system32\TCPSVCS.EXE
2009-08-14 09:16 11,264 a------- c:\windows\system32\MRINFO.EXE
2009-08-14 09:16 27,136 a------- c:\windows\system32\NETSTAT.EXE
2009-08-14 09:16 19,968 a------- c:\windows\system32\ARP.EXE
2009-08-14 09:16 10,240 a------- c:\windows\system32\finger.exe
2009-08-14 09:16 8,704 a------- c:\windows\system32\HOSTNAME.EXE
2009-08-05 09:22 3,597,896 a------- c:\windows\system32\ntkrnlpa.exe
2009-08-05 09:22 3,546,184 a------- c:\windows\system32\ntoskrnl.exe
2009-08-03 13:50 221,184 a------- c:\windows\system32\RaCoInst.dll
2009-08-03 13:50 13,931 a------- c:\windows\system32\RaCoInst.dat
2009-07-22 10:24 94,208 a------- c:\windows\system32\RTNUninst32.dll
2009-02-24 06:52 665,600 a------- c:\windows\inf\drvindex.dat
2008-01-20 21:43 174 a--sh--- c:\program files\desktop.ini
2006-11-02 07:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 07:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 07:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 07:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 04:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 04:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 04:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 04:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 23:04:37.46 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-10-13.01)

Microsoft® Windows Vistaâ„¢ Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 10/17/2009 11:45:01 PM
System Uptime: 10/19/2009 10:37:22 PM (1 hours ago)

Motherboard: Acer | | Aspire 4730Z
Processor: Pentium(R) Dual-Core CPU T4200 @ 2.00GHz | uPGA-478 | 2000/200mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 143 GiB total, 96.316 GiB free.
D: is FIXED (NTFS) - 143 GiB total, 133.439 GiB free.
E: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP114: 10/18/2009 12:07:15 AM - Installed Windows Media Player Firefox Plugin
RP115: 10/18/2009 12:14:18 AM - Device Driver Package Install: Hewlett-Packard Imaging devices
RP116: 10/18/2009 12:14:41 AM - Device Driver Package Install: Hewlett-Packard Printers
RP117: 10/18/2009 12:15:22 AM - Device Driver Package Install: Hewlett-Packard IEEE 1284.4 compatible printer
RP118: 10/18/2009 12:16:03 AM - Device Driver Package Install: Hewlett-Packard Universal Serial Bus controllers
RP120: 10/18/2009 12:44:45 AM - Installed Microsoft Office Home and Student 2007
RP121: 10/18/2009 1:12:26 AM - Windows Update
RP122: 10/18/2009 1:55:58 AM - Installed HP Product Assistant
RP123: 10/18/2009 1:56:33 AM - Installed 32 Bit HP CIO Components Installer
RP124: 10/18/2009 1:57:09 AM - Removed 32 Bit HP CIO Components Installer
RP125: 10/18/2009 2:20:09 AM - Removed HP Update.
RP126: 10/18/2009 2:20:53 AM - Removed HPSSupply
RP127: 10/18/2009 2:26:17 AM - Device Driver Package Install: Hewlett-Packard Imaging devices
RP128: 10/18/2009 2:26:50 AM - Device Driver Package Install: Hewlett-Packard Printers
RP129: 10/18/2009 2:27:13 AM - Device Driver Package Install: Hewlett-Packard IEEE 1284.4 compatible printer
RP130: 10/18/2009 2:52:07 AM - Removed HP Update
RP131: 10/18/2009 2:53:00 AM - Removed HPSSupply
RP132: 10/18/2009 2:57:51 AM - Removed HPSSupply
RP133: 10/18/2009 3:00:13 AM - Windows Update
RP134: 10/18/2009 3:07:55 AM - Device Driver Package Install: Hewlett-Packard Imaging devices
RP135: 10/18/2009 3:08:28 AM - Device Driver Package Install: Hewlett-Packard Printers
RP136: 10/18/2009 3:09:12 AM - Device Driver Package Install: Hewlett-Packard IEEE 1284.4 compatible printer
RP137: 10/18/2009 3:45:19 AM - Removed HPSSupply
RP138: 10/18/2009 3:50:24 AM - Removed HP Update
RP140: 10/18/2009 4:14:07 AM - Sample Restore Point
RP141: 10/18/2009 4:20:33 AM - Device Driver Package Install: Hewlett-Packard Imaging devices
RP142: 10/18/2009 4:20:54 AM - Device Driver Package Install: Hewlett-Packard Printers
RP143: 10/18/2009 4:21:29 AM - Device Driver Package Install: Hewlett-Packard IEEE 1284.4 compatible printer
RP144: 10/18/2009 4:42:00 AM - Removed HP Update
RP145: 10/18/2009 4:42:19 AM - Removed HP Update
RP146: 10/18/2009 4:43:02 AM - Removed HPSSupply
RP148: 10/18/2009 12:03:04 PM - Configured PowerCinema
RP149: 10/18/2009 12:09:24 PM - Windows Update
RP150: 10/18/2009 12:27:40 PM - Windows Update
RP151: 10/18/2009 12:34:01 PM - Windows Update
RP152: 10/18/2009 12:36:56 PM - Windows Update
RP153: 10/18/2009 1:17:58 PM - Device Driver Package Install: Hewlett-Packard Imaging devices
RP154: 10/18/2009 1:18:32 PM - Device Driver Package Install: Hewlett-Packard Printers
RP155: 10/18/2009 1:18:56 PM - Device Driver Package Install: Hewlett-Packard IEEE 1284.4 compatible printer
RP156: 10/18/2009 1:39:36 PM - Installed HP Product Assistant
RP157: 10/18/2009 1:51:35 PM - Removed HPSSupply
RP158: 10/18/2009 1:52:21 PM - Removed HP Update.
RP159: 10/18/2009 1:59:25 PM - Device Driver Package Install: Hewlett-Packard Imaging devices
RP160: 10/18/2009 1:59:45 PM - Device Driver Package Install: Hewlett-Packard Printers
RP161: 10/18/2009 2:00:25 PM - Device Driver Package Install: Hewlett-Packard IEEE 1284.4 compatible printer
RP162: 10/18/2009 2:16:19 PM - Windows Update
RP163: 10/18/2009 2:19:04 PM - Windows Update
RP164: 10/18/2009 2:23:49 PM - Windows Update
RP165: 10/18/2009 6:26:35 PM - Device Driver Package Install: Canon Printers
RP166: 10/18/2009 6:27:04 PM - Device Driver Package Install: Canon Imaging devices
RP167: 10/19/2009 3:00:15 AM - Windows Update
RP168: 10/19/2009 3:15:29 PM - Windows Update
RP169: 10/19/2009 9:11:00 PM - Installed WinZip 14.0
RP170: 10/19/2009 9:17:26 PM - Removed WinZip 14.0

==== Installed Programs ======================

32 Bit HP CIO Components Installer
Acer Assist
Acer Crystal Eye Webcam 2.0.7
Acer eDataSecurity Management
Acer Empowering Technology
Acer ePower Management
Acer eRecovery Management
Acer eSettings Management
Acer GridVista
Acer Mobility Center Plug-In
Acer Registration
Acer ScreenSaver
Acer VCM
Acrobat.com
Adobe AIR
Adobe Flash Player 10 Plugin
Adobe Flash Player ActiveX
Adobe Reader 9
Adobe Shockwave Player 11.5
Agere Systems HDA Modem
AIO_Scan
ATI Catalyst Install Manager
BufferChm
Canon Easy-WebPrint EX
Canon Inkjet Printer/Scanner/Fax Extended Survey Program
Canon MP Navigator EX 3.0
Canon MP250 series MP Drivers
Canon MP250 series User Registration
Canon Utilities Easy-PhotoPrint EX
Canon Utilities My Printer
Canon Utilities Solution Menu
Catalyst Control Center - Branding
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Graphics Previews Vista
Catalyst Control Center InstallProxy
Catalyst Control Center Localization Chinese Standard
Catalyst Control Center Localization Chinese Traditional
Catalyst Control Center Localization Czech
Catalyst Control Center Localization Danish
Catalyst Control Center Localization Dutch
Catalyst Control Center Localization Finnish
Catalyst Control Center Localization French
Catalyst Control Center Localization German
Catalyst Control Center Localization Greek
Catalyst Control Center Localization Hungarian
Catalyst Control Center Localization Italian
Catalyst Control Center Localization Japanese
Catalyst Control Center Localization Korean
Catalyst Control Center Localization Norwegian
Catalyst Control Center Localization Polish
Catalyst Control Center Localization Portuguese
Catalyst Control Center Localization Russian
Catalyst Control Center Localization Spanish
Catalyst Control Center Localization Swedish
Catalyst Control Center Localization Thai
Catalyst Control Center Localization Turkish
ccc-core-static
ccc-utility
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
Choice Guard
eSobi v2
Google Desktop
Google Earth
Google Update Helper
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Java(TM) 6 Update 16
JMicron JMB38X Flash Media Controller
Junk Mail filter update
Launch Manager
Malwarebytes' Anti-Malware
Microsoft .NET Framework 3.5 SP1
Microsoft Antimalware
Microsoft Application Error Reporting
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Security Essentials
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
Mozilla Firefox (3.5.3)
MSVCRT
MSXML 4.0 SP2 (KB954430)
NTI Backup Now 5
NTI Backup Now Standard
NTI Media Maker 8
PhotoNow!
PokerStars
Quicken Lawyer 2002 Personal Deluxe
Realtek 8169 8168 8101E 8102E Ethernet Driver
Realtek High Definition Audio Driver
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB969679)
Security Update for Microsoft Office Excel 2007 (KB969682)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB969604)
Skins
Skype web features
Skypeâ„¢ 4.1
SopCast 3.2.4
SUPERAntiSpyware Free Edition
Synaptics Pointing Device Driver
Toolbox
UnloadSupport
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Upload Tool
Windows Live Writer
Windows Media Player Firefox Plugin

