Anti-virims System Alert Popup

Computing.Net > Forums > Security and Virus > Anti-virims System Alert Popup

Anti-virims System Alert Popup

Original Message

Name: cownett
Date: December 29, 2006 at 08:03:16 Pacific
Subject: Anti-virims System Alert Popup
OS: XP
CPU/Ram: Athlon AMD 64
Model/Manufacturer: HP Pavilion

Comment:

Hi there
I hope you can help. I cannot get rid of a flashing ? system alert(question mark) in my toolbar.
Please can you help?
Many Thanks

Report Offensive Message For Removal

Response Number 1

Name: jabuck
Date: December 29, 2006 at 08:07:13 Pacific
Subject: Anti-virims System Alert Popup

Reply: (edit)

Please post a Hijack This log so that the files associated with the virus/spyware/hijacker can be identified.
Please download HJTsetup.exe from this link http://www.thespykiller.co.uk/files/HJTsetup.exe to your desktop.
Doubleclick on the HJTsetup.exe icon on your desktop.
By default it will install to C:\Program Files\Hijack This.
Continue to click "next" in the setup dialogue boxes until you get to the "Select Addition Tasks" dialogue.
Put a check by "Create a desktop icon" then click "Next" again.
Continue to follow the rest of the prompts from there.
At the final dialogue box click "Finish" and it will launch Hijack This.
Click on the "Do a system scan and save a logfile" button. It will scan and the log should open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log and post it in this thread.
Do not fix anything yet unless you know what you are doing. This is a powerful tool that can crash the computer if used improperly.
Please download SmitFraudFix from this link http://siri.urz.free.fr/Fix/Smitfra... Then extract the contents to your desktop.
!!!! Only run option #1 as runing the other options on an uninfected computer will damage the desktop.!!!!
Open the "SmitfraudFix" folder and double-click "smitfraudfix.cmd"
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.
Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

Report Offensive Follow Up For Removal

Response Number 2

Name: cownett
Date: December 29, 2006 at 12:01:30 Pacific
Subject: Anti-virims System Alert Popup

Reply: (edit)

Hi there
As follows:
Logfile of HijackThis v1.99.1
Scan saved at 15:41:50, on 29/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CyberLink\PowerCinema\PCMService.exe
C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
c:\windows\system\hpsysdrv.exe
C:\Documents and Settings\HP_Owner\Desktop\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?T...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sony.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?T...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?T...
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: (no name) - {67982BB7-0F95-44C5-92DC-E3AF3DC19D6D} - C:\Program Files\Video ActiveX Object\isaddon.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Norton Ghost 10.0] "C:\Program Files\Norton Ghost\Agent\GhostTray.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/res...
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windows...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microso...
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O20 - Winlogon Notify: 1_32bean32_1reg - C:\Documents and Settings\All Users\Documents\Settings\1_32bean32_1.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: flammei - {9d635a36-6b3c-4146-8625-f3aaf507bbf8} - (no file)
O21 - SSODL: buprestidae - {b59f3ba4-98da-4b5f-8a2d-7b56fb11140b} - C:\WINDOWS\system32\cthkpcv.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe

Smit Fraud fix
SmitFraudFix v2.131
Scan done at 19:59:36.15, 29/12/2006
Run from C:\Documents and Settings\HP_Owner\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\HP_Owner

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\HP_Owner\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\HP_Owner\FAVORI~1

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{9d635a36-6b3c-4146-8625-f3aaf507bbf8}"="flammei"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}"="buprestidae"
[HKEY_CLASSES_ROOT\CLSID\{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}\InProcServer32]
@="C:\WINDOWS\system32\cthkpcv.dll"
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}\InProcServer32]
@="C:\WINDOWS\system32\cthkpcv.dll"
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32

»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End
Many Thanks

Report Offensive Follow Up For Removal

Response Number 3

Name: jabuck
Date: December 29, 2006 at 14:24:59 Pacific
Subject: Anti-virims System Alert Popup

Reply: (edit)

Please download ATF-Cleaner to your desktop from this link
http://www.atribune.org/content/view/19/2/ We will need it later in safe mode
Download and install AVG Anti-Spyware We will need this later in safe mode
Be sure to update AVG Anti- Spyware
Please download ComboFix to the desktop from this link:
http://download.bleepingcomputer.com/sUBs/combofix.exe Don't run it yet
Temporarily disable any of the following anti-spyware realtime protection programs that you may have Temporarily Disable Realtime Protection
Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok
Set up the computer to view hidden files by going to start>control panel>folder options>view tab>tick the circle beside "show hidden files and folders" and untick the box beside "hide extensions of known file types" and "hide protected system operating files">apply>ok.
Next, please reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.
Run Hijack This from safe mode, close all windows except Hijack This, place a check to the left of the following items and press "fix checked":
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?T...

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin...

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin...

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?T...

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin...

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?T...
O2 - BHO: (no name) - {67982BB7-0F95-44C5-92DC-E3AF3DC19D6D} - C:\Program Files\Video ActiveX Object\isaddon.dll (file missing)
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O20 - Winlogon Notify: 1_32bean32_1reg - C:\Documents and Settings\All Users\Documents\Settings\1_32bean32_1.dll (file missing)
O21 - SSODL: flammei - {9d635a36-6b3c-4146-8625-f3aaf507bbf8} - (no file)
O21 - SSODL: buprestidae - {b59f3ba4-98da-4b5f-8a2d-7b56fb11140b} - C:\WINDOWS\system32\cthkpcv.dll
Exit hijack This but remain in safe mode
Navigate to and delete this file if found:
C:\WINDOWS\system32\cthkpcv.dll

Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

In Safe Mode, run AVG Anti-spyware and click on the Scanner tab at the top. Click the "Settings" tab and then change the recommended action to Quarantine and click Automatically generate report after every scan. Click back to the "Scan" tab and then click on Complete System Scan. This scan can take quite a while to run, so be prepared.
AVG Anti-Spyware will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. AVG Anti-Spyware will display "All actions have been applied" on the right hand side.
Click on "Save Report", then "Save Report As". This will create a text file. Make sure you know where to find this file again (like on the Desktop).
Reboot to normal mode.
Run Combofix. Double-click combofix.exe
Follow the prompts.
(Don't click on the window while the program is running, it may cause your system to hang.)
Please post the combofix.txt log and a new Hijack This log please.

Report Offensive Follow Up For Removal

Response Number 4

Name: cownett
Date: December 30, 2006 at 04:51:46 Pacific
Subject: Anti-virims System Alert Popup

Reply: (edit)

Cheers Jabuck. Problem sorted. You be the man.
Log files as follows:
HP_Owner - 06-12-30 12:37:55.43 Service Pack 2
ComboFix 06.11.27 - Running from: "C:\Documents and Settings\HP_Owner\Desktop"
(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\Documents and Settings\All Users\Documents\Settings

((((((((((((((((((((((((((((((( Files Created from 2006-11-30 to 2006-12-30 ))))))))))))))))))))))))))))))))))

