Outerinfo Malware

• abao

  20 Jan 08, 01:13

  PM-ed mayi just now...but think its better I post a hijackthis log first.
  
  Think I got infected when i installed some FTPmanager a week back...but i managed to stop the trojan that time.
  
  I couldnt find anytrace of outerinfo except on the add/remove programs and spybot returned 1 registry key only. It wasnt on C:\Program Files\Outerinfo
  
  So just help me see and ease my fears.
  
  Thanks
  

  Hijackthis log
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 1:10:55 AM, on 1/20/2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16574)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\ZoneLabs\vsmon.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  C:\WINDOWS\system32\inetsrv\inetinfo.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
  C:\WINDOWS\system32\wscntfy.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  C:\acer\epm\epm-dm.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
  C:\Program Files\Launch Manager\QtZgAcer.EXE
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
  C:\Program Files\Sony\WALKMAN Launcher\WMAAD.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\PeerGuardian2\pg2.exe
  C:\Program Files\acer\eRecovery\Monitor.exe
  C:\Program Files\Mozilla Firefox 3 Beta 2\firefox.exe
  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  O2 - BHO: Thunder AtOnce - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll (file missing)
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
  O4 - HKLM\..\Run: [LaunchApp] Alaunch
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
  O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
  O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
  O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
  O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
  O4 - HKLM\..\Run: [WMAAD] C:\Program Files\Sony\WALKMAN Launcher\WMAAD.exe
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
  O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
  O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
  O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O8 - Extra context menu item: Image Converter 3 ??? - C:\PROGRAM FILES\SONY\IMAGE CONVERTER 3\menu.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
  O9 - Extra button: (no name) - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - (no file)
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
  O15 - ESC Trusted Zone: http://*.update.microsoft.com
  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-SG/a-UNO1/GAME_UNO1.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1188797356406
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1188797311828
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
  O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
  O20 - Winlogon Notify: winosz32 - winosz32.dll (file missing)
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O23 - Service: Image Converter SCSI Service (ICScsiSV) - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\ICScsiSV.exe
  O23 - Service: IcVzMonLauncher - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMonLauncher.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
  O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMon.exe
  O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
  O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
  O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SsBeSvc.exe
  O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
  O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
  O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
  O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
  
  --
  End of file - 9239 bytes
  

• ndmmxiaomayi

  20 Jan 08, 01:47

  If you have uninstalled it, most likely it's gone. The uninstaller works quite well.
  
  I'm not seeing any signs of it in the log.
  
  To be on the safe side, I shall look deeper.
  
  

  [*]Please download Deckard's System Scanner from Tech Support Forum and save it to your desktop. Note: You must be logged onto an account with administrator privileges.
  [*]Save all your work and close all opened programs.
  [*]Double click on dss.exe to run it. Follow the prompts.
  [*]When the scan is complete, two log files will be produced. The first one, main.txt, will be maximized, the second one, extra.txt, will be minimized.
  [*]Please post the contents of the 2 log files in your next reply.
• abao

  20 Jan 08, 07:46

  funny thing was that it was stopped at the installation stage, but registry keys were created...
  
  i'll post a log in a few minutes with dss
• abao

  20 Jan 08, 07:53

  Deckard's System Scanner v20071014.68
  Run by Haruhi on 2008-01-20 07:50:13
  Computer is in Normal Mode.
  --------------------------------------------------------------------------------
  
  -- System Restore --------------------------------------------------------------
  
  Successfully created a Deckard's System Scanner Restore Point.
  
  -- Last 3 Restore Point(s) --
  3: 2008-01-19 23:50:25 UTC - RP627 - Deckard's System Scanner Restore Point
  2: 2008-01-19 21:02:23 UTC - RP626 - System Checkpoint
  1: 2008-01-18 10:40:13 UTC - RP625 - Removed Crystal Reports Embeddable Designer for IBM Rational Application Developer
  
  Backed up registry hives.
  Performed disk cleanup.
  
  -- HijackThis Clone ------------------------------------------------------------
  
  Emulating logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 2008-01-20 07:53:25
  Platform: Windows XP Service Pack 2 (5.01.2600)
  MSIE: Internet Explorer (7.00.6000.16574)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\system32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\ZoneLabs\vsmon.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Grisoft\AVG Free\avgamsvr.exe
  C:\Program Files\Grisoft\AVG Free\avgupsvc.exe
  C:\Program Files\Grisoft\AVG Free\avgemc.exe
  C:\WINDOWS\system32\inetsrv\inetinfo.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
  C:\WINDOWS\system32\wscntfy.exe
  C:\WINDOWS\system32\ati2evxx.exe
  C:\WINDOWS\explorer.exe
  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  C:\Acer\ePM\EPM-DM.exe
  C:\Program Files\Grisoft\AVG Free\avgcc.exe
  C:\Program Files\Launch Manager\QtZgAcer.EXE
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
  C:\Program Files\Sony\WALKMAN Launcher\WMAAD.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\PeerGuardian2\pg2.exe
  C:\Program Files\acer\eRecovery\Monitor.exe
  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  C:\WINDOWS\system32\conime.exe
  C:\Documents and Settings\Haruhi\Desktop\dss.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  O2 - BHO: Thunder AtOnce - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll (file missing)
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
  O4 - HKLM\..\Run: [LaunchApp] Alaunch
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
  O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
  O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
  O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
  O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
  O4 - HKLM\..\Run: [WMAAD] C:\Program Files\Sony\WALKMAN Launcher\WMAAD.exe
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
  O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
  O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
  O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O8 - Extra context menu item: Image Converter 3 ??? - C:\PROGRAM FILES\SONY\IMAGE CONVERTER 3\menu.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
  O9 - Extra button: (no name) - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - (file missing)
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
  O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O10 - Unknown file in Winsock LSP: C:\WINDOWS\system32\nwprovau.dll
  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-SG/a-UNO1/GAME_UNO1.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1188797356406
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1188797311828
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
  O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1288.0816.dll
  O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
  O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1288.0816.dll
  O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL
  O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL
  O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
  O20 - Winlogon Notify: winosz32 - C:\WINDOWS\system32\winosz32.dll (file missing)
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\ati2evxx.exe
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG Free\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG Free\avgupsvc.exe
  O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG Free\avgemc.exe
  O23 - Service: Image Converter SCSI Service (ICScsiSV) - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\ICScsiSV.exe
  O23 - Service: IcVzMonLauncher - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMonLauncher.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
  O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMon.exe
  O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
  O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
  O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SsBeSvc.exe
  O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
  O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
  O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
  O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
  