==== Event Viewer Messages From Past Week ========

10/19/2009 8:27:55 PM, Error: Service Control Manager [7030] - The Local System Utility service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
10/19/2009 3:04:33 PM, Error: EventLog [6008] - The previous system shutdown at 3:03:00 PM on 10/19/2009 was unexpected.
10/19/2009 10:50:03 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the PEVSystemStart service to connect.
10/19/2009 10:50:02 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
10/18/2009 9:50:39 PM, Error: PlugPlayManager [12] - The device 'JMB38X SD/MMC Host Controller' (PCI\VEN_197B&DEV_2382&SUBSYS_01401025&REV_00\4&1f1c355f&0&00E4) disappeared from the system without first being prepared for removal.
10/18/2009 9:50:39 PM, Error: PlugPlayManager [12] - The device 'JMB38X SD Host Controller' (PCI\VEN_197B&DEV_2381&SUBSYS_01401025&REV_00\4&1f1c355f&0&02E4) disappeared from the system without first being prepared for removal.
10/18/2009 2:02:42 AM, Error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting.
10/18/2009 1:16:55 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Update for Windows Live Sign-In Assistant (KB 967912).
10/17/2009 9:39:46 PM, Error: ACPI [13] - : The embedded controller (EC) did not respond within the specified timeout period. This may indicate that there is an error in the EC hardware or firmware or that the BIOS is accessing the EC incorrectly. You should check with your computer manufacturer for an upgraded BIOS. In some situations, this error may cause the computer to function incorrectly.
10/17/2009 9:29:58 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect.
10/17/2009 9:29:58 PM, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
10/17/2009 9:29:58 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments " " in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
10/17/2009 11:41:32 PM, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\Windows\system32\RAIHV.dll Error Code: 126
10/17/2009 10:59:51 PM, Error: Microsoft-Windows-DistributedCOM [10000] - Unable to start a DCOM Server: {FFF2D28F-E4EE-44D9-8104-8E71556757F6}. The error: "740" Happened while starting this command: C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\agent.exe -Embedding
10/17/2009 10:59:51 PM, Error: Microsoft-Windows-DistributedCOM [10000] - Unable to start a DCOM Server: {4A3522F6-5694-5E3E-9729-7269E6A8F3D3}. The error: "740" Happened while starting this command: C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\agent.exe -Embedding
10/17/2009 10:48:09 PM, Error: Microsoft-Windows-Kernel-General [5] - {Registry Hive Recovered} Registry hive (file): '\??\c:\users\steven\AppData\Local\Microsoft\Windows\usrclass.dat' was corrupted and it has been recovered. Some data might have been lost.
10/17/2009 10:36:18 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Definition Update for Windows Defender - KB915597 (Definition 1.67.841.0).
10/17/2009 10:33:50 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 0.0.0.0 Update Source: Microsoft Update Server Update Stage: Install Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 0.0.0.0 Error code: 0x80240016 Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
10/17/2009 10:33:50 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 0.0.0.0 Update Source: Microsoft Update Server Update Stage: Install Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 0.0.0.0 Error code: 0x80240016 Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
10/17/2009 10:33:50 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 0.0.0.0 Update Source: Microsoft Update Server Update Stage: Download Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 0.0.0.0 Error code: 0x80240016 Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-zh-TW-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-zh-HK-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-zh-CN-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-uk-UA-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-tr-TR-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-th-TH-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-sv-SE-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-sr-Latn-CS-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-sl-SI-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-sk-SK-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-ru-RU-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-ro-RO-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-pt-PT-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-pt-BR-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-pl-PL-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-nl-NL-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-Neutral from package WUClient-SelfUpdate-Aux(Feature Pack) into Staged(Staged) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-nb-NO-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-lv-LV-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-lt-LT-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-ko-KR-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-ja-JP-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-it-IT-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-hu-HU-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-hr-HR-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-he-IL-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-fr-FR-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-fi-FI-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-et-EE-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-es-ES-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-en-US-LP from package WUClient-SelfUpdate-Aux-Package-en-US-MiniLP(Feature Pack) into Staged(Staged) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-en-US-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Staged(Staged) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-el-GR-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-de-DE-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-da-DK-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-cs-CZ-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-bg-BG-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update WUClient-SelfUpdate-Aux-ar-sa-LP-Toplevel from package WUClient-SelfUpdate-Aux(Feature Pack) into Absent(Absent) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update AuxResourcesLP from package WindowsUpdateClient-SelfUpdate-Aux-Package(Language Pack) into Staged(Staged) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update AuxComp from package WindowsUpdateClient-SelfUpdate-Aux-Package(Update) into Staged(Staged) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update Aux from package WindowsUpdateClient-SelfUpdate-Aux-AuxComp-Package_en-US(Language Pack) into Staged(Staged) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update Aux from package WindowsUpdateClient-SelfUpdate-Aux-AuxComp-Package(Update) into Staged(Staged) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4375] - Windows Servicing failed to complete the process of setting package WUClient-SelfUpdate-Aux (Feature Pack) into Install Requested(Install Requested) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4375] - Windows Servicing failed to complete the process of setting package WUClient-SelfUpdate-Aux-Package-en-US-MiniLP (Feature Pack) into Install Requested(Install Requested) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4375] - Windows Servicing failed to complete the process of setting package WindowsUpdateClient-SelfUpdate-Aux-Package (Update) into Install Requested(Install Requested) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4375] - Windows Servicing failed to complete the process of setting package WindowsUpdateClient-SelfUpdate-Aux-Package (Language Pack) into Install Requested(Install Requested) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4375] - Windows Servicing failed to complete the process of setting package WindowsUpdateClient-SelfUpdate-Aux-AuxComp-Package_en-US (Language Pack) into Install Requested(Install Requested) state
10/17/2009 10:00:21 PM, Error: Microsoft-Windows-Servicing [4375] - Windows Servicing failed to complete the process of setting package WindowsUpdateClient-SelfUpdate-Aux-AuxComp-Package (Update) into Install Requested(Install Requested) state

==== End Of File ===========================

trub · 2009/10/19

Got combofix to run here is the log. Although is shows windows defender as enabled I am certain it was turned off.

Thanks.

ComboFix 09-10-19.01 - Steven 10/19/2009 22:50.1.2 - NTFSx86
Microsoft® Windows Vistaâ„¢ Home Premium 6.0.6001.1.1252.1.1033.18.3069.2098 [GMT -5:00]
Running from: c:\users\Steven\Desktop\ComboFix.exe
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Steven\AppData\Roaming\.#
c:\windows\Installer\836d1.msi
c:\windows\Suyin.reg
c:\windows\system32\AutoRun.inf

.
((((((((((((((((((((((((( Files Created from 2009-09-20 to 2009-10-20 )))))))))))))))))))))))))))))))
.