2006-12-30 10:00 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-12-30 09:59 <DIR> d-------- C:\Program Files\Grisoft
2006-12-29 13:48 3,456 --a------ C:\WINDOWS\system32\tmp.reg
2006-12-29 13:47 79,360 --a------ C:\WINDOWS\system32\swxcacls.exe
2006-12-29 13:47 53,248 --a------ C:\WINDOWS\system32\Process.exe
2006-12-29 13:47 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2006-12-29 13:47 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2006-12-29 13:47 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2006-12-29 13:47 135,168 --a------ C:\WINDOWS\system32\swreg.exe
2006-12-28 21:59 <DIR> d-------- C:\Program Files\Windows Live Safety Center
2006-12-28 17:49 <DIR> d-------- C:\Documents and Settings\HP_Owner\Application Data\PC Tools
2006-12-28 16:46 10 --a------ C:\WINDOWS\Syskernel12.dll
2006-12-28 16:46 <DIR> d-------- C:\Program Files\Cool MP3 Splitter
2006-12-28 16:40 3,082 --a------ C:\WINDOWS\system32\affv12740p1now.sys
2006-12-27 15:46 <DIR> d-------- C:\Program Files\HarvEX
2006-12-26 12:34 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE
2006-12-26 01:16 <DIR> d-------- C:\Documents and Settings\HP_Owner\Application Data\Ad Annihilator.files
2006-12-26 01:15 <DIR> d-------- C:\Program Files\Ad Annihilator
2006-12-26 00:50 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2006-12-26 00:50 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2006-12-21 20:12 <DIR> d-------- C:\Documents and Settings\HP_Owner\Application Data\Canon
2006-12-21 19:41 53,248 -ra------ C:\WINDOWS\system32\InstMed.exe
2006-12-21 19:40 913,280 --a------ C:\WINDOWS\system32\drivers\LV302AV.SYS
2006-12-21 19:40 7,136 --a------ C:\WINDOWS\system32\drivers\lv302af.sys
2006-12-21 19:40 372,736 --a------ C:\WINDOWS\system32\LVUI2RC.dll
2006-12-21 19:40 22,016 --a------ C:\WINDOWS\system32\drivers\LVUSBSta.sys
2006-12-21 19:40 204,800 --a------ C:\WINDOWS\system32\LVUI2.dll
2006-12-21 19:40 2,180,096 --a------ C:\WINDOWS\system32\drivers\LVSVF2.sys
2006-12-21 19:40 106,496 --a------ C:\WINDOWS\system32\lvcoinst.dll
2006-12-21 19:40 <DIR> d-------- C:\Program Files\Common Files\Logitech
2006-12-15 19:33 <DIR> d-------- C:\Documents and Settings\All Users\SonicStage
2006-12-15 18:59 90,112 --------- C:\WINDOWS\snymsico.dll
2006-12-15 18:59 38,951 --------- C:\WINDOWS\system32\drivers\NETMDUSB.sys
2006-12-15 18:59 36,679 --------- C:\WINDOWS\system32\drivers\NETMD052.sys
2006-12-15 18:59 36,232 --------- C:\WINDOWS\system32\drivers\NETMD033.sys
2006-12-15 18:59 35,319 --------- C:\WINDOWS\system32\drivers\NETMD031.sys
2006-12-15 18:58 770,048 --a------ C:\WINDOWS\system32\CDDBUISony.dll
2006-12-15 18:58 73,728 --a------ C:\WINDOWS\system32\CddbLinkSony.dll
2006-12-15 18:58 643,072 --a------ C:\WINDOWS\system32\CDDBControlSony.dll
2006-12-15 18:58 585,728 --a------ C:\WINDOWS\system32\CddbMusicIDSony.dll
2006-12-15 18:58 520,192 --a------ C:\WINDOWS\system32\CddbPlaylist2Sony.dll
2006-12-15 18:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sony Corporation
2006-12-15 18:57 <DIR> d-------- C:\Program Files\Sony
2006-12-15 18:57 <DIR> d-------- C:\Program Files\Common Files\Sony Shared
2006-12-15 18:57 <DIR> d-------- C:\Documents and Settings\HP_Owner\Application Data\Sony Corporation
2006-12-12 18:40 73,728 --a------ C:\WINDOWS\system32\Zion.dll
2006-12-12 18:40 7,040 --a------ C:\WINDOWS\system32\drivers\Gonzales.sys
2006-12-12 18:40 12,160 --a------ C:\WINDOWS\system32\drivers\Bonifay.sys
2006-12-12 18:40 <DIR> d-------- C:\Program Files\Freecom Personal Media Suite
2006-12-09 20:14 <DIR> d-------- C:\Program Files\Lavasoft
2006-12-09 20:14 <DIR> d-------- C:\Documents and Settings\HP_Owner\Application Data\Lavasoft
2006-12-09 20:08 <DIR> d-------- C:\WINDOWS\pss
2006-12-09 13:02 10,752 --a------ C:\WINDOWS\system32\BASSMOD.dll
2006-12-09 12:56 331,776 --a------ C:\WINDOWS\system32\NCTAudioVisualizationEx2.dll
2006-12-08 22:52 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2006-12-08 22:50 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2006-12-08 22:50 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2006-12-04 14:42 <DIR> d-------- C:\Documents and Settings\HP_Owner\Shared
2006-12-04 14:41 <DIR> d-------- C:\Documents and Settings\HP_Owner\Incomplete
2006-12-04 14:38 <DIR> d-------- C:\Program Files\LimeWire
2006-12-04 14:36 <DIR> d-------- C:\Documents and Settings\HP_Owner\.limewire
2006-12-02 11:54 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2006-12-02 00:33 127,208 --a------ C:\WINDOWS\system32\mucltui.dll
2006-12-01 23:50 <DIR> d-------- C:\WINDOWS\WBEM
2006-12-01 23:50 <DIR> d-------- C:\WINDOWS\system32\en-US
2006-12-01 23:48 <DIR> d--h-c--- C:\WINDOWS\ie7
2006-12-01 23:46 121,856 --------- C:\WINDOWS\system32\xmllite.dll
2006-12-01 23:45 <DIR> d-------- C:\WINDOWS\network diagnostic
2006-12-01 23:42 <DIR> d-------- C:\Program Files\MSXML 4.0
2006-12-01 23:33 28,672 --------- C:\WINDOWS\system32\verclsid.exe
2006-12-01 23:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2006-12-01 23:03 <DIR> d-------- C:\WINDOWS\system32\PreInstall
2006-12-01 23:00 18,200 --a------ C:\WINDOWS\system32\wups2.dll
2006-12-01 23:00 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution
2006-12-01 19:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2006-12-01 10:03 <DIR> d-------- C:\temp