  --
  End of file - 10962 bytes
  
  -- File Associations -----------------------------------------------------------
  
  All associations okay.
  
  -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------
  
  R0 prohlp02 (StarForce Protection Helper Driver v2) - c:\windows\system32\drivers\prohlp02.sys
  R0 prosync1 (StarForce Protection Synchronization Driver v1) - c:\windows\system32\drivers\prosync1.sys
  R0 sfhlp01 (StarForce Protection Helper Driver) - c:\windows\system32\drivers\sfhlp01.sys
  R1 prodrv06 (StarForce Protection Environment Driver v6) - c:\windows\system32\drivers\prodrv06.sys
  R1 UBHelper - c:\windows\system32\drivers\ubhelper.sys
  R2 EpmPsd (Acer EPM Power Scheme Driver) - c:\windows\system32\drivers\epm-psd.sys
  R2 EpmShd (Acer EPM System Hardware Driver) - c:\windows\system32\drivers\epm-shd.sys
  R3 int15.sys - c:\program files\acer\erecovery\int15.sys
  R3 NTIDrvr (Upper Class Filter Driver) - c:\windows\system32\drivers\ntidrvr.sys
  R3 pgfilter - c:\program files\peerguardian2\pgfilter.sys
  
  S2 npkcrypt - d:\program files\wizet\maplestory\npkcrypt.sys (file missing)
  S3 AmeAtmPc - c:\windows\system32\drivers\ameatmpc.sys (file missing)
  S3 EagleNT - c:\windows\system32\drivers\eaglent.sys (file missing)
  S3 LHidUsbK (Logitech SetPoint USB Receiver device driver) - c:\windows\system32\drivers\lhidusbk.sys
  S3 LMouKE (Logitech SetPoint Mouse Filter Driver) - c:\windows\system32\drivers\lmouke.sys (file missing)
  S3 tbhsd (Tunebite High-Speed Dubbing) - c:\windows\system32\drivers\tbhsd.sys (file missing)
  S3 XDva004 - c:\windows\system32\xdva004.sys (file missing)
  S3 XDva052 - c:\windows\system32\xdva052.sys (file missing)
  
  -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------
  
  S3 PACSPTISVR - "c:\program files\common files\sony shared\avlib\pacsptisvr.exe"
  
  -- Device Manager: Disabled ----------------------------------------------------
  
  Class GUID: {4D36E977-E325-11CE-BFC1-08002BE10318}
  Description: Generic CardBus Controller
  Device ID: PCI\VEN_104C&DEV_8031&SUBSYS_00661025&REV_00\4&1D3F0FBB&0&08F0
  Manufacturer: Microsoft
  Name: Texas Instruments PCIxx21/x515 Cardbus Controller
  PNP Device ID: PCI\VEN_104C&DEV_8031&SUBSYS_00661025&REV_00\4&1D3F0FBB&0&08F0
  Service: pcmcia
  
  Class GUID: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F}
  Description: Texas Instruments OHCI Compliant IEEE 1394 Host Controller
  Device ID: PCI\VEN_104C&DEV_8032&SUBSYS_00661025&REV_00\4&1D3F0FBB&0&0AF0
  Manufacturer: Texas Instruments
  Name: Texas Instruments OHCI Compliant IEEE 1394 Host Controller
  PNP Device ID: PCI\VEN_104C&DEV_8032&SUBSYS_00661025&REV_00\4&1D3F0FBB&0&0AF0
  Service: ohci1394
  
  Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
  Description: Intel(R) PRO/Wireless 2200BG Network Connection
  Device ID: PCI\VEN_8086&DEV_4220&SUBSYS_27018086&REV_05\4&1D3F0FBB&0&18F0
  Manufacturer: Intel(R) Corporation
  Name: Intel(R) PRO/Wireless 2200BG Network Connection
  PNP Device ID: PCI\VEN_8086&DEV_4220&SUBSYS_27018086&REV_05\4&1D3F0FBB&0&18F0
  Service: w29n51
  
  Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
  Description: Hamachi Network Interface
  Device ID: ROOT\NET\0000
  Manufacturer: Applied Networking Inc.
  Name: Hamachi Network Interface
  PNP Device ID: ROOT\NET\0000
  Service: hamachi
  