2009-10-20 03:55 . 2009-10-20 03:55 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-10-20 02:11 . 2009-10-20 02:18 -------- d-----w- c:\programdata\WinZip
2009-10-20 01:34 . 2009-10-20 01:40 -------- d-----w- c:\program files\7-Zip
2009-10-19 00:30 . 2009-10-19 00:30 -------- d--h--w- c:\programdata\CanonIJEGV
2009-10-19 00:30 . 2009-10-19 00:30 -------- d-----w- c:\programdata\CanonIJ
2009-10-19 00:30 . 2009-10-19 00:30 -------- d-----w- c:\users\Steven\AppData\Roaming\Canon
2009-10-18 23:43 . 2009-10-18 23:43 -------- d--h--w- c:\programdata\CanonIJSolutionMenu
2009-10-18 23:35 . 2009-10-18 23:35 -------- d--h--w- c:\programdata\CanonIJMyPrinter
2009-10-18 23:35 . 2009-10-19 00:31 -------- d-----w- c:\programdata\CanonIJPLM
2009-10-18 23:30 . 2009-10-18 23:30 -------- d-----w- c:\program files\Common Files\CANON
2009-10-18 23:27 . 2009-10-18 23:27 -------- d--h--w- c:\programdata\CanonBJ
2009-10-18 23:27 . 2009-10-18 23:27 -------- d--h--w- c:\windows\system32\CanonIJ Uninstaller Information
2009-10-18 23:27 . 2009-03-11 16:34 303104 ----a-w- c:\windows\system32\CNC250L.dll
2009-10-18 23:27 . 2009-03-13 14:31 1310720 ----a-w- c:\windows\system32\CNC250C.dll
2009-10-18 23:27 . 2009-03-13 14:31 110592 ----a-w- c:\windows\system32\CNC250I.dll
2009-10-18 23:27 . 2009-03-13 14:27 106496 ----a-w- c:\windows\system32\CNC250U.dll
2009-10-18 23:27 . 2008-08-25 23:02 15872 ----a-w- c:\windows\system32\CNHMCA.dll
2009-10-18 23:26 . 2009-03-17 10:00 272384 ----a-w- c:\windows\system32\CNMLM9W.DLL
2009-10-18 23:26 . 2009-02-04 04:17 90112 ----a-w- c:\windows\system32\CNC250O.dll
2009-10-18 23:26 . 2009-03-13 00:40 178176 ----a-w- c:\windows\system32\CNMIU9W.DLL
2009-10-18 23:26 . 2009-10-18 23:26 -------- d--h--w- c:\program files\CanonBJ
2009-10-18 23:24 . 2009-10-18 23:35 -------- d-----w- c:\program files\Canon
2009-10-18 20:22 . 2009-10-18 20:22 -------- d-----w- c:\windows\Sun
2009-10-18 19:10 . 2009-10-18 19:10 -------- d-----w- c:\users\Steven\AppData\Roaming\Template
2009-10-18 17:31 . 2009-10-18 17:31 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2009-10-18 07:07 . 2009-10-18 07:07 -------- d-----w- c:\users\Steven\AppData\Local\HP
2009-10-18 06:58 . 2009-10-18 18:41 116839 ----a-w- c:\windows\hpqins00.dat
2009-10-18 06:54 . 2009-10-18 18:41 -------- d-----w- c:\users\Steven\AppData\Roaming\HpUpdate
2009-10-18 06:54 . 2009-10-18 06:54 -------- d-----w- c:\windows\Hewlett-Packard
2009-10-18 06:40 . 2009-10-18 06:40 -------- d-----w- c:\users\Steven\AppData\Roaming\HP
2009-10-18 06:37 . 2009-10-18 06:37 -------- d-----w- c:\program files\Common Files\HP
2009-10-18 06:13 . 2009-10-18 18:55 -------- d-----w- c:\program files\HP
2009-10-18 06:10 . 1999-12-17 14:13 86016 ----a-w- c:\windows\unvise32.exe
2009-10-18 06:10 . 2009-10-18 06:10 -------- d-----w- c:\program files\QLP 2002 Deluxe
2009-10-18 06:02 . 2009-10-18 17:57 8224 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2009-10-18 05:48 . 2009-10-18 05:48 -------- d-----w- c:\program files\Microsoft.NET
2009-10-18 05:45 . 2009-10-18 05:45 -------- d-----w- c:\users\Steven\AppData\Local\Microsoft Help
2009-10-18 05:44 . 2009-10-18 05:44 -------- d-----r- C:\MSOCache
2009-10-18 05:18 . 2009-10-18 05:18 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2009-10-18 05:17 . 2009-10-18 05:17 -------- d-----w- c:\programdata\Hewlett-Packard
2009-10-18 05:14 . 2007-03-28 19:01 117760 ----a-w- c:\windows\system32\hpzll5ha.dll
2009-10-18 05:04 . 2009-10-18 05:04 -------- d-----w- c:\windows\system32\Adobe
2009-10-18 04:55 . 2009-10-18 04:55 -------- d-----w- c:\program files\Trend Micro
2009-10-18 04:53 . 2009-10-18 04:53 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2009-10-18 04:53 . 2009-10-18 04:53 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-10-18 04:53 . 2009-10-18 04:53 -------- d-----w- c:\users\Steven\AppData\Roaming\SUPERAntiSpyware.com
2009-10-18 04:52 . 2009-10-18 04:52 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-10-18 04:51 . 2009-10-18 04:51 -------- d-----w- c:\users\Steven\AppData\Roaming\Malwarebytes
2009-10-18 04:51 . 2009-10-18 18:55 -------- d-----w- c:\programdata\HP
2009-10-18 04:51 . 2009-09-10 19:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-18 04:51 . 2009-10-18 04:51 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-18 04:51 . 2009-10-18 04:51 -------- d-----w- c:\programdata\Malwarebytes
2009-10-18 04:51 . 2009-09-10 19:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-18 04:51 . 2007-03-31 05:07 267864 ----a-w- c:\windows\system32\hpzids01.dll
2009-10-18 04:51 . 2007-03-18 06:11 675840 ----a-w- c:\windows\system32\hpowiax3.dll
2009-10-18 04:51 . 2007-03-18 06:11 303104 ----a-w- c:\windows\system32\hpovst10.dll
2009-10-18 04:51 . 2007-03-18 06:11 569344 ----a-w- c:\windows\system32\hpotscl3.dll
2009-10-18 04:51 . 2007-03-08 19:20 364544 ----a-w- c:\windows\system32\hppldcoi.dll
2009-10-18 04:51 . 2007-03-08 19:20 309760 ----a-w- c:\windows\system32\difxapi.dll
2009-10-18 04:46 . 2009-10-18 04:46 0 ----a-w- c:\windows\ativpsrm.bin
2009-10-18 04:44 . 2009-10-18 04:44 -------- d-----w- c:\programdata\InstallShield
2009-10-18 04:44 . 2009-10-18 04:44 -------- d-----w- c:\program files\SuYin
2009-10-18 04:44 . 2008-04-11 16:43 550912 ----a-w- c:\windows\Acer Crystal Eye webcam.EXE
2009-10-18 04:44 . 2007-10-23 17:56 200704 ----a-w- c:\windows\PLFSetI.exe
2009-10-18 04:44 . 2007-03-29 23:48 626688 ----a-w- c:\windows\Image.dll
2009-10-18 04:44 . 2009-10-18 04:44 125 ----a-w- c:\windows\xUninstall.bat
2009-10-18 04:44 . 2009-10-18 04:44 -------- d-----w- c:\windows\JMCR_DIR
2009-10-18 04:44 . 2008-05-15 02:53 110080 ----a-w- c:\windows\system32\JmCrIcon.dll
2009-10-18 04:42 . 2009-10-18 04:42 -------- d-----w- c:\program files\ATI
2009-10-18 04:42 . 2009-10-18 04:43 -------- d-----w- c:\program files\ATI Technologies
2009-10-18 04:34 . 2009-10-18 05:04 -------- d-----w- c:\users\Steven\AppData\Roaming\skypePM
2009-10-18 04:31 . 2009-10-18 08:02 -------- d-----w- c:\users\Steven\AppData\Roaming\Skype
2009-10-18 04:30 . 2009-10-18 04:30 -------- d-----w- c:\program files\Common Files\Skype
2009-10-18 04:30 . 2009-10-18 04:30 -------- d-----r- c:\program files\Skype
2009-10-18 04:30 . 2009-10-18 04:30 -------- d-----w- c:\programdata\Skype
2009-10-18 04:23 . 2009-10-18 04:23 -------- d-----w- c:\program files\PokerStars
2009-10-18 04:21 . 2009-10-18 04:22 -------- d-----w- c:\program files\SopCast
2009-10-18 04:02 . 2009-10-18 06:57 -------- d-----w- c:\users\Steven\AppData\Local\Adobe
2009-10-18 03:44 . 2009-06-22 10:22 2048 ----a-w- c:\windows\system32\tzres.dll
2009-10-18 03:34 . 2009-10-01 15:29 195440 ------w- c:\windows\system32\MpSigStub.exe
2009-10-18 03:31 . 2009-10-18 03:32 -------- d-----w- c:\program files\Microsoft Security Essentials
2009-10-18 03:15 . 2008-06-20 01:14 97800 ----a-w- c:\windows\system32\infocardapi.dll
2009-10-18 03:15 . 2008-06-20 01:14 43544 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2009-10-18 03:15 . 2008-06-20 01:14 105016 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-10-18 03:15 . 2008-06-20 01:14 11264 ----a-w- c:\windows\system32\icardres.dll
2009-10-18 03:15 . 2008-06-20 01:14 622080 ----a-w- c:\windows\system32\icardagt.exe
2009-10-18 03:15 . 2008-06-20 01:14 781344 ----a-w- c:\windows\system32\PresentationNative_v0300.dll
2009-10-18 03:15 . 2008-06-20 01:14 326160 ----a-w- c:\windows\system32\PresentationHost.exe
2009-10-18 03:15 . 2009-10-19 02:28 -------- d-----w- c:\users\Steven\AppData\Roaming\U3
2009-10-18 03:11 . 2008-07-27 18:03 96760 ----a-w- c:\windows\system32\dfshim.dll
2009-10-18 03:11 . 2008-07-27 18:03 282112 ----a-w- c:\windows\system32\mscoree.dll
2009-10-18 03:11 . 2008-07-27 18:03 41984 ----a-w- c:\windows\system32\netfxperf.dll
2009-10-18 03:11 . 2008-07-27 18:03 158720 ----a-w- c:\windows\system32\mscorier.dll
2009-10-18 03:11 . 2008-07-27 18:03 83968 ----a-w- c:\windows\system32\mscories.dll
2009-10-18 03:10 . 2009-07-17 14:35 71680 ----a-w- c:\windows\system32\atl.dll
2009-10-18 03:10 . 2009-09-10 17:30 213504 ----a-w- c:\windows\system32\msv1_0.dll
2009-10-18 03:10 . 2009-08-28 12:39 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-10-18 03:10 . 2009-08-28 10:15 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-10-18 03:08 . 2009-07-14 13:00 313344 ----a-w- c:\windows\system32\wmpdxm.dll
2009-10-18 03:08 . 2009-07-14 12:59 4096 ----a-w- c:\windows\system32\dxmasf.dll
2009-10-18 03:08 . 2009-07-14 12:58 7680 ----a-w- c:\windows\system32\spwmp.dll
2009-10-18 03:08 . 2009-07-14 10:59 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-10-18 03:08 . 2008-06-06 03:27 38912 ----a-w- c:\windows\system32\xolehlp.dll
2009-10-18 03:08 . 2008-06-06 03:27 562176 ----a-w- c:\windows\system32\msdtcprx.dll
2009-10-18 03:05 . 2009-04-23 12:42 636928 ----a-w- c:\windows\system32\localspl.dll
2009-10-18 03:05 . 2009-04-23 12:43 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2009-10-18 03:05 . 2009-06-10 12:07 91136 ----a-w- c:\windows\system32\avifil32.dll
2009-10-18 03:05 . 2009-09-04 12:24 61440 ----a-w- c:\windows\system32\msasn1.dll
2009-10-18 03:05 . 2009-04-02 12:37 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2009-10-18 03:05 . 2009-09-14 09:44 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2009-10-18 02:59 . 2008-10-16 21:13 1809944 ----a-w- c:\windows\system32\wuaueng.dll
2009-10-18 02:59 . 2008-10-16 21:09 51224 ----a-w- c:\windows\system32\wuauclt.exe
2009-10-18 02:59 . 2008-10-16 21:09 43544 ----a-w- c:\windows\system32\wups2.dll
2009-10-18 02:59 . 2008-10-16 20:56 1524736 ----a-w- c:\windows\system32\wucltux.dll
2009-10-18 02:59 . 2008-10-16 21:12 561688 ----a-w- c:\windows\system32\wuapi.dll
2009-10-18 02:59 . 2008-10-16 21:08 34328 ----a-w- c:\windows\system32\wups.dll
2009-10-18 02:59 . 2008-10-16 20:55 83456 ----a-w- c:\windows\system32\wudriver.dll
2009-10-18 02:59 . 2008-10-16 19:08 162064 ----a-w- c:\windows\system32\wuwebv.dll
2009-10-18 02:59 . 2008-10-16 18:56 31232 ----a-w- c:\windows\system32\wuapp.exe
2009-10-18 02:34 . 2009-10-18 02:34 -------- d-----w- c:\users\Steven\AppData\Local\CyberLink
2009-10-18 02:34 . 2009-10-18 02:34 -------- d-----w- c:\users\Steven\AppData\Roaming\SoftDMA
2009-10-18 02:34 . 2009-10-18 02:35 -------- d-----w- c:\users\Steven\AppData\Roaming\CyberLink
2009-10-18 02:05 . 2008-05-07 11:16 43711460 ----a-w- c:\windows\system32\acer.exe
2009-10-18 02:05 . 2007-04-19 18:41 83554304 ----a-w- c:\windows\system32\acer.scr
2009-10-18 02:05 . 2009-10-18 02:05 -------- d-----w- c:\program files\Acer Incorporated

