Solved PCASp50 NDIS Protocol Driver service failed to start

A333 · 2009/08/31

[Resolved] PCASp50 NDIS Protocol Driver service failed to start

Hi,
as requested by another post, I'm posting the two DDS log files for review and advice. I shall appreciate your professional help.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-07-30.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 10/16/2006 5:53:16 PM
System Uptime: 8/31/2009 12:51:40 PM (1 hours ago)

Motherboard: Dell Inc. | | 0CJ774
Processor: Intel(R) Pentium(R) D CPU 3.20GHz | Microprocessor | 3192/800mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 233 GiB total, 198.277 GiB free.
D: is FIXED (NTFS) - 183 GiB total, 165.215 GiB free.
E: is CDROM ()
F: is CDROM (CDFS)
G: is Removable
H: is Removable
I: is Removable

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP532: 6/2/2009 1:09:22 PM - System Checkpoint
RP533: 6/3/2009 2:57:14 PM - System Checkpoint
RP534: 6/5/2009 10:09:42 AM - System Checkpoint
RP535: 6/7/2009 8:01:15 PM - System Checkpoint
RP536: 6/9/2009 8:44:41 AM - System Checkpoint
RP537: 6/10/2009 10:20:51 AM - System Checkpoint
RP538: 6/10/2009 11:05:31 AM - Software Distribution Service 3.0
RP539: 6/10/2009 2:02:21 PM - Installed YouCam
RP540: 6/10/2009 6:30:34 PM - Installed Gateway
RP541: 6/11/2009 1:40:13 PM - Installed Gateway
RP542: 6/12/2009 8:06:02 AM - Installed Linksys Dual-Band Wireless-N USB Network Adapter
RP543: 6/13/2009 8:44:42 AM - Installed Gateway
RP544: 6/14/2009 10:11:00 AM - System Checkpoint
RP545: 6/14/2009 4:51:56 PM - Software Distribution Service 3.0
RP546: 6/15/2009 8:25:48 PM - System Checkpoint
RP547: 6/16/2009 8:31:44 PM - System Checkpoint
RP548: 6/19/2009 2:52:57 PM - System Checkpoint
RP549: 6/20/2009 3:39:41 PM - System Checkpoint
RP550: 6/21/2009 12:36:03 PM - Installed HP My Display
RP551: 6/21/2009 12:36:12 PM - Installed HP My Display
RP552: 6/21/2009 12:36:26 PM - Installed SDK
RP553: 6/21/2009 12:36:45 PM - Installed Pivot Software
RP554: 6/21/2009 12:36:50 PM - Installed Pivot Software
RP555: 6/22/2009 12:47:09 PM - System Checkpoint
RP556: 6/23/2009 1:38:58 PM - System Checkpoint
RP557: 6/24/2009 2:13:03 PM - System Checkpoint
RP558: 6/25/2009 1:52:10 PM - Software Distribution Service 3.0
RP559: 6/26/2009 11:34:40 AM - Configured AVerTV USB 2.0 Plus
RP560: 6/26/2009 11:35:57 AM - Installed AVerTV USB 2.0 Plus
RP561: 6/27/2009 8:56:12 PM - System Checkpoint
RP562: 6/28/2009 3:30:31 PM - Changed network configuration parameters ({APPNAME})
RP563: 6/30/2009 9:36:51 AM - System Checkpoint
RP564: 7/1/2009 12:23:57 PM - Advanced SystemCare RestorePoint
RP565: 7/2/2009 1:32:31 PM - System Checkpoint
RP566: 7/3/2009 8:32:35 PM - System Checkpoint
RP567: 7/5/2009 9:18:24 AM - System Checkpoint
RP568: 7/6/2009 10:34:33 PM - System Checkpoint
RP569: 7/7/2009 11:33:55 PM - System Checkpoint
RP570: 7/9/2009 10:12:20 AM - System Checkpoint
RP571: 7/10/2009 2:35:02 PM - Configured YouCam
RP572: 7/10/2009 2:40:41 PM - Configured YouCam
RP573: 7/10/2009 2:46:26 PM - Configured YouCam
RP574: 7/16/2009 6:30:44 PM - Software Distribution Service 3.0
RP575: 7/17/2009 10:23:14 PM - MyRestore
RP576: 7/19/2009 11:47:55 AM - System Checkpoint
RP577: 7/20/2009 11:13:06 PM - System Checkpoint
RP578: 7/22/2009 9:22:30 AM - Software Distribution Service 3.0
RP579: 7/26/2009 11:56:34 AM - Before AverTV Removal
RP580: 7/26/2009 11:58:31 AM - Configured AVerTV USB 2.0 Plus
RP581: 7/26/2009 11:59:54 AM - Configured AVerTV USB 2.0 Plus Driver
RP582: 8/5/2009 3:50:19 PM - Software Distribution Service 3.0
RP583: 8/6/2009 6:41:32 PM - MyCheckpoint
RP584: 8/7/2009 10:30:14 PM - System Checkpoint
RP585: 8/8/2009 8:55:34 AM - Installed TVCenter Pro
RP586: 8/10/2009 8:20:58 PM - System Checkpoint
RP587: 8/11/2009 11:54:52 PM - System Checkpoint
RP588: 8/12/2009 8:24:51 PM - MycheckPoint
RP589: 8/13/2009 9:46:14 AM - Software Distribution Service 3.0
RP590: 8/13/2009 1:37:48 PM - Installed FW LiveUpdate
RP591: 8/14/2009 6:54:25 PM - System Checkpoint
RP592: 8/15/2009 10:23:33 PM - System Checkpoint
RP593: 8/15/2009 11:44:49 PM - Software Distribution Service 3.0
RP594: 8/16/2009 12:22:33 PM - Configured Linksys Dual-Band Wireless-N USB Network Adapter
RP595: 8/17/2009 2:46:46 PM - System Checkpoint
RP596: 8/17/2009 3:08:11 PM - Installed Gateway
RP597: 8/18/2009 3:32:02 PM - Configured Linksys Dual-Band Wireless-N USB Network Adapter
RP598: 8/19/2009 4:59:12 PM - System Checkpoint
RP599: 8/21/2009 10:11:31 AM - System Checkpoint
RP600: 8/22/2009 9:25:26 AM - MyRestorePoint
RP601: 8/22/2009 12:22:32 PM - Revo Uninstaller's restore point - InterVideo FilterSDK for AverMedia
RP602: 8/23/2009 1:00:53 PM - System Checkpoint
RP603: 8/25/2009 10:38:11 AM - System Checkpoint
RP604: 8/26/2009 5:20:45 AM - Software Distribution Service 3.0
RP605: 8/27/2009 2:57:35 PM - System Checkpoint
RP606: 8/27/2009 8:25:24 PM - Changed network configuration parameters ({APPNAME})
RP607: 8/27/2009 8:31:48 PM - Revo Uninstaller's restore point - TweakMASTER
RP608: 8/29/2009 8:43:17 AM - System Checkpoint
RP609: 8/30/2009 10:38:55 PM - System Checkpoint

==== Installed Programs ======================

AAC Decoder
AC3Filter (remove only)
Acrobat.com
Acronis*True*Image*Home
Adobe AIR
Adobe Anchor Service CS3
Adobe Asset Services CS3
Adobe Bridge CS3
Adobe Bridge Start Meeting
Adobe Camera Raw 4.0
Adobe CMaps
Adobe Color - Photoshop Specific
Adobe Color Common Settings
Adobe Color EU Extra Settings
Adobe Color EU Recommended Settings
Adobe Color JA Extra Settings
Adobe Color NA Extra Settings
Adobe Color NA Recommended Settings
Adobe Common File Installer
Adobe Default Language CS3
Adobe Device Central CS3
Adobe Dreamweaver CS3
Adobe ExtendScript Toolkit 2
Adobe Extension Manager CS3
Adobe Fireworks CS3
Adobe Flash CS3
Adobe Flash CS3 Professional
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Flash Player 9 ActiveX
Adobe Flash Player 9 Plugin
Adobe Flash Video Encoder
Adobe Fonts All
Adobe Help Viewer CS3
Adobe Illustrator CS3
Adobe InDesign CS3
Adobe InDesign CS3 Icon Handler
Adobe Linguistics CS3
Adobe PDF Library Files
Adobe Photoshop CS3
Adobe Reader 9.1.3
Adobe Setup
Adobe SING CS3
Adobe Stock Photos 1.0
Adobe Stock Photos CS3
Adobe SVG Viewer 3.0
Adobe Type Support
Adobe Update Manager CS3
Adobe Version Cue CS3 Client
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS3
Advanced SystemCare 3
Advertising Center
Apple Mobile Device Support
Apple Software Update
AutoUpdate
AVS Media Player 3.1
Aw2 Explorer 7 for Microsoft Windows
Bonjour
Broadcom Gigabit Integrated Controller
CCleaner (remove only)
Color Schemer v3
ColorImpact version 2.8.0
Compatibility Pack for the 2007 Office system
Creative Audio Console
Creative MediaSource
Creative MediaSource 5
Creative Vienna SoundFont Studio
Creative WaveStudio 7
Critical Update for Windows Media Player 11 (KB959772)
CyberLink YouCam
Defraggler (remove only)
Dell Resource CD
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Version Checker
DivX Web Player
DolbyFiles
DU Meter
ebgcInfra
ebgcRes
ebgcSDK
Express Burn
ffdshow [rev 2527] [2008-12-19]
FLV Player 2.0 (build 25)
Freecorder Toolbar
Freecorder Toolbar 3.0 Application
FW LiveUpdate
GPL MPEG-1/2 DirectShow Decoder Filter
H.264 Decoder
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
hp deskjet 5550 series (Remove only)
HP Driver Diagnostics
HP My Display
Intel(R) Matrix Storage Manager
Internet Download Manager
iTunes
Java(TM) 6 Update 15
Java(TM) 6 Update 6
Java(TM) 6 Update 7
jv16 PowerTools 2009
Kaspersky Internet Security 2010
LightScribe System Software 1.14.17.1
LimeWire 4.16.6
Livestation
Macromedia Dreamweaver MX 2004
Macromedia Extension Manager
Macromedia FreeHand MXa
Menu Templates - Starter Kit
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Baseline Security Analyzer 2.1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 2003 Web Components
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Converter Pack
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Software Update for Web Folders (English) 12
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Windows Script 5.7
Microsoft Windows XP Video Decoder Checkup Utility
Microsoft XML Parser
MKV Splitter
Movie Templates - Starter Kit
Mozilla Firefox (3.5)
MSN Money Investment Toolbox
MSN Music Assistant
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 6.0 Parser (KB933579)
NTRU Hybrid TSS v1.05
NVIDIA Drivers
NVIDIA nView Desktop Manager
NVIDIA Performance Drivers
NVIDIA PureVideo Decoder
OLYMPUS CAMEDIA Master 4.1
OneCare Advisor (Windows Live Toolbar)
OpenAL
OpenedFilesView
Panneau de configuration MobileMe
ParetoLogic Privacy Controls
PDF Settings
Personal Knowbase 3.1.1
Pinnacle TVCenter Pro
Pivot Software
Popup Blocker (Windows Live Toolbar)
Process Tamer 2.09.01
QuickTime
RealPlayer
Recuva (remove only)
RegCure 1.6.0.0
Revo Uninstaller 1.83
Safari
SDK
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB969679)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft Office Excel 2007 (KB969682)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office Publisher 2007 (KB969693)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office Word 2007 (KB969604)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
SigmaTel Audio
Smart Menus (Windows Live Toolbar)
SnapAPI
Sound Blaster Audigy 2
SoundFont Bank Manager
SoundTrax
SPBBC
Spelling Dictionaries Support For Adobe Reader 8
Spybot - Search & Destroy
STMicroelectronics TPM Software Package
System Requirements Lab
The KMPlayer (remove only)
The Rosetta Stone
TMPGEnc Authoring Works 4
Trojan Remover 6.8.1
Unlocker 1.8.7
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office Outlook 2007 (KB969907)
Update for Outlook 2007 Junk Email Filter (kb972691)
Update for Windows Internet Explorer 8 (KB969497)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973815)
User Profile Hive Cleanup Service
VC80CRTRedist - 8.0.50727.762
WebFldrs XP
Windows Defender Signatures
Windows Desktop Search 3.01
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Installer Clean Up
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live Favorites for Windows Live Toolbar
Windows Live installer
Windows Live Mail
Windows Live Messenger
Windows Live Outlook Toolbar (Windows Live Toolbar)
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Toolbar
Windows Live Toolbar Extension (Windows Live Toolbar)
Windows Live Toolbar Feed Detector (Windows Live Toolbar)
Windows Live Writer
Windows Media Connect
Windows Media Format 11 runtime
Windows Media Player 11
Windows Messenger 5.1
Windows XP Service Pack 3
WinRAR archiver
Xvid 1.1.3 final uninstall
Youtube Downloader HD v. 1.1

==== Event Viewer Messages From Past Week ========

8/29/2009 4:49:58 PM, error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error 2147749155 (0x80040D23).
8/25/2009 7:02:05 PM, error: Service Control Manager [7000] - The PCASp50 NDIS Protocol Driver service failed to start due to the following error: The system cannot find the file specified.
8/25/2009 7:01:38 PM, error: Dhcp [1002] - The IP address lease 192.168.1.100 for the Network Card with network address 001EE5E4EE69 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
8/24/2009 7:35:44 AM, error: ipnathlp [31008] - The DNS proxy agent was unable to read the local list of name-resolution servers from the registry. The data is the error code.
8/24/2009 1:46:20 PM, information: Windows File Protection [64017] - Windows File Protection file scan completed successfully.
8/24/2009 1:08:17 PM, information: Windows File Protection [64021] - The system file c:\windows\system32\inetsloc.dll could not be copied into the DLL cache. The specific error code is 0x000004c7 [The operation was canceled by the user. ]. This file is necessary to maintain system stability.
8/24/2009 1:08:02 PM, information: Windows File Protection [64021] - The system file c:\windows\system32\inetsrv\inetmgr.exe could not be copied into the DLL cache. The specific error code is 0x000004c7 [The operation was canceled by the user. ]. This file is necessary to maintain system stability.
8/24/2009 1:07:52 PM, information: Windows File Protection [64021] - The system file c:\windows\system32\inetsrv\iisui.dll could not be copied into the DLL cache. The specific error code is 0x000004c7 [The operation was canceled by the user. ]. This file is necessary to maintain system stability.
8/24/2009 1:07:28 PM, information: Windows File Protection [64021] - The system file c:\windows\system32\iisrstap.dll could not be copied into the DLL cache. The specific error code is 0x000004c7 [The operation was canceled by the user. ]. This file is necessary to maintain system stability.
8/24/2009 1:04:19 PM, information: Windows File Protection [64016] - Windows File Protection file scan was started.

==== End Of File ===========================

DDS (Ver_09-07-30.01) - NTFSx86
Run by SHAMS1 at 13:06:57.51 on Mon 08/31/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_15
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2434 [GMT 2:00]

AV: Norton Internet Security *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
AV: Kaspersky Internet Security *On-access scanning enabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *enabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

============== Running Processes ===============

C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
C:\Program Files\DU Meter\DUMeterSvc.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Portrait Displays\Pivot Software\floater.exe
C:\Program Files\SAMSUNG\FW LiveUpdate\FWManager.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Livestation\Livestation.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Portrait Displays\HP My Display\DTHtml.exe
C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
D:\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://news.google.com/
mSearchAssistant = hxxp://www.google.com/ie
uURLSearchHooks: N/A: {9cb65206-89c4-402c-ba80-02d8c59f9b1d} -
BHO: AutorunsDisabled - No File
BHO: IDMIEHlprObj Class: {0055c089-8582-441b-a0bf-17b458c2a3a8} - c:\program files\internet download manager\IDMIECC.dll
BHO: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - c:\program files\freecorder\tbFre1.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {3EE5C0A4-C6FD-4A6A-91BB-3FD8BE70B5CC} - No File
BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky internet security 2010\ievkbd.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Ask Search Assistant BHO: {9cb65201-89c4-402c-ba80-02d8c59f9b1d} - Ask Search Assistant BHO
{af69de43-7d58-4638-b6fa-ce66b5ad205d}
BHO: Windows Live Toolbar Helper: {bdbd1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
BHO: 1 (0x1) - No File
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: {DC5F9604-C6E2-47D0-8E0F-E60FCCB334C7} - No File
BHO: FilterBHO Class: {e33cf602-d945-461a-83f0-819f76a199f8} - c:\program files\kaspersky lab\kaspersky internet security 2010\klwtbbho.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: Ask Toolbar BHO: {fe063db1-4ec0-403e-8dd8-394c54984b2c} - Ask Toolbar BHO
TB: {a66cc04d-ca4e-4050-8e18-51f7e6d18096} - No File
TB: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - c:\program files\freecorder\tbFre1.dll
TB: {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - No File
TB: Windows Live Toolbar: {bdad1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
{ef99bd32-c1fb-11d2-892f-0090271d4f88}
TB: Ask Toolbar: {fe063db9-4ec0-403e-8dd8-394c54984b2c} -
uRun: [Livestation] c:\program files\livestation\Livestation.exe -startup
uRun: [IDMan] c:\program files\internet download manager\IDMan.exe /onboot
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [PMCLoader] c:\program files\pinnacle\tvcenter pro\PMCLoader.exe -checktasks
mRun: [TrueImageMonitor.exe] c:\program files\acronis\trueimagehome\TrueImageMonitor.exe
mRun: [AcronisTimounterMonitor] c:\program files\acronis\trueimagehome\TimounterMonitor.exe
mRun: [Acronis Scheduler2 Service] "c:\program files\common files\acronis\schedule2\schedhlp.exe "
mRun: [SigmatelSysTrayApp] stsystra.exe
mRun: [PivotSoftware] "c:\program files\portrait displays\pivot software\wpctrl.exe "
mRun: [DT HPW] c:\program files\common files\portrait displays\shared\DT_startup.exe -HPW
mRun: [avp] "c:\program files\kaspersky lab\kaspersky internet security 2010\avp.exe "
mRun: [UCam_Menu] "c:\program files\cyberlink\youcam\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\youcam" updatewithcreateonce "software\cyberlink\youcam\1.0 "
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
mRun: [Name of App] c:\program files\samsung\fw liveupdate\FWManager.exe r
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
IE: &Windows Live Search - c:\program files\windows live toolbar\msntb.dll/search.htm
IE: Add to Anti-Banner - c:\program files\kaspersky lab\kaspersky internet security 2010\ie_banner_deny.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: Download all links with IDM - c:\program files\internet download manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\internet download manager\IEGetVL.htm
IE: Download with IDM - c:\program files\internet download manager\IEExt.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {1F958B09-3312-7f0e-9723-4C1324C57B20}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - c:\program files\kaspersky lab\kaspersky internet security 2010\klwtbbho.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - c:\program files\kaspersky lab\kaspersky internet security 2010\klwtbbho.dll
LSP: c:\windows\system32\idmmbc.dll
Trusted Zone: 4irany.com\www
Trusted Zone: c-span.org
Trusted Zone: google.com\news
Trusted Zone: microsoft.com\update
Trusted Zone: radis.org
Trusted Zone: samsungodd.com\www
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab
DPF: {680285A8-96D3-43DA-9D3D-51DD987D0B77}
DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15101/CTSUEng.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078}
DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD}
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15108/CTPID.cab
TCP: {A0722B6E-E533-459C-B5CA-439F82D0F592} = 192.168.1.1,212.217.0.1
TCP: {EC0FDAB6-CFBC-4E8E-921B-908A7018B283} = 194.230.1.103,194.230.1.39
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Notify: klogon - c:\windows\system32\klogon.dll
AppInit_DLLs: c:\progra~1\kaspersky lab\kaspersky 2010\mzvkbd.dll,c:\progra~1\kaspersky lab\kaspersky internet security 2010\mzvkbd3.dll,c:\progra~1\kaspersky lab\kaspersky internet security 2010\kloehk.dll,c:\progra~1\kaspersky lab\kaspersky internet security 2010\mzvkbd.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
STS: IE Component Categories cache daemon: {553858a7-4922-4e7e-b1c1-97140c1c16ef} - c:\windows\system32\ieframe.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
LSA: Authentication Packages = msv1_0 relog_ap
LSA: Notification Packages = :\windows\syste