  -- Scheduled Tasks -------------------------------------------------------------
  
  2006-09-06 09:59:50 108 --a------ C:\WINDOWS\Tasks\Low Battery Alarm Program.job
  
  -- Files created between 2007-12-20 and 2008-01-20 -----------------------------
  
  2008-01-20 00:38:26 0 dr-h----- C:\Documents and Settings\Haruhi\Recent
  2008-01-18 18:43:29 60273 --a------ C:\WINDOWS\system32\pthreadGC2.dll
  2008-01-18 18:43:29 7680 --a------ C:\WINDOWS\system32\ff_vfw.dll
  2008-01-12 09:53:08 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
  2008-01-12 09:53:06 0 d-------- C:\Program Files\Fraps
  2008-01-11 21:15:36 0 d-------- C:\Program Files\FileZillaPortable
  2008-01-11 21:03:23 40183 ---hs---- C:\Program Files\Common Files\Yazzle1739OinUninstaller.exe
  2008-01-10 20:15:02 0 d-------- C:\Documents and Settings\Haruhi\Application Data\Aegisub
  2008-01-06 09:17:08 96768 --a------ C:\WINDOWS\system32\LAGARITH.DLL
  2008-01-06 00:45:21 74924 --ah----- C:\WINDOWS\system32\mlfcache.dat
  2008-01-05 14:18:00 0 d-------- C:\Program Files\Microsoft ASP.NET
  2008-01-04 16:58:12 0 d-------- C:\Program Files\CCleaner
  2008-01-03 16:09:59 0 d-------- C:\Downloads
  2007-12-25 23:23:02 0 d-------- C:\Documents and Settings\Haruhi\Application Data\foobar2000
  2007-12-22 16:00:38 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
  2007-12-22 15:50:19 0 d-------- C:\Program Files\MSBuild
  2007-12-20 19:26:20 0 d-------- C:\Program Files\Mozilla Firefox 3 Beta 2
  
  -- Find3M Report ---------------------------------------------------------------
  
  2008-01-20 07:52:38 0 d-------- C:\Program Files\PeerGuardian2
  2008-01-19 22:52:28 0 d-------- C:\Documents and Settings\Haruhi\Application Data\uTorrent
  2008-01-19 11:57:08 0 d-------- C:\Documents and Settings\Haruhi\Application Data\AVG7
  2008-01-19 09:18:54 0 d-------- C:\Program Files\Codecs Directory
  2008-01-14 21:17:26 0 d-------- C:\Documents and Settings\Haruhi\Application Data\Hamachi
  2008-01-12 07:13:20 0 d-------- C:\Documents and Settings\Haruhi\Application Data\mIRC
  2008-01-11 21:03:32 0 d-------- C:\Program Files\Common Files
  2008-01-11 20:42:05 0 d-------- C:\Program Files\mIRC
  2008-01-09 18:27:27 0 d-------- C:\Documents and Settings\Haruhi\Application Data\Free Download Manager
  2008-01-08 22:50:10 0 d-------- C:\Program Files\NJStar Japanese WP
  2007-12-27 22:37:56 0 d-------- C:\Documents and Settings\Haruhi\Application Data\Winamp
  2007-12-26 16:07:21 0 d-------- C:\Program Files\7-Zip
  2007-12-22 21:28:52 0 d-------- C:\Program Files\Creative
  2007-12-22 15:51:41 0 d-------- C:\Program Files\Common Files\Merge Modules
  2007-12-22 15:50:54 0 d-------- C:\Program Files\Microsoft Visual Studio 8
  2007-12-22 15:33:08 0 d-------- C:\Program Files\Microsoft SQL Server
  2007-12-09 21:21:04 0 d-------- C:\Program Files\Microsoft.NET
  2007-12-09 21:17:46 0 d-------- C:\Program Files\Microsoft Device Emulator
  2007-12-09 21:17:36 0 d-------- C:\Program Files\Microsoft SQL Server 2005 Mobile Edition
  2007-12-09 21:06:16 0 d-------- C:\Program Files\Common Files\Business Objects
  2007-12-09 21:04:28 0 d-------- C:\Program Files\CE Remote Tools
  2007-12-09 15:05:29 0 d-------- C:\Program Files\Winamp
  2007-12-08 17:02:01 137216 --a------ C:\WINDOWS\system32\secdel.dll
  2007-12-03 15:20:10 1190 --a------ C:\WINDOWS\eReg.dat
  2007-12-01 19:14:11 0 d-------- C:\Documents and Settings\Haruhi\Application Data\Sony Corporation
  2007-12-01 18:22:36 0 d--h----- C:\Program Files\InstallShield Installation Information
  2007-12-01 18:22:06 0 d-------- C:\Program Files\Common Files\Sony Shared
  2007-12-01 18:21:00 0 d-------- C:\Program Files\Sony
  2007-11-27 18:13:07 0 d-------- C:\Documents and Settings\Haruhi\Application Data\Command & Conquer 3 Tiberium Wars
  2007-11-26 17:18:09 0 dr-h----- C:\Documents and Settings\Haruhi\Application Data\SecuROM
  2007-11-26 17:18:08 98304 --a------ C:\WINDOWS\system32CmdLineExt.dll
  2007-11-22 07:59:32 0 d-------- C:\Program Files\MSECache
  2007-11-22 02:23:54 81920 --a------ C:\WINDOWS\system32\frapsvid.dll
  2007-10-24 16:13:42 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat
  