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-20 01:41 . 2009-02-24 13:19 -------- d-----w- c:\program files\Google
2009-10-18 19:21 . 2009-02-24 13:08 -------- d-----w- c:\programdata\Microsoft Help
2009-10-18 19:10 . 2009-10-18 19:10 0 ----a-w- c:\users\Steven\AppData\Roaming\wklnhst.dat
2009-10-18 17:57 . 2009-10-18 01:55 70176 ----a-w- c:\users\Steven\AppData\Local\GDIPFONTCACHEV1.DAT
2009-10-18 17:30 . 2009-02-24 13:10 -------- d-----w- c:\program files\Microsoft Works
2009-10-18 17:05 . 2009-02-24 13:01 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-10-18 04:44 . 2009-02-24 13:01 -------- d-----w- c:\program files\Common Files\InstallShield
2009-10-18 04:34 . 2009-10-18 04:34 56 ---ha-w- c:\programdata\ezsidmv.dat
2009-10-18 03:48 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-10-18 03:29 . 2009-10-18 03:29 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-08-18 04:33 . 2009-08-18 04:33 1193832 ----a-w- c:\windows\system32\FM20.DLL
2009-08-14 17:07 . 2009-10-18 03:09 897608 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-08-14 16:29 . 2009-10-18 03:09 104960 ----a-w- c:\windows\system32\netiohlp.dll
2009-08-14 16:29 . 2009-10-18 03:09 17920 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 14:16 . 2009-10-18 03:09 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 14:16 . 2009-10-18 03:09 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 14:16 . 2009-10-18 03:09 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 14:16 . 2009-10-18 03:09 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 14:16 . 2009-10-18 03:09 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 14:16 . 2009-10-18 03:09 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 14:16 . 2009-10-18 03:09 10240 ----a-w- c:\windows\system32\finger.exe
2009-08-05 14:22 . 2009-10-18 03:09 3546184 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-08-05 14:22 . 2009-10-18 03:09 3597896 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-08-03 18:54 . 2009-08-03 18:54 569856 ----a-w- c:\windows\system32\drivers\netr28.sys
2009-08-03 18:50 . 2009-08-03 18:50 13931 ----a-w- c:\windows\system32\RaCoInst.dat
2009-08-03 18:50 . 2009-02-24 11:14 221184 ----a-w- c:\windows\system32\RaCoInst.dll
2009-07-22 15:24 . 2009-07-22 15:24 94208 ----a-w- c:\windows\system32\RTNUninst32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@= "{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} "
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-07-30 01:52 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM "= "c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-05-16 213936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender "= "c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"Google Desktop Search "= "c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-02-24 30192]
"ePower_DMC "= "c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-11-28 417792]
"eDataSecurity Loader "= "c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-07-30 526896]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"StartCCC "= "c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"PLFSetI "= "c:\windows\PLFSetI.exe" [2007-10-23 200704]
"Acer Assist Launcher "= "c:\program files\Acer\Acer Assist\launcher.exe" [2007-11-19 1261568]
"Acer Product Registration "= "c:\program files\Acer\Acer Registration\ACE1.exe" [2007-11-26 3387392]
"LManager "= "c:\progra~1\LAUNCH~1\LManager.exe" [2008-07-02 850440]
"SynTPEnh "= "c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-02-22 1037608]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-10-18 149280]
"MSSE "= "c:\program files\Microsoft Security Essentials\msseces.exe" [2009-09-13 1048392]
"CanonMyPrinter "= "c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-03-23 1983816]
"CanonSolutionMenu "= "c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-17 767312]
"RtHDVCpl "= "RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-06-20 6244896]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle "= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 20:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs "=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux "=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@= "Service "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@= "Service "

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Acer VCM.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Acer VCM.lnk
backup=c:\windows\pss\Acer VCM.lnk.CommonStartup
backupExtension=.CommonStartup

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [10/12/2009 9:24 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [10/12/2009 9:24 PM 74480]
R2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [2/24/2009 8:18 AM 24576]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [9/23/2008 5:11 PM 144632]
R2 RS_Service;Raw Socket Service;c:\program files\Acer\Acer VCM\RS_Service.exe [10/17/2009 9:04 PM 233472]
R3 JMCR;JMCR;c:\windows\System32\drivers\jmcr.sys [7/9/2009 12:45 PM 116064]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\System32\drivers\MpNWMon.sys [6/18/2009 6:48 PM 42480]
R3 netr28;Ralink 802.11n Wireless Driver for Windows Vista;c:\windows\System32\drivers\netr28.sys [8/3/2009 1:54 PM 569856]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [10/17/2009 11:15 PM 133104]
S3 GoogleDesktopManager-092308-165331;Google Desktop Manager 5.8.809.23506;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2/24/2009 8:20 AM 30192]
S3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [9/23/2008 5:11 PM 50424]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [10/12/2009 9:24 PM 7408]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2009-10-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-18 04:15]

2009-10-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-18 04:15]