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2006-12-30 12:34 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\Skype
2006-12-28 21:34 -------- d-------- C:\Program Files\Symantec
2006-12-28 21:34 -------- d-------- C:\Program Files\Google
2006-12-28 21:29 -------- d-------- C:\Program Files\Common Files\Symantec Shared
2006-12-28 21:29 -------- d-------- C:\Program Files\Common Files
2006-12-28 21:20 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\Symantec
2006-12-28 18:18 -------- d-------- C:\Program Files\Mozilla Firefox
2006-12-26 12:34 2560 --a------ C:\WINDOWS\_MSRSTRT.EXE
2006-12-26 01:23 82 --a------ C:\Documents and Settings\HP_Owner\Application Data\Ad Annihilator.aap
2006-12-16 14:48 -------- d-------- C:\Program Files\MSN
2006-12-16 03:07 -------- d-------- C:\Program Files\Common Files\System
2006-12-16 03:01 -------- d-------- C:\Program Files\Outlook Express
2006-12-15 18:59 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-12-15 18:58 -------- d-------- C:\Program Files\Common Files\InstallShield
2006-12-12 19:31 -------- d-------- C:\Program Files\WinMPG VideoConvert
2006-12-12 19:21 -------- d-------- C:\Program Files\Blaze Media Pro
2006-12-09 14:21 -------- d-------- C:\Program Files\Norton GoBack
2006-12-09 12:34 -------- d-------- C:\Program Files\Windows Media Player
2006-12-04 14:29 -------- d---s---- C:\Documents and Settings\HP_Owner\Application Data\Microsoft
2006-12-02 11:54 -------- d-------- C:\Program Files\Common Files\Microsoft Shared
2006-12-02 11:52 -------- d-------- C:\Program Files\Microsoft Office
2006-12-02 00:46 -------- d-------- C:\Program Files\Internet Explorer
2006-11-29 19:38 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\Sun
2006-11-25 17:08 -------- d-------- C:\Program Files\Common Files\ScanSoft Shared
2006-11-22 21:05 19317 --a------ C:\WINDOWS\2.exe
2006-11-22 16:33 -------- d-------- C:\Program Files\Xilisoft
2006-11-22 16:33 -------- d-------- C:\Program Files\QuickTime
2006-11-22 14:30 30720 --a------ C:\WINDOWS\3.exe
2006-11-22 07:37 -------- d-------- C:\Program Files\Skype
2006-11-21 19:43 -------- d-------- C:\Program Files\Boilsoft AVI Converter
2006-11-21 19:12 -------- d-------- C:\Program Files\DivX
2006-11-21 18:40 -------- d-------- C:\Program Files\WinRAR
2006-11-20 22:37 -------- d-------- C:\Program Files\Java
2006-11-20 22:35 -------- d-------- C:\Program Files\PC-Doctor 5 for Windows
2006-11-20 22:16 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\Real
2006-11-20 15:19 45568 --a------ C:\WINDOWS\system32\drivers\tshd4_kern_i386.sys
2006-11-20 15:19 44416 --a------ C:\WINDOWS\system32\drivers\Surroundhp_kern_i386.sys
2006-11-20 15:19 37248 --a------ C:\WINDOWS\system32\drivers\csiidecoder_kern_i386.sys
2006-11-20 15:19 34176 --a------ C:\WINDOWS\system32\drivers\SRS_SSCFilter.sys
2006-11-20 15:19 32000 --a------ C:\WINDOWS\system32\drivers\wowhd_kern_i386.sys
2006-11-19 22:38 -------- d-------- C:\Program Files\AlphaZIP
2006-11-19 21:54 -------- d-------- C:\Program Files\Xvid
2006-11-19 20:48 -------- d-------- C:\Program Files\PDT
2006-11-19 14:11 41074 --a------ C:\Documents and Settings\HP_Owner\Application Data\PatchUpdate_HP_CounterReport_Update_HPSU.log
2006-11-19 13:44 -------- d-------- C:\Program Files\Symantec Technical Support
2006-11-18 11:14 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\Symantec(2)
2006-11-17 18:48 -------- d-------- C:\Program Files\Cucusoft
2006-11-17 18:21 -------- d-------- C:\Program Files\MeWiG
2006-11-17 17:39 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\vlc
2006-11-17 17:37 -------- d-------- C:\Program Files\VideoLAN
2006-11-17 17:22 -------- d-------- C:\Program Files\DirectVobSub
2006-11-17 00:38 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\DivX
2006-11-17 00:12 -------- d-------- C:\Program Files\7-Zip
2006-11-16 20:09 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\Google
2006-11-16 18:57 -------- d-------- C:\Program Files\MSBuild
2006-11-16 18:57 -------- d-------- C:\Program Files\Microsoft Visual Studio
2006-11-16 18:57 -------- d-------- C:\Program Files\Common Files\DESIGNER
2006-11-16 18:56 -------- d-------- C:\Program Files\Microsoft.NET
2006-11-15 09:00 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\HP
2006-11-14 21:23 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\Mozilla
2006-11-12 14:19 -------- d-------- C:\Program Files\Sky Broadband
2006-11-11 12:46 -------- d-------- C:\Program Files\Acoustica MP3 CD Burner
2006-11-11 11:36 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\CyberLink
2006-11-10 20:40 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\Macromedia
2006-11-08 05:06 679424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-11-07 21:03 6049280 --------- C:\WINDOWS\system32\ieframe.dll
2006-11-07 21:03 50688 --------- C:\WINDOWS\system32\msfeedsbs.dll
2006-11-07 21:03 458752 --------- C:\WINDOWS\system32\msfeeds.dll
2006-11-07 21:03 413696 --a------ C:\WINDOWS\system32\vbscript.dll
2006-11-07 21:03 231424 --a------ C:\WINDOWS\system32\webcheck.dll
2006-11-07 21:03 180736 --------- C:\WINDOWS\system32\ieui.dll
2006-11-07 21:03 156160 --a------ C:\WINDOWS\system32\msls31.dll
2006-11-07 20:16 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\RapidGet
2006-11-07 20:08 -------- d-------- C:\Program Files\WinZip
2006-11-07 20:02 -------- d-------- C:\Program Files\XVideoConverter
2006-11-07 03:27 382976 --a------ C:\WINDOWS\system32\iedkcs32.dll
2006-11-07 03:27 229376 --a------ C:\WINDOWS\system32\ieaksie.dll
2006-11-07 03:26 71680 --a------ C:\WINDOWS\system32\admparse.dll
2006-11-07 03:26 55296 --a------ C:\WINDOWS\system32\iesetup.dll
2006-11-07 03:26 54784 --a------ C:\WINDOWS\system32\ie4uinit.exe
2006-11-07 03:26 43008 --a------ C:\WINDOWS\system32\iernonce.dll
2006-11-07 03:26 152064 --a------ C:\WINDOWS\system32\ieakeng.dll
2006-11-07 03:26 13312 --a------ C:\WINDOWS\system32\ieudinit.exe
2006-11-07 03:26 123904 --a------ C:\WINDOWS\system32\advpack.dll
2006-11-07 03:25 161792 --a------ C:\WINDOWS\system32\ieakui.dll
2006-11-04 14:14 1245696 --a------ C:\WINDOWS\system32\msxml4.dll
2006-11-02 13:28 8784 --a------ C:\WINDOWS\system32\ractrlkeyhook.dll
2006-10-19 13:56 713216 --a------ C:\WINDOWS\system32\sxs.dll
2006-10-18 21:58 8704 --a------ C:\WINDOWS\system32\wdfmgr.exe
2006-10-18 21:58 8704 --a------ C:\WINDOWS\system32\uwdf.exe
2006-10-18 21:47 99840 --a------ C:\WINDOWS\system32\wmpshell.dll
2006-10-18 21:47 991744 --a------ C:\WINDOWS\system32\drmv2clt.dll
2006-10-18 21:47 937984 --a------ C:\WINDOWS\system32\WMNetMgr.dll
2006-10-18 21:47 8231936 --a------ C:\WINDOWS\system32\wmploc.dll
2006-10-18 21:47 767488 --------- C:\WINDOWS\system32\WMVSENCD.dll
2006-10-18 21:47 757248 --a------ C:\WINDOWS\system32\WMADMOD.dll
2006-10-18 21:47 7168 --a------ C:\WINDOWS\system32\asferror.dll
2006-10-18 21:47 656896 --------- C:\WINDOWS\system32\WMVXENCD.dll
2006-10-18 21:47 63488 --a------ C:\WINDOWS\system32\wpdmtpus.dll
2006-10-18 21:47 629760 --a------ C:\WINDOWS\system32\wpd_ci.dll
2006-10-18 21:47 613376 --------- C:\WINDOWS\system32\wmpmde.dll
2006-10-18 21:47 603648 --a------ C:\WINDOWS\system32\WMSPDMOD.dll
2006-10-18 21:47 542720 --a------ C:\WINDOWS\system32\blackbox.dll
2006-10-18 21:47 535040 --------- C:\WINDOWS\system32\wmdrmsdk.dll
2006-10-18 21:47 429056 --a------ C:\WINDOWS\system32\wmdrmdev.dll
2006-10-18 21:47 414208 --a------ C:\WINDOWS\system32\msscp.dll
2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\wmvdmoe2.dll
2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\wmvdmod.dll
2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\WMVADVE.DLL
2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\WMVADVD.dll
2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\wmsdmoe2.dll
2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\wmsdmod.dll
2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\wdfapi.dll
2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\MPG4DMOD.dll
2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\MP4SDMOD.dll
2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\MP43DMOD.dll
2006-10-18 21:47 38400 --------- C:\WINDOWS\system32\wpdshextres.dll
2006-10-18 21:47 37376 --a------ C:\WINDOWS\system32\wmdmps.dll
2006-10-18 21:47 35840 --a------ C:\WINDOWS\system32\wpdconns.dll
2006-10-18 21:47 356352 --a------ C:\WINDOWS\system32\wpdsp.dll
2006-10-18 21:47 348672 --a------ C:\WINDOWS\system32\wmdrmnet.dll
2006-10-18 21:47 33792 --a------ C:\WINDOWS\system32\wmdmlog.dll
2006-10-18 21:47 321536 --a------ C:\WINDOWS\system32\mswmdm.dll
2006-10-18 21:47 317440 --------- C:\WINDOWS\system32\MP4SDECD.dll
2006-10-18 21:47 314880 --a------ C:\WINDOWS\system32\wmpdxm.dll
2006-10-18 21:47 295936 --------- C:\WINDOWS\system32\wmpeffects.dll
2006-10-18 21:47 284160 --------- C:\WINDOWS\system32\PortableDeviceApi.dll
2006-10-18 21:47 276992 --a------ C:\WINDOWS\system32\audiodev.dll
2006-10-18 21:47 27136 --a------ C:\WINDOWS\system32\mspmsnsv.dll
2006-10-18 21:47 2603008 --------- C:\WINDOWS\system32\WpdShext.dll
2006-10-18 21:47 259072 --------- C:\WINDOWS\system32\MPG4DECD.dll
2006-10-18 21:47 259072 --------- C:\WINDOWS\system32\MP43DECD.dll
2006-10-18 21:47 2450944 --a------ C:\WINDOWS\system32\wmvcore.dll
2006-10-18 21:47 242688 --a------ C:\WINDOWS\system32\wmpasf.dll
2006-10-18 21:47 229376 --a------ C:\WINDOWS\system32\cewmdm.dll
2006-10-18 21:47 227328 --a------ C:\WINDOWS\system32\wmerror.dll
2006-10-18 21:47 222208 --a------ C:\WINDOWS\system32\wmasf.dll
2006-10-18 21:47 212992 --------- C:\WINDOWS\system32\MFPLAT.dll
2006-10-18 21:47 211456 --a------ C:\WINDOWS\system32\qasf.dll
2006-10-18 21:47 204288 --a------ C:\WINDOWS\system32\wmpsrcwp.dll
2006-10-18 21:47 199168 --------- C:\WINDOWS\system32\PortableDeviceWMDRM.dll
2006-10-18 21:47 179712 --a------ C:\WINDOWS\system32\msnetobj.dll
2006-10-18 21:47 175616 --a------ C:\WINDOWS\system32\mspmsp.dll
2006-10-18 21:47 166912 --------- C:\WINDOWS\system32\PortableDeviceTypes.dll
2006-10-18 21:47 1661440 --a------ C:\WINDOWS\system32\wmpencen.dll
2006-10-18 21:47 1574912 --------- C:\WINDOWS\system32\WMVENCOD.dll
2006-10-18 21:47 157184 --a------ C:\WINDOWS\system32\wmidx.dll
2006-10-18 21:47 154624 --a------ C:\WINDOWS\system32\wpdmtp.dll
2006-10-18 21:47 1543680 --------- C:\WINDOWS\system32\WMVDECOD.dll
2006-10-18 21:47 1382912 --------- C:\WINDOWS\system32\WMVSDECD.dll
2006-10-18 21:47 133632 --------- C:\WINDOWS\system32\WPDShServiceObj.dll
2006-10-18 21:47 1329152 --a------ C:\WINDOWS\system32\WMSPDMOE.dll
2006-10-18 21:47 132096 --------- C:\WINDOWS\system32\PortableDeviceWiaCompat.dll
2006-10-18 21:47 130048 --------- C:\WINDOWS\system32\wmpps.dll
2006-10-18 21:47 11264 --a------ C:\WINDOWS\system32\LAPRXY.dll
2006-10-18 21:47 1117696 --a------ C:\WINDOWS\system32\WMADMOE.dll
2006-10-18 21:47 101888 --------- C:\WINDOWS\system32\PortableDeviceClassExtension.dll
2006-10-18 20:03 100864 --a------ C:\WINDOWS\system32\logagent.exe
2006-10-18 20:00 249856 --------- C:\WINDOWS\system32\drmupgds.exe
2006-10-18 20:00 17408 --------- C:\WINDOWS\system32\wpdshextautoplay.exe
2006-10-17 12:06 78336 --a------ C:\WINDOWS\system32\ieencode.dll
2006-10-17 12:05 40960 --a------ C:\WINDOWS\system32\licmgr10.dll
2006-10-17 12:05 206336 --------- C:\WINDOWS\system32\WinFXDocObj.exe
2006-10-17 12:05 105984 --a------ C:\WINDOWS\system32\url.dll
2006-10-17 12:04 101376 --a------ C:\WINDOWS\system32\occache.dll
2006-10-17 12:03 17408 --a------ C:\WINDOWS\system32\corpol.dll
2006-10-17 11:58 61952 --------- C:\WINDOWS\system32\icardie.dll
2006-10-17 11:58 12288 --------- C:\WINDOWS\system32\msfeedssync.exe
2006-10-17 11:57 36352 --a------ C:\WINDOWS\system32\imgutil.dll
2006-10-17 11:57 266752 --------- C:\WINDOWS\system32\iertutil.dll
2006-10-17 11:56 45568 --a------ C:\WINDOWS\system32\mshta.exe
2006-10-17 11:28 48128 --a------ C:\WINDOWS\system32\mshtmler.dll
2006-10-17 11:27 380928 --------- C:\WINDOWS\system32\ieapfltr.dll
2006-10-13 12:35 142336 --a------ C:\WINDOWS\system32\nwprovau.dll
2006-10-02 19:04 806912 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2006-10-02 19:04 806912 --a------ C:\WINDOWS\system32\divx_xx07.dll
2006-10-02 19:04 790528 --a------ C:\WINDOWS\system32\divx_xx11.dll
2006-10-02 19:04 635486 --a------ C:\WINDOWS\system32\DivX.dll
2006-10-02 15:28 312128 --------- C:\WINDOWS\system32\msdelta.dll