  -- Registry Dump ---------------------------------------------------------------
  
  *Note* empty entries & legit default entries are not shown
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "LaunchApp"="Alaunch" []
  "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [02/07/2005 07:36 PM]
  "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [02/07/2005 07:32 PM]
  "BluetoothAuthenticationAgent"="bthprops.cpl" [08/04/2004 12:00 PM C:\WINDOWS\system32\bthprops.cpl]
  "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [08/04/2004 05:00 AM]
  "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [08/04/2004 08:00 PM]
  "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [08/04/2004 08:00 PM]
  "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [08/04/2004 08:00 PM]
  "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [02/08/2005 09:05 PM]
  "EPM-DM"="c:\acer\epm\epm-dm.exe" [03/28/2005 06:04 PM]
  "ePowerManagement"="C:\Acer\ePM\ePM.exe" [03/24/2005 09:13 AM]
  "eRecoveryService"="C:\Windows\System32\Check.exe" [03/23/2005 10:01 AM]
  "ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" []
  "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [08/11/2005 03:30 PM]
  "AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [12/22/2007 10:02 AM]
  "LManager"="C:\Program Files\Launch Manager\QtZgAcer.EXE" [12/09/2004 12:50 PM]
  "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [10/07/2004 11:44 PM]
  "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [10/07/2004 11:43 PM]
  "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [02/16/2007 10:54 AM]
  "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [03/09/2007 01:02 AM]
  "WMAAD"="C:\Program Files\Sony\WALKMAN Launcher\WMAAD.exe" [02/16/2007 06:41 PM]
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 12:00 PM]
  "PeerGuardian"="C:\Program Files\PeerGuardian2\pg2.exe" [09/18/2005 06:40 PM]
  "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [08/31/2007 04:46 PM]
  
  C:\Documents and Settings\Haruhi\Start Menu\Programs\Startup\
  Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [5/10/2006 8:18:09 PM]
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
  "DisableRegistryTools"=0 (0x0)
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
  "NoRecentDocsMenu"=01000000
  "NoRecentDocsHistory"=01000000
  "NoRecentDocsNetHood"=01000000
  "ClearRecentDocsOnExit"=01000000
  "NoSMMyPictures"=00000000
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winosz32]
  winosz32.dll
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
  path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
  backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
  path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
  backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\8start]
  C:\Program Files\8start Launcher\8start.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AAWTray]
  C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
  "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
  "C:\Program Files\iTunes\iTunesHelper.exe"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
  "C:\Program Files\QuickTime\qttask.exe" -atboottime
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
  "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
  "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
  "iPodService"=3 (0x3)
  "iPod Service"=3 (0x3)
  "SandraTheSrv"=3 (0x3)
  "SandraDataSrv"=3 (0x3)
  "Adobe LM Service"=3 (0x3)
  "BthServ"=3 (0x3)
  "AVG Anti-Spyware Guard"=2 (0x2)
  "NuTCRACKERService"=2 (0x2)
  "aawservice"=3 (0x3)
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
  bthsvcs BthServ
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5f081c3c-9982-11dc-9ce7-00c09f97fdd3}]
  Auto\command- auto.exe
  AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe
  
  *Newly Created Service* - PGFILTER
  
  -- Hosts -----------------------------------------------------------------------
  
  127.0.0.1 007guard.com
  127.0.0.1 www.007guard.com
  127.0.0.1 008i.com
  127.0.0.1 008k.com
  127.0.0.1 www.008k.com
  127.0.0.1 00hq.com
  127.0.0.1 www.00hq.com
  127.0.0.1 010402.com
  127.0.0.1 032439.com
  127.0.0.1 www.032439.com
  
  7835 more entries in hosts file.
  
  -- End of Deckard's System Scanner: finished at 2008-01-20 07:54:13 ------------
  
  
• abao

  20 Jan 08, 07:54

  Deckard's System Scanner v20071014.68
  Extra logfile - please post this as an attachment with your post.
  --------------------------------------------------------------------------------
  
  -- System Information ----------------------------------------------------------
  
  Microsoft Windows XP Professional (build 2600) SP 2.0
  Architecture: X86; Language: English
  
  CPU 0: Intel(R) Pentium(R) M processor 1.73GHz
  Percentage of Memory in Use: 30%
  Physical Memory (total/avail): 2046.05 MiB / 1414.48 MiB
  Pagefile Memory (total/avail): 3938.6 MiB / 3463.14 MiB
  Virtual Memory (total/avail): 2047.88 MiB / 1927.48 MiB
  
  C: is Fixed (NTFS) - 35.71 GiB total, 10.62 GiB free.
  D: is Fixed (NTFS) - 35.88 GiB total, 15.06 GiB free.
  E: is CDROM (No Media)
  F: is CDROM (CDFS)
  I: is Fixed (NTFS) - 74.52 GiB total, 52.47 GiB free.
  
  \\.\PHYSICALDRIVE0 - ST9808210A - 74.53 GiB - 3 partitions
  \PARTITION0 - Unknown - 2.93 GiB
  \PARTITION1 (bootable) - Installable File System - 35.71 GiB - C:
  \PARTITION2 - Extended w/Extended Int 13 - 35.88 GiB - D:
  
  \\.\PHYSICALDRIVE1 - Generic USB Disk USB Device - 74.53 GiB - 1 partition
  \PARTITION0 - Extended w/Extended Int 13 - 74.52 GiB - I:
  
  -- Security Center -------------------------------------------------------------
  
  AUOptions is disabled.
  Windows Internal Firewall is disabled.
  