2009-10-20 c:\windows\Tasks\User_Feed_Synchronization-{23D322CC-22B4-4681-A36A-6F2FDE0DA6C2}.job
- c:\windows\system32\msfeedssync.exe [2009-10-18 03:41]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp32&d=1009&m=aspire_4730z
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp32&d=1009&m=aspire_4730z
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_803138DCE93649E4.dll/cmsidewiki.html
FF - ProfilePath - c:\users\Steven\AppData\Roaming\Mozilla\Firefox\Profiles\sao4jgiv.default\
FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/?_bc=1
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-eRecoveryService - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-19 22:55
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
"MSCurrentCountry "=dword:000000b5
.
Completion time: 2009-10-20 22:57
ComboFix-quarantined-files.txt 2009-10-20 03:56

Pre-Run: 102,271,307,776 bytes free
Post-Run: 103,374,483,456 bytes free

- - End Of File - - 6A34C5B9F270B21797C66ECC0239A851

trub · 2009/10/19

Malwarebytes' Anti-Malware 1.41
Database version: 2993
Windows 6.0.6001 Service Pack 1

10/20/2009 12:19:36 AM
mbam-log-2009-10-20 (00-19-36).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 201203
Time elapsed: 1 hour(s), 13 minute(s), 6 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

broni · 2009/10/20

1. Please open Notepad

Click Start , then Run

Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:
Code:
File::
c:\programdata\ezsidmv.dat


Folder::

Driver::

Registry::

RegLockDel::
3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

A new HijackThis log.

trub · 2009/10/20

ComboFix 09-10-19.01 - Steven 10/20/2009 1:48.3.2 - NTFSx86
Microsoft® Windows Vistaâ„¢ Home Premium 6.0.6002.2.1252.1.1033.18.3069.2155 [GMT -5:00]
Running from: c:\users\Steven\Desktop\ComboFix.exe
Command switches used :: c:\users\Steven\Desktop\CFScript.txt
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::
"c:\programdata\ezsidmv.dat "
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programdata\ezsidmv.dat

.
((((((((((((((((((((((((( Files Created from 2009-09-20 to 2009-10-20 )))))))))))))))))))))))))))))))
.