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\shams1\application data\mozilla\firefox\profiles\xgto0m36.default\
FF - prefs.js: browser.startup.homepage - hxxp://news.google.com/
FF - component: c:\documents and settings\shams1\application data\idm\idmmzcc3\components\idmmzcc.dll
FF - component: c:\program files\mozilla firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPAbacheck.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npracplug.dll
FF - plugin: c:\program files\real\realarcade\plugins\mozilla\npracplug.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref( "media.enforce_same_site_origin ", false);
c:\program files\mozilla firefox\greprefs\all.js - pref( "media.cache_size ", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref( "media.ogg.enabled ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "media.wave.enabled ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "media.autoplay.enabled ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.urlbar.autocomplete.enabled ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "capability.policy.mailnews.*.wholeText ", "noAccess ");
c:\program files\mozilla firefox\greprefs\all.js - pref( "dom.storage.default_quota ", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref( "content.sink.event_probe_rate ", 3);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.http.prompt-temp-redirect ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "layout.css.dpi ", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref( "layout.css.devPixelsPerPx ", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref( "gestures.enable_single_finger_input ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "dom.max_chrome_script_run_time ", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.tcp.sendbuffer ", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref( "geo.enabled ", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.remember_cert_checkbox_default_setting ", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "browser.search.param.yahoo-fr ", "moz35 ");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "browser.search.param.yahoo-fr-cjkt ", "moz35 ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "extensions.blocklist.level ", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.urlbar.restrict.typed ", "~ ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.urlbar.default.behavior ", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.history ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.formdata ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.passwords ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.downloads ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.cookies ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.cache ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.sessions ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.offlineApps ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.siteSettings ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.cpd.history ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.cpd.formdata ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.cpd.passwords ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.cpd.downloads ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.cpd.cookies ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.cpd.cache ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.cpd.sessions ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.cpd.offlineApps ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.cpd.siteSettings ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.sanitize.migrateFx3Prefs ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.ssl_override_behavior ", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "security.alternate_certificate_error_page ", "certerror ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.privatebrowsing.autostart ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.privatebrowsing.dont_prompt_on_enter ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "geo.wifi.uri ", "https://www.google.com/loc/json ");

============= SERVICES / DRIVERS ===============

R0 kl1;Kl1;c:\windows\system32\drivers\kl1.sys [2009-5-24 128016]
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-1-29 33808]
R0 stmtpm;STM TPM Service;c:\windows\system32\drivers\stm_tpm.sys [2006-4-1 21504]
R0 tdrpman228;Acronis Try&Decide and Restore Points filter (build 228);c:\windows\system32\drivers\tdrpm228.sys [2009-6-24 902592]
R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2008-7-20 296976]
R2 AVP;Kaspersky Internet Security;c:\program files\kaspersky lab\kaspersky internet security 2010\avp.exe [2009-7-3 303376]
R2 DUMeterSvc;DU Meter Service;c:\program files\du meter\DUMeterSvc.exe [2007-12-4 1387544]
R2 NVIDIA Performance Driver Service;NVIDIA Performance Driver Service;c:\program files\nvidia corporation\performance drivers\nvPDsvc.exe [2009-5-14 4440064]
R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [2008-5-1 2368]
R3 3xHybrid;Pinnacle PCTV 100i-110i-300i-310i-MCE;c:\windows\system32\drivers\3xHybrid.sys [2009-8-8 1121536]
R3 COMMONFX.SYS;COMMONFX.SYS;c:\windows\system32\drivers\COMMONFX.sys [2009-3-4 99352]
R3 CTAUDFX.SYS;CTAUDFX.SYS;c:\windows\system32\drivers\CTAUDFX.sys [2009-3-4 555032]
R3 CTSBLFX.SYS;CTSBLFX.SYS;c:\windows\system32\drivers\CTSBLFX.sys [2009-3-4 566296]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2009-5-16 19472]
R3 rt2870;Linksys 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [2009-8-18 551680]
S2 ccEvtMgr;ccEvtMgr; [x]
S2 ccSetMgr;ccSetMgr; [x]
S3 ccPwdSvc;ccPwdSvc; [x]
S3 COMMONFX;COMMONFX;c:\windows\system32\drivers\COMMONFX.sys [2009-3-4 99352]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\common files\creative labs shared\service\CTAELicensing.exe [2009-5-29 79360]
S3 CTAUDFX;CTAUDFX;c:\windows\system32\drivers\CTAUDFX.sys [2009-3-4 555032]
S3 CTERFXFX.SYS;CTERFXFX.SYS;c:\windows\system32\drivers\CTERFXFX.sys [2009-3-4 100888]
S3 CTERFXFX;CTERFXFX;c:\windows\system32\drivers\CTERFXFX.sys [2009-3-4 100888]
S3 CTSBLFX;CTSBLFX;c:\windows\system32\drivers\CTSBLFX.sys [2009-3-4 566296]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2009-5-13 31760]
S3 PPDrv;PPDrv; [x]
S3 SAVRT;SAVRT; [x]
S4 Rdbssatcwpth;Rdbssatcwpth; [x]

=============== Created Last 30 ================

2009-08-27 19:47 1,706,528 a------- c:\windows\system32\nvcuvenc.dll
2009-08-27 19:47 1,597,690 a------- c:\windows\system32\nvdata.bin
2009-08-22 11:53 <DIR> --d----- c:\program files\VS Revo Group
2009-08-18 15:38 551,680 a----r-- c:\windows\system32\drivers\rt2870.sys
2009-08-08 08:57 196,096 -------- c:\windows\system32\MACD32.DLL
2009-08-08 08:57 138,752 -------- c:\windows\system32\MASE32.DLL
2009-08-08 08:57 136,192 -------- c:\windows\system32\MAMC32.DLL
2009-08-08 08:57 57,856 -------- c:\windows\system32\MASD32.DLL
2009-08-08 08:57 27,648 -------- c:\windows\system32\MA32.DLL
2009-08-08 08:57 2,179,072 -------- c:\windows\system32\mfc71d.dll
2009-08-08 08:57 765,952 -------- c:\windows\system32\msvcp71d.dll
2009-08-08 08:57 737,280 -------- c:\windows\system32\msvcp70d.dll
2009-08-08 08:57 544,768 -------- c:\windows\system32\msvcr71d.dll
2009-08-08 08:57 536,576 -------- c:\windows\system32\msvcr70d.dll
2009-08-08 08:57 385,100 -------- c:\windows\system32\MSVCRTD.DLL
2009-08-08 08:55 548,864 -------- c:\windows\system32\msvcp80.dll
2009-08-08 08:55 <DIR> --d----- c:\program files\Pinnacle
2009-08-08 08:55 626,688 -------- c:\windows\system32\msvcr80.dll
2009-08-08 08:51 15,232 ac------ c:\windows\system32\dllcache\mpe.sys
2009-08-08 08:51 15,232 a------- c:\windows\system32\drivers\MPE.sys
2009-08-08 08:50 1,121,536 a----r-- c:\windows\system32\drivers\3xHybrid.sys
2009-08-08 08:50 3,072 a----r-- c:\windows\system32\34CoInstaller.dll
2009-08-08 08:50 363,520 ac------ c:\windows\system32\dllcache\psisdecd.dll
2009-08-08 08:50 33,280 ac------ c:\windows\system32\dllcache\psisrndr.ax
2009-08-08 08:50 363,520 a------- c:\windows\system32\PsisDecd.dll
2009-08-08 08:50 33,280 a------- c:\windows\system32\PsisRndr.ax
2009-08-08 08:50 56,832 ac------ c:\windows\system32\dllcache\msdvbnp.ax
2009-08-08 08:50 56,832 a------- c:\windows\system32\MSDvbNP.ax
2009-08-08 08:50 18,432 ac------ c:\windows\system32\dllcache\bdaplgin.ax
2009-08-08 08:50 11,776 ac------ c:\windows\system32\dllcache\bdasup.sys
2009-08-08 08:50 18,432 a------- c:\windows\system32\BdaPlgIn.ax
2009-08-08 08:50 11,776 a------- c:\windows\system32\drivers\BdaSup.sys

==================== Find3M ====================

2009-08-05 11:01 204,800 a------- c:\windows\system32\mswebdvd.dll
2009-07-25 05:23 411,368 ac------ c:\windows\system32\deploytk.dll
2009-07-17 21:01 58,880 a------- c:\windows\system32\atl.dll
2009-07-14 20:54 485,920 ac------ c:\windows\system32\nvudisp.exe
2009-07-14 20:54 10,457,088 a------- c:\windows\system32\nvoglnt.dll
2009-07-14 20:54 7,741,664 a------- c:\windows\system32\drivers\nv4_mini.sys
2009-07-14 20:54 5,842,816 a------- c:\windows\system32\nv4_disp.dll
2009-07-14 20:54 2,189,856 a------- c:\windows\system32\nvcuvid.dll
2009-07-14 20:54 2,002,944 a------- c:\windows\system32\nvcuda.dll
2009-07-14 20:54 868,352 a------- c:\windows\system32\nvapi.dll
2009-07-14 20:54 151,552 a------- c:\windows\system32\nvcodins.dll
2009-07-14 20:54 151,552 a------- c:\windows\system32\nvcod.dll
2009-07-14 13:35 2,173,472 a------- c:\windows\system32\nvcplui.exe
2009-07-14 13:35 81,920 a------- c:\windows\system32\nvwddi.dll
2009-07-14 13:35 4,026,368 a------- c:\windows\system32\nvvitvs.dll
2009-07-14 13:35 3,170,304 a------- c:\windows\system32\nvwss.dll
2009-07-14 13:34 13,877,248 a------- c:\windows\system32\nvcpl.dll
2009-07-14 13:34 4,923,392 a------- c:\windows\system32\nvdisps.dll
2009-07-14 13:34 3,547,136 a------- c:\windows\system32\nvgames.dll
2009-07-14 13:34 1,286,144 a------- c:\windows\system32\nvmobls.dll
2009-07-14 13:34 188,416 a------- c:\windows\system32\nvmccss.dll
2009-07-14 13:34 168,004 a------- c:\windows\system32\nvsvc32.exe
2009-07-14 13:34 143,360 a------- c:\windows\system32\nvcolor.exe
2009-07-14 13:34 86,016 a------- c:\windows\system32\nvmctray.dll
2009-07-14 13:34 229,376 a------- c:\windows\system32\nvmccs.dll
2009-07-13 23:43 286,208 a------- c:\windows\system32\wmpdxm.dll
2009-07-10 07:01 485,920 ac------ c:\windows\system32\NVUNINST.EXE
2009-07-09 17:12 128,016 a------- c:\windows\system32\drivers\kl1.sys
2009-07-07 16:29 604,140 a--sh--- c:\windows\system32\drivers\ISwift3.dat
2009-07-07 16:24 6,766,624 a--sh--- c:\windows\system32\drivers\fidbox.dat
2009-07-07 16:24 1,638,432 a--sh--- c:\windows\system32\drivers\fidbox2.dat
2009-07-07 16:24 54,992 a--sh--- c:\windows\system32\drivers\fidbox.idx
2009-07-07 16:24 7,728 a--sh--- c:\windows\system32\drivers\fidbox2.idx
2009-07-03 19:09 915,456 a------- c:\windows\system32\wininet.dll
2009-07-03 15:48 219,664 a------- c:\windows\system32\klogon.dll
2009-07-03 15:45 27,507 a------- c:\windows\system32\drivers\klopp.dat
2009-06-26 14:34 2,070,808 a------- c:\windows\system32\AutoPartNt.exe
2009-06-25 10:25 730,112 a------- c:\windows\system32\lsasrv.dll
2009-06-25 10:25 301,568 a------- c:\windows\system32\kerberos.dll
2009-06-25 10:25 147,456 a------- c:\windows\system32\schannel.dll
2009-06-25 10:25 136,192 a------- c:\windows\system32\msv1_0.dll
2009-06-25 10:25 56,832 a------- c:\windows\system32\secur32.dll
2009-06-25 10:25 54,272 a------- c:\windows\system32\wdigest.dll
2009-06-16 16:36 119,808 a------- c:\windows\system32\t2embed.dll
2009-06-16 16:36 81,920 a------- c:\windows\system32\fontsub.dll
2009-06-12 14:31 80,896 a------- c:\windows\system32\tlntsess.exe
2009-06-12 14:31 76,288 a------- c:\windows\system32\telnet.exe
2009-06-10 16:13 84,992 a------- c:\windows\system32\avifil32.dll
2009-06-10 09:19 2,066,432 a------- c:\windows\system32\mstscax.dll
2009-06-10 08:14 132,096 a------- c:\windows\system32\wkssvc.dll
2009-06-03 21:09 1,291,264 a------- c:\windows\system32\quartz.dll
2007-09-27 19:34 2,293,712 ac------ c:\program files\FLV PlayerFCSetup.exe
2007-07-07 19:36 774,144 ac------ c:\program files\RngInterstitial.dll
2008-06-04 13:14 23 ac-sh--- c:\windows\system32\aebed7_z.dll
2009-05-30 12:59 23 a--sh--- c:\windows\system32\edacded0.dat
2009-02-14 10:07 23 a--sh--- c:\windows\system32\edacded0_x.dat
2008-02-17 10:34 23 ac-sh--- c:\windows\system32\fffbbf_r.dll
2008-05-12 14:24 32,768 ac-sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008051220080513\index.dat

============= FINISH: 13:08:12.35 ===============

broni · 2009/08/31

I assume, Kaspersky is your current security program?
If so, there are some Norton's leftovers.
Run Norton Removal Tool: http://service1.symantec.com/Support/tsgeninfo.nsf/docid/2005033108162039

=================================================================

Uninstall Java(TM) 6 Update 6, and Java(TM) 6 Update 7 through Add\Remove.

==================================================================

Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Please, never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

NOTE. If Combofix asks you to install Recovery Console, please allow it.

Close any open browsers.

WARNING: Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

A333 · 2009/09/01

Hi,

I ahve done all you said. Below please find the ComboFix.txt. I couldn't see any Hijackthis log. But I will send you two fresh DDs.

ComboFix 09-08-31.03 - SHAMS1 09/01/2009 13:34.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2431 [GMT 2:00]
Running from: c:\documents and settings\SHAMS1\My Documents\Downloads\Programs\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\desktop.ini
c:\recycler\NPROTECT
c:\windows\Installer\1b1203.msp
c:\windows\Installer\1b121f.msp
c:\windows\Installer\1b1237.msp
c:\windows\Installer\1b124e.msp
c:\windows\Installer\1b1265.msp
c:\windows\Installer\2c5249.msi
c:\windows\Installer\2c5255.msi
c:\windows\Installer\2c526f.msi
c:\windows\Installer\2c527b.msi
c:\windows\Installer\2c5281.msi
c:\windows\Installer\2c52f8.msi
c:\windows\Installer\2c52fe.msi
c:\windows\Installer\2ebf6.msi
c:\windows\Installer\4d8bb8.msi
c:\windows\Installer\4d8bbe.msi
c:\windows\Installer\4d8bc4.msi
c:\windows\Installer\4d8bca.msi
c:\windows\Installer\4d8bd0.msi
c:\windows\Installer\4d8bd7.msi
c:\windows\Installer\4d8be2.msi
c:\windows\Installer\4d8bf1.msi
c:\windows\Installer\4d8bfd.msi
c:\windows\Installer\4d8c03.msi
c:\windows\Installer\4d8c09.msi
c:\windows\Installer\4d8c0f.msi
c:\windows\Installer\4d8c15.msi
c:\windows\Installer\4d8c1b.msi
c:\windows\Installer\4d8c21.msi
c:\windows\Installer\4d8c27.msi
c:\windows\Installer\4d8c31.msi
c:\windows\Installer\4d8c3b.msi
c:\windows\Installer\4ffcf7.msi
c:\windows\Installer\7066a.msi
c:\windows\Installer\70674.msi
c:\windows\Installer\7067b.msi
c:\windows\Installer\70682.msi
c:\windows\Installer\7068c.msi
c:\windows\Installer\7069a.msi
c:\windows\Installer\706a0.msi
c:\windows\Installer\706a6.msi
c:\windows\Installer\706ac.msi
c:\windows\Installer\706b2.msi
c:\windows\Installer\706b8.msi
c:\windows\Installer\706c4.msi
c:\windows\Installer\706d6.msi
c:\windows\Installer\706e7.msi
c:\windows\Installer\706ed.msi
c:\windows\Installer\706f3.msi
c:\windows\Installer\706f9.msi
c:\windows\Installer\706ff.msi
c:\windows\Installer\70705.msi
c:\windows\Installer\7070b.msi
c:\windows\Installer\70719.msi
c:\windows\Installer\7071f.msi
c:\windows\Installer\70725.msi
c:\windows\Installer\7072b.msi
c:\windows\Installer\70731.msi
c:\windows\Installer\70737.msi
c:\windows\Installer\70741.msi
c:\windows\Installer\77e2aa.msi
c:\windows\Installer\78e823.msi
c:\windows\Installer\80583.msi
c:\windows\Installer\805a7.msi
c:\windows\Installer\805ad.msi
c:\windows\Installer\80f796.msi
c:\windows\Installer\a8b31.msi
c:\windows\Installer\a8b77.msi
c:\windows\Installer\a8b81.msi
c:\windows\Installer\a8b87.msi
c:\windows\Installer\a8b96.msi
c:\windows\Installer\a8be0.msi
c:\windows\Installer\dab140.msp
c:\windows\msvrc20.dll
c:\windows\system32\Memman.vxd
c:\windows\system32\skinboxer43.dll

.
((((((((((((((((((((((((( Files Created from 2009-08-01 to 2009-09-01 )))))))))))))))))))))))))))))))
.