  FirstRunDisabled is set.
  
  FW: ZoneAlarm Firewall v7.0.337.000 (Check Point, LTD.)
  FW: COMODO Firewall Pro v2.3.035 (COMODO) [COLOR=RED]Disabled[/COLOR]
  AV: AVG 7.5.516 v7.5.516 (Grisoft)
  
  [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
  "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
  "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
  "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
  
  [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
  "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
  "C:\\Program Files\\BitComet\\BitComet.exe"="C:\\Program Files\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
  "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
  "C:\\Program Files\\Grisoft\\AVG Free\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG Free\\avginet.exe:*:Enabled:avginet.exe"
  "C:\\Program Files\\Grisoft\\AVG Free\\avgamsvr.exe"="C:\\Program Files\\Grisoft\\AVG Free\\avgamsvr.exe:*:Enabled:avgamsvr.exe"
  "C:\\Program Files\\Grisoft\\AVG Free\\avgcc.exe"="C:\\Program Files\\Grisoft\\AVG Free\\avgcc.exe:*:Enabled:avgcc.exe"
  "C:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe"="C:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe:*:Enabled:avgemc.exe"
  "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
  "C:\\Program Files\\uTorrent\\utorrent.exe"="C:\\Program Files\\uTorrent\\utorrent.exe:*:Enabled:μTorrent"
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
  "G:\\utorrent-1.6.1\\utorrent.exe"="G:\\utorrent-1.6.1\\utorrent.exe:*:Enabled:μTorrent"
  "I:\\utorrent-1.6.1\\utorrent.exe"="I:\\utorrent-1.6.1\\utorrent.exe:*:Enabled:μTorrent"
  "I:\\Share10_ex2\\Share.exe"="I:\\Share10_ex2\\Share.exe:*:Enabled:Share"
  "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
  "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
  
  -- Environment Variables -------------------------------------------------------
  
  ALLUSERSPROFILE=C:\Documents and Settings\All Users
  APPDATA=C:\Documents and Settings\Haruhi\Application Data
  CLASSPATH=.;C:\Program Files\Java\jre1.5.0_08\lib\ext\QTJava.zip
  CommonProgramFiles=C:\Program Files\Common Files
  COMPUTERNAME=ACER-788D15BB1C
  ComSpec=C:\WINDOWS\system32\cmd.exe
  FP_NO_HOST_CHECK=NO
  HOME=C:\Documents and Settings\Haruhi
  HOMEDRIVE=C:
  HOMEPATH=\Documents and Settings\Haruhi
  INCLUDE=C:\Program Files\Microsoft Visual Studio .NET 2003\SDK\v1.1\include\
  LANGUAGE=English
  LIB=C:\Program Files\Microsoft Visual Studio .NET 2003\SDK\v1.1\Lib\
  LOGONSERVER=\\ACER-788D15BB1C
  NUMBER_OF_PROCESSORS=1
  OS=Windows_NT
  Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\WBEM;C:\Program Files\ATI Technologies\ATI Control Panel;C:\Program Files\Common Files\Adobe\AGL;C:\Nokia\Update_Manager\bin;C:\Program Files\QuickTime\QTSystem\;;;"C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier";C:\Program Files\Microsoft SQL Server\90\Tools\binn\;C:\Program Files\Codecs Directory\MKVtoolnix;;C:\PROGRA~1\COMMON~1\MUVEET~1\030625
  PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
  PROCESSOR_ARCHITECTURE=x86
  PROCESSOR_IDENTIFIER=x86 Family 6 Model 13 Stepping 8, GenuineIntel
  PROCESSOR_LEVEL=6
  PROCESSOR_REVISION=0d08
  ProgramFiles=C:\Program Files
  PROMPT=$P$G
  QTJAVA=C:\Program Files\Java\jre1.5.0_08\lib\ext\QTJava.zip
  SESSIONNAME=Console
  SystemDrive=C:
  SystemRoot=C:\WINDOWS
  TEMP=C:\DOCUME~1\Haruhi\LOCALS~1\Temp
  TMP=C:\DOCUME~1\Haruhi\LOCALS~1\Temp
  TMPDIR=C:\DOCUME~1\Haruhi\LOCALS~1\Temp
  tvdumpflags=8
  USERDOMAIN=ACER-788D15BB1C
  USERNAME=Haruhi
  USERPROFILE=C:\Documents and Settings\Haruhi
  VS71COMNTOOLS=C:\Program Files\Microsoft Visual Studio .NET 2003\Common7\Tools\
  VS80COMNTOOLS=C:\Program Files\Microsoft Visual Studio 8\Common7\Tools\
  windir=C:\WINDOWS
  
  -- User Profiles ---------------------------------------------------------------
  
  Haruhi [I](admin)[/I]
  ASPNET
  Bao Yi
  Administrator [I](new local, admin)[/I]
  