2009-10-20 06:52 . 2009-10-20 06:52 -------- d-----w- c:\users\Public\AppData\Local\temp
2009-10-20 06:52 . 2009-10-20 06:52 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-10-20 05:48 . 2009-10-20 05:48 -------- d-----w- c:\windows\system32\ca-ES
2009-10-20 05:48 . 2009-10-20 05:48 -------- d-----w- c:\windows\system32\eu-ES
2009-10-20 05:48 . 2009-10-20 05:48 -------- d-----w- c:\windows\system32\vi-VN
2009-10-20 05:44 . 2009-10-20 05:44 -------- d-----w- c:\windows\system32\SPReview
2009-10-20 05:33 . 2009-04-11 04:28 98816 ----a-w- c:\windows\system32\powrprof.dll
2009-10-20 05:32 . 2009-04-11 04:28 547840 ----a-w- c:\windows\system32\wiaaut.dll
2009-10-20 05:29 . 2009-10-20 05:29 -------- d-----w- c:\windows\system32\EventProviders
2009-10-20 02:11 . 2009-10-20 02:18 -------- d-----w- c:\programdata\WinZip
2009-10-20 01:34 . 2009-10-20 01:40 -------- d-----w- c:\program files\7-Zip
2009-10-19 00:30 . 2009-10-19 00:30 -------- d--h--w- c:\programdata\CanonIJEGV
2009-10-19 00:30 . 2009-10-19 00:30 -------- d-----w- c:\programdata\CanonIJ
2009-10-19 00:30 . 2009-10-19 00:30 -------- d-----w- c:\users\Steven\AppData\Roaming\Canon
2009-10-18 23:43 . 2009-10-18 23:43 -------- d--h--w- c:\programdata\CanonIJSolutionMenu
2009-10-18 23:35 . 2009-10-18 23:35 -------- d--h--w- c:\programdata\CanonIJMyPrinter
2009-10-18 23:35 . 2009-10-19 00:31 -------- d-----w- c:\programdata\CanonIJPLM
2009-10-18 23:30 . 2009-10-18 23:30 -------- d-----w- c:\program files\Common Files\CANON
2009-10-18 23:27 . 2009-10-18 23:27 -------- d--h--w- c:\programdata\CanonBJ
2009-10-18 23:27 . 2009-10-18 23:27 -------- d--h--w- c:\windows\system32\CanonIJ Uninstaller Information
2009-10-18 23:27 . 2009-03-11 16:34 303104 ----a-w- c:\windows\system32\CNC250L.dll
2009-10-18 23:27 . 2009-03-13 14:31 1310720 ----a-w- c:\windows\system32\CNC250C.dll
2009-10-18 23:27 . 2009-03-13 14:31 110592 ----a-w- c:\windows\system32\CNC250I.dll
2009-10-18 23:27 . 2009-03-13 14:27 106496 ----a-w- c:\windows\system32\CNC250U.dll
2009-10-18 23:27 . 2008-08-25 23:02 15872 ----a-w- c:\windows\system32\CNHMCA.dll
2009-10-18 23:26 . 2009-03-17 10:00 272384 ----a-w- c:\windows\system32\CNMLM9W.DLL
2009-10-18 23:26 . 2009-02-04 04:17 90112 ----a-w- c:\windows\system32\CNC250O.dll
2009-10-18 23:26 . 2009-03-13 00:40 178176 ----a-w- c:\windows\system32\CNMIU9W.DLL
2009-10-18 23:26 . 2009-10-18 23:26 -------- d--h--w- c:\program files\CanonBJ
2009-10-18 23:24 . 2009-10-18 23:35 -------- d-----w- c:\program files\Canon
2009-10-18 20:22 . 2009-10-18 20:22 -------- d-----w- c:\windows\Sun
2009-10-18 19:10 . 2009-10-18 19:10 -------- d-----w- c:\users\Steven\AppData\Roaming\Template
2009-10-18 17:31 . 2009-10-18 17:31 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2009-10-18 07:07 . 2009-10-18 07:07 -------- d-----w- c:\users\Steven\AppData\Local\HP
2009-10-18 06:58 . 2009-10-18 18:41 116839 ----a-w- c:\windows\hpqins00.dat
2009-10-18 06:54 . 2009-10-18 18:41 -------- d-----w- c:\users\Steven\AppData\Roaming\HpUpdate
2009-10-18 06:54 . 2009-10-18 06:54 -------- d-----w- c:\windows\Hewlett-Packard
2009-10-18 06:40 . 2009-10-18 06:40 -------- d-----w- c:\users\Steven\AppData\Roaming\HP
2009-10-18 06:37 . 2009-10-18 06:37 -------- d-----w- c:\program files\Common Files\HP
2009-10-18 06:13 . 2009-10-18 18:55 -------- d-----w- c:\program files\HP
2009-10-18 06:10 . 1999-12-17 14:13 86016 ----a-w- c:\windows\unvise32.exe
2009-10-18 06:10 . 2009-10-18 06:10 -------- d-----w- c:\program files\QLP 2002 Deluxe
2009-10-18 06:02 . 2009-10-18 17:57 8224 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2009-10-18 05:48 . 2009-10-18 05:48 -------- d-----w- c:\program files\Microsoft.NET
2009-10-18 05:45 . 2009-10-18 05:45 -------- d-----w- c:\users\Steven\AppData\Local\Microsoft Help
2009-10-18 05:44 . 2009-10-18 05:44 -------- d-----r- C:\MSOCache
2009-10-18 05:18 . 2009-10-18 05:18 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2009-10-18 05:17 . 2009-10-18 05:17 -------- d-----w- c:\programdata\Hewlett-Packard
2009-10-18 05:14 . 2007-03-28 19:01 117760 ----a-w- c:\windows\system32\hpzll5ha.dll
2009-10-18 05:04 . 2009-10-18 05:04 -------- d-----w- c:\windows\system32\Adobe
2009-10-18 04:55 . 2009-10-18 04:55 -------- d-----w- c:\program files\Trend Micro
2009-10-18 04:53 . 2009-10-18 04:53 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2009-10-18 04:53 . 2009-10-18 04:53 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-10-18 04:53 . 2009-10-18 04:53 -------- d-----w- c:\users\Steven\AppData\Roaming\SUPERAntiSpyware.com
2009-10-18 04:52 . 2009-10-18 04:52 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-10-18 04:51 . 2009-10-18 04:51 -------- d-----w- c:\users\Steven\AppData\Roaming\Malwarebytes
2009-10-18 04:51 . 2009-10-18 18:55 -------- d-----w- c:\programdata\HP
2009-10-18 04:51 . 2009-09-10 19:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-18 04:51 . 2009-10-18 04:51 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-18 04:51 . 2009-10-18 04:51 -------- d-----w- c:\programdata\Malwarebytes
2009-10-18 04:51 . 2009-09-10 19:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-18 04:51 . 2007-03-31 05:07 267864 ----a-w- c:\windows\system32\hpzids01.dll
2009-10-18 04:51 . 2007-03-18 06:11 675840 ----a-w- c:\windows\system32\hpowiax3.dll
2009-10-18 04:51 . 2007-03-18 06:11 303104 ----a-w- c:\windows\system32\hpovst10.dll
2009-10-18 04:51 . 2007-03-18 06:11 569344 ----a-w- c:\windows\system32\hpotscl3.dll
2009-10-18 04:51 . 2007-03-08 19:20 364544 ----a-w- c:\windows\system32\hppldcoi.dll
2009-10-18 04:51 . 2007-03-08 19:20 309760 ----a-w- c:\windows\system32\difxapi.dll
2009-10-18 04:46 . 2009-10-18 04:46 0 ----a-w- c:\windows\ativpsrm.bin
2009-10-18 04:44 . 2009-10-18 04:44 -------- d-----w- c:\programdata\InstallShield
2009-10-18 04:44 . 2009-10-18 04:44 -------- d-----w- c:\program files\SuYin
2009-10-18 04:44 . 2008-04-11 16:43 550912 ----a-w- c:\windows\Acer Crystal Eye webcam.EXE
2009-10-18 04:44 . 2007-10-23 17:56 200704 ----a-w- c:\windows\PLFSetI.exe
2009-10-18 04:44 . 2007-03-29 23:48 626688 ----a-w- c:\windows\Image.dll
2009-10-18 04:44 . 2009-10-18 04:44 125 ----a-w- c:\windows\xUninstall.bat
2009-10-18 04:44 . 2009-10-18 04:44 -------- d-----w- c:\windows\JMCR_DIR
2009-10-18 04:44 . 2008-05-15 02:53 110080 ----a-w- c:\windows\system32\JmCrIcon.dll
2009-10-18 04:42 . 2009-10-18 04:42 -------- d-----w- c:\program files\ATI
2009-10-18 04:42 . 2009-10-18 04:43 -------- d-----w- c:\program files\ATI Technologies
2009-10-18 04:34 . 2009-10-18 05:04 -------- d-----w- c:\users\Steven\AppData\Roaming\skypePM
2009-10-18 04:31 . 2009-10-18 08:02 -------- d-----w- c:\users\Steven\AppData\Roaming\Skype
2009-10-18 04:30 . 2009-10-18 04:30 -------- d-----w- c:\program files\Common Files\Skype
2009-10-18 04:30 . 2009-10-18 04:30 -------- d-----r- c:\program files\Skype
2009-10-18 04:30 . 2009-10-18 04:30 -------- d-----w- c:\programdata\Skype
2009-10-18 04:23 . 2009-10-18 04:23 -------- d-----w- c:\program files\PokerStars
2009-10-18 04:21 . 2009-10-18 04:22 -------- d-----w- c:\program files\SopCast
2009-10-18 04:02 . 2009-10-18 06:57 -------- d-----w- c:\users\Steven\AppData\Local\Adobe
2009-10-18 03:44 . 2009-06-22 10:09 2048 ----a-w- c:\windows\system32\tzres.dll
2009-10-18 03:34 . 2009-10-01 15:29 195440 ------w- c:\windows\system32\MpSigStub.exe
2009-10-18 03:31 . 2009-10-18 03:32 -------- d-----w- c:\program files\Microsoft Security Essentials
2009-10-18 03:15 . 2009-10-19 02:28 -------- d-----w- c:\users\Steven\AppData\Roaming\U3
2009-10-18 03:11 . 2008-07-27 18:03 41984 ----a-w- c:\windows\system32\netfxperf.dll
2009-10-18 03:10 . 2009-07-17 13:54 71680 ----a-w- c:\windows\system32\atl.dll
2009-10-18 03:10 . 2009-09-10 16:48 218624 ----a-w- c:\windows\system32\msv1_0.dll
2009-10-18 03:10 . 2009-04-11 06:28 1696768 ----a-w- c:\windows\system32\gameux.dll
2009-10-18 03:10 . 2009-08-29 00:14 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-10-18 03:10 . 2009-08-29 00:27 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-10-18 03:08 . 2009-07-15 12:39 313344 ----a-w- c:\windows\system32\wmpdxm.dll
2009-10-18 03:08 . 2009-07-15 12:40 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-10-18 03:08 . 2009-07-15 12:39 4096 ----a-w- c:\windows\system32\dxmasf.dll
2009-10-18 03:08 . 2009-07-15 12:39 7680 ----a-w- c:\windows\system32\spwmp.dll
2009-10-18 03:07 . 2009-10-18 03:07 0 ----a-w- c:\windows\nsreg.dat
2009-10-18 03:07 . 2009-10-18 03:07 -------- d-----w- c:\users\Steven\AppData\Local\Mozilla
2009-10-18 03:05 . 2009-04-23 12:14 623616 ----a-w- c:\windows\system32\localspl.dll
2009-10-18 03:05 . 2009-04-23 12:15 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2009-10-18 03:05 . 2009-06-10 11:38 91136 ----a-w- c:\windows\system32\avifil32.dll
2009-10-18 03:05 . 2009-09-04 11:41 60928 ----a-w- c:\windows\system32\msasn1.dll
2009-10-18 03:05 . 2009-05-08 12:53 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2009-10-18 03:05 . 2009-09-14 09:29 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2009-10-18 02:59 . 2008-10-16 21:13 1809944 ----a-w- c:\windows\system32\wuaueng.dll
2009-10-18 02:59 . 2008-10-16 21:09 51224 ----a-w- c:\windows\system32\wuauclt.exe
2009-10-18 02:59 . 2008-10-16 21:09 43544 ----a-w- c:\windows\system32\wups2.dll
2009-10-18 02:59 . 2008-10-16 20:56 1524736 ----a-w- c:\windows\system32\wucltux.dll
2009-10-18 02:59 . 2008-10-16 21:12 561688 ----a-w- c:\windows\system32\wuapi.dll
2009-10-18 02:59 . 2008-10-16 21:08 34328 ----a-w- c:\windows\system32\wups.dll
2009-10-18 02:59 . 2008-10-16 20:55 83456 ----a-w- c:\windows\system32\wudriver.dll
2009-10-18 02:59 . 2008-10-16 19:08 162064 ----a-w- c:\windows\system32\wuwebv.dll
2009-10-18 02:59 . 2008-10-16 18:56 31232 ----a-w- c:\windows\system32\wuapp.exe
2009-10-18 02:34 . 2009-10-18 02:34 -------- d-----w- c:\users\Steven\AppData\Local\CyberLink
2009-10-18 02:34 . 2009-10-18 02:34 -------- d-----w- c:\users\Steven\AppData\Roaming\SoftDMA
2009-10-18 02:34 . 2009-10-18 02:35 -------- d-----w- c:\users\Steven\AppData\Roaming\CyberLink
2009-10-18 02:05 . 2008-05-07 11:16 43711460 ----a-w- c:\windows\system32\acer.exe
2009-10-18 02:05 . 2007-04-19 18:41 83554304 ----a-w- c:\windows\system32\acer.scr
2009-10-18 02:05 . 2009-10-18 02:05 -------- d-----w- c:\program files\Acer Incorporated
2009-10-18 02:05 . 2009-10-18 02:05 -------- d-----w- c:\windows\ACER
2009-10-18 02:03 . 2008-10-04 09:09 44544 ----a-w- c:\windows\system32\msxml4a.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-20 05:48 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar
2009-10-20 05:48 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Collaboration
2009-10-20 05:48 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
2009-10-20 05:48 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-10-20 05:48 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Photo Gallery
2009-10-20 05:48 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Journal
2009-10-20 05:48 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender
2009-10-20 01:41 . 2009-02-24 13:19 -------- d-----w- c:\program files\Google
2009-10-18 19:21 . 2009-02-24 13:08 -------- d-----w- c:\programdata\Microsoft Help
2009-10-18 19:10 . 2009-10-18 19:10 0 ----a-w- c:\users\Steven\AppData\Roaming\wklnhst.dat
2009-10-18 17:57 . 2009-10-18 01:55 70176 ----a-w- c:\users\Steven\AppData\Local\GDIPFONTCACHEV1.DAT
2009-10-18 17:30 . 2009-02-24 13:10 -------- d-----w- c:\program files\Microsoft Works
2009-10-18 17:05 . 2009-02-24 13:01 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-10-18 04:44 . 2009-02-24 13:01 -------- d-----w- c:\program files\Common Files\InstallShield
2009-08-18 04:33 . 2009-08-18 04:33 1193832 ----a-w- c:\windows\system32\FM20.DLL
2009-08-14 16:27 . 2009-10-18 03:09 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-08-14 15:53 . 2009-10-18 03:09 17920 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 13:49 . 2009-10-18 03:09 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 13:49 . 2009-10-18 03:09 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 13:49 . 2009-10-18 03:09 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 13:49 . 2009-10-18 03:09 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 13:49 . 2009-10-18 03:09 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 13:49 . 2009-10-18 03:09 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 13:49 . 2009-10-18 03:09 10240 ----a-w- c:\windows\system32\finger.exe
2009-08-14 13:48 . 2009-10-18 03:09 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2009-08-14 13:48 . 2009-10-18 03:09 105984 ----a-w- c:\windows\system32\netiohlp.dll
2009-08-04 12:34 . 2009-10-18 03:09 3600456 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-08-04 12:34 . 2009-10-18 03:09 3548216 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-08-03 18:54 . 2009-08-03 18:54 569856 ----a-w- c:\windows\system32\drivers\netr28.sys
2009-08-03 18:50 . 2009-08-03 18:50 13931 ----a-w- c:\windows\system32\RaCoInst.dat
2009-08-03 18:50 . 2009-02-24 11:14 221184 ----a-w- c:\windows\system32\RaCoInst.dll
2009-07-22 15:24 . 2009-07-22 15:24 94208 ----a-w- c:\windows\system32\RTNUninst32.dll
.