2009-09-01 06:09 . 2009-09-01 06:09 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-08-28 19:15 . 2008-06-12 10:09 33088 ----a-w- c:\documents and settings\SHAMS1\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-08-28 14:52 . 2009-08-05 17:29 3036024 ----a-w- c:\documents and settings\SHAMS1\Application Data\Simply Super Software\Trojan Remover\ttd61C.exe
2009-08-27 17:47 . 2009-07-14 18:54 1706528 ----a-w- c:\windows\system32\nvcuvenc.dll
2009-08-27 17:47 . 2009-07-14 18:54 1597690 ----a-w- c:\windows\system32\nvdata.bin
2009-08-25 11:22 . 2009-08-25 11:22 80400 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav9exec\9.0.0.459\mzvkbd3.dll
2009-08-25 11:22 . 2009-08-25 11:22 80400 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav9exec\9.0.0.459\mzvkbd.dll
2009-08-25 11:22 . 2009-08-25 11:22 264720 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav9exec\9.0.0.459\klwtbbho.dll
2009-08-25 11:22 . 2009-08-25 11:22 59920 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.459\mzvkbd.dll
2009-08-25 11:22 . 2009-08-25 11:22 264720 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.459\klwtbbho.dll
2009-08-25 11:22 . 2009-08-25 11:22 109072 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.459\mzvkbd3.dll
2009-08-22 09:53 . 2009-08-22 09:53 -------- d-----w- c:\program files\VS Revo Group
2009-08-18 13:38 . 2007-12-14 10:04 551680 ----a-r- c:\windows\system32\drivers\rt2870.sys
2009-08-17 09:43 . 2006-12-07 08:45 110592 ----a-w- c:\documents and settings\SHAMS1\Application Data\U3\temp\cleanup.exe
2009-08-17 09:34 . 2006-12-07 08:45 3096576 ---ha-w- c:\documents and settings\SHAMS1\Application Data\U3\temp\Launchpad Removal.exe
2009-08-17 09:33 . 2009-08-17 09:34 -------- d-----w- c:\documents and settings\SHAMS1\Application Data\U3
2009-08-15 08:56 . 2009-08-15 08:56 -------- d-----w- c:\documents and settings\SHAMS2\Local Settings\Application Data\Mozilla
2009-08-08 07:46 . 2009-08-08 07:46 -------- d-----w- c:\documents and settings\SHAMS1\Local Settings\Application Data\IsolatedStorage
2009-08-08 07:07 . 2009-08-08 07:07 -------- d-----w- c:\documents and settings\SHAMS1\Local Settings\Application Data\Pinnacle
2009-08-08 06:59 . 2009-08-08 06:59 129 ------w- c:\documents and settings\SHAMS1\Local Settings\Application Data\fusioncache.dat
2009-08-08 06:59 . 2009-08-28 05:55 -------- d-----w- c:\documents and settings\SHAMS1\Local Settings\Application Data\ApplicationHistory
2009-08-08 06:57 . 1998-11-02 18:57 57856 ------w- c:\windows\system32\MASD32.DLL
2009-08-08 06:57 . 1998-11-02 18:57 27648 ------w- c:\windows\system32\MA32.DLL
2009-08-08 06:57 . 1998-11-02 18:57 196096 ------w- c:\windows\system32\MACD32.DLL
2009-08-08 06:57 . 1998-11-02 18:57 138752 ------w- c:\windows\system32\MASE32.DLL
2009-08-08 06:57 . 1998-11-02 18:57 136192 ------w- c:\windows\system32\MAMC32.DLL
2009-08-08 06:57 . 2004-06-03 10:47 385100 ------w- c:\windows\system32\MSVCRTD.DLL
2009-08-08 06:57 . 2003-03-19 04:28 2179072 ------w- c:\windows\system32\mfc71d.dll
2009-08-08 06:57 . 2003-03-19 03:04 765952 ------w- c:\windows\system32\msvcp71d.dll
2009-08-08 06:57 . 2003-03-19 03:03 544768 ------w- c:\windows\system32\msvcr71d.dll
2009-08-08 06:57 . 2002-01-05 19:16 737280 ------w- c:\windows\system32\msvcp70d.dll
2009-08-08 06:57 . 2002-01-05 19:16 536576 ------w- c:\windows\system32\msvcr70d.dll
2009-08-08 06:55 . 2006-12-01 21:54 548864 ------w- c:\windows\system32\msvcp80.dll
2009-08-08 06:55 . 2009-08-08 06:55 -------- d-----w- c:\program files\Pinnacle
2009-08-08 06:55 . 2006-12-01 21:54 626688 ------w- c:\windows\system32\msvcr80.dll
2009-08-08 06:52 . 2009-08-08 07:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Pinnacle
2009-08-08 06:51 . 2008-04-13 18:46 15232 -c--a-w- c:\windows\system32\dllcache\mpe.sys
2009-08-08 06:51 . 2008-04-13 18:46 15232 ----a-w- c:\windows\system32\drivers\MPE.sys
2009-08-08 06:50 . 2006-11-22 07:53 1121536 ----a-r- c:\windows\system32\drivers\3xHybrid.sys
2009-08-08 06:50 . 2003-02-27 08:07 3072 ----a-r- c:\windows\system32\34CoInstaller.dll
2009-08-08 06:50 . 2008-04-14 00:12 363520 -c--a-w- c:\windows\system32\dllcache\psisdecd.dll
2009-08-08 06:50 . 2008-04-14 00:12 363520 ----a-w- c:\windows\system32\PsisDecd.dll
2009-08-08 06:50 . 2008-04-13 18:46 11776 -c--a-w- c:\windows\system32\dllcache\bdasup.sys
2009-08-08 06:50 . 2008-04-13 18:46 11776 ----a-w- c:\windows\system32\drivers\BdaSup.sys
2009-08-05 13:52 . 2009-08-05 13:52 152576 ------w- c:\documents and settings\SHAMS1\Application Data\Sun\Java\jre1.6.0_15\lzma.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-01 11:49 . 2009-06-28 16:02 -------- d-----w- c:\documents and settings\SHAMS1\Application Data\DMCache
2009-09-01 11:48 . 2008-07-20 20:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-09-01 07:21 . 2006-04-22 15:56 -------- d-----w- c:\program files\Java
2009-08-28 14:52 . 2007-11-02 14:24 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-27 17:48 . 2007-05-19 06:38 -------- d-----w- c:\program files\NVIDIA Corporation
2009-08-27 17:48 . 2007-05-19 06:38 -------- d-----w- c:\documents and settings\All Users\Application Data\NVIDIA Corporation
2009-08-22 10:23 . 2006-03-30 12:17 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-22 07:19 . 2008-09-20 17:13 -------- d-----w- c:\program files\Trojan Remover
2009-08-20 16:16 . 2009-02-05 20:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-19 14:08 . 2007-10-22 13:32 -------- d-----w- c:\program files\DU Meter
2009-08-13 16:58 . 2007-05-16 12:02 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-13 07:49 . 2006-12-24 11:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-08-11 18:08 . 2009-02-19 11:42 110680 ----a-w- c:\documents and settings\My Sepy\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-09 14:21 . 2009-02-14 08:07 -------- d-----w- c:\program files\jv16 PowerTools 2009
2009-08-08 07:07 . 2009-02-18 07:24 110680 ------w- c:\documents and settings\SHAMS1\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-05 13:54 . 2008-05-03 19:05 -------- d-----w- c:\program files\Microsoft Silverlight
2009-08-05 09:01 . 2004-08-04 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-26 07:46 . 2008-05-02 17:05 -------- d-----w- c:\program files\UPHClean
2009-07-25 03:23 . 2008-10-25 08:09 411368 -c--a-w- c:\windows\system32\deploytk.dll
2009-07-23 11:57 . 2008-07-20 20:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-07-20 12:58 . 2009-07-20 12:55 -------- d-----w- c:\program files\Unlocker
2009-07-19 18:50 . 2007-09-19 18:54 -------- d-----w- c:\program files\Internet Download Manager
2009-07-19 17:05 . 2009-07-19 17:02 -------- d-----w- c:\documents and settings\SHAMS1\Application Data\SUPERAntiSpyware.com
2009-07-17 19:01 . 2004-08-04 12:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-17 14:24 . 2009-04-01 16:38 -------- d-----w- c:\program files\Knowbase
2009-07-14 18:54 . 2009-04-22 11:34 2189856 ----a-w- c:\windows\system32\nvcuvid.dll
2009-07-14 18:54 . 2008-10-08 12:52 2002944 ----a-w- c:\windows\system32\nvcuda.dll
2009-07-14 18:54 . 2006-07-12 12:19 868352 ----a-w- c:\windows\system32\nvapi.dll
2009-07-14 18:54 . 2006-03-30 12:12 485920 -c--a-w- c:\windows\system32\nvudisp.exe
2009-07-14 18:54 . 2006-03-30 12:12 10457088 ----a-w- c:\windows\system32\nvoglnt.dll
2009-07-14 18:54 . 2006-03-30 12:12 7741664 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2009-07-14 18:54 . 2006-03-30 12:12 5842816 ----a-w- c:\windows\system32\nv4_disp.dll
2009-07-14 18:54 . 2006-03-30 12:12 151552 ----a-w- c:\windows\system32\nvcodins.dll
2009-07-14 18:54 . 2006-03-30 12:12 151552 ----a-w- c:\windows\system32\nvcod.dll
2009-07-14 11:35 . 2009-07-14 11:35 2173472 ----a-w- c:\windows\system32\nvcplui.exe
2009-07-14 11:35 . 2009-07-14 11:35 81920 ----a-w- c:\windows\system32\nvwddi.dll
2009-07-14 11:35 . 2009-07-14 11:35 4026368 ----a-w- c:\windows\system32\nvvitvs.dll
2009-07-14 11:35 . 2009-07-14 11:35 3170304 ----a-w- c:\windows\system32\nvwss.dll
2009-07-14 11:34 . 2009-07-14 11:34 86016 ----a-w- c:\windows\system32\nvmctray.dll
2009-07-14 11:34 . 2009-07-14 11:34 4923392 ----a-w- c:\windows\system32\nvdisps.dll
2009-07-14 11:34 . 2009-07-14 11:34 3547136 ----a-w- c:\windows\system32\nvgames.dll
2009-07-14 11:34 . 2009-07-14 11:34 188416 ----a-w- c:\windows\system32\nvmccss.dll
2009-07-14 11:34 . 2009-07-14 11:34 168004 ----a-w- c:\windows\system32\nvsvc32.exe
2009-07-14 11:34 . 2009-07-14 11:34 143360 ----a-w- c:\windows\system32\nvcolor.exe
2009-07-14 11:34 . 2009-07-14 11:34 13877248 ----a-w- c:\windows\system32\nvcpl.dll
2009-07-14 11:34 . 2009-07-14 11:34 1286144 ----a-w- c:\windows\system32\nvmobls.dll
2009-07-14 11:34 . 2009-07-14 11:34 229376 ----a-w- c:\windows\system32\nvmccs.dll
2009-07-13 21:43 . 2004-08-04 12:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-11 07:28 . 2009-07-11 07:28 -------- d-----w- c:\documents and settings\SHAMS1\Application Data\Creative
2009-07-10 12:46 . 2009-06-10 12:02 -------- d-----w- c:\program files\CyberLink
2009-07-10 12:45 . 2009-07-10 12:45 36864 ----a-w- c:\documents and settings\All Users\Application Data\TEMP\{01FB4998-33C4-4431-85ED-079E3EEFE75D}\PostBuild.exe
2009-07-10 12:42 . 2009-07-10 12:42 -------- d-----w- c:\documents and settings\All Users\Application Data\CyberLink
2009-07-10 05:01 . 2007-03-01 13:59 485920 -c--a-w- c:\windows\system32\NVUNINST.EXE
2009-07-09 15:52 . 2009-07-09 15:52 59992 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 2010 9.0.0.463\English\setup.exe
2009-07-09 15:12 . 2009-05-24 13:30 128016 ----a-w- c:\windows\system32\drivers\kl1.sys
2009-07-09 15:12 . 2009-07-09 15:12 296976 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.459\sys\i386\5.1\klif.sys
2009-07-09 15:12 . 2009-07-09 15:12 128016 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.459\sys\i386\kl1.sys
2009-07-07 14:32 . 2009-07-07 14:32 932368 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\profiles-1-6.dll
2009-07-07 14:32 . 2009-07-07 14:32 678416 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\content_interpreter-1-1.dll
2009-07-07 14:32 . 2009-07-07 14:32 604688 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\gsg-3-9.dll
2009-07-07 14:32 . 2009-07-07 14:32 1096208 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\filtration-4-6.dll
2009-07-07 14:32 . 2009-07-07 14:32 522768 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\database-1-5.dll
2009-07-07 14:29 . 2009-07-07 14:29 604140 --sha-w- c:\windows\system32\drivers\ISwift3.dat
2009-07-07 14:24 . 2008-07-20 20:10 7728 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-07-07 14:24 . 2008-07-20 20:10 6766624 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-07-07 14:24 . 2008-07-20 20:10 54992 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-07-07 14:24 . 2008-07-20 20:10 1638432 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-07-07 14:22 . 2008-07-20 20:10 -------- d-----w- c:\program files\Kaspersky Lab
2009-07-03 17:09 . 2004-08-04 12:00 915456 ----a-w- c:\windows\system32\wininet.dll
2009-07-03 13:48 . 2009-07-03 13:48 219664 ----a-w- c:\windows\system32\klogon.dll
2009-07-03 13:45 . 2009-07-03 13:45 27507 ----a-w- c:\windows\system32\drivers\klopp.dat
2009-07-01 10:26 . 2009-07-01 10:26 109136 -c--a-w- c:\documents and settings\SHAMS2\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-28 16:02 . 2009-06-28 16:02 198064 ------w- c:\documents and settings\SHAMS1\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
2009-06-26 12:34 . 2009-06-26 12:34 2070808 ----a-w- c:\windows\system32\AutoPartNt.exe
2009-06-25 08:25 . 2008-05-12 11:23 730112 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:25 . 2008-05-12 11:23 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:25 . 2008-05-12 11:23 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:25 . 2004-08-04 12:00 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:25 . 2004-08-04 12:00 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:25 . 2004-08-04 12:00 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-24 11:18 . 2008-05-12 11:23 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-24 10:04 . 2009-06-24 10:04 902592 ----a-w- c:\windows\system32\drivers\tdrpm228.sys
2009-06-24 10:04 . 2009-06-24 10:04 138208 ----a-w- c:\windows\system32\drivers\snapman.sys
2009-06-16 14:36 . 2004-08-04 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2004-08-04 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-12 12:31 . 2004-08-04 12:00 80896 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 . 2004-08-04 12:00 76288 ----a-w- c:\windows\system32\telnet.exe
2009-06-10 14:13 . 2004-08-04 12:00 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 07:19 . 2006-03-30 11:58 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:14 . 2008-05-12 11:23 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-04 16:00 . 2009-06-04 16:00 59992 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 2010 9.0.0.459\English\setup.exe
2009-06-03 19:09 . 2004-08-04 12:00 1291264 ----a-w- c:\windows\system32\quartz.dll
2007-09-27 17:34 . 2007-09-27 17:34 2293712 -c--a-w- c:\program files\FLV PlayerFCSetup.exe
2007-07-07 17:36 . 2007-07-07 17:36 774144 -c--a-w- c:\program files\RngInterstitial.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2008-06-04 11:14 . 2008-06-04 11:14 23 -csha-w- c:\windows\system32\aebed7_z.dll
2009-05-30 10:59 . 2009-05-30 10:59 23 --sha-w- c:\windows\system32\edacded0.dat
2009-02-14 08:07 . 2009-02-14 08:07 23 --sha-w- c:\windows\system32\edacded0_x.dat
2008-02-17 08:34 . 2008-02-17 08:34 23 -csha-w- c:\windows\system32\fffbbf_r.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]
2007-09-27 17:36 1453080 -c--a-w- c:\program files\Freecorder\tbFre1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{1392b8d2-5c05-419f-a8f6-b9f15a596612} "= "c:\program files\Freecorder\tbFre1.dll" [2007-09-27 1453080]

[HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Livestation "= "c:\program files\Livestation\Livestation.exe" [2009-03-30 2027520]
"IDMan "= "c:\program files\Internet Download Manager\IDMan.exe" [2009-05-27 2815408]
"PMCLoader "= "c:\program files\Pinnacle\TVCenter Pro\PMCLoader.exe" [2007-07-26 105544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TrueImageMonitor.exe "= "c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2009-05-24 4359776]
"AcronisTimounterMonitor "= "c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe" [2009-05-24 960616]
"Acronis Scheduler2 Service "= "c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2009-05-24 377304]
"PivotSoftware "= "c:\program files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 694008]
"DT HPW "= "c:\program files\Common Files\Portrait Displays\Shared\DT_startup.exe" [2008-06-24 81920]
"avp "= "c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2009-07-03 303376]
"UCam_Menu "= "c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2008-06-13 210216]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"Name of App "= "c:\program files\SAMSUNG\FW LiveUpdate\FWManager.exe" [2009-07-15 692340]
"nwiz "= "c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2009-07-08 1657376]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2009-07-14 86016]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2009-07-14 13877248]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"SigmatelSysTrayApp "= "stsystra.exe" - c:\windows\stsystra.exe [2009-02-09 339968]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5} "= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"CTHelper "=CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\LimeWire\\LimeWire.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE "=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE "=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE "=
"c:\\WINDOWS\\system32\\java.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
"c:\\Program Files\\Messenger\\Msmsgs.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP "= 3389:TCPxpsp2res.dll,-22009
"1723:TCP "= 1723:TCPxpsp2res.dll,-22015
"1701:UDP "= 1701:UDPxpsp2res.dll,-22016
"500:UDP "= 500:UDPxpsp2res.dll,-22017

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [1/29/2008 6:29 PM 33808]
R0 stmtpm;STM TPM Service;c:\windows\system32\drivers\stm_tpm.sys [4/1/2006 12:09 AM 21504]
R0 tdrpman228;Acronis Try&Decide and Restore Points filter (build 228);c:\windows\system32\drivers\tdrpm228.sys [6/24/2009 12:04 PM 902592]
R2 DUMeterSvc;DU Meter Service;c:\program files\DU Meter\DUMeterSvc.exe [12/4/2007 8:55 PM 1387544]
R2 NVIDIA Performance Driver Service;NVIDIA Performance Driver Service;c:\program files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe [5/14/2009 9:01 AM 4440064]
R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [5/1/2008 7:38 PM 2368]
R3 3xHybrid;Pinnacle PCTV 100i-110i-300i-310i-MCE;c:\windows\system32\drivers\3xHybrid.sys [8/8/2009 8:50 AM 1121536]
R3 COMMONFX.SYS;COMMONFX.SYS;c:\windows\system32\drivers\COMMONFX.sys [3/4/2009 2:42 PM 99352]
R3 CTAUDFX.SYS;CTAUDFX.SYS;c:\windows\system32\drivers\CTAUDFX.sys [3/4/2009 2:42 PM 555032]
R3 CTSBLFX.SYS;CTSBLFX.SYS;c:\windows\system32\drivers\CTSBLFX.sys [3/4/2009 2:42 PM 566296]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [5/16/2009 8:59 PM 19472]
R3 rt2870;Linksys 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [8/18/2009 3:38 PM 551680]
S3 COMMONFX;COMMONFX;c:\windows\system32\drivers\COMMONFX.sys [3/4/2009 2:42 PM 99352]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [5/29/2009 2:58 PM 79360]
S3 CTAUDFX;CTAUDFX;c:\windows\system32\drivers\CTAUDFX.sys [3/4/2009 2:42 PM 555032]
S3 CTERFXFX.SYS;CTERFXFX.SYS;c:\windows\system32\drivers\CTERFXFX.sys [3/4/2009 2:42 PM 100888]
S3 CTERFXFX;CTERFXFX;c:\windows\system32\drivers\CTERFXFX.sys [3/4/2009 2:42 PM 100888]
S3 CTSBLFX;CTSBLFX;c:\windows\system32\drivers\CTSBLFX.sys [3/4/2009 2:42 PM 566296]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [5/13/2009 5:46 PM 31760]
S3 PPDrv;PPDrv; [x]
S4 Rdbssatcwpth;Rdbssatcwpth; [x]

--- Other Services/Drivers In Memory ---

*Deregistered* - uphcleanhlp

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll ",BrandIEActiveSetup SIGNUP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe "
.
Contents of the 'Scheduled Tasks' folder

2009-02-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2009-09-01 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 10:20]

2009-08-27 c:\windows\Tasks\Defraggler Volume C Task.job
- c:\program files\Defraggler\df.exe [2009-05-11 13:47]

2009-02-05 c:\windows\Tasks\ParetoLogic Privacy Controls_{151696A8-F390-11DD-877A-0018F8A86A12}.job
- c:\program files\ParetoLogic\Privacy Controls\Pareto_PC.exe [2008-11-25 10:27]

2009-03-09 c:\windows\Tasks\ParetoLogic Privacy Controls_{9A32DD2C-0CD8-11DE-8821-0018F8A86A12}.job
- c:\program files\ParetoLogic\Privacy Controls\Pareto_PC.exe [2008-11-25 10:27]

2009-06-22 c:\windows\Tasks\ParetoLogic Privacy Controls_{9A6B7ABA-F38D-11DD-877A-0018F8A86A12}.job
- c:\program files\ParetoLogic\Privacy Controls\Pareto_PC.exe [2008-11-25 10:27]

2009-08-20 c:\windows\Tasks\ParetoLogic Registration.job
- c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [2008-02-22 11:25]

2009-08-22 c:\windows\Tasks\ParetoLogic Update Version2.job
- c:\program files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2008-02-22 11:25]

2009-09-01 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2009-06-10 22:28]

2009-09-01 c:\windows\Tasks\RegCure Startup.job
- c:\program files\RegCure\RegCure.exe [2009-06-10 22:28]

2009-06-26 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2009-06-10 22:28]

2009-09-01 c:\windows\Tasks\User_Feed_Synchronization-{1D5A943D-5DD1-4EF1-A125-7AB70DCCBC4E}.job
- c:\windows\system32\msfeedssync.exe [2006-08-22 02:31]

2009-09-01 c:\windows\Tasks\User_Feed_Synchronization-{34DF8543-DCA0-435E-AC2F-501DE9E5A701}.job
- c:\windows\system32\msfeedssync.exe [2006-08-22 02:31]
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{9CB65206-89C4-402c-BA80-02D8C59F9B1D} - (no file)

.
------- Supplementary Scan -------
.
uStart Page = hxxp://news.google.com/
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{1F958B09-3312-7f0e-9723-4C1324C57B20}
LSP: c:\windows\system32\idmmbc.dll
Trusted Zone: 4irany.com\www
Trusted Zone: c-span.org
Trusted Zone: google.com\news
Trusted Zone: microsoft.com\update
Trusted Zone: radis.org
Trusted Zone: samsungodd.com\www
TCP: {A0722B6E-E533-459C-B5CA-439F82D0F592} = 192.168.1.1,212.217.0.1
TCP: {EC0FDAB6-CFBC-4E8E-921B-908A7018B283} = 194.230.1.103,194.230.1.39
DPF: {680285A8-96D3-43DA-9D3D-51DD987D0B77}
FF - ProfilePath - c:\documents and settings\SHAMS1\Application Data\Mozilla\Firefox\Profiles\xgto0m36.default\
FF - prefs.js: browser.startup.homepage - hxxp://news.google.com/
FF - component: c:\documents and settings\SHAMS1\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
FF - component: c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPAbacheck.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npracplug.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-01 13:47
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\DUMeterSvc]
"ImagePath "= "c:\program files\DU Meter\DUMeterSvc.exe /startedbyscm:E1F6D4BE-40E33354-DUMeterService "
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Multimedia\MIDIMap]
@DACL=(02 0000)
"DeviceInterface "= "\\\\?\\PCI#VEN_1102&DEV_0004&SUBSYS_10031102&REV_04#4&5855be9&0&20F0#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\\SynthA "
"SetupPreferredAudioDevicesCount "=dword:0000000a
"szPname "= "SB Audigy 2 Synth A [DCC0] "