  -- Add/Remove Programs ---------------------------------------------------------
  
  --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
  --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Acer Inc.\Acer English Online Help Creator\Uninst.isu"
  --> Dummy
  --> MsiExec.exe /X{E9F81423-211E-46B6-9AE0-38568BC5CF6F}
  --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{19822917-61F6-4221-B1D0-1C3B8A06BE60}\setup.exe" -l0x9
  --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{19822917-61F6-4221-B1D0-1C3B8A06BE60}\setup.exe" -l0x9 /remove
  --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x9
  --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x9 /remove
  --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7550D6AA-CCF3-4FDA-87D6-C2C1B2E5358D}\setup.exe" -l0x9
  --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7550D6AA-CCF3-4FDA-87D6-C2C1B2E5358D}\setup.exe" -l0x9 /remove
  --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A82F10CB-18B5-4EAC-AEF2-FA49CD565626}\setup.exe" -l0x9
  --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B49BCFF0-64CC-4E0E-AD9D-91BFBD344BAE}\setup.exe" -l0x9
  --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B49BCFF0-64CC-4E0E-AD9D-91BFBD344BAE}\setup.exe" -l0x9 /remove
  --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CB99E420-8071-48F9-9567-4A53BE7569C4}\setup.exe" -l0x9
  --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CB99E420-8071-48F9-9567-4A53BE7569C4}\setup.exe" -l0x9 /remove
  --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E250A50C-9CA5-4F2E-829B-E3C96760ADE3}\setup.exe" -l0x9
  --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E250A50C-9CA5-4F2E-829B-E3C96760ADE3}\setup.exe" -l0x9 /remove
  --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F90CBE30-7269-465D-AB66-0DCF33CE3618}\setup.exe" -l0x9
  --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
  7-Zip 4.57 --> "C:\Program Files\7-Zip\Uninstall.exe"
  Acer ePowerManagement --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{58E5844B-7CE2-413D-83D1-99294BF6C74F}\Setup.exe" -l0x9
  Acer GridVista --> C:\WINDOWS\UnInst32.exe GridV.UNI
  Adobe Bridge 1.0 --> MsiExec.exe /I{B74D4E10-1033-0000-0000-000000000001}
  Adobe Common File Installer --> MsiExec.exe /I{8EDBA74D-0686-4C99-BFDD-F894678E5B39}
  Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
  Adobe Flash Player Plugin --> C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
  Adobe Help Center 1.0 --> MsiExec.exe /I{E9787678-1033-0000-8E67-000000000001}
  Adobe Photoshop CS2 --> msiexec /I {236BB7C4-4419-42FD-0409-1E257A25E34D}
  Adobe Reader 8.1.0 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81000000003}
  Adobe Reader Chinese Simplified Fonts --> MsiExec.exe /I{AC76BA86-7AD7-2447-0000-705000000001}
  Adobe Stock Photos 1.0 --> MsiExec.exe /I{786C5747-1033-0000-B58E-000000000001}
  Aegisub 2.00 alpha r1611 --> "C:\Program Files\Codecs Directory\Aegisub\unins000.exe"
  ATI - Software Uninstall Utility --> C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
  ATI Control Panel --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}\setup.exe"
  ATI Display Driver --> rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_classISPLAY -clean
  Audacity 1.2.4 --> "C:\Program Files\Audacity\unins000.exe"
  AVG Free Edition --> C:\Program Files\Grisoft\AVG Free\setup.exe /UNINSTALL
  AviSynth 2.5 --> "C:\Program Files\AviSynth 2.5\Uninstall.exe"
  Calculator Powertoy for Windows XP --> MsiExec.exe /I{B37C842A-B624-46B8-A727-654E72F1C91A}
  CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe"
  Command & Conquer Red Alert 2 --> D:\Program Files\Westwood\RA2\Uninstll.EXE
  Command && Conquer Red Alert 2 - Yuri's Revenge --> D:\Program Files\Westwood\RA2\Uninstll.EXE
  Compatibility Pack for the 2007 Office system --> MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE}
  Conexant AC-Link Audio --> CIAunwdm.exe
  CoreWavPack DirectShow Filters (remove only) --> "C:\WINDOWS\system32\CoreWavPack-uninstall.exe"
  Creative Mass Storage Drivers --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F90CBE30-7269-465D-AB66-0DCF33CE3618}\setup.exe" -l0x9 /remove
  Creative MuVo S200 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8DC9744E-7410-467E-AB5A-4947C5D89C39}\SETUP.EXE" -l0x9 /remove
  DirectVobSub (remove only) --> "C:\Program Files\Codecs Directory\DirectVobSub\uninstall.exe"
  DVD Decrypter (Remove Only) --> "C:\Program Files\Codecs Directory\DVD Decrypter\uninstall.exe"
  EPSON Printer Software --> C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /R
  ffdshow [rev 1763] [2007-01-08] --> "C:\Program Files\Codecs Directory\ffdshow\unins000.exe"
  Fraps --> "C:\Program Files\Fraps\uninstall.exe"