((((((((((((((((((((((((((((( SnapShot_2009-10-20_06.03.12 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-21 01:58 . 2009-10-20 06:12 46174 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2009-10-20 06:12 77380 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2009-10-18 04:44 . 2009-10-20 06:10 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-10-18 04:44 . 2009-10-20 05:54 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-10-18 04:44 . 2009-10-20 05:54 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-10-18 04:44 . 2009-10-20 06:10 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-10-18 04:44 . 2009-10-20 06:10 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-10-18 04:44 . 2009-10-20 05:54 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-10-20 06:04 . 2009-10-20 06:04 44032 c:\windows\assembly\NativeImages_v2.0.50727_32\stdole\52a46f3dd36f111d1836b3097fee5a70\stdole.ni.dll
+ 2009-10-18 01:56 . 2009-10-20 06:12 5318 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1003339124-694913111-3587296485-1000_UserData.bin
+ 2009-10-20 06:10 . 2009-10-20 06:10 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-10-20 05:52 . 2009-10-20 05:52 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-10-20 06:10 . 2009-10-20 06:10 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-10-20 05:52 . 2009-10-20 05:52 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2006-11-02 10:33 . 2009-10-20 06:17 595684 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2009-10-20 05:59 595684 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2009-10-20 06:17 101350 c:\windows\System32\perfc009.dat
- 2006-11-02 10:33 . 2009-10-20 05:59 101350 c:\windows\System32\perfc009.dat
+ 2009-10-18 02:52 . 2009-10-20 06:10 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2009-10-18 02:52 . 2009-10-20 05:52 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2009-10-20 06:03 . 2009-10-20 06:03 202240 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\7077a03939b7318d55d5210981f27a2d\System.Web.RegularExpressions.ni.dll
+ 2009-10-20 06:03 . 2009-10-20 06:03 627200 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\5cbea3b1a1d74123219b69306b8c8af2\System.Transactions.ni.dll
+ 2009-10-20 06:03 . 2009-10-20 06:03 771584 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\e515919524c6be56f55ad12fbdd23c19\System.Runtime.Remoting.ni.dll
+ 2009-10-20 06:04 . 2009-10-20 06:04 593408 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Messaging\0ea1e0e08dbc3640a3633c93d16a3ab5\System.Messaging.ni.dll
+ 2009-10-20 06:04 . 2009-10-20 06:04 212992 c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\6bf4a0b75632068b6a502b5e8a0d3f8d\System.IdentityModel.Selectors.ni.dll
+ 2009-10-20 06:03 . 2009-10-20 06:03 280064 c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\87f2c180fec78701501d8e3e84fac248\System.EnterpriseServices.Wrapper.dll
+ 2009-10-20 06:03 . 2009-10-20 06:03 627712 c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\87f2c180fec78701501d8e3e84fac248\System.EnterpriseServices.ni.dll
+ 2009-10-20 06:03 . 2009-10-20 06:03 455680 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\c57ed7ebb3d17c24907a0782451b7cd6\System.DirectoryServices.Protocols.ni.dll
+ 2009-10-20 06:04 . 2009-10-20 06:04 256000 c:\windows\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\0ff31ba4e5bd7fc222d882b7231e8b85\SMDiagnostics.ni.dll
+ 2009-10-20 06:04 . 2009-10-20 06:04 965632 c:\windows\assembly\NativeImages_v2.0.50727_32\ehiProxy\c0236311c6f9535dc945874535861d1a\ehiProxy.ni.dll
+ 2009-10-20 06:03 . 2009-10-20 06:03 410112 c:\windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\63990cc28cb95a5230b77d8a83850a0d\ComSvcConfig.ni.exe
+ 2009-10-20 06:03 . 2009-10-20 06:03 386560 c:\windows\assembly\NativeImages_v2.0.50727_32\BDATunePIA\171f746cbe9ca77cc225e0c146b64c2f\BDATunePIA.ni.dll
- 2006-11-02 10:22 . 2009-10-20 05:54 6553600 c:\windows\System32\SMI\Store\Machine\SCHEMA.DAT
+ 2006-11-02 10:22 . 2009-10-20 06:09 6553600 c:\windows\System32\SMI\Store\Machine\SCHEMA.DAT
+ 2009-10-20 06:03 . 2009-10-20 06:03 1840640 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\162f9b45ceca6f7f6fa1fa41b3b2084a\System.Web.Services.ni.dll
+ 2009-10-20 06:04 . 2009-10-20 06:04 2346496 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\8956038e00dfe9da1a536959bbb607d4\System.Runtime.Serialization.ni.dll
+ 2009-10-20 06:04 . 2009-10-20 06:04 1056768 c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\98f1d0fed2373728306a45326e4c83f0\System.IdentityModel.ni.dll
+ 2009-10-20 06:03 . 2009-10-20 06:03 1116672 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\9c09800674074a10d799efde7c2788ba\System.DirectoryServices.ni.dll
+ 2009-10-20 06:03 . 2009-10-20 06:03 1119232 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\10e612c97e300a16246395b0d68723cf\System.Data.OracleClient.ni.dll
+ 2009-10-20 06:04 . 2009-10-20 06:04 1093120 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\833095a3b841a331bce23daa9d2149a2\Microsoft.Transactions.Bridge.ni.dll
+ 2009-10-20 06:04 . 2009-10-20 06:04 2130432 c:\windows\assembly\NativeImages_v2.0.50727_32\ehepg\48ad3cb37dac8ad63938a1fee4f54f83\ehepg.ni.dll
+ 2009-10-20 06:03 . 2009-10-20 06:03 11800576 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\27b0a88bfa56a9390f516b0fa55f3dcb\System.Web.ni.dll
+ 2009-10-20 06:04 . 2009-10-20 06:04 17328640 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\df2a5eddb476c275ff657264182a0d24\System.ServiceModel.ni.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@= "{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} "
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-07-30 01:52 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM "= "c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-05-16 213936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender "= "c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"Google Desktop Search "= "c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-02-24 30192]
"ePower_DMC "= "c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-11-28 417792]
"eDataSecurity Loader "= "c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-07-30 526896]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"StartCCC "= "c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"PLFSetI "= "c:\windows\PLFSetI.exe" [2007-10-23 200704]
"Acer Assist Launcher "= "c:\program files\Acer\Acer Assist\launcher.exe" [2007-11-19 1261568]
"Acer Product Registration "= "c:\program files\Acer\Acer Registration\ACE1.exe" [2007-11-26 3387392]
"LManager "= "c:\progra~1\LAUNCH~1\LManager.exe" [2008-07-02 850440]
"SynTPEnh "= "c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-02-22 1037608]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-10-18 149280]
"MSSE "= "c:\program files\Microsoft Security Essentials\msseces.exe" [2009-09-13 1048392]
"CanonMyPrinter "= "c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-03-23 1983816]
"CanonSolutionMenu "= "c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-17 767312]
"RtHDVCpl "= "RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-06-20 6244896]
"Skytel "= "Skytel.exe" - c:\windows\SkyTel.exe [2007-11-21 1826816]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle "= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 20:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs "=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@= "Service "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@= "Service "

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Acer VCM.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Acer VCM.lnk
backup=c:\windows\pss\Acer VCM.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2 "=hex(b):a7,b3,b9,ce,49,51,ca,01

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [10/12/2009 9:24 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [10/12/2009 9:24 PM 74480]
R2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [2/24/2009 8:18 AM 24576]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [9/23/2008 5:11 PM 144632]
R2 RS_Service;Raw Socket Service;c:\program files\Acer\Acer VCM\RS_Service.exe [10/17/2009 9:04 PM 233472]
R3 JMCR;JMCR;c:\windows\System32\drivers\jmcr.sys [7/9/2009 12:45 PM 116064]
R3 netr28;Ralink 802.11n Wireless Driver for Windows Vista;c:\windows\System32\drivers\netr28.sys [8/3/2009 1:54 PM 569856]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [10/17/2009 11:15 PM 133104]
S3 GoogleDesktopManager-092308-165331;Google Desktop Manager 5.8.809.23506;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2/24/2009 8:20 AM 30192]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\System32\drivers\MpNWMon.sys [6/18/2009 6:48 PM 42480]
S3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [9/23/2008 5:11 PM 50424]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [10/12/2009 9:24 PM 7408]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2009-10-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-18 04:15]