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Skype"="\"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"SsAAD.exe"="C:\\PROGRA~1\\Sony\\SONICS~1\\SsAAD.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ftutil2"="rundll32.exe ftutil2.dll,SetWriteCacheMode"
"HPHUPD08"="c:\\Program Files\\HP\\Digital Imaging\\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\\hphupd08.exe"
"PCMService"="\"C:\\Program Files\\CyberLink\\PowerCinema\\PCMService.exe\""
"Recguard"="C:\\WINDOWS\\SMINST\\RECGUARD.EXE"
"HPBootOp"="\"C:\\Program Files\\Hewlett-Packard\\HP Boot Optimizer\\HPBootOp.exe\" /run"
"Reminder"="\"C:\\Windows\\Creator\\Remind_XP.exe\""
"HP Software Update"=hex(2):43,3a,5c,50,72,6f,67,72,61,6d,20,46,69,6c,65,73,5c,\
48,50,5c,48,50,20,53,6f,66,74,77,61,72,65,20,55,70,64,61,74,65,5c,48,50,77,\
75,53,63,68,64,32,2e,65,78,65,00
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\""
"OpwareSE2"="\"C:\\Program Files\\ScanSoft\\OmniPageSE2.0\\OpwareSE2.exe\""
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"Norton Ghost 10.0"="\"C:\\Program Files\\Norton Ghost\\Agent\\GhostTray.exe\""
"LVCOMSX"="C:\\WINDOWS\\system32\\LVCOMSX.EXE"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,20,01,00,00,00,00,00,00,80,04,00,00,62,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
"{9d635a36-6b3c-4146-8625-f3aaf507bbf8}"="flammei"
"{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}"="buprestidae"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoCDBurning"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"isamonitor.exe"="C:\\Program Files\\Video ActiveX Object\\isamonitor.exe"
"none"="C:\\Program Files\\Video ActiveX Object\\pmsngr.exe"
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCDrProfiler]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKLM"
"command"=""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
Completion time: 06-12-30 12:38:36.42
C:\ComboFix.txt ... 06-12-30 12:38

Logfile of HijackThis v1.99.1
Scan saved at 12:42:56, on 30/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CyberLink\PowerCinema\PCMService.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\WINDOWS\System32\svchost.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
c:\windows\system\hpsysdrv.exe
C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
C:\Documents and Settings\HP_Owner\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sony.co.uk/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Norton Ghost 10.0] "C:\Program Files\Norton Ghost\Agent\GhostTray.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/res...
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windows...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microso...
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe

Many Thanks
Cheers
Cownett

Report Offensive Follow Up For Removal

Response Number 5

Name: jabuck
Date: December 30, 2006 at 07:13:54 Pacific
Subject: Anti-virims System Alert Popup

Reply: (edit)

A few more things to do.
Please download ATF-Cleaner to your desktop from this link
http://www.atribune.org/content/view/19/2/ We will need it later in safe mode
Download and install AVG Anti-Spyware We will need this later in safe mode
Be sure to update AVG Anti- Spyware
Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.
Reboot into safe mode.
Navigate to and delete these files if found:
2.exe
3.exe
Navigate to and delete this folder if found.
C:\WINDOWS\_MSRSTRT.EXE
Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

In Safe Mode, run AVG Anti-spyware and click on the Scanner tab at the top. Click the "Settings" tab and then change the recommended action to Quarantine and click Automatically generate report after every scan. Click back to the "Scan" tab and then click on Complete System Scan. This scan can take quite a while to run, so be prepared.
AVG Anti-Spyware will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. AVG Anti-Spyware will display "All actions have been applied" on the right hand side.
Click on "Save Report", then "Save Report As". This will create a text file. Make sure you know where to find this file again (like on the Desktop).
Open notepad (Start Menu > Run > Type notepad and press "ok".
Copy and paste everything into notepad between the x's making regedit4 the top line.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{9d635a36-6b3c-4146-8625-f3aaf507bbf8}"=-
"{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}"=-
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it Fix.reg then save it to your desktop.
Double click Fix.reg (or right click and choose Merge) and it will ask if you want to merge the contents into the registry, choose Yes.
Post the AVG-AntiSpyware report and a new combofix log.

Report Offensive Follow Up For Removal


Anti-virims System Alert Popup System Alert Popup REMOVAL System Alert Popup (PLEASE HELP) Zlob, System Alert Popup system alert popup	System Alert Popup System Alert! Popup System Alert Popup- Can't Remove System alert popup, unwipable! Antivermins System Alert Popup

Response Number 6

Name: cownett
Date: December 31, 2006 at 09:49:46 Pacific
Subject: Anti-virims System Alert Popup

Reply: (edit)

AVG-Antispyware & Combofix log files as follows:

AVG Anti-Spyware - Scan Report

+ Created at: 17:12 06-12-31
+ Scan result:
J:\CanonUserData\Gords Pers\PsyTests-dm.exe -> Adware.Trymedia : No action taken.
C:\System Volume Information\_restore{D5F7A20F-1294-41E9-A947-A77075103E2E}\RP72\A0019784.exe -> Dropper.Agent.ata : No action taken.
:mozilla.11:C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\u1khyqe0.default\cookies.txt -> TrackingCookie.Googleadservices : No action taken.
C:\System Volume Information\_restore{D5F7A20F-1294-41E9-A947-A77075103E2E}\RP72\A0019783.exe -> Trojan.LdPinch.beq : No action taken.

::Report end

HP_Owner - 06-12-31 17:39:59.45 Service Pack 2
ComboFix 06.11.27 - Running from: "C:\Documents and Settings\HP_Owner\My Documents\downloads\Spyware anti virus software"
((((((((((((((((((((((((((((((( Files Created from 2006-11-30 to 2006-12-30 ))))))))))))))))))))))))))))))))))

2006-12-31 11:22 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-12-30 13:17 <DIR> d-------- C:\Documents and Settings\HP_Owner\Application Data\McAfee.com Personal Firewall
2006-12-30 13:12 <DIR> d-------- C:\WINDOWS\system32\mclsphlr
2006-12-30 13:12 <DIR> d-------- C:\Program Files\McAfee
2006-12-30 13:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2006-12-30 13:11 90,112 --a------ C:\WINDOWS\system32\mcrtl32.dll
2006-12-30 13:11 32,768 --a------ C:\WINDOWS\system32\instlsp.exe
2006-12-30 13:11 131,072 --a------ C:\WINDOWS\system32\mclsp.dll
2006-12-30 13:11 11,264 --a------ C:\WINDOWS\system32\sporder.dll
2006-12-30 13:10 9,216 --a------ C:\WINDOWS\system32\MpfApi.dll
2006-12-30 13:10 80,640 --a------ C:\WINDOWS\system32\drivers\MpFirewall.sys
2006-12-30 13:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee.com Personal Firewall
2006-12-30 13:09 114,464 --a------ C:\WINDOWS\system32\drivers\naiavf5x.sys
2006-12-30 13:09 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee.com
2006-12-30 13:08 349,760 -ra------ C:\WINDOWS\system32\mcinsctl.dll
2006-12-30 13:08 288,320 -ra------ C:\WINDOWS\system32\mcgdmgr.dll
2006-12-30 13:08 <DIR> d-------- C:\Program Files\McAfee.com
2006-12-30 13:02 51,072 --a------ C:\WINDOWS\system32\drivers\ikhlayer.sys
2006-12-30 13:02 30,592 --a------ C:\WINDOWS\system32\drivers\ikhfile.sys
2006-12-30 13:02 <DIR> d-------- C:\Program Files\Spyware Doctor
2006-12-30 09:59 <DIR> d-------- C:\Program Files\Grisoft
2006-12-29 13:48 3,456 --a------ C:\WINDOWS\system32\tmp.reg
2006-12-29 13:47 79,360 --a------ C:\WINDOWS\system32\swxcacls.exe
2006-12-29 13:47 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2006-12-29 13:47 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2006-12-29 13:47 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2006-12-29 13:47 135,168 --a------ C:\WINDOWS\system32\swreg.exe
2006-12-28 21:59 <DIR> d-------- C:\Program Files\Windows Live Safety Center
2006-12-28 17:49 <DIR> d-------- C:\Documents and Settings\HP_Owner\Application Data\PC Tools
2006-12-28 16:46 10 --a------ C:\WINDOWS\Syskernel12.dll
2006-12-28 16:46 <DIR> d-------- C:\Program Files\Cool MP3 Splitter
2006-12-28 16:40 3,082 --a------ C:\WINDOWS\system32\affv12740p1now.sys
2006-12-27 15:46 <DIR> d-------- C:\Program Files\HarvEX
2006-12-26 01:16 <DIR> d-------- C:\Documents and Settings\HP_Owner\Application Data\Ad Annihilator.files
2006-12-26 01:15 <DIR> d-------- C:\Program Files\Ad Annihilator
2006-12-26 00:50 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2006-12-26 00:50 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2006-12-21 20:12 <DIR> d-------- C:\Documents and Settings\HP_Owner\Application Data\Canon
2006-12-21 19:41 53,248 -ra------ C:\WINDOWS\system32\InstMed.exe
2006-12-21 19:40 913,280 --a------ C:\WINDOWS\system32\drivers\LV302AV.SYS
2006-12-21 19:40 7,136 --a------ C:\WINDOWS\system32\drivers\lv302af.sys
2006-12-21 19:40 372,736 --a------ C:\WINDOWS\system32\LVUI2RC.dll
2006-12-21 19:40 22,016 --a------ C:\WINDOWS\system32\drivers\LVUSBSta.sys
2006-12-21 19:40 204,800 --a------ C:\WINDOWS\system32\LVUI2.dll
2006-12-21 19:40 2,180,096 --a------ C:\WINDOWS\system32\drivers\LVSVF2.sys
2006-12-21 19:40 106,496 --a------ C:\WINDOWS\system32\lvcoinst.dll
2006-12-21 19:40 <DIR> d-------- C:\Program Files\Common Files\Logitech
2006-12-15 19:33 <DIR> d-------- C:\Documents and Settings\All Users\SonicStage
2006-12-15 18:59 90,112 --------- C:\WINDOWS\snymsico.dll
2006-12-15 18:59 38,951 --------- C:\WINDOWS\system32\drivers\NETMDUSB.sys
2006-12-15 18:59 36,679 --------- C:\WINDOWS\system32\drivers\NETMD052.sys
2006-12-15 18:59 36,232 --------- C:\WINDOWS\system32\drivers\NETMD033.sys
2006-12-15 18:59 35,319 --------- C:\WINDOWS\system32\drivers\NETMD031.sys
2006-12-15 18:58 770,048 --a------ C:\WINDOWS\system32\CDDBUISony.dll
2006-12-15 18:58 73,728 --a------ C:\WINDOWS\system32\CddbLinkSony.dll
2006-12-15 18:58 643,072 --a------ C:\WINDOWS\system32\CDDBControlSony.dll
2006-12-15 18:58 585,728 --a------ C:\WINDOWS\system32\CddbMusicIDSony.dll
2006-12-15 18:58 520,192 --a------ C:\WINDOWS\system32\CddbPlaylist2Sony.dll
2006-12-15 18:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sony Corporation
2006-12-15 18:57 <DIR> d-------- C:\Program Files\Sony
2006-12-15 18:57 <DIR> d-------- C:\Program Files\Common Files\Sony Shared
2006-12-15 18:57 <DIR> d-------- C:\Documents and Settings\HP_Owner\Application Data\Sony Corporation
2006-12-12 18:40 73,728 --a------ C:\WINDOWS\system32\Zion.dll
2006-12-12 18:40 7,040 --a------ C:\WINDOWS\system32\drivers\Gonzales.sys
2006-12-12 18:40 12,160 --a------ C:\WINDOWS\system32\drivers\Bonifay.sys
2006-12-12 18:40 <DIR> d-------- C:\Program Files\Freecom Personal Media Suite
2006-12-09 20:14 <DIR> d-------- C:\Program Files\Lavasoft
2006-12-09 20:14 <DIR> d-------- C:\Documents and Settings\HP_Owner\Application Data\Lavasoft
2006-12-09 20:08 <DIR> d-------- C:\WINDOWS\pss
2006-12-09 13:02 10,752 --a------ C:\WINDOWS\system32\BASSMOD.dll
2006-12-09 12:56 331,776 --a------ C:\WINDOWS\system32\NCTAudioVisualizationEx2.dll
2006-12-08 22:52 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2006-12-08 22:50 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2006-12-08 22:50 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2006-12-04 14:42 <DIR> d-------- C:\Documents and Settings\HP_Owner\Shared
2006-12-04 14:41 <DIR> d-------- C:\Documents and Settings\HP_Owner\Incomplete
2006-12-04 14:38 <DIR> d-------- C:\Program Files\LimeWire
2006-12-04 14:36 <DIR> d-------- C:\Documents and Settings\HP_Owner\.limewire
2006-12-02 11:54 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2006-12-02 00:33 127,208 --a------ C:\WINDOWS\system32\mucltui.dll
2006-12-01 23:50 <DIR> d-------- C:\WINDOWS\WBEM
2006-12-01 23:50 <DIR> d-------- C:\WINDOWS\system32\en-US
2006-12-01 23:48 <DIR> d--h-c--- C:\WINDOWS\ie7
2006-12-01 23:46 121,856 --------- C:\WINDOWS\system32\xmllite.dll
2006-12-01 23:45 <DIR> d-------- C:\WINDOWS\network diagnostic
2006-12-01 23:42 <DIR> d-------- C:\Program Files\MSXML 4.0
2006-12-01 23:33 28,672 --------- C:\WINDOWS\system32\verclsid.exe
2006-12-01 23:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2006-12-01 23:03 <DIR> d-------- C:\WINDOWS\system32\PreInstall
2006-12-01 23:00 18,200 --a------ C:\WINDOWS\system32\wups2.dll
2006-12-01 23:00 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution
2006-12-01 19:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2006-12-01 10:03 <DIR> d-------- C:\temp