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card0]
@DACL=(02 0000)
"Name "= "None (Direct Dial) "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "=" "
"InternationalAccessNumber "=" "
"LocalRule "=" "
"LDRule "=" "
"InternationalRule "=" "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card1]
@DACL=(02 0000)
"Name "= "AT&T Direct Dial via 1010ATT1 "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "= "1010288 "
"InternationalAccessNumber "= "1010288 "
"LocalRule "= "G "
"LDRule "= "J1FG "
"InternationalRule "= "J011EFG "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card10]
@DACL=(02 0000)
"Name "= "US Sprint via 10103330 "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "= "1010333 "
"InternationalAccessNumber "= "1010333 "
"LocalRule "= "G "
"LDRule "= "J0FG$TH "
"InternationalRule "= "J01EFG$TH "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card11]
@DACL=(02 0000)
"Name "= "US Sprint via 1-800-877-8000 "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "= "18008778000 "
"InternationalAccessNumber "= "18008778000 "
"LocalRule "= "G "
"LDRule "= "J,,,T0FG,,H "
"InternationalRule "= "J,,,T01EFG#,H "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card12]
@DACL=(02 0000)
"Name "= "Calling Card via 0 "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "=" "
"InternationalAccessNumber "=" "
"LocalRule "= "G "
"LDRule "= "0FG$TH "
"InternationalRule "= "01EFG$TH "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card13]
@DACL=(02 0000)
"Name "= "Carte France Telecom "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "=" "
"InternationalAccessNumber "=" "
"LocalRule "= "T3010,H,0FG# "
"LDRule "= "T3010,H,0FG# "
"InternationalRule "= "T3010,H,00EFG# "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card14]
@DACL=(02 0000)
"Name "= "Mercury (UK) "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "= "0500800800 "
"LDAccessNumber "= "0500800800 "
"InternationalAccessNumber "= "0500800800 "
"LocalRule "= "J$TH,0FG "
"LDRule "= "J$TH,0FG "
"InternationalRule "= "J$TH,0FG "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card15]
@DACL=(02 0000)
"Name "= "British Telecom (UK) "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "= "144 "
"LDAccessNumber "= "144 "
"InternationalAccessNumber "= "144 "
"LocalRule "= "J$H,0FG "
"LDRule "= "J$H,0FG "
"InternationalRule "= "J$H,00EFG "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card16]
@DACL=(02 0000)
"Name "= "CLEAR Communications (New Zealand) "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "= "0502333 "
"LDAccessNumber "= "0502333 "
"InternationalAccessNumber "= "0502333 "
"LocalRule "= "J$TH,0FG "
"LDRule "= "J$TH,0FG "
"InternationalRule "= "J$TH,00EFG "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card17]
@DACL=(02 0000)
"Name "= "Telecom New Zealand "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "= "012 "
"LDAccessNumber "= "012 "
"InternationalAccessNumber "= "012 "
"LocalRule "= "J,0FG?H "
"LDRule "= "J,0FG?H "
"InternationalRule "= "J,00EFG?H "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card18]
@DACL=(02 0000)
"Name "= "Global Card (Taiwan to USA) "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "=" "
"InternationalAccessNumber "= "0080 "
"LocalRule "= "G "
"LDRule "= "0FG "
"InternationalRule "= "J,102880$TFG$H "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card19]
@DACL=(02 0000)
"Name "= "Telstra (Australia) via 1818 (voice) "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "= "1818 "
"LDAccessNumber "= "1818 "
"InternationalAccessNumber "= "1818 "
"LocalRule "= "J$TH,FG# "
"LDRule "= "J$TH,FG# "
"InternationalRule "= "J$TH,0011EFG# "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card2]
@DACL=(02 0000)
"Name "= "AT&T via 1010ATT0 "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "= "1010288 "
"InternationalAccessNumber "= "1010288 "
"LocalRule "= "G "
"LDRule "= "J0FG$TH "
"InternationalRule "= "J01EFG$TH "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card20]
@DACL=(02 0000)
"Name "= "Telstra (Australia) via 1818 (fax) "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "= "1818 "
"LDAccessNumber "= "1818 "
"InternationalAccessNumber "= "1818 "
"LocalRule "= "J$TH,FG# "
"LDRule "= "J$TH,FG# "
"InternationalRule "= "J$TH,0015EFG# "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card21]
@DACL=(02 0000)
"Name "= "Optus (Australia) via 1812 "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "=" "
"InternationalAccessNumber "= "1812 "
"LocalRule "= "FG "
"LDRule "= "FG "
"InternationalRule "= "J@TH,0011EFG "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card22]
@DACL=(02 0000)
"Name "= "Optus (Australia) via 008551812 "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "=" "
"InternationalAccessNumber "= "008551812 "
"LocalRule "= "FG "
"LDRule "= "FG "
"InternationalRule "= "J@TH,0011EFG "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card3]
@DACL=(02 0000)
"Name "= "AT&T via 1-800-321-0288 "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "= "18003210288 "
"InternationalAccessNumber "= "18003210288 "
"LocalRule "= "G "
"LDRule "= "J$TFG$TH "
"InternationalRule "= "J$T01EFG$TH "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card4]
@DACL=(02 0000)
"Name "= "MCI Direct Dial via 10102221 "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "= "1010222 "
"InternationalAccessNumber "= "1010222 "
"LocalRule "= "G "
"LDRule "= "J1FG "
"InternationalRule "= "J011EFG "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card5]
@DACL=(02 0000)
"Name "= "MCI via 10102220 "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "= "1010222 "
"InternationalAccessNumber "= "1010222 "
"LocalRule "= "G "
"LDRule "= "J0FG$TH "
"InternationalRule "= "J01EFG$TH "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card6]
@DACL=(02 0000)
"Name "= "MCI via 1-800-888-8000 "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "= "18008888000 "
"InternationalAccessNumber "= "18008888000 "
"LocalRule "= "G "
"LDRule "= "J,,,,,,TH,,FG "
"InternationalRule "= "J,,,,,,TH,,011EFG "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card7]
@DACL=(02 0000)
"Name "= "MCI via 1-800-674-0700 "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "= "18006740700 "
"InternationalAccessNumber "= "18006740700 "
"LocalRule "= "G "
"LDRule "= "J,,,,,,TH,,FG "
"InternationalRule "= "J,,,,,,TH,,011EFG "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card8]
@DACL=(02 0000)
"Name "= "MCI via 1-800-674-7000 "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "= "18006747000 "
"InternationalAccessNumber "= "18006747000 "
"LocalRule "= "G "
"LDRule "= "J,,,,,,TH,,FG "
"InternationalRule "= "J,,,,,,TH,,011EFG "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card9]
@DACL=(02 0000)
"Name "= "US Sprint Direct Dial via 10103331 "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "= "1010333 "
"InternationalAccessNumber "= "1010333 "
"LocalRule "= "G "
"LDRule "= "J1FG "
"InternationalRule "= "J011EFG "
"Flags "=dword:00000001

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Abacast\Client]
@DACL=(02 0000)
"Version "= "v1.62 "
"ReconnectAttempts "=dword:00000014
"ReconnectDelay "=dword:00001388
"GUID "= "{C4E58F98-99F9-4E07-A760-618F683C6903} "
"PosY "=dword:000000c6
"PosX "=dword:00000084
"LastServer "= "wm.afnl.abacast.com:80/afnl-wm-56 "
"loport "=dword:00000fa0
"hiport "=dword:00001004
"AutoTaskTray "=dword:00000001
"LastAddr "= "adsp://wm.afnl.abacast.com:80/afnl-wm-56?launchPlayer=false&displayerrors=false& "
"SOCKSServer "=" "
"SOCKSPort "=dword:00000438
"PingTime "=dword:0000003c
"SOCKS "=dword:00000000
"MediaPort "=dword:00000fa1
"ACWH "=dword:00030564
"CCS "= "adsp://wm.afnl.abacast.com:80/afnl-wm-56?launchPlayer=false&displayerrors=false& "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1063439b-dc44-45c8-a721-140b94538b89}]
@Denied: (Full) (Everyone)
"Model "=dword:00000050
"Therad "=dword:0000001f
"MData "=hex(0):83,a4,f9,ff,b3,e5,66,cc,8b,1e,5b,6c,e0,41,b9,e5,9b,68,b6,42,29,
d8,f3,88,04,a3,b7,bd,5b,11,77,40,a9,9c,2a,86,78,06,a9,58,70,62,dd,25,31,01,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel "= "Apartment "
@= "c:\\WINDOWS\\system32\\OLE32.DLL "
"cd042efbbd7f7af1647644e76e06692b "=hex:c8,28,51,af,b0,29,a3,98,7f,76,93,36,ef,
de,dd,68,e2,63,26,f1,3f,c8,ff,68,26,41,88,07,3c,76,ae,32,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel "= "Apartment "
@= "c:\\WINDOWS\\system32\\OLE32.DLL "
"bca643cdc5c2726b20d2ecedcc62c59b "=hex:71,3b,04,66,8b,46,0d,96,fe,29,7f,7c,67,
98,77,96,6a,9c,d6,61,af,45,84,18,2c,2d,43,fa,d2,42,9e,75,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel "= "Apartment "
@= "c:\\WINDOWS\\system32\\OLE32.DLL "
"2c81e34222e8052573023a60d06dd016 "=hex:ff,7c,85,e0,43,d4,0e,fe,ba,d3,3e,a0,98,
b0,d8,58,ff,7c,85,e0,43,d4,0e,fe,5c,76,85,dc,99,7d,7c,43,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel "= "Apartment "
@= "c:\\WINDOWS\\system32\\OLE32.DLL "
"2582ae41fb52324423be06337561aa48 "=hex:3e,1e,9e,e0,57,5a,93,61,61,90,8b,6a,d2,
50,7c,f4,86,8c,21,01,be,91,eb,e7,0d,87,20,b2,b6,8f,7a,2f,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk "=hex(0):8e,c0,1a,9b,ec,f3,60,82,6c,9d,fa,01,f0,90,ae,3c,2c,80,c7,73,c1,
c9,8e,61,8e,eb,97,49,00,1d,c1,27,46,fa,00,49,98,fb,03,9a,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel "= "Apartment "
@= "c:\\WINDOWS\\system32\\OLE32.DLL "
"caaeda5fd7a9ed7697d9686d4b818472 "=hex:f5,1d,4d,73,a8,13,5c,05,d3,00,ee,e2,42,
32,2f,a3,f5,1d,4d,73,a8,13,5c,05,6a,c6,1f,df,dc,3b,20,ae,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel "= "Apartment "
@= "c:\\WINDOWS\\system32\\OLE32.DLL "
"a4a1bcf2cc2b8bc3716b74b2b4522f5d "=hex:df,20,58,62,78,6b,cf,c8,01,eb,bf,1d,0d,
e1,39,19,df,20,58,62,78,6b,cf,c8,b9,d4,f8,85,d2,06,33,1c,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel "= "Apartment "
@= "c:\\WINDOWS\\system32\\OLE32.DLL "
"4d370831d2c43cd13623e232fed27b7b "=hex:31,77,e1,ba,b1,f8,68,02,05,4c,31,68,e9,
11,9e,f7,fb,a7,78,e6,12,2f,9a,ea,a7,d7,36,de,a1,66,30,54,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel "= "Apartment "
@= "c:\\WINDOWS\\system32\\OLE32.DLL "
"1d68fe701cdea33e477eb204b76f993d "=hex:01,3a,48,fc,e8,04,4a,f1,fd,0b,f8,77,1e,
51,66,39,01,3a,48,fc,e8,04,4a,f1,63,97,c7,ba,ac,58,60,19,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel "= "Apartment "
@= "c:\\WINDOWS\\system32\\OLE32.DLL "
"1fac81b91d8e3c5aa4b0a51804d844a3 "=hex:51,fa,6e,91,28,9e,14,cc,91,70,19,85,7d,
d9,2b,50,f6,0f,4e,58,98,5b,89,c9,37,64,98,c6,22,0f,fe,65,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel "= "Apartment "
@= "c:\\WINDOWS\\system32\\OLE32.DLL "
"f5f62a6129303efb32fbe080bb27835b "=hex:37,a4,aa,c3,a6,15,56,0a,59,6e,36,72,2b,
16,b3,c3,3d,ce,ea,26,2d,45,aa,78,47,ea,95,63,2b,bb,8e,a4,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel "= "Apartment "
@= "c:\\WINDOWS\\system32\\OLE32.DLL "
"fd4e2e1a3940b94dceb5a6a021f2e3c6 "=hex:f8,31,0f,a9,5f,a0,ec,fb,c5,ad,11,12,6d,
8f,e8,5c,2a,b7,cc,b5,b9,7f,41,e7,09,79,c5,41,79,5f,01,54,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel "= "Apartment "
@= "c:\\WINDOWS\\system32\\OLE32.DLL "
"8a8aec57dd6508a385616fbc86791ec2 "=hex:6c,43,2d,1e,aa,22,2f,9c,8a,96,f8,f9,24,
2f,42,a3,6c,43,2d,1e,aa,22,2f,9c,7c,c4,47,a2,01,82,9d,bd,6c,43,2d,1e,aa,22,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Windows\AutorunsDisabled]
"Appinit_Dlls "= "sockspy.dll "

[HKEY_LOCAL_MACHINE\software\SupportSoft\RemoteAssistant]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\SymNRT\LTM]
@DACL=(02 0000)
"FontCacheState "=dword:44ff4447

[HKEY_LOCAL_MACHINE\software\SystemRequirementsLab\nvd]
@DACL=(02 0000)
"LibPath "= "c:\\Program Files\\SystemRequirementsLab\\systemnvd.dll "

[HKEY_LOCAL_MACHINE\software\The Silicon Realms Toolworks\Armadillo]
@DACL=(02 0000)
"{0F943452EDEBA2F7C} "=hex:bb,75,7b,38,04,ae,52,5f,7f,68,ef,02,ed,f6,0e,26,86,
5a,83,ab,37

[HKEY_LOCAL_MACHINE\software\Tracker Software\PDF-XChange 3.0]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Tracker Software\pdfxctrl.PdfPrinterPreferences]
@DACL=(02 0000)
"XCL_PATH "= "c:\\Program Files\\Tracker Software\\PDF-XChange 3\\AxLanguages\\ "

[HKEY_LOCAL_MACHINE\software\Ulead Systems\Ulead CD/DVD Writing Engine]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Wise Solutions\Wise Installation System]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Xing Technology Corp.\SharedDlls]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Yahoo\Companion]
@DACL=(02 0000)
"Corp "= "none "
"Guest "= "none "
"ft "=dword:00000001
"ii "=dword:00000001
"dc "= "v7_iobit "
"Region "= "us "
"Language "= "us "
"attempt "= "...attempting to retrieve buttons from Yahoo!... "
"swp "=dword:00000001
"pc "= "iobit "
"sc "= "iobit "
"Version "= "6.3.6.0 "
"Apptitle "= "Yahoo! Toolbar "

[HKEY_LOCAL_MACHINE\software\Yahoo\Skin]
@DACL=(02 0000)
"Path "= "c:\\Program Files\\Yahoo!\\Shared\\Graphics "
"DefSkin "= "Indigo\\indigo.xml "

[HKEY_LOCAL_MACHINE\software\Yahoo\Uninstaller]
@DACL=(02 0000)
"ExitCode "=dword:00000000

[HKEY_LOCAL_MACHINE\System\ControlSet002\Enum\HID\Vid_046d&Pid_c016\6&21af8844&0&0000\LogConf]
@DACL=(02 0000)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(1500)
c:\windows\system32\relog_ap.dll

- - - - - - - > 'explorer.exe'(3380)
c:\windows\system32\WININET.dll
c:\program files\NVIDIA Corporation\nView\nview.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\program files\Portrait Displays\Pivot Software\winphook.dll
c:\program files\Internet Download Manager\idmmkb.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\Creative\Shared Files\CTAudSvc.exe
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\windows\system32\bgsvcgen.exe
c:\program files\Common Files\Portrait Displays\Shared\DTSRVC.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\UPHClean\uphclean.exe
c:\windows\system32\MsPMSPSv.exe
c:\windows\system32\searchindexer.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\wscntfy.exe
c:\program files\Portrait Displays\HP My Display\dthtml.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\Portrait Displays\Shared\HookManager.exe
c:\program files\Portrait Displays\Pivot Software\Floater.exe
c:\program files\Internet Download Manager\IEMonitor.exe
.
**************************************************************************
.
Completion time: 2009-09-01 13:55 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-01 11:55

Pre-Run: 212,973,580,288 bytes free
Post-Run: 212,868,558,848 bytes free

867 --- E O F --- 2009-08-26 03:20

A333 · 2009/09/01

This is the fresh follow-up DDS1 log file:

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-07-30.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 10/16/2006 5:53:16 PM
System Uptime: 9/1/2009 1:45:09 PM (1 hours ago)

Motherboard: Dell Inc. | | 0CJ774
Processor: Intel(R) Pentium(R) D CPU 3.20GHz | Microprocessor | 3192/800mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 233 GiB total, 198.26 GiB free.
D: is FIXED (NTFS) - 183 GiB total, 165.899 GiB free.
E: is CDROM ()
F: is CDROM (CDFS)
G: is Removable
H: is Removable
I: is Removable

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP533: 6/3/2009 2:57:14 PM - System Checkpoint
RP534: 6/5/2009 10:09:42 AM - System Checkpoint
RP535: 6/7/2009 8:01:15 PM - System Checkpoint
RP536: 6/9/2009 8:44:41 AM - System Checkpoint
RP537: 6/10/2009 10:20:51 AM - System Checkpoint
RP538: 6/10/2009 11:05:31 AM - Software Distribution Service 3.0
RP539: 6/10/2009 2:02:21 PM - Installed YouCam
RP540: 6/10/2009 6:30:34 PM - Installed Gateway
RP541: 6/11/2009 1:40:13 PM - Installed Gateway
RP542: 6/12/2009 8:06:02 AM - Installed Linksys Dual-Band Wireless-N USB Network Adapter
RP543: 6/13/2009 8:44:42 AM - Installed Gateway
RP544: 6/14/2009 10:11:00 AM - System Checkpoint
RP545: 6/14/2009 4:51:56 PM - Software Distribution Service 3.0
RP546: 6/15/2009 8:25:48 PM - System Checkpoint
RP547: 6/16/2009 8:31:44 PM - System Checkpoint
RP548: 6/19/2009 2:52:57 PM - System Checkpoint
RP549: 6/20/2009 3:39:41 PM - System Checkpoint
RP550: 6/21/2009 12:36:03 PM - Installed HP My Display
RP551: 6/21/2009 12:36:12 PM - Installed HP My Display
RP552: 6/21/2009 12:36:26 PM - Installed SDK
RP553: 6/21/2009 12:36:45 PM - Installed Pivot Software
RP554: 6/21/2009 12:36:50 PM - Installed Pivot Software
RP555: 6/22/2009 12:47:09 PM - System Checkpoint
RP556: 6/23/2009 1:38:58 PM - System Checkpoint
RP557: 6/24/2009 2:13:03 PM - System Checkpoint
RP558: 6/25/2009 1:52:10 PM - Software Distribution Service 3.0
RP559: 6/26/2009 11:34:40 AM - Configured AVerTV USB 2.0 Plus
RP560: 6/26/2009 11:35:57 AM - Installed AVerTV USB 2.0 Plus
RP561: 6/27/2009 8:56:12 PM - System Checkpoint
RP562: 6/28/2009 3:30:31 PM - Changed network configuration parameters ({APPNAME})
RP563: 6/30/2009 9:36:51 AM - System Checkpoint
RP564: 7/1/2009 12:23:57 PM - Advanced SystemCare RestorePoint
RP565: 7/2/2009 1:32:31 PM - System Checkpoint
RP566: 7/3/2009 8:32:35 PM - System Checkpoint
RP567: 7/5/2009 9:18:24 AM - System Checkpoint
RP568: 7/6/2009 10:34:33 PM - System Checkpoint
RP569: 7/7/2009 11:33:55 PM - System Checkpoint
RP570: 7/9/2009 10:12:20 AM - System Checkpoint
RP571: 7/10/2009 2:35:02 PM - Configured YouCam
RP572: 7/10/2009 2:40:41 PM - Configured YouCam
RP573: 7/10/2009 2:46:26 PM - Configured YouCam
RP574: 7/16/2009 6:30:44 PM - Software Distribution Service 3.0
RP575: 7/17/2009 10:23:14 PM - MyRestore
RP576: 7/19/2009 11:47:55 AM - System Checkpoint
RP577: 7/20/2009 11:13:06 PM - System Checkpoint
RP578: 7/22/2009 9:22:30 AM - Software Distribution Service 3.0
RP579: 7/26/2009 11:56:34 AM - Before AverTV Removal
RP580: 7/26/2009 11:58:31 AM - Configured AVerTV USB 2.0 Plus
RP581: 7/26/2009 11:59:54 AM - Configured AVerTV USB 2.0 Plus Driver
RP582: 8/5/2009 3:50:19 PM - Software Distribution Service 3.0
RP583: 8/6/2009 6:41:32 PM - MyCheckpoint
RP584: 8/7/2009 10:30:14 PM - System Checkpoint
RP585: 8/8/2009 8:55:34 AM - Installed TVCenter Pro
RP586: 8/10/2009 8:20:58 PM - System Checkpoint
RP587: 8/11/2009 11:54:52 PM - System Checkpoint
RP588: 8/12/2009 8:24:51 PM - MycheckPoint
RP589: 8/13/2009 9:46:14 AM - Software Distribution Service 3.0
RP590: 8/13/2009 1:37:48 PM - Installed FW LiveUpdate
RP591: 8/14/2009 6:54:25 PM - System Checkpoint
RP592: 8/15/2009 10:23:33 PM - System Checkpoint
RP593: 8/15/2009 11:44:49 PM - Software Distribution Service 3.0
RP594: 8/16/2009 12:22:33 PM - Configured Linksys Dual-Band Wireless-N USB Network Adapter
RP595: 8/17/2009 2:46:46 PM - System Checkpoint
RP596: 8/17/2009 3:08:11 PM - Installed Gateway
RP597: 8/18/2009 3:32:02 PM - Configured Linksys Dual-Band Wireless-N USB Network Adapter
RP598: 8/19/2009 4:59:12 PM - System Checkpoint
RP599: 8/21/2009 10:11:31 AM - System Checkpoint
RP600: 8/22/2009 9:25:26 AM - MyRestorePoint
RP601: 8/22/2009 12:22:32 PM - Revo Uninstaller's restore point - InterVideo FilterSDK for AverMedia
RP602: 8/23/2009 1:00:53 PM - System Checkpoint
RP603: 8/25/2009 10:38:11 AM - System Checkpoint
RP604: 8/26/2009 5:20:45 AM - Software Distribution Service 3.0
RP605: 8/27/2009 2:57:35 PM - System Checkpoint
RP606: 8/27/2009 8:25:24 PM - Changed network configuration parameters ({APPNAME})
RP607: 8/27/2009 8:31:48 PM - Revo Uninstaller's restore point - TweakMASTER
RP608: 8/29/2009 8:43:17 AM - System Checkpoint
RP609: 8/30/2009 10:38:55 PM - System Checkpoint
RP610: 9/1/2009 1:32:32 PM - ComboFix created restore point