2009-10-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-18 04:15]

2009-10-20 c:\windows\Tasks\User_Feed_Synchronization-{23D322CC-22B4-4681-A36A-6F2FDE0DA6C2}.job
- c:\windows\system32\msfeedssync.exe [2009-10-18 03:41]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp32&d=1009&m=aspire_4730z
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp32&d=1009&m=aspire_4730z
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_803138DCE93649E4.dll/cmsidewiki.html
FF - ProfilePath - c:\users\Steven\AppData\Roaming\Mozilla\Firefox\Profiles\sao4jgiv.default\
FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/?_bc=1
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-20 01:52
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
"MSCurrentCountry "=dword:000000b5
.
Completion time: 2009-10-20 1:54
ComboFix-quarantined-files.txt 2009-10-20 06:54
ComboFix2.txt 2009-10-20 06:04
ComboFix3.txt 2009-10-20 03:57

Pre-Run: 123,524,923,392 bytes free
Post-Run: 123,492,446,208 bytes free

- - End Of File - - 8CD19B4B69E64B7D39E3A05ED5D4E4D5

trub · 2009/10/20

Got an update for vista sp2. Installed it after posting first combofix log. Hope this will not matter.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:55:53 AM, on 10/20/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18828)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\Explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp32&d=1009&m=aspire_4730z
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp32&d=1009&m=aspire_4730z
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [PLFSetI] C:\Windows\PLFSetI.exe
O4 - HKLM\..\Run: [Acer Assist Launcher] C:\Program Files\Acer\Acer Assist\launcher.exe
O4 - HKLM\..\Run: [Acer Product Registration] "C:\Program Files\Acer\Acer Registration\ACE1.exe" /startup
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKLM\..\Run: [MSSE] "C:\Program Files\Microsoft Security Essentials\msseces.exe" -hide
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_803138DCE93649E4.dll/cmsidewiki.html
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
O23 - Service: Google Desktop Manager 5.8.809.23506 (GoogleDesktopManager-092308-165331) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Canon Inkjet Printer/Scanner/Fax Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: Raw Socket Service (RS_Service) - Acer Incorporated - C:\Program Files\Acer\Acer VCM\RS_Service.exe

--
End of file - 7276 bytes

broni · 2009/10/20

Disable Windows Defender, as it'll interfere with cleaning process:
- Open Windows Defender by clicking the Start, clicking All Programs, and then clicking Windows Defender.
- Click Tools
then...

++ Windows XP:
- Click General Settings
- Scroll down to Real Time Protection Options
- Uncheck Turn on Real Time Protection
- After you uncheck this, click on the Save button
- Close Windows Defender

++ Windows Vista:
- Click Options
- Under Administrator options, clear the Use Windows Defender check box, and then click Save.

Enable Windows Defender, when all cleaning is done.

===============================================================

Print this post out, since you won't have an access to it, at some point.

1. Open HijackThis.

2. Close all windows, except for HijackThis.

3. Put checkmarks next to the following HijackThis entries:

- O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

4. You should also checkmark following entries (these are unnecessary startups; no actual programs will be removed):

- O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
- O4 - HKLM\..\Run: [PLFSetI] C:\Windows\PLFSetI.exe
- O4 - HKLM\..\Run: [Acer Assist Launcher] C:\Program Files\Acer\Acer Assist\launcher.exe
- O4 - HKLM\..\Run: [Acer Product Registration] "C:\Program Files\Acer\Acer Registration\ACE1.exe" /startup
- O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
- O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
- O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
- O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
- O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

5. Click on Fix checked button.

6. Restart computer.

7. Post new HijackThis log.

trub · 2009/10/20

Broni here it is! Thanks again!!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:48:28 PM, on 10/20/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18828)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Users\Steven\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp32&d=1009&m=aspire_4730z
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp32&d=1009&m=aspire_4730z
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [MSSE] "C:\Program Files\Microsoft Security Essentials\msseces.exe" -hide
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_803138DCE93649E4.dll/cmsidewiki.html
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
O23 - Service: Google Desktop Manager 5.8.809.23506 (GoogleDesktopManager-092308-165331) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Canon Inkjet Printer/Scanner/Fax Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: Raw Socket Service (RS_Service) - Acer Incorporated - C:\Program Files\Acer\Acer VCM\RS_Service.exe

--
End of file - 6512 bytes

broni · 2009/10/20

Your computer is clean

1. Download Temp File Cleaner (TFC)
Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

2. Turn off System Restore:

- Windows XP:
1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore ".
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
- Windows Vista:
1. Click Start.
2. Right-click the Computer icon, and then click Properties.
3. Click on System Protection under the Tasks column on the left side
4. Click on Continue on the "User Account Control" window that pops up
5. Under the System Protection tab, find Available Disks
6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C: ")
7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
8. Click OK

3. Restart computer.

4. Turn System Restore on.

5. Make sure, Windows Updates are current.

[SIZE= "4"]6. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately![/SIZE]

7. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

8. Run defrag at your convenience.

9. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

10. Please, let me know, how is your computer doing.

trub · 2009/10/20

Thanks as always for the help!!!!!!!!

I will mark as resolved, again thank you so much.

trub · 2009/10/20

Actually you will have to close it . That option is not in the list for some reason.

Thanks Again!

Trub

broni · 2009/10/20

You're very welcome
In this forum, I'm the only one, who can mark thread as resolved. Done.

trub · 2009/10/20

Hey Broni, when I went to turn sys restore back on it shows me three options for drives.

PQSERVICE
ACER C
DATA

Should I create on both C and D? And what is the PQSERVICE?

THANKS AGAIN

broni · 2009/10/20

PQSERVICE is your recovery partition. This partition remains untouched, so no need to enable system restore on it.

Since system restore deals with system files only, which are located on C drive, that's the drive, you need to have system restore turned on.

trub · 2009/10/20

Thanks, one more question. When doing a clean install of "7" is it fairly easy to set up the partitions the same way? Recovery on one, system on two and data on three?

If I understand correctly the restore partition is "hidden ". With installing the new os will the disc know to wipe out the recovery since this is the vista setup.

Any other general advice you might have for setting up the clean install would be great.

Thanks

Trub

broni · 2009/10/20

Windows installer will see all partitions, no matter, hidden, or not.
You'll get options to delete any partition, you want and then create as many partitions as you want.
In your case, you can simply wipe out C and recovery partitions, leaving D (data) partition alone. Then, you'll create new (C) partition, on which you'll install Win 7.
Safer yet, back up your data, remove ALL partitions, create two new ones and install Win 7 on C.

trub · 2009/10/20

Do you have to change the bios to allow the first boot option to be from disc or simply put in the disc and go?

Trub

trub · 2009/10/20

Is windows installer a down loadable utility that should be installed prior to doing the new os install?

broni · 2009/10/20

Do you have to change the bios to allow the first boot option to be from disc or simply put in the disc and go?
Click to expand...

It depends on computer. Put the disk in and restart computer. If you DO NOT see this message:
Press any key to boot from CD
then you have to access BIOS.

Is windows installer a down loadable utility that should be installed prior to doing the new os install?
Click to expand...

Yes to 1st part of your question and no to the 2nd part.

trub · 2009/10/20

Broni, you are the man!!!!

Much Obliged

Log in or Sign up

Solved Checkup to make sure machine is clean!

trub Well-Known Member Thread Starter

trub Well-Known Member Thread Starter

trub Well-Known Member Thread Starter

broni Moderator Malware Analyst

trub Well-Known Member Thread Starter

trub Well-Known Member Thread Starter

broni Moderator Malware Analyst

trub Well-Known Member Thread Starter

broni Moderator Malware Analyst

trub Well-Known Member Thread Starter

trub Well-Known Member Thread Starter

broni Moderator Malware Analyst

trub Well-Known Member Thread Starter

broni Moderator Malware Analyst

trub Well-Known Member Thread Starter

broni Moderator Malware Analyst

trub Well-Known Member Thread Starter

trub Well-Known Member Thread Starter

broni Moderator Malware Analyst

trub Well-Known Member Thread Starter

Share This Page

Log in or Sign up

Solved Checkup to make sure machine is clean!

trub Well-Known Member Thread Starter

trub Well-Known Member Thread Starter

trub Well-Known Member Thread Starter

broni Moderator Malware Analyst

trub Well-Known Member Thread Starter

trub Well-Known Member Thread Starter

broni Moderator Malware Analyst

trub Well-Known Member Thread Starter

broni Moderator Malware Analyst

trub Well-Known Member Thread Starter

trub Well-Known Member Thread Starter

broni Moderator Malware Analyst

trub Well-Known Member Thread Starter

broni Moderator Malware Analyst

trub Well-Known Member Thread Starter

broni Moderator Malware Analyst

trub Well-Known Member Thread Starter

trub Well-Known Member Thread Starter

broni Moderator Malware Analyst

trub Well-Known Member Thread Starter

Share This Page

Useful Searches