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2006-12-31 17:31 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\Skype
2006-12-28 21:34 -------- d-------- C:\Program Files\Symantec
2006-12-28 21:34 -------- d-------- C:\Program Files\Google
2006-12-28 21:29 -------- d-------- C:\Program Files\Common Files\Symantec Shared
2006-12-28 21:29 -------- d-------- C:\Program Files\Common Files
2006-12-28 21:20 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\Symantec
2006-12-28 18:18 -------- d-------- C:\Program Files\Mozilla Firefox
2006-12-26 01:23 82 --a------ C:\Documents and Settings\HP_Owner\Application Data\Ad Annihilator.aap
2006-12-16 14:48 -------- d-------- C:\Program Files\MSN
2006-12-16 03:07 -------- d-------- C:\Program Files\Common Files\System
2006-12-16 03:01 -------- d-------- C:\Program Files\Outlook Express
2006-12-15 18:59 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-12-15 18:58 -------- d-------- C:\Program Files\Common Files\InstallShield
2006-12-12 19:31 -------- d-------- C:\Program Files\WinMPG VideoConvert
2006-12-12 19:21 -------- d-------- C:\Program Files\Blaze Media Pro
2006-12-09 14:21 -------- d-------- C:\Program Files\Norton GoBack
2006-12-09 12:34 -------- d-------- C:\Program Files\Windows Media Player
2006-12-04 14:29 -------- d---s---- C:\Documents and Settings\HP_Owner\Application Data\Microsoft
2006-12-02 11:54 -------- d-------- C:\Program Files\Common Files\Microsoft Shared
2006-12-02 11:52 -------- d-------- C:\Program Files\Microsoft Office
2006-12-02 00:46 -------- d-------- C:\Program Files\Internet Explorer
2006-11-29 19:38 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\Sun
2006-11-25 17:08 -------- d-------- C:\Program Files\Common Files\ScanSoft Shared
2006-11-22 16:33 -------- d-------- C:\Program Files\Xilisoft
2006-11-22 16:33 -------- d-------- C:\Program Files\QuickTime
2006-11-22 07:37 -------- d-------- C:\Program Files\Skype
2006-11-21 19:43 -------- d-------- C:\Program Files\Boilsoft AVI Converter
2006-11-21 19:12 -------- d-------- C:\Program Files\DivX
2006-11-21 18:40 -------- d-------- C:\Program Files\WinRAR
2006-11-20 22:37 -------- d-------- C:\Program Files\Java
2006-11-20 22:35 -------- d-------- C:\Program Files\PC-Doctor 5 for Windows
2006-11-20 22:16 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\Real
2006-11-20 15:19 45568 --a------ C:\WINDOWS\system32\drivers\tshd4_kern_i386.sys
2006-11-20 15:19 44416 --a------ C:\WINDOWS\system32\drivers\Surroundhp_kern_i386.sys
2006-11-20 15:19 37248 --a------ C:\WINDOWS\system32\drivers\csiidecoder_kern_i386.sys
2006-11-20 15:19 34176 --a------ C:\WINDOWS\system32\drivers\SRS_SSCFilter.sys
2006-11-20 15:19 32000 --a------ C:\WINDOWS\system32\drivers\wowhd_kern_i386.sys
2006-11-19 22:38 -------- d-------- C:\Program Files\AlphaZIP
2006-11-19 21:54 -------- d-------- C:\Program Files\Xvid
2006-11-19 20:48 -------- d-------- C:\Program Files\PDT
2006-11-19 14:11 41074 --a------ C:\Documents and Settings\HP_Owner\Application Data\PatchUpdate_HP_CounterReport_Update_HPSU.log
2006-11-19 13:44 -------- d-------- C:\Program Files\Symantec Technical Support
2006-11-18 11:14 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\Symantec(2)
2006-11-17 18:48 -------- d-------- C:\Program Files\Cucusoft
2006-11-17 18:21 -------- d-------- C:\Program Files\MeWiG
2006-11-17 17:39 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\vlc
2006-11-17 17:37 -------- d-------- C:\Program Files\VideoLAN
2006-11-17 17:22 -------- d-------- C:\Program Files\DirectVobSub
2006-11-17 00:38 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\DivX
2006-11-17 00:12 -------- d-------- C:\Program Files\7-Zip
2006-11-16 20:09 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\Google
2006-11-16 18:57 -------- d-------- C:\Program Files\MSBuild
2006-11-16 18:57 -------- d-------- C:\Program Files\Microsoft Visual Studio
2006-11-16 18:57 -------- d-------- C:\Program Files\Common Files\DESIGNER
2006-11-16 18:56 -------- d-------- C:\Program Files\Microsoft.NET
2006-11-15 09:00 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\HP
2006-11-14 21:23 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\Mozilla
2006-11-12 14:19 -------- d-------- C:\Program Files\Sky Broadband
2006-11-11 12:46 -------- d-------- C:\Program Files\Acoustica MP3 CD Burner
2006-11-11 11:36 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\CyberLink
2006-11-10 20:40 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\Macromedia
2006-11-08 05:06 679424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-11-07 21:03 6049280 --------- C:\WINDOWS\system32\ieframe.dll
2006-11-07 21:03 50688 --------- C:\WINDOWS\system32\msfeedsbs.dll
2006-11-07 21:03 458752 --------- C:\WINDOWS\system32\msfeeds.dll
2006-11-07 21:03 413696 --a------ C:\WINDOWS\system32\vbscript.dll
2006-11-07 21:03 231424 --a------ C:\WINDOWS\system32\webcheck.dll
2006-11-07 21:03 180736 --------- C:\WINDOWS\system32\ieui.dll
2006-11-07 21:03 156160 --a------ C:\WINDOWS\system32\msls31.dll
2006-11-07 20:16 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\RapidGet
2006-11-07 20:08 -------- d-------- C:\Program Files\WinZip
2006-11-07 20:02 -------- d-------- C:\Program Files\XVideoConverter
2006-11-07 03:27 382976 --a------ C:\WINDOWS\system32\iedkcs32.dll
2006-11-07 03:27 229376 --a------ C:\WINDOWS\system32\ieaksie.dll
2006-11-07 03:26 71680 --a------ C:\WINDOWS\system32\admparse.dll
2006-11-07 03:26 55296 --a------ C:\WINDOWS\system32\iesetup.dll
2006-11-07 03:26 54784 --a------ C:\WINDOWS\system32\ie4uinit.exe
2006-11-07 03:26 43008 --a------ C:\WINDOWS\system32\iernonce.dll
2006-11-07 03:26 152064 --a------ C:\WINDOWS\system32\ieakeng.dll
2006-11-07 03:26 13312 --a------ C:\WINDOWS\system32\ieudinit.exe
2006-11-07 03:26 123904 --a------ C:\WINDOWS\system32\advpack.dll
2006-11-07 03:25 161792 --a------ C:\WINDOWS\system32\ieakui.dll
2006-11-04 14:14 1245696 --a------ C:\WINDOWS\system32\msxml4.dll
2006-11-02 13:28 8784 --a------ C:\WINDOWS\system32\ractrlkeyhook.dll
2006-10-19 13:56 713216 --a------ C:\WINDOWS\system32\sxs.dll
2006-10-18 21:58 8704 --a------ C:\WINDOWS\system32\wdfmgr.exe
2006-10-18 21:58 8704 --a------ C:\WINDOWS\system32\uwdf.exe
2006-10-18 21:47 99840 --a------ C:\WINDOWS\system32\wmpshell.dll
2006-10-18 21:47 991744 --a------ C:\WINDOWS\system32\drmv2clt.dll
2006-10-18 21:47 937984 --a------ C:\WINDOWS\system32\WMNetMgr.dll
2006-10-18 21:47 8231936 --a------ C:\WINDOWS\system32\wmploc.dll
2006-10-18 21:47 767488 --------- C:\WINDOWS\system32\WMVSENCD.dll
2006-10-18 21:47 757248 --a------ C:\WINDOWS\system32\WMADMOD.dll
2006-10-18 21:47 7168 --a------ C:\WINDOWS\system32\asferror.dll
2006-10-18 21:47 656896 --------- C:\WINDOWS\system32\WMVXENCD.dll
2006-10-18 21:47 63488 --a------ C:\WINDOWS\system32\wpdmtpus.dll
2006-10-18 21:47 629760 --a------ C:\WINDOWS\system32\wpd_ci.dll
2006-10-18 21:47 613376 --------- C:\WINDOWS\system32\wmpmde.dll
2006-10-18 21:47 603648 --a------ C:\WINDOWS\system32\WMSPDMOD.dll
2006-10-18 21:47 542720 --a------ C:\WINDOWS\system32\blackbox.dll
2006-10-18 21:47 535040 --------- C:\WINDOWS\system32\wmdrmsdk.dll
2006-10-18 21:47 429056 --a------ C:\WINDOWS\system32\wmdrmdev.dll
2006-10-18 21:47 414208 --a------ C:\WINDOWS\system32\msscp.dll
2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\wmvdmoe2.dll
2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\wmvdmod.dll
2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\WMVADVE.DLL
2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\WMVADVD.dll
2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\wmsdmoe2.dll
2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\wmsdmod.dll
2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\wdfapi.dll
2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\MPG4DMOD.dll
2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\MP4SDMOD.dll
2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\MP43DMOD.dll
2006-10-18 21:47 38400 --------- C:\WINDOWS\system32\wpdshextres.dll
2006-10-18 21:47 37376 --a------ C:\WINDOWS\system32\wmdmps.dll
2006-10-18 21:47 35840 --a------ C:\WINDOWS\system32\wpdconns.dll
2006-10-18 21:47 356352 --a------ C:\WINDOWS\system32\wpdsp.dll
2006-10-18 21:47 348672 --a------ C:\WINDOWS\system32\wmdrmnet.dll
2006-10-18 21:47 33792 --a------ C:\WINDOWS\system32\wmdmlog.dll
2006-10-18 21:47 321536 --a------ C:\WINDOWS\system32\mswmdm.dll
2006-10-18 21:47 317440 --------- C:\WINDOWS\system32\MP4SDECD.dll
2006-10-18 21:47 314880 --a------ C:\WINDOWS\system32\wmpdxm.dll
2006-10-18 21:47 295936 --------- C:\WINDOWS\system32\wmpeffects.dll
2006-10-18 21:47 284160 --------- C:\WINDOWS\system32\PortableDeviceApi.dll
2006-10-18 21:47 276992 --a------ C:\WINDOWS\system32\audiodev.dll
2006-10-18 21:47 27136 --a------ C:\WINDOWS\system32\mspmsnsv.dll
2006-10-18 21:47 2603008 --------- C:\WINDOWS\system32\WpdShext.dll
2006-10-18 21:47 259072 --------- C:\WINDOWS\system32\MPG4DECD.dll
2006-10-18 21:47 259072 --------- C:\WINDOWS\system32\MP43DECD.dll
2006-10-18 21:47 2450944 --a------ C:\WINDOWS\system32\wmvcore.dll
2006-10-18 21:47 242688 --a------ C:\WINDOWS\system32\wmpasf.dll
2006-10-18 21:47 229376 --a------ C:\WINDOWS\system32\cewmdm.dll
2006-10-18 21:47 227328 --a------ C:\WINDOWS\system32\wmerror.dll
2006-10-18 21:47 222208 --a------ C:\WINDOWS\system32\wmasf.dll
2006-10-18 21:47 212992 --------- C:\WINDOWS\system32\MFPLAT.dll
2006-10-18 21:47 211456 --a------ C:\WINDOWS\system32\qasf.dll
2006-10-18 21:47 204288 --a------ C:\WINDOWS\system32\wmpsrcwp.dll
2006-10-18 21:47 199168 --------- C:\WINDOWS\system32\PortableDeviceWMDRM.dll
2006-10-18 21:47 179712 --a------ C:\WINDOWS\system32\msnetobj.dll
2006-10-18 21:47 175616 --a------ C:\WINDOWS\system32\mspmsp.dll
2006-10-18 21:47 166912 --------- C:\WINDOWS\system32\PortableDeviceTypes.dll
2006-10-18 21:47 1661440 --a------ C:\WINDOWS\system32\wmpencen.dll
2006-10-18 21:47 1574912 --------- C:\WINDOWS\system32\WMVENCOD.dll
2006-10-18 21:47 157184 --a------ C:\WINDOWS\system32\wmidx.dll
2006-10-18 21:47 154624 --a------ C:\WINDOWS\system32\wpdmtp.dll
2006-10-18 21:47 1543680 --------- C:\WINDOWS\system32\WMVDECOD.dll
2006-10-18 21:47 1382912 --------- C:\WINDOWS\system32\WMVSDECD.dll
2006-10-18 21:47 133632 --------- C:\WINDOWS\system32\WPDShServiceObj.dll
2006-10-18 21:47 1329152 --a------ C:\WINDOWS\system32\WMSPDMOE.dll
2006-10-18 21:47 132096 --------- C:\WINDOWS\system32\PortableDeviceWiaCompat.dll
2006-10-18 21:47 130048 --------- C:\WINDOWS\system32\wmpps.dll
2006-10-18 21:47 11264 --a------ C:\WINDOWS\system32\LAPRXY.dll
2006-10-18 21:47 1117696 --a------ C:\WINDOWS\system32\WMADMOE.dll
2006-10-18 21:47 101888 --------- C:\WINDOWS\system32\PortableDeviceClassExtension.dll
2006-10-18 20:03 100864 --a------ C:\WINDOWS\system32\logagent.exe
2006-10-18 20:00 249856 --------- C:\WINDOWS\system32\drmupgds.exe
2006-10-18 20:00 17408 --------- C:\WINDOWS\system32\wpdshextautoplay.exe
2006-10-17 12:06 78336 --a------ C:\WINDOWS\system32\ieencode.dll
2006-10-17 12:05 40960 --a------ C:\WINDOWS\system32\licmgr10.dll
2006-10-17 12:05 206336 --------- C:\WINDOWS\system32\WinFXDocObj.exe
2006-10-17 12:05 105984 --a------ C:\WINDOWS\system32\url.dll
2006-10-17 12:04 101376 --a------ C:\WINDOWS\system32\occache.dll
2006-10-17 12:03 17408 --a------ C:\WINDOWS\system32\corpol.dll
2006-10-17 11:58 61952 --------- C:\WINDOWS\system32\icardie.dll
2006-10-17 11:58 12288 --------- C:\WINDOWS\system32\msfeedssync.exe
2006-10-17 11:57 36352 --a------ C:\WINDOWS\system32\imgutil.dll
2006-10-17 11:57 266752 --------- C:\WINDOWS\system32\iertutil.dll
2006-10-17 11:56 45568 --a------ C:\WINDOWS\system32\mshta.exe
2006-10-17 11:28 48128 --a------ C:\WINDOWS\system32\mshtmler.dll
2006-10-17 11:27 380928 --------- C:\WINDOWS\system32\ieapfltr.dll
2006-10-13 12:35 142336 --a------ C:\WINDOWS\system32\nwprovau.dll
2006-10-02 19:04 806912 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2006-10-02 19:04 806912 --a------ C:\WINDOWS\system32\divx_xx07.dll
2006-10-02 19:04 790528 --a------ C:\WINDOWS\system32\divx_xx11.dll
2006-10-02 19:04 635486 --a------ C:\WINDOWS\system32\DivX.dll
2006-10-02 15:28 312128 --------- C:\WINDOWS\system32\msdelta.dll