==== Installed Programs ======================

AAC Decoder
AC3Filter (remove only)
Acrobat.com
Acronis*True*Image*Home
Adobe AIR
Adobe Anchor Service CS3
Adobe Asset Services CS3
Adobe Bridge CS3
Adobe Bridge Start Meeting
Adobe Camera Raw 4.0
Adobe CMaps
Adobe Color - Photoshop Specific
Adobe Color Common Settings
Adobe Color EU Extra Settings
Adobe Color EU Recommended Settings
Adobe Color JA Extra Settings
Adobe Color NA Extra Settings
Adobe Color NA Recommended Settings
Adobe Common File Installer
Adobe Default Language CS3
Adobe Device Central CS3
Adobe Dreamweaver CS3
Adobe ExtendScript Toolkit 2
Adobe Extension Manager CS3
Adobe Fireworks CS3
Adobe Flash CS3
Adobe Flash CS3 Professional
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Flash Player 9 ActiveX
Adobe Flash Player 9 Plugin
Adobe Flash Video Encoder
Adobe Fonts All
Adobe Help Viewer CS3
Adobe Illustrator CS3
Adobe InDesign CS3
Adobe InDesign CS3 Icon Handler
Adobe Linguistics CS3
Adobe PDF Library Files
Adobe Photoshop CS3
Adobe Reader 9.1.3
Adobe Setup
Adobe SING CS3
Adobe Stock Photos 1.0
Adobe Stock Photos CS3
Adobe SVG Viewer 3.0
Adobe Type Support
Adobe Update Manager CS3
Adobe Version Cue CS3 Client
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS3
Advanced SystemCare 3
Advertising Center
Apple Mobile Device Support
Apple Software Update
AutoUpdate
AVS Media Player 3.1
Aw2 Explorer 7 for Microsoft Windows
Bonjour
Broadcom Gigabit Integrated Controller
CCleaner (remove only)
Color Schemer v3
ColorImpact version 2.8.0
Compatibility Pack for the 2007 Office system
Creative Audio Console
Creative MediaSource
Creative MediaSource 5
Creative Vienna SoundFont Studio
Creative WaveStudio 7
Critical Update for Windows Media Player 11 (KB959772)
CyberLink YouCam
Defraggler (remove only)
Dell Resource CD
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Version Checker
DivX Web Player
DolbyFiles
DU Meter
ebgcInfra
ebgcRes
ebgcSDK
Express Burn
ffdshow [rev 2527] [2008-12-19]
FLV Player 2.0 (build 25)
Freecorder Toolbar
Freecorder Toolbar 3.0 Application
FW LiveUpdate
GPL MPEG-1/2 DirectShow Decoder Filter
H.264 Decoder
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
hp deskjet 5550 series (Remove only)
HP Driver Diagnostics
HP My Display
Intel(R) Matrix Storage Manager
Internet Download Manager
iTunes
Java(TM) 6 Update 15
jv16 PowerTools 2009
Kaspersky Internet Security 2010
LightScribe System Software 1.14.17.1
LimeWire 4.16.6
Livestation
Macromedia Dreamweaver MX 2004
Macromedia Extension Manager
Macromedia FreeHand MXa
Menu Templates - Starter Kit
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Baseline Security Analyzer 2.1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 2003 Web Components
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Converter Pack
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Software Update for Web Folders (English) 12
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Windows Script 5.7
Microsoft Windows XP Video Decoder Checkup Utility
Microsoft XML Parser
MKV Splitter
Movie Templates - Starter Kit
Mozilla Firefox (3.5)
MSN Money Investment Toolbox
MSN Music Assistant
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 6.0 Parser (KB933579)
NTRU Hybrid TSS v1.05
NVIDIA Drivers
NVIDIA nView Desktop Manager
NVIDIA Performance Drivers
NVIDIA PureVideo Decoder
OLYMPUS CAMEDIA Master 4.1
OneCare Advisor (Windows Live Toolbar)
OpenAL
OpenedFilesView
Panneau de configuration MobileMe
ParetoLogic Privacy Controls
PDF Settings
Personal Knowbase 3.1.1
Pivot Software
Popup Blocker (Windows Live Toolbar)
Process Tamer 2.09.01
QuickTime
RealPlayer
Recuva (remove only)
RegCure 1.6.0.0
Revo Uninstaller 1.83
Safari
SDK
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB969679)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft Office Excel 2007 (KB969682)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office Publisher 2007 (KB969693)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office Word 2007 (KB969604)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
SigmaTel Audio
Smart Menus (Windows Live Toolbar)
SnapAPI
Sound Blaster Audigy 2
SoundFont Bank Manager
SoundTrax
Spelling Dictionaries Support For Adobe Reader 8
Spybot - Search & Destroy
STMicroelectronics TPM Software Package
System Requirements Lab
The KMPlayer (remove only)
The Rosetta Stone
TMPGEnc Authoring Works 4
Trojan Remover 6.8.1
Unlocker 1.8.7
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office Outlook 2007 (KB969907)
Update for Outlook 2007 Junk Email Filter (kb972691)
Update for Windows Internet Explorer 8 (KB969497)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973815)
User Profile Hive Cleanup Service
VC80CRTRedist - 8.0.50727.762
WebFldrs XP
Windows Defender Signatures
Windows Desktop Search 3.01
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Installer Clean Up
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live Favorites for Windows Live Toolbar
Windows Live installer
Windows Live Mail
Windows Live Messenger
Windows Live Outlook Toolbar (Windows Live Toolbar)
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Toolbar
Windows Live Toolbar Extension (Windows Live Toolbar)
Windows Live Toolbar Feed Detector (Windows Live Toolbar)
Windows Live Writer
Windows Media Connect
Windows Media Format 11 runtime
Windows Media Player 11
Windows Messenger 5.1
Windows XP Service Pack 3
WinRAR archiver
Xvid 1.1.3 final uninstall
Youtube Downloader HD v. 1.1

==== Event Viewer Messages From Past Week ========

9/1/2009 1:43:22 PM, error: PlugPlayManager [11] - The device Root\LEGACY_UNLOCKERDRIVER5\0000 disappeared from the system without first being prepared for removal.
9/1/2009 1:34:32 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the PEVSystemStart service to connect.
9/1/2009 1:32:54 PM, error: Service Control Manager [7034] - The Machine Debug Manager service terminated unexpectedly. It has done this 1 time(s).
9/1/2009 1:32:54 PM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
9/1/2009 1:32:54 PM, error: Service Control Manager [7031] - The Windows Media Player Network Sharing Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
8/29/2009 4:49:58 PM, error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error 2147749155 (0x80040D23).
8/26/2009 11:22:28 AM, error: ipnathlp [31008] - The DNS proxy agent was unable to read the local list of name-resolution servers from the registry. The data is the error code.
8/26/2009 11:21:58 AM, error: Service Control Manager [7000] - The PCASp50 NDIS Protocol Driver service failed to start due to the following error: The system cannot find the file specified.
8/26/2009 11:21:25 AM, error: Dhcp [1002] - The IP address lease 192.168.1.100 for the Network Card with network address 001EE5E4EE69 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).

==== End Of File ===========================

A333 · 2009/09/01

This is a follow-up fresh DDS2 Log file:

DDS (Ver_09-07-30.01) - NTFSx86
Run by SHAMS1 at 14:24:35.65 on Tue 09/01/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_15
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2376 [GMT 2:00]

AV: Kaspersky Internet Security *On-access scanning enabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *enabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

============== Running Processes ===============

C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
C:\Program Files\DU Meter\DUMeterSvc.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe
C:\Program Files\Portrait Displays\HP My Display\DTHtml.exe
C:\Program Files\SAMSUNG\FW LiveUpdate\FWManager.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
C:\Program Files\Portrait Displays\Pivot Software\floater.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Livestation\Livestation.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\explorer.exe
D:\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://news.google.com/
BHO: AutorunsDisabled - No File
BHO: IDMIEHlprObj Class: {0055c089-8582-441b-a0bf-17b458c2a3a8} - c:\program files\internet download manager\IDMIECC.dll
BHO: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - c:\program files\freecorder\tbFre1.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {3EE5C0A4-C6FD-4A6A-91BB-3FD8BE70B5CC} - No File
BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky internet security 2010\ievkbd.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Ask Search Assistant BHO: {9cb65201-89c4-402c-ba80-02d8c59f9b1d} - Ask Search Assistant BHO
{af69de43-7d58-4638-b6fa-ce66b5ad205d}
BHO: Windows Live Toolbar Helper: {bdbd1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
BHO: 1 (0x1) - No File
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: {DC5F9604-C6E2-47D0-8E0F-E60FCCB334C7} - No File
BHO: FilterBHO Class: {e33cf602-d945-461a-83f0-819f76a199f8} - c:\program files\kaspersky lab\kaspersky internet security 2010\klwtbbho.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: Ask Toolbar BHO: {fe063db1-4ec0-403e-8dd8-394c54984b2c} - Ask Toolbar BHO
TB: {a66cc04d-ca4e-4050-8e18-51f7e6d18096} - No File
TB: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - c:\program files\freecorder\tbFre1.dll
TB: {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - No File
TB: Windows Live Toolbar: {bdad1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
{ef99bd32-c1fb-11d2-892f-0090271d4f88}
TB: Ask Toolbar: {fe063db9-4ec0-403e-8dd8-394c54984b2c} -
uRun: [Livestation] c:\program files\livestation\Livestation.exe -startup
uRun: [IDMan] c:\program files\internet download manager\IDMan.exe /onboot
uRun: [PMCLoader] c:\program files\pinnacle\tvcenter pro\PMCLoader.exe -checktasks
mRun: [TrueImageMonitor.exe] c:\program files\acronis\trueimagehome\TrueImageMonitor.exe
mRun: [AcronisTimounterMonitor] c:\program files\acronis\trueimagehome\TimounterMonitor.exe
mRun: [Acronis Scheduler2 Service] "c:\program files\common files\acronis\schedule2\schedhlp.exe "
mRun: [SigmatelSysTrayApp] stsystra.exe
mRun: [PivotSoftware] "c:\program files\portrait displays\pivot software\wpctrl.exe "
mRun: [DT HPW] c:\program files\common files\portrait displays\shared\DT_startup.exe -HPW
mRun: [avp] "c:\program files\kaspersky lab\kaspersky internet security 2010\avp.exe "
mRun: [UCam_Menu] "c:\program files\cyberlink\youcam\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\youcam" updatewithcreateonce "software\cyberlink\youcam\1.0 "
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
mRun: [Name of App] c:\program files\samsung\fw liveupdate\FWManager.exe r
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
IE: &Windows Live Search - c:\program files\windows live toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: Download all links with IDM - c:\program files\internet download manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\internet download manager\IEGetVL.htm
IE: Download with IDM - c:\program files\internet download manager\IEExt.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {1F958B09-3312-7f0e-9723-4C1324C57B20}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\ssv.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - c:\program files\kaspersky lab\kaspersky internet security 2010\klwtbbho.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - c:\program files\kaspersky lab\kaspersky internet security 2010\klwtbbho.dll
LSP: c:\windows\system32\idmmbc.dll
Trusted Zone: 4irany.com\www
Trusted Zone: c-span.org
Trusted Zone: google.com\news
Trusted Zone: microsoft.com\update
Trusted Zone: radis.org
Trusted Zone: samsungodd.com\www
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab
DPF: {680285A8-96D3-43DA-9D3D-51DD987D0B77}
DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15101/CTSUEng.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078}
DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD}
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15108/CTPID.cab
TCP: {A0722B6E-E533-459C-B5CA-439F82D0F592} = 192.168.1.1,212.217.0.1
TCP: {EC0FDAB6-CFBC-4E8E-921B-908A7018B283} = 194.230.1.103,194.230.1.39
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Notify: klogon - c:\windows\system32\klogon.dll
AppInit_DLLs: c:\progra~1\kaspersky lab\kaspersky internet security 2010\kloehk.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
STS: IE Component Categories cache daemon: {553858a7-4922-4e7e-b1c1-97140c1c16ef} - c:\windows\system32\ieframe.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
LSA: Authentication Packages = msv1_0 relog_ap

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\shams1\application data\mozilla\firefox\profiles\xgto0m36.default\
FF - prefs.js: browser.startup.homepage - hxxp://news.google.com/
FF - component: c:\documents and settings\shams1\application data\idm\idmmzcc3\components\idmmzcc.dll
FF - component: c:\program files\mozilla firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPAbacheck.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npracplug.dll
FF - plugin: c:\program files\real\realarcade\plugins\mozilla\npracplug.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref( "media.enforce_same_site_origin ", false);
c:\program files\mozilla firefox\greprefs\all.js - pref( "media.cache_size ", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref( "media.ogg.enabled ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "media.wave.enabled ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "media.autoplay.enabled ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.urlbar.autocomplete.enabled ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "capability.policy.mailnews.*.wholeText ", "noAccess ");
c:\program files\mozilla firefox\greprefs\all.js - pref( "dom.storage.default_quota ", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref( "content.sink.event_probe_rate ", 3);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.http.prompt-temp-redirect ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "layout.css.dpi ", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref( "layout.css.devPixelsPerPx ", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref( "gestures.enable_single_finger_input ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "dom.max_chrome_script_run_time ", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.tcp.sendbuffer ", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref( "geo.enabled ", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.remember_cert_checkbox_default_setting ", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "browser.search.param.yahoo-fr ", "moz35 ");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "browser.search.param.yahoo-fr-cjkt ", "moz35 ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "extensions.blocklist.level ", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.urlbar.restrict.typed ", "~ ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.urlbar.default.behavior ", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.history ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.formdata ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.passwords ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.downloads ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.cookies ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.cache ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.sessions ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.offlineApps ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.clearOnShutdown.siteSettings ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.cpd.history ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.cpd.formdata ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.cpd.passwords ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.cpd.downloads ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.cpd.cookies ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.cpd.cache ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.cpd.sessions ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.cpd.offlineApps ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.cpd.siteSettings ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "privacy.sanitize.migrateFx3Prefs ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.ssl_override_behavior ", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "security.alternate_certificate_error_page ", "certerror ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.privatebrowsing.autostart ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.privatebrowsing.dont_prompt_on_enter ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "geo.wifi.uri ", "https://www.google.com/loc/json ");

============= SERVICES / DRIVERS ===============

R0 kl1;Kl1;c:\windows\system32\drivers\kl1.sys [2009-5-24 128016]
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-1-29 33808]
R0 stmtpm;STM TPM Service;c:\windows\system32\drivers\stm_tpm.sys [2006-4-1 21504]
R0 tdrpman228;Acronis Try&Decide and Restore Points filter (build 228);c:\windows\system32\drivers\tdrpm228.sys [2009-6-24 902592]
R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2008-7-20 296976]
R2 AVP;Kaspersky Internet Security;c:\program files\kaspersky lab\kaspersky internet security 2010\avp.exe [2009-7-3 303376]
R2 DUMeterSvc;DU Meter Service;c:\program files\du meter\DUMeterSvc.exe [2007-12-4 1387544]
R2 NVIDIA Performance Driver Service;NVIDIA Performance Driver Service;c:\program files\nvidia corporation\performance drivers\nvPDsvc.exe [2009-5-14 4440064]
R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [2008-5-1 2368]
R3 3xHybrid;Pinnacle PCTV 100i-110i-300i-310i-MCE;c:\windows\system32\drivers\3xHybrid.sys [2009-8-8 1121536]
R3 COMMONFX.SYS;COMMONFX.SYS;c:\windows\system32\drivers\COMMONFX.sys [2009-3-4 99352]
R3 CTAUDFX.SYS;CTAUDFX.SYS;c:\windows\system32\drivers\CTAUDFX.sys [2009-3-4 555032]
R3 CTSBLFX.SYS;CTSBLFX.SYS;c:\windows\system32\drivers\CTSBLFX.sys [2009-3-4 566296]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2009-5-16 19472]
R3 rt2870;Linksys 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [2009-8-18 551680]
S3 COMMONFX;COMMONFX;c:\windows\system32\drivers\COMMONFX.sys [2009-3-4 99352]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\common files\creative labs shared\service\CTAELicensing.exe [2009-5-29 79360]
S3 CTAUDFX;CTAUDFX;c:\windows\system32\drivers\CTAUDFX.sys [2009-3-4 555032]
S3 CTERFXFX.SYS;CTERFXFX.SYS;c:\windows\system32\drivers\CTERFXFX.sys [2009-3-4 100888]
S3 CTERFXFX;CTERFXFX;c:\windows\system32\drivers\CTERFXFX.sys [2009-3-4 100888]
S3 CTSBLFX;CTSBLFX;c:\windows\system32\drivers\CTSBLFX.sys [2009-3-4 566296]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2009-5-13 31760]
S3 PPDrv;PPDrv; [x]
S4 Rdbssatcwpth;Rdbssatcwpth; [x]

=============== Created Last 30 ================

2009-09-01 13:53 <DIR> -cd----- c:\windows\system32\dllcache\cache
2009-09-01 13:31 229,376 a------- c:\windows\PEV.exe
2009-09-01 13:31 161,792 a------- c:\windows\SWREG.exe
2009-09-01 13:31 98,816 a------- c:\windows\sed.exe
2009-09-01 08:09 <DIR> --d----- c:\docume~1\alluse~1\applic~1\NortonInstaller
2009-08-27 19:47 1,706,528 a------- c:\windows\system32\nvcuvenc.dll
2009-08-27 19:47 1,597,690 a------- c:\windows\system32\nvdata.bin
2009-08-22 11:53 <DIR> --d----- c:\program files\VS Revo Group
2009-08-18 15:38 551,680 a----r-- c:\windows\system32\drivers\rt2870.sys
2009-08-08 08:57 196,096 -------- c:\windows\system32\MACD32.DLL
2009-08-08 08:57 138,752 -------- c:\windows\system32\MASE32.DLL
2009-08-08 08:57 136,192 -------- c:\windows\system32\MAMC32.DLL
2009-08-08 08:57 57,856 -------- c:\windows\system32\MASD32.DLL
2009-08-08 08:57 27,648 -------- c:\windows\system32\MA32.DLL
2009-08-08 08:57 2,179,072 -------- c:\windows\system32\mfc71d.dll
2009-08-08 08:57 765,952 -------- c:\windows\system32\msvcp71d.dll
2009-08-08 08:57 737,280 -------- c:\windows\system32\msvcp70d.dll
2009-08-08 08:57 544,768 -------- c:\windows\system32\msvcr71d.dll
2009-08-08 08:57 536,576 -------- c:\windows\system32\msvcr70d.dll
2009-08-08 08:57 385,100 -------- c:\windows\system32\MSVCRTD.DLL
2009-08-08 08:55 548,864 -------- c:\windows\system32\msvcp80.dll
2009-08-08 08:55 <DIR> --d----- c:\program files\Pinnacle
2009-08-08 08:55 626,688 -------- c:\windows\system32\msvcr80.dll
2009-08-08 08:51 15,232 ac------ c:\windows\system32\dllcache\mpe.sys
2009-08-08 08:51 15,232 a------- c:\windows\system32\drivers\MPE.sys
2009-08-08 08:50 1,121,536 a----r-- c:\windows\system32\drivers\3xHybrid.sys
2009-08-08 08:50 3,072 a----r-- c:\windows\system32\34CoInstaller.dll
2009-08-08 08:50 363,520 ac------ c:\windows\system32\dllcache\psisdecd.dll
2009-08-08 08:50 33,280 ac------ c:\windows\system32\dllcache\psisrndr.ax
2009-08-08 08:50 363,520 a------- c:\windows\system32\PsisDecd.dll
2009-08-08 08:50 33,280 a------- c:\windows\system32\PsisRndr.ax
2009-08-08 08:50 56,832 ac------ c:\windows\system32\dllcache\msdvbnp.ax
2009-08-08 08:50 56,832 a------- c:\windows\system32\MSDvbNP.ax
2009-08-08 08:50 18,432 ac------ c:\windows\system32\dllcache\bdaplgin.ax
2009-08-08 08:50 11,776 ac------ c:\windows\system32\dllcache\bdasup.sys
2009-08-08 08:50 18,432 a------- c:\windows\system32\BdaPlgIn.ax
2009-08-08 08:50 11,776 a------- c:\windows\system32\drivers\BdaSup.sys