  Free Download Manager 2.5 --> "C:\Program Files\Free Download Manager\unins000.exe"
  Google Earth --> MsiExec.exe /I{1E04F83B-2AB9-4301-9EF7-E86307F79C72}
  Granado Espada --> "D:\Program Files\Granado Espada\unins000.exe"
  Haali Media Splitter --> "C:\Program Files\Codecs Directory\MatroskaSplitter\uninstall.exe"
  Hamachi 1.0.0.62 --> C:\Program Files\Hamachi\uninstall.exe
  Hot Potatoes v 6.0.4.27 --> "C:\Program Files\HotPotatoes6\unins000.exe"
  Image Converter 3 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FE013D72-CF3D-41A8-BC09-C38070FDE2CB}\setup.exe" -l0x11 /CONPANE -removeonly
  Japanese Fonts Support For Adobe Reader 8 --> MsiExec.exe /I{AC76BA86-7AD7-5760-0000-800000000003}
  Java(TM) SE Development Kit 6 --> MsiExec.exe /I{32A3A4F4-B792-11D6-A78A-00B0D0160000}
  Java(TM) SE Runtime Environment 6 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160000}
  Lagarith lossless video codec (Remove Only) --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\LAGARITH.INF
  Lame ACM MP3 Codec --> C:\WINDOWS\system32\rundll32.exe setupapi,InstallHinfSection Remove_LameMP3 132 C:\WINDOWS\INF\LameACM.inf
  Launch Manager --> C:\WINDOWS\UnInst32.exe QtZgAcer.UNI
  MatroskaProp (remove only) --> C:\Program Files\MatroskaProp\MatroskaProp-uninstall.exe
  meGUI modern media encoder (remove only) --> "C:\Program Files\Codecs Directory\megui-0.3.0.0\megui-uninstall.exe"
  Microsoft ASP.NET 2.0 AJAX Extensions 1.0 --> MsiExec.exe /X{082BDF7B-4810-4599-BF0D-E3AC44EC8524}
  Microsoft Base Smart Card Cryptographic Service Provider Package --> "C:\WINDOWS\$NtUninstallbasecsp$\spuninst\spuninst.exe"
  Microsoft Device Emulator version 1.0 - ENU --> MsiExec.exe /X{78B75C6D-E53C-424C-BF83-4B63BD4A6682}
  Microsoft Document Explorer 2005 --> C:\Program Files\Common Files\Microsoft Shared\Help 8\Microsoft Document Explorer 2005\install.exe
  Microsoft Document Explorer 2005 --> MsiExec.exe /X{44D4AF75-6870-41F5-9181-662EA05507E1}
  Microsoft Office Professional Edition 2003 --> MsiExec.exe /I{90110409-6000-11D3-8CFE-0150048383C9}
  Microsoft Office Project Professional 2003 --> MsiExec.exe /I{903B0409-6000-11D3-8CFE-0150048383C9}
  Microsoft SQL Server 2005 --> "C:\Program Files\Microsoft SQL Server\90\Setup Bootstrap\ARPWrapper.exe" /Remove
  Microsoft SQL Server 2005 Express Edition (SQLEXPRESS) --> MsiExec.exe /I{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}
  Microsoft SQL Server 2005 Mobile [ENU] Developer Tools --> MsiExec.exe /X{1389C6A4-4965-4AEC-9175-08B54A10FA48}
  Microsoft SQL Server 2005 Tools Express Edition --> MsiExec.exe /I{2750B389-A2D2-4953-99CA-27C1F2A8E6FD}
  Microsoft SQL Server Management Studio Express --> MsiExec.exe /I{20608BFA-6068-48FE-A410-400F2A124C27}
  Microsoft SQL Server Native Client --> MsiExec.exe /I{F9B3DD02-B0B3-42E9-8650-030DFF0D133D}
  Microsoft SQL Server Setup Support Files (English) --> MsiExec.exe /X{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}
  Microsoft SQL Server VSS Writer --> MsiExec.exe /I{E9F44C98-B8B6-480F-AF7B-E42A0A46F4E3}
  Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
  Microsoft Visual J# .NET Redistributable Package 1.1 --> MsiExec.exe /X{1A655D51-1423-48A3-B748-8F5A0BE294C8}
  Microsoft Visual J# 2.0 Redistributable Package --> C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft Visual J# 2.0 Redistributable Package\install.exe
  Microsoft Visual Studio .NET Professional 2003 - English --> "C:\Program Files\Microsoft Visual Studio .NET 2003\Setup\Visual Studio .NET Professional 2003 - English\setup.exe" /MaintMode
  Microsoft Visual Studio 2005 Professional Edition - ENU --> C:\Program Files\Microsoft Visual Studio 8\Microsoft Visual Studio 2005 Professional Edition - ENU\setup.exe
  Microsoft Visual Studio 2005 Professional Edition - ENU Service Pack 1 (KB926601) --> C:\WINDOWS\system32\msiexec.exe /promptrestart /uninstall {D93F9C7C-AB57-44C8-BAD6-1494674BCAF7} /package {437AB8E0-FB69-4222-B280-A64F3DE22591}
  mIRC --> C:\Program Files\mIRC\uninstall.exe _?=C:\Program Files\mIRC
  MKVtoolnix 2.1.0 --> C:\Program Files\Codecs Directory\MKVtoolnix\uninst.exe
  Monkey's Audio --> "C:\Program Files\Codecs Directory\Monkey's Audio\unins000.exe"
  Mozilla Firefox (2.0.0.11) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
  Mozilla Firefox (3.0b2) --> C:\Program Files\Mozilla Firefox 3 Beta 2\uninstall\helper.exe
  MSXML 6.0 Parser (KB933579) --> MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
  NJStar Japanese WP --> C:\Program Files\NJStar Japanese WP\uninst.exe
  NTI Backup NOW! 4 --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{385979FE-DC4F-4140-8EAD-A59625000D72} /l1033 BUN4