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Skype"="\"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"SsAAD.exe"="C:\\PROGRA~1\\Sony\\SONICS~1\\SsAAD.exe"
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ftutil2"="rundll32.exe ftutil2.dll,SetWriteCacheMode"
"HPHUPD08"="c:\\Program Files\\HP\\Digital Imaging\\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\\hphupd08.exe"
"PCMService"="\"C:\\Program Files\\CyberLink\\PowerCinema\\PCMService.exe\""
"Recguard"="C:\\WINDOWS\\SMINST\\RECGUARD.EXE"
"HPBootOp"="\"C:\\Program Files\\Hewlett-Packard\\HP Boot Optimizer\\HPBootOp.exe\" /run"
"Reminder"="\"C:\\Windows\\Creator\\Remind_XP.exe\""
"HP Software Update"=hex(2):43,3a,5c,50,72,6f,67,72,61,6d,20,46,69,6c,65,73,5c,\
48,50,5c,48,50,20,53,6f,66,74,77,61,72,65,20,55,70,64,61,74,65,5c,48,50,77,\
75,53,63,68,64,32,2e,65,78,65,00
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\""
"OpwareSE2"="\"C:\\Program Files\\ScanSoft\\OmniPageSE2.0\\OpwareSE2.exe\""
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"Norton Ghost 10.0"="\"C:\\Program Files\\Norton Ghost\\Agent\\GhostTray.exe\""
"LVCOMSX"="C:\\WINDOWS\\system32\\LVCOMSX.EXE"
"VSOCheckTask"="\"C:\\PROGRA~1\\McAfee.com\\VSO\\mcmnhdlr.exe\" /checktask"
"VirusScan Online"="C:\\Program Files\\McAfee.com\\VSO\\mcvsshld.exe"
"OASClnt"="C:\\Program Files\\McAfee.com\\VSO\\oasclnt.exe"
"MCAgentExe"="c:\\PROGRA~1\\mcafee.com\\agent\\mcagent.exe"
"MCUpdateExe"="c:\\PROGRA~1\\mcafee.com\\agent\\McUpdate.exe"
"MPFExe"="C:\\PROGRA~1\\McAfee.com\\PERSON~1\\MpfTray.exe"
"MPSExe"="c:\\PROGRA~1\\mcafee.com\\mps\\mscifapp.exe /embedding"
"MSKAGENTEXE"="C:\\PROGRA~1\\McAfee\\SPAMKI~1\\MskAgent.exe"
"MSKDetectorExe"="C:\\PROGRA~1\\McAfee\\SPAMKI~1\\MSKDetct.exe /startup"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,20,01,00,00,00,00,00,00,80,04,00,00,62,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoCDBurning"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"isamonitor.exe"="C:\\Program Files\\Video ActiveX Object\\isamonitor.exe"
"none"="C:\\Program Files\\Video ActiveX Object\\pmsngr.exe"
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCDrProfiler]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKLM"
"command"=""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
Completion time: 06-12-31 17:42:20.12
C:\ComboFix.txt ... 06-12-31 17:42
C:\ComboFix2.txt ... 06-12-30 12:40