==================== Find3M ====================

2009-08-05 11:01 204,800 a------- c:\windows\system32\mswebdvd.dll
2009-07-25 05:23 411,368 ac------ c:\windows\system32\deploytk.dll
2009-07-17 21:01 58,880 a------- c:\windows\system32\atl.dll
2009-07-14 20:54 485,920 ac------ c:\windows\system32\nvudisp.exe
2009-07-14 20:54 10,457,088 a------- c:\windows\system32\nvoglnt.dll
2009-07-14 20:54 7,741,664 a------- c:\windows\system32\drivers\nv4_mini.sys
2009-07-14 20:54 5,842,816 a------- c:\windows\system32\nv4_disp.dll
2009-07-14 20:54 2,189,856 a------- c:\windows\system32\nvcuvid.dll
2009-07-14 20:54 2,002,944 a------- c:\windows\system32\nvcuda.dll
2009-07-14 20:54 868,352 a------- c:\windows\system32\nvapi.dll
2009-07-14 20:54 151,552 a------- c:\windows\system32\nvcodins.dll
2009-07-14 20:54 151,552 a------- c:\windows\system32\nvcod.dll
2009-07-14 13:35 2,173,472 a------- c:\windows\system32\nvcplui.exe
2009-07-14 13:35 81,920 a------- c:\windows\system32\nvwddi.dll
2009-07-14 13:35 4,026,368 a------- c:\windows\system32\nvvitvs.dll
2009-07-14 13:35 3,170,304 a------- c:\windows\system32\nvwss.dll
2009-07-14 13:34 13,877,248 a------- c:\windows\system32\nvcpl.dll
2009-07-14 13:34 4,923,392 a------- c:\windows\system32\nvdisps.dll
2009-07-14 13:34 3,547,136 a------- c:\windows\system32\nvgames.dll
2009-07-14 13:34 1,286,144 a------- c:\windows\system32\nvmobls.dll
2009-07-14 13:34 188,416 a------- c:\windows\system32\nvmccss.dll
2009-07-14 13:34 168,004 a------- c:\windows\system32\nvsvc32.exe
2009-07-14 13:34 143,360 a------- c:\windows\system32\nvcolor.exe
2009-07-14 13:34 86,016 a------- c:\windows\system32\nvmctray.dll
2009-07-14 13:34 229,376 a------- c:\windows\system32\nvmccs.dll
2009-07-13 23:43 286,208 a------- c:\windows\system32\wmpdxm.dll
2009-07-10 07:01 485,920 ac------ c:\windows\system32\NVUNINST.EXE
2009-07-09 17:12 128,016 a------- c:\windows\system32\drivers\kl1.sys
2009-07-07 16:29 604,140 a--sh--- c:\windows\system32\drivers\ISwift3.dat
2009-07-07 16:24 6,766,624 a--sh--- c:\windows\system32\drivers\fidbox.dat
2009-07-07 16:24 1,638,432 a--sh--- c:\windows\system32\drivers\fidbox2.dat
2009-07-07 16:24 54,992 a--sh--- c:\windows\system32\drivers\fidbox.idx
2009-07-07 16:24 7,728 a--sh--- c:\windows\system32\drivers\fidbox2.idx
2009-07-03 19:09 915,456 -------- c:\windows\system32\wininet.dll
2009-07-03 15:48 219,664 a------- c:\windows\system32\klogon.dll
2009-07-03 15:45 27,507 a------- c:\windows\system32\drivers\klopp.dat
2009-06-26 14:34 2,070,808 a------- c:\windows\system32\AutoPartNt.exe
2009-06-25 10:25 730,112 a------- c:\windows\system32\lsasrv.dll
2009-06-25 10:25 301,568 a------- c:\windows\system32\kerberos.dll
2009-06-25 10:25 147,456 a------- c:\windows\system32\schannel.dll
2009-06-25 10:25 136,192 a------- c:\windows\system32\msv1_0.dll
2009-06-25 10:25 56,832 a------- c:\windows\system32\secur32.dll
2009-06-25 10:25 54,272 a------- c:\windows\system32\wdigest.dll
2009-06-16 16:36 119,808 a------- c:\windows\system32\t2embed.dll
2009-06-16 16:36 81,920 a------- c:\windows\system32\fontsub.dll
2009-06-12 14:31 80,896 a------- c:\windows\system32\tlntsess.exe
2009-06-12 14:31 76,288 a------- c:\windows\system32\telnet.exe
2009-06-10 16:13 84,992 a------- c:\windows\system32\avifil32.dll
2009-06-10 09:19 2,066,432 a------- c:\windows\system32\mstscax.dll
2009-06-10 08:14 132,096 a------- c:\windows\system32\wkssvc.dll
2009-06-03 21:09 1,291,264 a------- c:\windows\system32\quartz.dll
2007-09-27 19:34 2,293,712 ac------ c:\program files\FLV PlayerFCSetup.exe
2007-07-07 19:36 774,144 ac------ c:\program files\RngInterstitial.dll
2008-06-04 13:14 23 ac-sh--- c:\windows\system32\aebed7_z.dll
2009-05-30 12:59 23 a--sh--- c:\windows\system32\edacded0.dat
2009-02-14 10:07 23 a--sh--- c:\windows\system32\edacded0_x.dat
2008-02-17 10:34 23 ac-sh--- c:\windows\system32\fffbbf_r.dll
2008-05-12 14:24 32,768 ac-sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008051220080513\index.dat

============= FINISH: 14:25:14.65 ===============

broni · 2009/09/01

Combofix says:

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
Click to expand...

Please, accept recovery console installation on next Combofix run.

Please, uninstall RegCure through Add\Remove. Registry programs are nothing but dangerous.

1. Please open Notepad

Click Start , then Run

Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:
Code:
File::
c:\documents and settings\SHAMS1\Application Data\U3\temp\cleanup.exe
c:\documents and settings\SHAMS1\Application Data\U3\temp\Launchpad Removal.exe


Folder::
c:\documents and settings\All Users\Application Data\NortonInstaller


Driver::
PPDrv
Rdbssatcwpth


Registry::

RegLockDel::
3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

A new HijackThis log.

Download HijackThis:
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
by clicking on Download HijackThis Installer
Install, and run it.
Post HijackTHis log.
Do NOT attempt to fix anything!

NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator

A333 · 2009/09/01

Broni,

- It didn't ask me for the recovery Console installation. It also tried to to get connected to Microsoft site, but failed.
-Why don't you want me to delete the "NortonInstaller" in "Application data "? As you suggested, I used the Norton Uninstaller and cleaned all the traces.
-RegCure is not active in my system. I use it once a week, which works quite nicely and have had no problem with it. And these problems occurred quite a long time after using RegCure. Do you really want me to uninstall it?

broni · 2009/09/01

It didn't ask me for the recovery Console installation. It also tried to to get connected to Microsoft site, but failed.
Click to expand...

Don't worry about it.

Why don't you want me to delete the "NortonInstaller" in "Application data "? As you suggested, I used the Norton Uninstaller and cleaned all the traces.
Click to expand...

You don't need it anymore.

RegCure is not active in my system. I use it once a week, which works quite nicely and have had no problem with it. And these problems occurred quite a long time after using RegCure. Do you really want me to uninstall it?
Click to expand...

Well, I can't force you to do anything. My suggestion is to uninstall it, but if you want to keep it....it's your computer.

A333 · 2009/09/02

Broni,
I know that I don't need the "NortonInstaller" anymore and I can delete it. But my question was that why you have put it into the NotePad for ComboFix usage?

broni · 2009/09/02

Because it's one of the things we want to remove.

A333 · 2009/09/02

Dear Broni,

Followin is the ComboFix.txt. The new HijackThis will follow.

ComboFix 09-09-01.04 - SHAMS1 09/02/2009 14:17.2.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2433 [GMT 2:00]
Running from: c:\documents and settings\SHAMS1\My Documents\Downloads\Programs\ComboFix.exe
Command switches used :: c:\documents and settings\SHAMS1\My Documents\Downloads\Programs\CFScript.txt
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FILE ::
"c:\documents and settings\SHAMS1\Application Data\U3\temp\cleanup.exe "
"c:\documents and settings\SHAMS1\Application Data\U3\temp\Launchpad Removal.exe "
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\NortonInstaller
c:\documents and settings\All Users\Application Data\NortonInstaller\Logs\09-01-2009-08h09m49s\SymNRT-09-01-2009-08h09m49s.log
c:\documents and settings\All Users\Application Data\NortonInstaller\Logs\09-01-2009-08h09m49s\SymNRT.1.mft.7z
c:\documents and settings\All Users\Application Data\NortonInstaller\Settings\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}.7z
c:\documents and settings\SHAMS1\Application Data\U3\temp\cleanup.exe
c:\documents and settings\SHAMS1\Application Data\U3\temp\Launchpad Removal.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_PPDRV
-------\Service_PPDrv
-------\Service_Rdbssatcwpth

((((((((((((((((((((((((( Files Created from 2009-08-02 to 2009-09-02 )))))))))))))))))))))))))))))))
.

2009-09-02 11:19 . 2009-09-02 11:19 -------- d-----w- c:\program files\Trend Micro
2009-08-28 14:52 . 2009-08-05 17:29 3036024 ----a-w- c:\documents and settings\SHAMS1\Application Data\Simply Super Software\Trojan Remover\ttd61C.exe
2009-08-27 17:47 . 2009-07-14 18:54 1706528 ----a-w- c:\windows\system32\nvcuvenc.dll
2009-08-27 17:47 . 2009-07-14 18:54 1597690 ----a-w- c:\windows\system32\nvdata.bin
2009-08-25 11:22 . 2009-08-25 11:22 80400 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav9exec\9.0.0.459\mzvkbd3.dll
2009-08-25 11:22 . 2009-08-25 11:22 80400 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav9exec\9.0.0.459\mzvkbd.dll
2009-08-25 11:22 . 2009-08-25 11:22 264720 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav9exec\9.0.0.459\klwtbbho.dll
2009-08-25 11:22 . 2009-08-25 11:22 59920 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.459\mzvkbd.dll
2009-08-25 11:22 . 2009-08-25 11:22 264720 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.459\klwtbbho.dll
2009-08-25 11:22 . 2009-08-25 11:22 109072 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.459\mzvkbd3.dll
2009-08-22 09:53 . 2009-08-22 09:53 -------- d-----w- c:\program files\VS Revo Group
2009-08-18 13:38 . 2007-12-14 10:04 551680 ----a-r- c:\windows\system32\drivers\rt2870.sys
2009-08-17 09:33 . 2009-08-17 09:34 -------- d-----w- c:\documents and settings\SHAMS1\Application Data\U3
2009-08-15 08:56 . 2009-08-15 08:56 -------- d-----w- c:\documents and settings\SHAMS2\Local Settings\Application Data\Mozilla
2009-08-08 07:46 . 2009-08-08 07:46 -------- d-----w- c:\documents and settings\SHAMS1\Local Settings\Application Data\IsolatedStorage
2009-08-08 07:07 . 2009-08-08 07:07 -------- d-----w- c:\documents and settings\SHAMS1\Local Settings\Application Data\Pinnacle
2009-08-08 06:59 . 2009-08-08 06:59 129 ------w- c:\documents and settings\SHAMS1\Local Settings\Application Data\fusioncache.dat
2009-08-08 06:59 . 2009-08-28 05:55 -------- d-----w- c:\documents and settings\SHAMS1\Local Settings\Application Data\ApplicationHistory
2009-08-08 06:57 . 1998-11-02 18:57 57856 ------w- c:\windows\system32\MASD32.DLL
2009-08-08 06:57 . 1998-11-02 18:57 27648 ------w- c:\windows\system32\MA32.DLL
2009-08-08 06:57 . 1998-11-02 18:57 196096 ------w- c:\windows\system32\MACD32.DLL
2009-08-08 06:57 . 1998-11-02 18:57 138752 ------w- c:\windows\system32\MASE32.DLL
2009-08-08 06:57 . 1998-11-02 18:57 136192 ------w- c:\windows\system32\MAMC32.DLL
2009-08-08 06:57 . 2004-06-03 10:47 385100 ------w- c:\windows\system32\MSVCRTD.DLL
2009-08-08 06:57 . 2003-03-19 04:28 2179072 ------w- c:\windows\system32\mfc71d.dll
2009-08-08 06:57 . 2003-03-19 03:04 765952 ------w- c:\windows\system32\msvcp71d.dll
2009-08-08 06:57 . 2003-03-19 03:03 544768 ------w- c:\windows\system32\msvcr71d.dll
2009-08-08 06:57 . 2002-01-05 19:16 737280 ------w- c:\windows\system32\msvcp70d.dll
2009-08-08 06:57 . 2002-01-05 19:16 536576 ------w- c:\windows\system32\msvcr70d.dll
2009-08-08 06:55 . 2006-12-01 21:54 548864 ------w- c:\windows\system32\msvcp80.dll
2009-08-08 06:55 . 2009-08-08 06:55 -------- d-----w- c:\program files\Pinnacle
2009-08-08 06:55 . 2006-12-01 21:54 626688 ------w- c:\windows\system32\msvcr80.dll
2009-08-08 06:52 . 2009-08-08 07:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Pinnacle
2009-08-08 06:51 . 2008-04-13 18:46 15232 -c--a-w- c:\windows\system32\dllcache\mpe.sys
2009-08-08 06:51 . 2008-04-13 18:46 15232 ----a-w- c:\windows\system32\drivers\MPE.sys
2009-08-08 06:50 . 2006-11-22 07:53 1121536 ----a-r- c:\windows\system32\drivers\3xHybrid.sys
2009-08-08 06:50 . 2003-02-27 08:07 3072 ----a-r- c:\windows\system32\34CoInstaller.dll
2009-08-08 06:50 . 2008-04-14 00:12 363520 -c--a-w- c:\windows\system32\dllcache\psisdecd.dll
2009-08-08 06:50 . 2008-04-14 00:12 363520 ----a-w- c:\windows\system32\PsisDecd.dll
2009-08-08 06:50 . 2008-04-13 18:46 11776 -c--a-w- c:\windows\system32\dllcache\bdasup.sys
2009-08-08 06:50 . 2008-04-13 18:46 11776 ----a-w- c:\windows\system32\drivers\BdaSup.sys
2009-08-05 13:52 . 2009-08-05 13:52 152576 ------w- c:\documents and settings\SHAMS1\Application Data\Sun\Java\jre1.6.0_15\lzma.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-02 12:28 . 2009-06-28 16:02 -------- d-----w- c:\documents and settings\SHAMS1\Application Data\DMCache
2009-09-02 12:27 . 2008-07-20 20:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-09-01 07:21 . 2006-04-22 15:56 -------- d-----w- c:\program files\Java
2009-08-28 14:52 . 2007-11-02 14:24 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-27 17:48 . 2007-05-19 06:38 -------- d-----w- c:\program files\NVIDIA Corporation
2009-08-27 17:48 . 2007-05-19 06:38 -------- d-----w- c:\documents and settings\All Users\Application Data\NVIDIA Corporation
2009-08-22 10:23 . 2006-03-30 12:17 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-22 07:19 . 2008-09-20 17:13 -------- d-----w- c:\program files\Trojan Remover
2009-08-20 16:16 . 2009-02-05 20:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-19 14:08 . 2007-10-22 13:32 -------- d-----w- c:\program files\DU Meter
2009-08-13 16:58 . 2007-05-16 12:02 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-13 07:49 . 2006-12-24 11:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-08-11 18:08 . 2009-02-19 11:42 110680 ----a-w- c:\documents and settings\My Sepy\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-09 14:21 . 2009-02-14 08:07 -------- d-----w- c:\program files\jv16 PowerTools 2009
2009-08-08 07:07 . 2009-02-18 07:24 110680 ------w- c:\documents and settings\SHAMS1\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-05 13:54 . 2008-05-03 19:05 -------- d-----w- c:\program files\Microsoft Silverlight
2009-08-05 09:01 . 2004-08-04 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-26 07:46 . 2008-05-02 17:05 -------- d-----w- c:\program files\UPHClean
2009-07-25 03:23 . 2008-10-25 08:09 411368 -c--a-w- c:\windows\system32\deploytk.dll
2009-07-23 11:57 . 2008-07-20 20:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-07-20 12:58 . 2009-07-20 12:55 -------- d-----w- c:\program files\Unlocker
2009-07-19 18:50 . 2007-09-19 18:54 -------- d-----w- c:\program files\Internet Download Manager
2009-07-19 17:05 . 2009-07-19 17:02 -------- d-----w- c:\documents and settings\SHAMS1\Application Data\SUPERAntiSpyware.com
2009-07-17 19:01 . 2004-08-04 12:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-17 14:24 . 2009-04-01 16:38 -------- d-----w- c:\program files\Knowbase
2009-07-14 18:54 . 2009-04-22 11:34 2189856 ----a-w- c:\windows\system32\nvcuvid.dll
2009-07-14 18:54 . 2008-10-08 12:52 2002944 ----a-w- c:\windows\system32\nvcuda.dll
2009-07-14 18:54 . 2006-07-12 12:19 868352 ----a-w- c:\windows\system32\nvapi.dll
2009-07-14 18:54 . 2006-03-30 12:12 485920 -c--a-w- c:\windows\system32\nvudisp.exe
2009-07-14 18:54 . 2006-03-30 12:12 10457088 ----a-w- c:\windows\system32\nvoglnt.dll
2009-07-14 18:54 . 2006-03-30 12:12 7741664 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2009-07-14 18:54 . 2006-03-30 12:12 5842816 ----a-w- c:\windows\system32\nv4_disp.dll
2009-07-14 18:54 . 2006-03-30 12:12 151552 ----a-w- c:\windows\system32\nvcodins.dll
2009-07-14 18:54 . 2006-03-30 12:12 151552 ----a-w- c:\windows\system32\nvcod.dll
2009-07-14 11:35 . 2009-07-14 11:35 2173472 ----a-w- c:\windows\system32\nvcplui.exe
2009-07-14 11:35 . 2009-07-14 11:35 81920 ----a-w- c:\windows\system32\nvwddi.dll
2009-07-14 11:35 . 2009-07-14 11:35 4026368 ----a-w- c:\windows\system32\nvvitvs.dll
2009-07-14 11:35 . 2009-07-14 11:35 3170304 ----a-w- c:\windows\system32\nvwss.dll
2009-07-14 11:34 . 2009-07-14 11:34 86016 ----a-w- c:\windows\system32\nvmctray.dll
2009-07-14 11:34 . 2009-07-14 11:34 4923392 ----a-w- c:\windows\system32\nvdisps.dll
2009-07-14 11:34 . 2009-07-14 11:34 3547136 ----a-w- c:\windows\system32\nvgames.dll
2009-07-14 11:34 . 2009-07-14 11:34 188416 ----a-w- c:\windows\system32\nvmccss.dll
2009-07-14 11:34 . 2009-07-14 11:34 168004 ----a-w- c:\windows\system32\nvsvc32.exe
2009-07-14 11:34 . 2009-07-14 11:34 143360 ----a-w- c:\windows\system32\nvcolor.exe
2009-07-14 11:34 . 2009-07-14 11:34 13877248 ----a-w- c:\windows\system32\nvcpl.dll
2009-07-14 11:34 . 2009-07-14 11:34 1286144 ----a-w- c:\windows\system32\nvmobls.dll
2009-07-14 11:34 . 2009-07-14 11:34 229376 ----a-w- c:\windows\system32\nvmccs.dll
2009-07-13 21:43 . 2004-08-04 12:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-11 07:28 . 2009-07-11 07:28 -------- d-----w- c:\documents and settings\SHAMS1\Application Data\Creative
2009-07-10 12:46 . 2009-06-10 12:02 -------- d-----w- c:\program files\CyberLink
2009-07-10 12:45 . 2009-07-10 12:45 36864 ----a-w- c:\documents and settings\All Users\Application Data\TEMP\{01FB4998-33C4-4431-85ED-079E3EEFE75D}\PostBuild.exe
2009-07-10 12:42 . 2009-07-10 12:42 -------- d-----w- c:\documents and settings\All Users\Application Data\CyberLink
2009-07-10 05:01 . 2007-03-01 13:59 485920 -c--a-w- c:\windows\system32\NVUNINST.EXE
2009-07-09 15:52 . 2009-07-09 15:52 59992 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 2010 9.0.0.463\English\setup.exe
2009-07-09 15:12 . 2009-05-24 13:30 128016 ----a-w- c:\windows\system32\drivers\kl1.sys
2009-07-09 15:12 . 2009-07-09 15:12 296976 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.459\sys\i386\5.1\klif.sys
2009-07-09 15:12 . 2009-07-09 15:12 128016 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.459\sys\i386\kl1.sys
2009-07-07 14:32 . 2009-07-07 14:32 932368 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\profiles-1-6.dll
2009-07-07 14:32 . 2009-07-07 14:32 678416 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\content_interpreter-1-1.dll
2009-07-07 14:32 . 2009-07-07 14:32 604688 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\gsg-3-9.dll
2009-07-07 14:32 . 2009-07-07 14:32 1096208 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\filtration-4-6.dll
2009-07-07 14:32 . 2009-07-07 14:32 522768 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\database-1-5.dll
2009-07-07 14:29 . 2009-07-07 14:29 604140 --sha-w- c:\windows\system32\drivers\ISwift3.dat
2009-07-07 14:24 . 2008-07-20 20:10 7728 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-07-07 14:24 . 2008-07-20 20:10 6766624 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-07-07 14:24 . 2008-07-20 20:10 54992 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-07-07 14:24 . 2008-07-20 20:10 1638432 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-07-07 14:22 . 2008-07-20 20:10 -------- d-----w- c:\program files\Kaspersky Lab
2009-07-03 17:09 . 2004-08-04 12:00 915456 ------w- c:\windows\system32\wininet.dll
2009-07-03 13:48 . 2009-07-03 13:48 219664 ----a-w- c:\windows\system32\klogon.dll
2009-07-03 13:45 . 2009-07-03 13:45 27507 ----a-w- c:\windows\system32\drivers\klopp.dat
2009-07-01 10:26 . 2009-07-01 10:26 109136 -c--a-w- c:\documents and settings\SHAMS2\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-28 16:02 . 2009-06-28 16:02 198064 ------w- c:\documents and settings\SHAMS1\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
2009-06-26 12:34 . 2009-06-26 12:34 2070808 ----a-w- c:\windows\system32\AutoPartNt.exe
2009-06-25 08:25 . 2008-05-12 11:23 730112 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:25 . 2008-05-12 11:23 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:25 . 2008-05-12 11:23 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:25 . 2004-08-04 12:00 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:25 . 2004-08-04 12:00 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:25 . 2004-08-04 12:00 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-24 11:18 . 2008-05-12 11:23 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-24 10:04 . 2009-06-24 10:04 902592 ----a-w- c:\windows\system32\drivers\tdrpm228.sys
2009-06-24 10:04 . 2009-06-24 10:04 138208 ----a-w- c:\windows\system32\drivers\snapman.sys
2009-06-16 14:36 . 2004-08-04 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2004-08-04 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-12 12:31 . 2004-08-04 12:00 80896 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 . 2004-08-04 12:00 76288 ----a-w- c:\windows\system32\telnet.exe
2009-06-10 14:13 . 2004-08-04 12:00 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 07:19 . 2006-03-30 11:58 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:14 . 2008-05-12 11:23 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-04 16:00 . 2009-06-04 16:00 59992 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 2010 9.0.0.459\English\setup.exe
2007-09-27 17:34 . 2007-09-27 17:34 2293712 -c--a-w- c:\program files\FLV PlayerFCSetup.exe
2007-07-07 17:36 . 2007-07-07 17:36 774144 -c--a-w- c:\program files\RngInterstitial.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2008-06-04 11:14 . 2008-06-04 11:14 23 -csha-w- c:\windows\system32\aebed7_z.dll
2009-05-30 10:59 . 2009-05-30 10:59 23 --sha-w- c:\windows\system32\edacded0.dat
2009-02-14 08:07 . 2009-02-14 08:07 23 --sha-w- c:\windows\system32\edacded0_x.dat
2008-02-17 08:34 . 2008-02-17 08:34 23 -csha-w- c:\windows\system32\fffbbf_r.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-09-01_11.47.42 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-09-02 12:25 . 2009-09-02 12:25 16384 c:\windows\temp\Perflib_Perfdata_564.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]
2007-09-27 17:36 1453080 -c--a-w- c:\program files\Freecorder\tbFre1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{1392b8d2-5c05-419f-a8f6-b9f15a596612} "= "c:\program files\Freecorder\tbFre1.dll" [2007-09-27 1453080]

[HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Livestation "= "c:\program files\Livestation\Livestation.exe" [2009-03-30 2027520]
"IDMan "= "c:\program files\Internet Download Manager\IDMan.exe" [2009-05-27 2815408]
"PMCLoader "= "c:\program files\Pinnacle\TVCenter Pro\PMCLoader.exe" [2007-07-26 105544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TrueImageMonitor.exe "= "c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2009-05-24 4359776]
"AcronisTimounterMonitor "= "c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe" [2009-05-24 960616]
"PivotSoftware "= "c:\program files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 694008]
"DT HPW "= "c:\program files\Common Files\Portrait Displays\Shared\DT_startup.exe" [2008-06-24 81920]
"avp "= "c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2009-07-03 303376]
"UCam_Menu "= "c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2008-06-13 210216]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"Name of App "= "c:\program files\SAMSUNG\FW LiveUpdate\FWManager.exe" [2009-07-15 692340]
"nwiz "= "c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2009-07-08 1657376]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2009-07-14 86016]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2009-07-14 13877248]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"SigmatelSysTrayApp "= "stsystra.exe" - c:\windows\stsystra.exe [2009-02-09 339968]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5} "= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"CTHelper "=CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\LimeWire\\LimeWire.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE "=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE "=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE "=
"c:\\WINDOWS\\system32\\java.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
"c:\\Program Files\\Messenger\\Msmsgs.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP "= 3389:TCPxpsp2res.dll,-22009
"1723:TCP "= 1723:TCPxpsp2res.dll,-22015
"1701:UDP "= 1701:UDPxpsp2res.dll,-22016
"500:UDP "= 500:UDPxpsp2res.dll,-22017

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [1/29/2008 6:29 PM 33808]
R0 stmtpm;STM TPM Service;c:\windows\system32\drivers\stm_tpm.sys [4/1/2006 12:09 AM 21504]
R0 tdrpman228;Acronis Try&Decide and Restore Points filter (build 228);c:\windows\system32\drivers\tdrpm228.sys [6/24/2009 12:04 PM 902592]
R2 DUMeterSvc;DU Meter Service;c:\program files\DU Meter\DUMeterSvc.exe [12/4/2007 8:55 PM 1387544]
R2 NVIDIA Performance Driver Service;NVIDIA Performance Driver Service;c:\program files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe [5/14/2009 9:01 AM 4440064]
R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [5/1/2008 7:38 PM 2368]
R3 3xHybrid;Pinnacle PCTV 100i-110i-300i-310i-MCE;c:\windows\system32\drivers\3xHybrid.sys [8/8/2009 8:50 AM 1121536]
R3 COMMONFX.SYS;COMMONFX.SYS;c:\windows\system32\drivers\COMMONFX.sys [3/4/2009 2:42 PM 99352]
R3 CTAUDFX.SYS;CTAUDFX.SYS;c:\windows\system32\drivers\CTAUDFX.sys [3/4/2009 2:42 PM 555032]
R3 CTSBLFX.SYS;CTSBLFX.SYS;c:\windows\system32\drivers\CTSBLFX.sys [3/4/2009 2:42 PM 566296]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [5/16/2009 8:59 PM 19472]
R3 rt2870;Linksys 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [8/18/2009 3:38 PM 551680]
S3 COMMONFX;COMMONFX;c:\windows\system32\drivers\COMMONFX.sys [3/4/2009 2:42 PM 99352]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [5/29/2009 2:58 PM 79360]
S3 CTAUDFX;CTAUDFX;c:\windows\system32\drivers\CTAUDFX.sys [3/4/2009 2:42 PM 555032]
S3 CTERFXFX.SYS;CTERFXFX.SYS;c:\windows\system32\drivers\CTERFXFX.sys [3/4/2009 2:42 PM 100888]
S3 CTERFXFX;CTERFXFX;c:\windows\system32\drivers\CTERFXFX.sys [3/4/2009 2:42 PM 100888]
S3 CTSBLFX;CTSBLFX;c:\windows\system32\drivers\CTSBLFX.sys [3/4/2009 2:42 PM 566296]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [5/13/2009 5:46 PM 31760]

--- Other Services/Drivers In Memory ---

*Deregistered* - uphcleanhlp

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll ",BrandIEActiveSetup SIGNUP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe "
.
Contents of the 'Scheduled Tasks' folder

2009-02-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2009-09-02 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 10:20]

2009-08-27 c:\windows\Tasks\Defraggler Volume C Task.job
- c:\program files\Defraggler\df.exe [2009-05-11 13:47]

2009-02-05 c:\windows\Tasks\ParetoLogic Privacy Controls_{151696A8-F390-11DD-877A-0018F8A86A12}.job
- c:\program files\ParetoLogic\Privacy Controls\Pareto_PC.exe [2008-11-25 10:27]

2009-03-09 c:\windows\Tasks\ParetoLogic Privacy Controls_{9A32DD2C-0CD8-11DE-8821-0018F8A86A12}.job
- c:\program files\ParetoLogic\Privacy Controls\Pareto_PC.exe [2008-11-25 10:27]

2009-06-22 c:\windows\Tasks\ParetoLogic Privacy Controls_{9A6B7ABA-F38D-11DD-877A-0018F8A86A12}.job
- c:\program files\ParetoLogic\Privacy Controls\Pareto_PC.exe [2008-11-25 10:27]

2009-08-20 c:\windows\Tasks\ParetoLogic Registration.job
- c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [2008-02-22 11:25]

2009-08-22 c:\windows\Tasks\ParetoLogic Update Version2.job
- c:\program files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2008-02-22 11:25]

2009-09-02 c:\windows\Tasks\User_Feed_Synchronization-{1D5A943D-5DD1-4EF1-A125-7AB70DCCBC4E}.job
- c:\windows\system32\msfeedssync.exe [2006-08-22 02:31]

2009-09-02 c:\windows\Tasks\User_Feed_Synchronization-{34DF8543-DCA0-435E-AC2F-501DE9E5A701}.job
- c:\windows\system32\msfeedssync.exe [2006-08-22 02:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://news.google.com/
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{1F958B09-3312-7f0e-9723-4C1324C57B20}
LSP: c:\windows\system32\idmmbc.dll
Trusted Zone: 4irany.com\www
Trusted Zone: c-span.org
Trusted Zone: google.com\news
Trusted Zone: microsoft.com\update
Trusted Zone: radis.org
Trusted Zone: samsungodd.com\www
TCP: {A0722B6E-E533-459C-B5CA-439F82D0F592} = 192.168.1.1,212.217.0.1
TCP: {EC0FDAB6-CFBC-4E8E-921B-908A7018B283} = 194.230.1.103,194.230.1.39
DPF: {680285A8-96D3-43DA-9D3D-51DD987D0B77}
FF - ProfilePath - c:\documents and settings\SHAMS1\Application Data\Mozilla\Firefox\Profiles\xgto0m36.default\
FF - prefs.js: browser.startup.homepage - hxxp://news.google.com/
FF - component: c:\documents and settings\SHAMS1\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
FF - component: c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPAbacheck.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npracplug.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-02 14:26
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\DUMeterSvc]
"ImagePath "= "c:\program files\DU Meter\DUMeterSvc.exe /startedbyscm:E1F6D4BE-40E33354-DUMeterService "
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Multimedia\MIDIMap]
@DACL=(02 0000)
"DeviceInterface "= "\\\\?\\PCI#VEN_1102&DEV_0004&SUBSYS_10031102&REV_04#4&5855be9&0&20F0#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\\SynthA "
"SetupPreferredAudioDevicesCount "=dword:0000000a
"szPname "= "SB Audigy 2 Synth A [DCC0] "

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card0]
@DACL=(02 0000)
"Name "= "None (Direct Dial) "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "=" "
"InternationalAccessNumber "=" "
"LocalRule "=" "
"LDRule "=" "
"InternationalRule "=" "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card1]
@DACL=(02 0000)
"Name "= "AT&T Direct Dial via 1010ATT1 "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "= "1010288 "
"InternationalAccessNumber "= "1010288 "
"LocalRule "= "G "
"LDRule "= "J1FG "
"InternationalRule "= "J011EFG "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card10]
@DACL=(02 0000)
"Name "= "US Sprint via 10103330 "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "= "1010333 "
"InternationalAccessNumber "= "1010333 "
"LocalRule "= "G "
"LDRule "= "J0FG$TH "
"InternationalRule "= "J01EFG$TH "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card11]
@DACL=(02 0000)
"Name "= "US Sprint via 1-800-877-8000 "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "= "18008778000 "
"InternationalAccessNumber "= "18008778000 "
"LocalRule "= "G "
"LDRule "= "J,,,T0FG,,H "
"InternationalRule "= "J,,,T01EFG#,H "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card12]
@DACL=(02 0000)
"Name "= "Calling Card via 0 "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "=" "
"InternationalAccessNumber "=" "
"LocalRule "= "G "
"LDRule "= "0FG$TH "
"InternationalRule "= "01EFG$TH "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card13]
@DACL=(02 0000)
"Name "= "Carte France Telecom "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "=" "
"InternationalAccessNumber "=" "
"LocalRule "= "T3010,H,0FG# "
"LDRule "= "T3010,H,0FG# "
"InternationalRule "= "T3010,H,00EFG# "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card14]
@DACL=(02 0000)
"Name "= "Mercury (UK) "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "= "0500800800 "
"LDAccessNumber "= "0500800800 "
"InternationalAccessNumber "= "0500800800 "
"LocalRule "= "J$TH,0FG "
"LDRule "= "J$TH,0FG "
"InternationalRule "= "J$TH,0FG "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card15]
@DACL=(02 0000)
"Name "= "British Telecom (UK) "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "= "144 "
"LDAccessNumber "= "144 "
"InternationalAccessNumber "= "144 "
"LocalRule "= "J$H,0FG "
"LDRule "= "J$H,0FG "
"InternationalRule "= "J$H,00EFG "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card16]
@DACL=(02 0000)
"Name "= "CLEAR Communications (New Zealand) "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "= "0502333 "
"LDAccessNumber "= "0502333 "
"InternationalAccessNumber "= "0502333 "
"LocalRule "= "J$TH,0FG "
"LDRule "= "J$TH,0FG "
"InternationalRule "= "J$TH,00EFG "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card17]
@DACL=(02 0000)
"Name "= "Telecom New Zealand "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "= "012 "
"LDAccessNumber "= "012 "
"InternationalAccessNumber "= "012 "
"LocalRule "= "J,0FG?H "
"LDRule "= "J,0FG?H "
"InternationalRule "= "J,00EFG?H "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card18]
@DACL=(02 0000)
"Name "= "Global Card (Taiwan to USA) "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "=" "
"InternationalAccessNumber "= "0080 "
"LocalRule "= "G "
"LDRule "= "0FG "
"InternationalRule "= "J,102880$TFG$H "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card19]
@DACL=(02 0000)
"Name "= "Telstra (Australia) via 1818 (voice) "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "= "1818 "
"LDAccessNumber "= "1818 "
"InternationalAccessNumber "= "1818 "
"LocalRule "= "J$TH,FG# "
"LDRule "= "J$TH,FG# "
"InternationalRule "= "J$TH,0011EFG# "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card2]
@DACL=(02 0000)
"Name "= "AT&T via 1010ATT0 "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "= "1010288 "
"InternationalAccessNumber "= "1010288 "
"LocalRule "= "G "
"LDRule "= "J0FG$TH "
"InternationalRule "= "J01EFG$TH "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card20]
@DACL=(02 0000)
"Name "= "Telstra (Australia) via 1818 (fax) "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "= "1818 "
"LDAccessNumber "= "1818 "
"InternationalAccessNumber "= "1818 "
"LocalRule "= "J$TH,FG# "
"LDRule "= "J$TH,FG# "
"InternationalRule "= "J$TH,0015EFG# "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card21]
@DACL=(02 0000)
"Name "= "Optus (Australia) via 1812 "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "=" "
"InternationalAccessNumber "= "1812 "
"LocalRule "= "FG "
"LDRule "= "FG "
"InternationalRule "= "J@TH,0011EFG "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card22]
@DACL=(02 0000)
"Name "= "Optus (Australia) via 008551812 "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "=" "
"InternationalAccessNumber "= "008551812 "
"LocalRule "= "FG "
"LDRule "= "FG "
"InternationalRule "= "J@TH,0011EFG "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card3]
@DACL=(02 0000)
"Name "= "AT&T via 1-800-321-0288 "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "= "18003210288 "
"InternationalAccessNumber "= "18003210288 "
"LocalRule "= "G "
"LDRule "= "J$TFG$TH "
"InternationalRule "= "J$T01EFG$TH "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card4]
@DACL=(02 0000)
"Name "= "MCI Direct Dial via 10102221 "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "= "1010222 "
"InternationalAccessNumber "= "1010222 "
"LocalRule "= "G "
"LDRule "= "J1FG "
"InternationalRule "= "J011EFG "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card5]
@DACL=(02 0000)
"Name "= "MCI via 10102220 "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "= "1010222 "
"InternationalAccessNumber "= "1010222 "
"LocalRule "= "G "
"LDRule "= "J0FG$TH "
"InternationalRule "= "J01EFG$TH "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card6]
@DACL=(02 0000)
"Name "= "MCI via 1-800-888-8000 "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "= "18008888000 "
"InternationalAccessNumber "= "18008888000 "
"LocalRule "= "G "
"LDRule "= "J,,,,,,TH,,FG "
"InternationalRule "= "J,,,,,,TH,,011EFG "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card7]
@DACL=(02 0000)
"Name "= "MCI via 1-800-674-0700 "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "= "18006740700 "
"InternationalAccessNumber "= "18006740700 "
"LocalRule "= "G "
"LDRule "= "J,,,,,,TH,,FG "
"InternationalRule "= "J,,,,,,TH,,011EFG "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card8]
@DACL=(02 0000)
"Name "= "MCI via 1-800-674-7000 "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "= "18006747000 "
"InternationalAccessNumber "= "18006747000 "
"LocalRule "= "G "
"LDRule "= "J,,,,,,TH,,FG "
"InternationalRule "= "J,,,,,,TH,,011EFG "
"Flags "=dword:00000001

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\Card9]
@DACL=(02 0000)
"Name "= "US Sprint Direct Dial via 10103331 "
"Pin "=" "
"AccountNumber "=" "
"LocalAccessNumber "=" "
"LDAccessNumber "= "1010333 "
"InternationalAccessNumber "= "1010333 "
"LocalRule "= "G "
"LDRule "= "J1FG "
"InternationalRule "= "J011EFG "
"Flags "=dword:00000001

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Abacast\Client]
@DACL=(02 0000)
"Version "= "v1.62 "
"ReconnectAttempts "=dword:00000014
"ReconnectDelay "=dword:00001388
"GUID "= "{C4E58F98-99F9-4E07-A760-618F683C6903} "
"PosY "=dword:000000c6
"PosX "=dword:00000084
"LastServer "= "wm.afnl.abacast.com:80/afnl-wm-56 "
"loport "=dword:00000fa0
"hiport "=dword:00001004
"AutoTaskTray "=dword:00000001
"LastAddr "= "adsp://wm.afnl.abacast.com:80/afnl-wm-56?launchPlayer=false&displayerrors=false& "
"SOCKSServer "=" "
"SOCKSPort "=dword:00000438
"PingTime "=dword:0000003c
"SOCKS "=dword:00000000
"MediaPort "=dword:00000fa1
"ACWH "=dword:00030564
"CCS "= "adsp://wm.afnl.abacast.com:80/afnl-wm-56?launchPlayer=false&displayerrors=false& "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1063439b-dc44-45c8-a721-140b94538b89}]
@Denied: (Full) (Everyone)
"Model "=dword:00000050
"Therad "=dword:0000001f
"MData "=hex(0):83,a4,f9,ff,b3,e5,66,cc,8b,1e,5b,6c,e0,41,b9,e5,9b,68,b6,42,29,
d8,f3,88,04,a3,b7,bd,5b,11,77,40,a9,9c,2a,86,78,06,a9,58,70,62,dd,25,31,01,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel "= "Apartment "
@= "c:\\WINDOWS\\system32\\OLE32.DLL "
"cd042efbbd7f7af1647644e76e06692b "=hex:c8,28,51,af,b0,29,a3,98,7f,76,93,36,ef,
de,dd,68,e2,63,26,f1,3f,c8,ff,68,26,41,88,07,3c,76,ae,32,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel "= "Apartment "
@= "c:\\WINDOWS\\system32\\OLE32.DLL "
"bca643cdc5c2726b20d2ecedcc62c59b "=hex:71,3b,04,66,8b,46,0d,96,fe,29,7f,7c,67,
98,77,96,6a,9c,d6,61,af,45,84,18,2c,2d,43,fa,d2,42,9e,75,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel "= "Apartment "
@= "c:\\WINDOWS\\system32\\OLE32.DLL "
"2c81e34222e8052573023a60d06dd016 "=hex:ff,7c,85,e0,43,d4,0e,fe,ba,d3,3e,a0,98,
b0,d8,58,ff,7c,85,e0,43,d4,0e,fe,5c,76,85,dc,99,7d,7c,43,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel "= "Apartment "
@= "c:\\WINDOWS\\system32\\OLE32.DLL "
"2582ae41fb52324423be06337561aa48 "=hex:3e,1e,9e,e0,57,5a,93,61,61,90,8b,6a,d2,
50,7c,f4,86,8c,21,01,be,91,eb,e7,0d,87,20,b2,b6,8f,7a,2f,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk "=hex(0):8e,c0,1a,9b,ec,f3,60,82,6c,9d,fa,01,f0,90,ae,3c,2c,80,c7,73,c1,
c9,8e,61,8e,eb,97,49,00,1d,c1,27,46,fa,00,49,98,fb,03,9a,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel "= "Apartment "
@= "c:\\WINDOWS\\system32\\OLE32.DLL "
"caaeda5fd7a9ed7697d9686d4b818472 "=hex:f5,1d,4d,73,a8,13,5c,05,d3,00,ee,e2,42,
32,2f,a3,f5,1d,4d,73,a8,13,5c,05,6a,c6,1f,df,dc,3b,20,ae,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel "= "Apartment "
@= "c:\\WINDOWS\\system32\\OLE32.DLL "
"a4a1bcf2cc2b8bc3716b74b2b4522f5d "=hex:df,20,58,62,78,6b,cf,c8,01,eb,bf,1d,0d,
e1,39,19,df,20,58,62,78,6b,cf,c8,b9,d4,f8,85,d2,06,33,1c,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel "= "Apartment "
@= "c:\\WINDOWS\\system32\\OLE32.DLL "
"4d370831d2c43cd13623e232fed27b7b "=hex:31,77,e1,ba,b1,f8,68,02,05,4c,31,68,e9,
11,9e,f7,fb,a7,78,e6,12,2f,9a,ea,a7,d7,36,de,a1,66,30,54,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel "= "Apartment "
@= "c:\\WINDOWS\\system32\\OLE32.DLL "
"1d68fe701cdea33e477eb204b76f993d "=hex:01,3a,48,fc,e8,04,4a,f1,fd,0b,f8,77,1e,
51,66,39,01,3a,48,fc,e8,04,4a,f1,63,97,c7,ba,ac,58,60,19,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel "= "Apartment "
@= "c:\\WINDOWS\\system32\\OLE32.DLL "
"1fac81b91d8e3c5aa4b0a51804d844a3 "=hex:51,fa,6e,91,28,9e,14,cc,91,70,19,85,7d,
d9,2b,50,f6,0f,4e,58,98,5b,89,c9,37,64,98,c6,22,0f,fe,65,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel "= "Apartment "
@= "c:\\WINDOWS\\system32\\OLE32.DLL "
"f5f62a6129303efb32fbe080bb27835b "=hex:37,a4,aa,c3,a6,15,56,0a,59,6e,36,72,2b,
16,b3,c3,3d,ce,ea,26,2d,45,aa,78,47,ea,95,63,2b,bb,8e,a4,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel "= "Apartment "
@= "c:\\WINDOWS\\system32\\OLE32.DLL "
"fd4e2e1a3940b94dceb5a6a021f2e3c6 "=hex:f8,31,0f,a9,5f,a0,ec,fb,c5,ad,11,12,6d,
8f,e8,5c,2a,b7,cc,b5,b9,7f,41,e7,09,79,c5,41,79,5f,01,54,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel "= "Apartment "
@= "c:\\WINDOWS\\system32\\OLE32.DLL "
"8a8aec57dd6508a385616fbc86791ec2 "=hex:6c,43,2d,1e,aa,22,2f,9c,8a,96,f8,f9,24,
2f,42,a3,6c,43,2d,1e,aa,22,2f,9c,7c,c4,47,a2,01,82,9d,bd,6c,43,2d,1e,aa,22,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Windows\AutorunsDisabled]
"Appinit_Dlls "= "sockspy.dll "