Many Thanks
Cownett

Report Offensive Follow Up For Removal

Response Number 7

Name: jabuck
Date: December 31, 2006 at 12:48:52 Pacific
Subject: Anti-virims System Alert Popup

Reply: (edit)

Looks like you picked up a baddie since your last post.
Temporarily disable any of the following anti-spyware realtime protection programs that you may have and leave them off untill you can post back. Temporarily Disable Realtime Protection

Open the "SmitfraudFix" folder and double-click "smitfraudfix.cmd"
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.
Update your java. Download the latest version of http://java.sun.com/javase/downloads/index.jsp
Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
Click the "Download" button to the right.
Check the box that says: "Accept License Agreement". The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the "coffee cup" icon next to it.
Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed
. Then from your desktop double-click on jre-1_6_0-windowsi586-p.exe to install the newest version.

Report Offensive Follow Up For Removal

Response Number 8

Name: cownett
Date: January 1, 2007 at 13:05:05 Pacific
Subject: Anti-virims System Alert Popup

Reply: (edit)

Hi there
SmitFraudfix log file as follows:
SmitFraudFix v2.132
Scan done at 11:02:33.64, 01/01/2007
Run from C:\Documents and Settings\HP_Owner\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\HP_Owner

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\HP_Owner\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\HP_Owner\FAVORI~1

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32

»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

Many Thanks
Cownett

Report Offensive Follow Up For Removal

Response Number 9

Name: jabuck
Date: January 1, 2007 at 13:43:00 Pacific
Subject: Anti-virims System Alert Popup

Reply: (edit)

Looks like it was only a registry key.
Navigate to and delete this folder if found:
C:\Program Files\Video ActiveX Object
Open notepad (Start Menu > Run > Type notepad and press "ok".
Copy and paste everything into notepad between the x's making regedit4 the top line.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"isamonitor.exe"=-
"none"=-
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it Fix.reg then save it to your desktop.
Double click Fix.reg (or right click and choose Merge) and it will ask if you want to merge the contents into the registry, choose Yes.
Run the combofix scan again and if those entries are gone your computer is clean, let me know please.

Report Offensive Follow Up For Removal

Response Number 10

Name: cownett
Date: January 1, 2007 at 15:05:52 Pacific
Subject: Anti-virims System Alert Popup

Reply: (edit)

Cheers Jabuck. Helped me out big time. Thanks very much.
I've posted the last combofix log file. Everything looks cool.
Cheers mate.
Log file as follows:
HP_Owner - 07-01-01 22:56:08.14 Service Pack 2
ComboFix 06.11.27 - Running from: "C:\Documents and Settings\HP_Owner\My Documents\downloads\Spyware anti virus software"
((((((((((((((((((((((((((((((( Files Created from 2006-12-01 to 2007-01-01 ))))))))))))))))))))))))))))))))))

2007-01-01 21:23 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-01-01 21:16 51,072 --a------ C:\WINDOWS\system32\drivers\ikhlayer.sys
2007-01-01 21:16 30,592 --a------ C:\WINDOWS\system32\drivers\ikhfile.sys
2007-01-01 21:16 <DIR> d-------- C:\Program Files\Spyware Doctor
2007-01-01 20:59 <DIR> d-------- C:\Program Files\Java
2007-01-01 20:59 <DIR> d-------- C:\Program Files\Common Files\Java
2007-01-01 11:03 <DIR> d-------- C:\smit report
2007-01-01 11:02 53,248 --a------ C:\WINDOWS\system32\Process.exe
2006-12-30 13:17 <DIR> d-------- C:\Documents and Settings\HP_Owner\Application Data\McAfee.com Personal Firewall
2006-12-30 13:12 <DIR> d-------- C:\Program Files\McAfee
2006-12-30 13:11 32,768 --a------ C:\WINDOWS\system32\instlsp.exe
2006-12-30 13:11 131,072 --------- C:\WINDOWS\system32\mclsp.dll
2006-12-30 13:11 11,264 --a------ C:\WINDOWS\system32\sporder.dll
2006-12-30 13:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee.com Personal Firewall
2006-12-30 13:09 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee.com
2006-12-30 09:59 <DIR> d-------- C:\Program Files\Grisoft
2006-12-29 13:48 3,618 --a------ C:\WINDOWS\system32\tmp.reg
2006-12-29 13:47 79,360 --a------ C:\WINDOWS\system32\swxcacls.exe
2006-12-29 13:47 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2006-12-29 13:47 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2006-12-29 13:47 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2006-12-29 13:47 135,168 --a------ C:\WINDOWS\system32\swreg.exe
2006-12-28 21:59 <DIR> d-------- C:\Program Files\Windows Live Safety Center
2006-12-28 17:49 <DIR> d-------- C:\Documents and Settings\HP_Owner\Application Data\PC Tools
2006-12-28 16:46 10 --a------ C:\WINDOWS\Syskernel12.dll
2006-12-28 16:46 <DIR> d-------- C:\Program Files\Cool MP3 Splitter
2006-12-28 16:40 3,082 --a------ C:\WINDOWS\system32\affv12740p1now.sys
2006-12-27 15:46 <DIR> d-------- C:\Program Files\HarvEX
2006-12-26 01:16 <DIR> d-------- C:\Documents and Settings\HP_Owner\Application Data\Ad Annihilator.files
2006-12-26 01:15 <DIR> d-------- C:\Program Files\Ad Annihilator
2006-12-26 00:50 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2006-12-26 00:50 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2006-12-21 20:12 <DIR> d-------- C:\Documents and Settings\HP_Owner\Application Data\Canon
2006-12-21 19:41 53,248 -ra------ C:\WINDOWS\system32\InstMed.exe
2006-12-21 19:40 913,280 --a------ C:\WINDOWS\system32\drivers\LV302AV.SYS
2006-12-21 19:40 7,136 --a------ C:\WINDOWS\system32\drivers\lv302af.sys
2006-12-21 19:40 372,736 --a------ C:\WINDOWS\system32\LVUI2RC.dll
2006-12-21 19:40 22,016 --a------ C:\WINDOWS\system32\drivers\LVUSBSta.sys
2006-12-21 19:40 204,800 --a------ C:\WINDOWS\system32\LVUI2.dll
2006-12-21 19:40 2,180,096 --a------ C:\WINDOWS\system32\drivers\LVSVF2.sys
2006-12-21 19:40 106,496 --a------ C:\WINDOWS\system32\lvcoinst.dll
2006-12-21 19:40 <DIR> d-------- C:\Program Files\Common Files\Logitech
2006-12-15 19:33 <DIR> d-------- C:\Documents and Settings\All Users\SonicStage
2006-12-15 18:59 90,112 --------- C:\WINDOWS\snymsico.dll
2006-12-15 18:59 38,951 --------- C:\WINDOWS\system32\drivers\NETMDUSB.sys
2006-12-15 18:59 36,679 --------- C:\WINDOWS\system32\drivers\NETMD052.sys
2006-12-15 18:59 36,232 --------- C:\WINDOWS\system32\drivers\NETMD033.sys
2006-12-15 18:59 35,319 --------- C:\WINDOWS\system32\drivers\NETMD031.sys
2006-12-15 18:58 770,048 --a------ C:\WINDOWS\system32\CDDBUISony.dll
2006-12-15 18:58 73,728 --a------ C:\WINDOWS\system32\CddbLinkSony.dll
2006-12-15 18:58 643,072 --a------ C:\WINDOWS\system32\CDDBControlSony.dll
2006-12-15 18:58 585,728 --a------ C:\WINDOWS\system32\CddbMusicIDSony.dll
2006-12-15 18:58 520,192 --a------ C:\WINDOWS\system32\CddbPlaylist2Sony.dll
2006-12-15 18:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sony Corporation
2006-12-15 18:57 <DIR> d-------- C:\Program Files\Sony
2006-12-15 18:57 <DIR> d-------- C:\Program Files\Common Files\Sony Shared
2006-12-15 18:57 <DIR> d-------- C:\Documents and Settings\HP_Owner\Application Data\Sony Corporation
2006-12-12 18:40 73,728 --a------ C:\WINDOWS\system32\Zion.dll
2006-12-12 18:40 7,040 --a------ C:\WINDOWS\system32\drivers\Gonzales.sys
2006-12-12 18:40 12,160 --a------ C:\WINDOWS\system32\drivers\Bonifay.sys
2006-12-12 18:40 <DIR> d-------- C:\Program Files\Freecom Personal Media Suite
2006-12-09 20:14 <DIR> d-------- C:\Documents and Settings\HP_Owner\Application Data\Lavasoft
2006-12-09 20:08 <DIR> d-------- C:\WINDOWS\pss
2006-12-09 13:02 10,752 --a------ C:\WINDOWS\system32\BASSMOD.dll
2006-12-09 12:56 331,776 --a------ C:\WINDOWS\system32\NCTAudioVisualizationEx2.dll
2006-12-08 22:52 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2006-12-08 22:50 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2006-12-08 22:50 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2006-12-04 14:42 <DIR> d-------- C:\Documents and Settings\HP_Owner\Shared
2006-12-04 14:41 <DIR> d-------- C:\Documents and Settings\HP_Owner\Incomplete
2006-12-04 14:38 <DIR> d-------- C:\Program Files\LimeWire
2006-12-04 14:36 <DIR> d-------- C:\Documents and Settings\HP_Owner\.limewire
2006-12-02 11:54 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2006-12-02 00:33 127,208 --a------ C:\WINDOWS\system32\mucltui.dll
2006-12-01 23:50 <DIR> d-------- C:\WINDOWS\WBEM
2006-12-01 23:50 <DIR> d-------- C:\WINDOWS\system32\en-US
2006-12-01 23:48 <DIR> d--h-c--- C:\WINDOWS\ie7
2006-12-01 23:46 121,856 --------- C:\WINDOWS\system32\xmllite.dll
2006-12-01 23:45 <DIR> d-------- C:\WINDOWS\network diagnostic
2006-12-01 23:42 <DIR> d-------- C:\Program Files\MSXML 4.0
2006-12-01 23:33 28,672 --------- C:\WINDOWS\system32\verclsid.exe
2006-12-01 23:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2006-12-01 23:03 <DIR> d-------- C:\WINDOWS\system32\PreInstall
2006-12-01 23:00 18,200 --a------ C:\WINDOWS\system32\wups2.dll
2006-12-01 23:00 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution
2006-12-01 19:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2006-12-01 10:03 <DIR> d-------- C:\temp