[HKEY_LOCAL_MACHINE\software\SupportSoft\RemoteAssistant]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\SymNRT\LTM]
@DACL=(02 0000)
"FontCacheState "=dword:44ff4447

[HKEY_LOCAL_MACHINE\software\SystemRequirementsLab\nvd]
@DACL=(02 0000)
"LibPath "= "c:\\Program Files\\SystemRequirementsLab\\systemnvd.dll "

[HKEY_LOCAL_MACHINE\software\The Silicon Realms Toolworks\Armadillo]
@DACL=(02 0000)
"{0F943452EDEBA2F7C} "=hex:bb,75,7b,38,04,ae,52,5f,7f,68,ef,02,ed,f6,0e,26,86,
5a,83,ab,37

[HKEY_LOCAL_MACHINE\software\Tracker Software\PDF-XChange 3.0]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Tracker Software\pdfxctrl.PdfPrinterPreferences]
@DACL=(02 0000)
"XCL_PATH "= "c:\\Program Files\\Tracker Software\\PDF-XChange 3\\AxLanguages\\ "

[HKEY_LOCAL_MACHINE\software\Ulead Systems\Ulead CD/DVD Writing Engine]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Wise Solutions\Wise Installation System]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Xing Technology Corp.\SharedDlls]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Yahoo\Companion]
@DACL=(02 0000)
"Corp "= "none "
"Guest "= "none "
"ft "=dword:00000001
"ii "=dword:00000001
"dc "= "v7_iobit "
"Region "= "us "
"Language "= "us "
"attempt "= "...attempting to retrieve buttons from Yahoo!... "
"swp "=dword:00000001
"pc "= "iobit "
"sc "= "iobit "
"Version "= "6.3.6.0 "
"Apptitle "= "Yahoo! Toolbar "

[HKEY_LOCAL_MACHINE\software\Yahoo\Skin]
@DACL=(02 0000)
"Path "= "c:\\Program Files\\Yahoo!\\Shared\\Graphics "
"DefSkin "= "Indigo\\indigo.xml "

[HKEY_LOCAL_MACHINE\software\Yahoo\Uninstaller]
@DACL=(02 0000)
"ExitCode "=dword:00000000

[HKEY_LOCAL_MACHINE\System\ControlSet002\Enum\HID\Vid_046d&Pid_c016\6&21af8844&0&0000\LogConf]
@DACL=(02 0000)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(1508)
c:\windows\system32\relog_ap.dll

- - - - - - - > 'explorer.exe'(2100)
c:\windows\system32\WININET.dll
c:\program files\NVIDIA Corporation\nView\nview.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\program files\Portrait Displays\Pivot Software\winphook.dll
c:\program files\Internet Download Manager\idmmkb.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\Creative\Shared Files\CTAudSvc.exe
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\windows\system32\bgsvcgen.exe
c:\program files\Common Files\Portrait Displays\Shared\DTSRVC.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\UPHClean\uphclean.exe
c:\windows\system32\MsPMSPSv.exe
c:\windows\system32\searchindexer.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\Portrait Displays\Shared\HookManager.exe
c:\program files\Portrait Displays\Pivot Software\Floater.exe
c:\program files\Internet Download Manager\IEMonitor.exe
.
**************************************************************************
.
Completion time: 2009-09-02 14:34 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-02 12:34

Pre-Run: 212,800,008,192 bytes free
Post-Run: 212,771,024,896 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS= "Microsoft Windows XP Professional" /noexecute=optin /fastdetect
[acronis snap restore]
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS= "Microsoft Windows XP Professional" /noexecute=optin /fastdetect
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS= "Microsoft Windows XP Professional" /noexecute=optin /fastdetect

802 --- E O F --- 2009-08-26 03:20

A333 · 2009/09/02

Also The new HijackThis as below:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:43:16 PM, on 9/2/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
C:\Program Files\DU Meter\DUMeterSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe
C:\Program Files\SAMSUNG\FW LiveUpdate\FWManager.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
C:\Program Files\Portrait Displays\Pivot Software\floater.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Livestation\Livestation.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {3EE5C0A4-C6FD-4A6A-91BB-3FD8BE70B5CC} - (no file)
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - (no file)
O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: (no name) - {DC5F9604-C6E2-47D0-8E0F-E60FCCB334C7} - (no file)
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - (no file)
O3 - Toolbar: (no name) - {a66cc04d-ca4e-4050-8e18-51f7e6d18096} - (no file)
O3 - Toolbar: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll
O3 - Toolbar: (no name) - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - (no file)
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe "
O4 - HKLM\..\Run: [DT HPW] C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe -HPW
O4 - HKLM\..\Run: [avp] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe "
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\1.0 "
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [Name of App] C:\Program Files\SAMSUNG\FW LiveUpdate\FWManager.exe r
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKCU\..\Run: [Livestation] C:\Program Files\Livestation\Livestation.exe -startup
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [PMCLoader] C:\Program Files\Pinnacle\TVCenter Pro\PMCLoader.exe -checktasks
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Internet Radio by Endicosoft.com - {1F958B09-3312-7f0e-9723-4C1324C57B20} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.4irany.com
O15 - Trusted Zone: http://*.c-span.org
O15 - Trusted Zone: http://*.radis.org
O15 - Trusted Zone: http://www.samsungodd.com
O16 - DPF: {680285A8-96D3-43DA-9D3D-51DD987D0B77} -
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} - http://ccfiles.creative.com/Web/softwareupdate/su/ocx/15101/CTSUEng.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} -
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} -
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - http://ccfiles.creative.com/Web/softwareupdate/su/ocx/15108/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A0722B6E-E533-459C-B5CA-439F82D0F592}: NameServer = 192.168.1.1,212.217.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{EC0FDAB6-CFBC-4E8E-921B-908A7018B283}: NameServer = 194.230.1.103,194.230.1.39
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Kaspersky Lab\Kaspersky Internet Security 2010\kloehk.dll
O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
O23 - Service: DU Meter Service (DUMeterSvc) - Hagel Technologies Ltd - C:\Program Files\DU Meter\DUMeterSvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: gusvc - Unknown owner - (no file)
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Performance Driver Service - Unknown owner - C:\Program Files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe

--
End of file - 13793 bytes

broni · 2009/09/02

Uninstall Combofix:
Go Start > Run
Type in:
combofix /u
Note the space between the "combofix" and the "/u "
Restart computer.

===============================================================

Print these instructions out.

NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

***VERY IMPORTANT! Make sure, you update Superantispyware, and Malwarebytes before running the scans.***

STEP 1. Download SUPERAntiSpyware Free for Home Users:
http://www.superantispyware.com/

* Double-click SUPERAntiSpyware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes ". If not, update the definitions before scanning by selecting "Check for Updates ". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
* Close SUPERAntiSpyware.

PHYSICALLY DISCONNECT FROM THE INTERNET

Restart computer in Safe Mode.
To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

* Open SUPERAntiSpyware.
* Click Scan your Computer... button.
* Click Scanning Preferences/Control Center... button.
* Under General and Startup tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked):
- Close browsers before scanning.
- Terminate memory threats before quarantining.
* Click the Close button to leave the control center screen.
* On the left, make sure you check C:\Fixed Drive.
* On the right, choose Perform Complete Scan.
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
* Make sure everything has a checkmark next to it and click Next.
* A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
* If asked if you want to reboot, click Yes.
* To retrieve the removal information after reboot, launch SUPERAntispyware again.
- Click Preferences, then click the Statistics/Logs tab.
- Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
- If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
- Please copy and paste the Scan Log results in your next reply.
* Click Close to exit the program.
Post SUPERAntiSpyware log.

RECONNECT TO THE INTERNET

RESTART COMPUTER!

STEP 2. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
(Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

RESTART COMPUTER!

STEP 3.
Post fresh HijackThis log.
NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator
Do NOT attempt to "fix" anything!

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

A333 · 2009/09/06

Hi Broni,

Sorry I was discmnnected from my nrtwork during the past few days. I'm posting results as below, but still the nasty error comes on, in the System Event Viewer, when I log on to my computer. I'm on Windows XP Professional SP3:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 09/02/2009 at 09:25 PM

Application Version : 4.27.1002

Core Rules Database Version : 4082
Trace Rules Database Version: 2022

Scan type : Complete Scan
Total Scan Time : 01:28:04

Memory items scanned : 234
Memory threats detected : 0
Registry items scanned : 8250
Registry threats detected : 0
File items scanned : 149719
File threats detected : 0

Malwarebytes' Anti-Malware 1.40
Database version: 2745
Windows 5.1.2600 Service Pack 3

9/5/2009 8:47:08 PM
mbam-log-2009-09-05 (20-47-08).txt

Scan type: Full Scan (C:\|D:\|E:\|F:\|)
Objects scanned: 329203
Time elapsed: 1 hour(s), 25 minute(s), 40 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

The newest hijackThis will follow.

A333 · 2009/09/06

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:08:05 AM, on 9/6/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
C:\Program Files\DU Meter\DUMeterSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe
C:\Program Files\SAMSUNG\FW LiveUpdate\FWManager.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Portrait Displays\Pivot Software\floater.exe
C:\Program Files\Portrait Displays\HP My Display\DTHtml.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Livestation\Livestation.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\DU Meter\DUMeter.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {3EE5C0A4-C6FD-4A6A-91BB-3FD8BE70B5CC} - (no file)
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - (no file)
O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: (no name) - {DC5F9604-C6E2-47D0-8E0F-E60FCCB334C7} - (no file)
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - (no file)
O3 - Toolbar: (no name) - {a66cc04d-ca4e-4050-8e18-51f7e6d18096} - (no file)
O3 - Toolbar: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll
O3 - Toolbar: (no name) - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - (no file)
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe "
O4 - HKLM\..\Run: [DT HPW] C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe -HPW
O4 - HKLM\..\Run: [avp] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe "
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\1.0 "
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [Name of App] C:\Program Files\SAMSUNG\FW LiveUpdate\FWManager.exe r
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKCU\..\Run: [Livestation] C:\Program Files\Livestation\Livestation.exe -startup
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Acronis Scheduler2 Service] C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
O4 - HKCU\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKCU\..\Run: [PMCLoader] C:\Program Files\Pinnacle\TVCenter Pro\PMCLoader.exe -checktasks
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Internet Radio by Endicosoft.com - {1F958B09-3312-7f0e-9723-4C1324C57B20} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.4irany.com
O15 - Trusted Zone: http://*.c-span.org
O15 - Trusted Zone: http://*.radis.org
O15 - Trusted Zone: http://www.samsungodd.com
O16 - DPF: {680285A8-96D3-43DA-9D3D-51DD987D0B77} -
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} - http://ccfiles.creative.com/Web/softwareupdate/su/ocx/15101/CTSUEng.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} -
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} -
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - http://ccfiles.creative.com/Web/softwareupdate/su/ocx/15108/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A0722B6E-E533-459C-B5CA-439F82D0F592}: NameServer = 192.168.1.1,212.217.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{EC0FDAB6-CFBC-4E8E-921B-908A7018B283}: NameServer = 192.168.1.1
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Kaspersky Lab\Kaspersky Internet Security 2010\kloehk.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
O23 - Service: DU Meter Service (DUMeterSvc) - Hagel Technologies Ltd - C:\Program Files\DU Meter\DUMeterSvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: gusvc - Unknown owner - (no file)
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Performance Driver Service - Unknown owner - C:\Program Files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe

--
End of file - 14342 bytes

broni · 2009/09/06

Please, uninstall Java(TM) 6 Update 6 and Java(TM) 6 Update 7 through Add\Remove.

===============================================================

Print this post out, since you won't have an access to it, at some point.

1. Open HijackThis.

2. Close all windows, except for HijackThis.

3. Put checkmarks next to the following HijackThis entries:

- R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
- R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
- O2 - BHO: (no name) - AutorunsDisabled - (no file)
- O2 - BHO: (no name) - {3EE5C0A4-C6FD-4A6A-91BB-3FD8BE70B5CC} - (no file)
- O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
- O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - (no file)
- O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
- O2 - BHO: (no name) - {DC5F9604-C6E2-47D0-8E0F-E60FCCB334C7} - (no file)
- O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - (no file)
- O3 - Toolbar: (no name) - {a66cc04d-ca4e-4050-8e18-51f7e6d18096} - (no file)
- O3 - Toolbar: (no name) - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - (no file)
- O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
- O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - (no file)

4. You should also checkmark following entries (these are unnecessary startups; no actual programs will be removed):

- O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
- O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe "
- O4 - HKLM\..\Run: [Name of App] C:\Program Files\SAMSUNG\FW LiveUpdate\FWManager.exe r
- O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /install
- O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
- O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
- O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

5. Click on Fix checked button.

6. Go Start>Run (Vista users - "Start search "), type in:
cmd
Click OK (Vista users - hold CTRL, and SHIFT keys, press Enter).

Command Prompt window will open.
Type in:
sc stop gusvc
Press Enter.
Wait for the service to be stopped.

Type in:
sc delete gusvc
Press Enter.
Wait for confirmation.

7. Restart computer.

8. Post new HijackThis log.

A333 · 2009/09/06

Broni,

When I type and run the "sc stop gusvc command ", I get the Error: SC ControlService failed 1062: The Service has not started. So I just didn't continue with "delete" , until I hear form you.

Al the rest vent very well( although my heart was beating) and following is the newest HijackThis. By the way I had already uninstalled the Java 6 and Java 7 update.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:02:56 PM, on 9/6/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
C:\Program Files\DU Meter\DUMeterSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Livestation\Livestation.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\DU Meter\DUMeter.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Portrait Displays\HP My Display\DTHtml.exe
C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Live Toolbar\msn_sl.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [DT HPW] C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe -HPW
O4 - HKLM\..\Run: [avp] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe "
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\1.0 "
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [Livestation] C:\Program Files\Livestation\Livestation.exe -startup
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Acronis Scheduler2 Service] C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
O4 - HKCU\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKCU\..\Run: [PMCLoader] C:\Program Files\Pinnacle\TVCenter Pro\PMCLoader.exe -checktasks
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Internet Radio by Endicosoft.com - {1F958B09-3312-7f0e-9723-4C1324C57B20} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.4irany.com
O15 - Trusted Zone: http://*.c-span.org
O15 - Trusted Zone: http://*.radis.org
O15 - Trusted Zone: http://www.samsungodd.com
O16 - DPF: {680285A8-96D3-43DA-9D3D-51DD987D0B77} -
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} - http://ccfiles.creative.com/Web/softwareupdate/su/ocx/15101/CTSUEng.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} -
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} -
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - http://ccfiles.creative.com/Web/softwareupdate/su/ocx/15108/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A0722B6E-E533-459C-B5CA-439F82D0F592}: NameServer = 192.168.1.1,212.217.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{EC0FDAB6-CFBC-4E8E-921B-908A7018B283}: NameServer = 192.168.1.1
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Kaspersky Lab\Kaspersky Internet Security 2010\kloehk.dll
O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
O23 - Service: DU Meter Service (DUMeterSvc) - Hagel Technologies Ltd - C:\Program Files\DU Meter\DUMeterSvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: gusvc - Unknown owner - (no file)
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Performance Driver Service - Unknown owner - C:\Program Files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe

--
End of file - 12750 bytes

broni · 2009/09/06

When I type and run the "sc stop gusvc command ", I get the Error: SC ControlService failed 1062: The Service has not started. So I just didn't continue with "delete" , until I hear form you
Click to expand...

Don't worry about. It's more, or less cosmetic issue.

Your computer is clean

1. Download Temp File Cleaner (TFC)
Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

2. Turn off System Restore:

- Windows XP:
1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore ".
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
- Windows Vista:
1. Click Start.
2. Right-click the Computer icon, and then click Properties.
3. Click on System Protection under the Tasks column on the left side
4. Click on Continue on the "User Account Control" window that pops up
5. Under the System Protection tab, find Available Disks
6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C: ")
7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
8. Click OK

3. Restart computer.

4. Turn System Restore on.

5. Make sure, Windows Updates are current.

[SIZE= "4"]6. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately![/SIZE]

7. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

8. Run defrag at your convenience.

9. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

10. Please, let me know, how is your computer doing.

A333 · 2009/09/07

Broni,

Thanks to you. I have done all of your instruction and system is running much more smoothly than before. But still, each time that I log on, I get the same system error, in System evenet Viewer as before. May be I should copy and paste the detail of the error as bellow:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 9/7/2009
Time: 1:15:11 PM
User: N/A
Computer: FAMILYROOM
Description:
The PCASp50 NDIS Protocol Driver service failed to start due to the following error:
The system cannot find the file specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

The specified file that cannot be found is : ntevent.dll

I know that my system is clean, but is there a way to get this error fixed?

broni · 2009/09/07

Since your computer is clean, you may start a new topic under Windows section about your issue.
If this is an issue. In general, every computer has some errors in Event Viewer. If your computer is working fine, there is no reason to dig through Event Viewer, unless you're asking for a headache
I'll mark this thread as resolved.
Happy surfing

Log in or Sign up

Solved PCASp50 NDIS Protocol Driver service failed to start

A333 Inactive Thread Starter

broni Moderator Malware Analyst

A333 Inactive Thread Starter

A333 Inactive Thread Starter

A333 Inactive Thread Starter

broni Moderator Malware Analyst

A333 Inactive Thread Starter

broni Moderator Malware Analyst

A333 Inactive Thread Starter

broni Moderator Malware Analyst

A333 Inactive Thread Starter

A333 Inactive Thread Starter

broni Moderator Malware Analyst

A333 Inactive Thread Starter

A333 Inactive Thread Starter

broni Moderator Malware Analyst

A333 Inactive Thread Starter

broni Moderator Malware Analyst

A333 Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Log in or Sign up

Solved PCASp50 NDIS Protocol Driver service failed to start

A333 Inactive Thread Starter

broni Moderator Malware Analyst

A333 Inactive Thread Starter

A333 Inactive Thread Starter

A333 Inactive Thread Starter

broni Moderator Malware Analyst

A333 Inactive Thread Starter

broni Moderator Malware Analyst

A333 Inactive Thread Starter

broni Moderator Malware Analyst

A333 Inactive Thread Starter

A333 Inactive Thread Starter

broni Moderator Malware Analyst

A333 Inactive Thread Starter

A333 Inactive Thread Starter

broni Moderator Malware Analyst

A333 Inactive Thread Starter

broni Moderator Malware Analyst

A333 Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Useful Searches