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-01-01 22:54 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\Skype
2007-01-01 20:59 -------- d-------- C:\Program Files\Common Files
2006-12-28 21:34 -------- d-------- C:\Program Files\Symantec
2006-12-28 21:34 -------- d-------- C:\Program Files\Google
2006-12-28 21:29 -------- d-------- C:\Program Files\Common Files\Symantec Shared
2006-12-28 21:20 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\Symantec
2006-12-28 18:18 -------- d-------- C:\Program Files\Mozilla Firefox
2006-12-26 01:23 82 --a------ C:\Documents and Settings\HP_Owner\Application Data\Ad Annihilator.aap
2006-12-16 14:48 -------- d-------- C:\Program Files\MSN
2006-12-16 03:07 -------- d-------- C:\Program Files\Common Files\System
2006-12-16 03:01 -------- d-------- C:\Program Files\Outlook Express
2006-12-15 18:59 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-12-15 18:58 -------- d-------- C:\Program Files\Common Files\InstallShield
2006-12-12 19:31 -------- d-------- C:\Program Files\WinMPG VideoConvert
2006-12-12 19:21 -------- d-------- C:\Program Files\Blaze Media Pro
2006-12-09 14:21 -------- d-------- C:\Program Files\Norton GoBack
2006-12-09 12:34 -------- d-------- C:\Program Files\Windows Media Player
2006-12-04 14:29 -------- d---s---- C:\Documents and Settings\HP_Owner\Application Data\Microsoft
2006-12-02 11:54 -------- d-------- C:\Program Files\Common Files\Microsoft Shared
2006-12-02 11:52 -------- d-------- C:\Program Files\Microsoft Office
2006-12-02 00:46 -------- d-------- C:\Program Files\Internet Explorer
2006-11-29 19:38 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\Sun
2006-11-25 17:08 -------- d-------- C:\Program Files\Common Files\ScanSoft Shared
2006-11-22 16:33 -------- d-------- C:\Program Files\Xilisoft
2006-11-22 16:33 -------- d-------- C:\Program Files\QuickTime
2006-11-22 07:37 -------- d-------- C:\Program Files\Skype
2006-11-21 19:43 -------- d-------- C:\Program Files\Boilsoft AVI Converter
2006-11-21 19:12 -------- d-------- C:\Program Files\DivX
2006-11-21 18:40 -------- d-------- C:\Program Files\WinRAR
2006-11-20 22:35 -------- d-------- C:\Program Files\PC-Doctor 5 for Windows
2006-11-20 22:16 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\Real
2006-11-20 15:19 45568 --a------ C:\WINDOWS\system32\drivers\tshd4_kern_i386.sys
2006-11-20 15:19 44416 --a------ C:\WINDOWS\system32\drivers\Surroundhp_kern_i386.sys
2006-11-20 15:19 37248 --a------ C:\WINDOWS\system32\drivers\csiidecoder_kern_i386.sys
2006-11-20 15:19 34176 --a------ C:\WINDOWS\system32\drivers\SRS_SSCFilter.sys
2006-11-20 15:19 32000 --a------ C:\WINDOWS\system32\drivers\wowhd_kern_i386.sys
2006-11-19 22:38 -------- d-------- C:\Program Files\AlphaZIP
2006-11-19 21:54 -------- d-------- C:\Program Files\Xvid
2006-11-19 20:48 -------- d-------- C:\Program Files\PDT
2006-11-19 14:11 41074 --a------ C:\Documents and Settings\HP_Owner\Application Data\PatchUpdate_HP_CounterReport_Update_HPSU.log
2006-11-19 13:44 -------- d-------- C:\Program Files\Symantec Technical Support
2006-11-18 11:14 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\Symantec(2)
2006-11-17 18:48 -------- d-------- C:\Program Files\Cucusoft
2006-11-17 18:21 -------- d-------- C:\Program Files\MeWiG
2006-11-17 17:39 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\vlc
2006-11-17 17:37 -------- d-------- C:\Program Files\VideoLAN
2006-11-17 17:22 -------- d-------- C:\Program Files\DirectVobSub
2006-11-17 00:38 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\DivX
2006-11-17 00:12 -------- d-------- C:\Program Files\7-Zip
2006-11-16 20:09 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\Google
2006-11-16 18:57 -------- d-------- C:\Program Files\MSBuild
2006-11-16 18:57 -------- d-------- C:\Program Files\Microsoft Visual Studio
2006-11-16 18:57 -------- d-------- C:\Program Files\Common Files\DESIGNER
2006-11-16 18:56 -------- d-------- C:\Program Files\Microsoft.NET
2006-11-15 09:00 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\HP
2006-11-14 21:23 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\Mozilla
2006-11-12 14:19 -------- d-------- C:\Program Files\Sky Broadband
2006-11-11 12:46 -------- d-------- C:\Program Files\Acoustica MP3 CD Burner
2006-11-11 11:36 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\CyberLink
2006-11-10 20:40 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\Macromedia
2006-11-08 05:06 679424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-11-07 21:03 6049280 --------- C:\WINDOWS\system32\ieframe.dll
2006-11-07 21:03 50688 --------- C:\WINDOWS\system32\msfeedsbs.dll
2006-11-07 21:03 458752 --------- C:\WINDOWS\system32\msfeeds.dll
2006-11-07 21:03 413696 --a------ C:\WINDOWS\system32\vbscript.dll
2006-11-07 21:03 231424 --a------ C:\WINDOWS\system32\webcheck.dll
2006-11-07 21:03 180736 --------- C:\WINDOWS\system32\ieui.dll
2006-11-07 21:03 156160 --a------ C:\WINDOWS\system32\msls31.dll
2006-11-07 20:16 -------- d-------- C:\Documents and Settings\HP_Owner\Application Data\RapidGet
2006-11-07 20:08 -------- d-------- C:\Program Files\WinZip
2006-11-07 20:02 -------- d-------- C:\Program Files\XVideoConverter
2006-11-07 03:27 382976 --a------ C:\WINDOWS\system32\iedkcs32.dll
2006-11-07 03:27 229376 --a------ C:\WINDOWS\system32\ieaksie.dll
2006-11-07 03:26 71680 --a------ C:\WINDOWS\system32\admparse.dll
2006-11-07 03:26 55296 --a------ C:\WINDOWS\system32\iesetup.dll
2006-11-07 03:26 54784 --a------ C:\WINDOWS\system32\ie4uinit.exe
2006-11-07 03:26 43008 --a------ C:\WINDOWS\system32\iernonce.dll
2006-11-07 03:26 152064 --a------ C:\WINDOWS\sys