  NTI CD & DVD-Maker --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2} /l1033 CDM7
  OpenMG Limited Patch 4.7-07-14-05-01 --> C:\Program Files\Common Files\Sony Shared\OpenMG\HotFixes\HotFix4.7-07-14-05-01\HotFixSetup\setup.exe /u
  OpenMG Secure Module 4.7.00 --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\1150\INTEL3~1\IDriver.exe /M{CCD663AE-610D-4BDF-AAB0-E914B044527D} UNINSTALL
  Opera 9.50 --> MsiExec.exe /X{2F3B0D3D-E1D3-42CC-BDC4-A5BF799FD375}
  Outerinfo --> "C:\Program Files\Common Files\Yazzle1739OinUninstaller.exe"
  PC Inspector File Recovery --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0DD140D3-9563-481E-AA75-BA457CBDAEF2}\Setup.exe" -l0x9
  PDF Manual NW-A800 Series --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{99B9FAF2-33FD-4DC7-9087-5BC2EE4CBB9E}\setup.exe" -l0x9 UNINSTALL -removeonly
  PeerGuardian 2.0 --> "C:\Program Files\PeerGuardian2\unins000.exe"
  PowerDVD --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall
  Quick Start V1.3 --> "C:\Program Files\Prolink Hurricane 9000C\unins000.exe"
  QuickTime --> MsiExec.exe /I{5E863175-E85D-44A6-8968-82507D34AE7F}
  RealPlayer --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
  Security Update for CAPICOM (KB931906) --> MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
  Security Update for CAPICOM (KB931906) --> MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
  SimCity 4 Deluxe --> D:\Program Files\Electronic Arts\Sim City 4 Deluxe\EAUninstall.exe
  Simple File Shredder 3.2 --> C:\Program Files\scar5\Simple File Shredder\uninst.exe
  SoftV92 Data Fax Modem with SmartCP --> C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_8086&DEV_266D&SUBSYS_00661025\HXFSETUP.EXE -U -Iqta00665.inf
  SonicStage 4.3 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A0EB195B-5876-48E6-879D-33D4B2102610}\setup.exe" -l0x9 UNINSTALL -removeonly
  Sony Video Shared Library --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{01FDC9FC-4D4F-4DB0-ACD1-D3E8E1D52902}\setup.exe" -l0x11 -removeonly /nos
  Spelling Dictionaries Support For Adobe Reader 8 --> MsiExec.exe /I{AC76BA86-7AD7-5464-3428-800000000003}
  Spybot - Search & Destroy --> "C:\Program Files\Spybot - Search & Destroy\unins000.exe"
  Synaptics Pointing Device Driver --> rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
  System Requirements Lab --> C:\Program Files\Common Files\SystemRequirementsLab\Uninstall.exe
  Texas Instruments PCIxx21/x515 drivers. --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{8E50332B-772C-4AEA-BF56-94DE6A1D5F10} /l1033
  Tweak UI --> "C:\WINDOWS\system32\mshta.exe" "res://C:\WINDOWS\system32\TweakUI.exe/uninstall.hta"
  Video Downloader --> C:\Program Files\InstallShield Installation Information\{F1D891A7-2BAF-4033-9A20-DBB78F86BF0C}\setup.exe -runfromtemp -l0x0009UNINSTALL -removeonly
  WALKMAN Launcher --> C:\Program Files\InstallShield Installation Information\{C20B3C31-28CD-4732-AE45-A30F401AF91F}\setup.exe -runfromtemp -l0x0011 UNINSTALL -removeonly
  Westwood Shared Internet Components --> D:\Program Files\Westwood\Internet\UnstllAP.EXE
  Winamp --> "C:\Program Files\Winamp\UninstWA.exe"
  Windows Live installer --> MsiExec.exe /X{7BC43F11-02C8-45FA-ABDC-E2F9FF31F825}
  Windows Live Messenger --> MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0}
  Windows Live Sign-in Assistant --> MsiExec.exe /I{CB5EA99C-8A5B-49F2-9A1A-2EF78BE4DB41}
  x264 VFW (remove only) --> "C:\WINDOWS\system32\x264-uninstall.exe"
  ZoneAlarm --> C:\Program Files\Zone Labs\ZoneAlarm\zauninst.exe
  ﾕ貶ｹ昀ﾞﾋｫ4ﾖﾐﾎﾄｰ・ --> "D:\Program Files\Shin Sangokumusou 4 Special\unins000.exe"
  
  -- Application Event Log -------------------------------------------------------
  
  Event Record #/Type2589 / Error
  Event Submitted/Written: 01/13/2008 03:28:07 PM
  Event ID/Source: 1000 / Application Error
  Event Description:
  Faulting application gamemd.exe, version 1.0.0.5, faulting module unknown, version 0.0.0.0, fault address 0x6056c690.
  Processing media-specific event for [gamemd.exe!ws!]
  
  Event Record #/Type2588 / Error
  Event Submitted/Written: 01/13/2008 03:25:09 PM
  Event ID/Source: 1000 / Application Error
  Event Description:
  Faulting application gamemd.exe, version 1.0.0.5, faulting module unknown, version 0.0.0.0, fault address 0x6056c690.
  Processing media-specific event for [gamemd.exe!ws!]
  
  Event Record #/Type2587 / Error
  Event Submitted/Written: 01/13/2008 03:22:27 PM
  Event ID/Source: 1000 / Application Error
  Event Description:
  Faulting application gamemd.exe, version 1.0.0.5, faulting module unknown, version 0.0.0.0, fault address 0x6056c690.
  Processing media-specific event for [gamemd.exe!ws!]
  
  Event Record #/Type2575 / Error
  Event Submitted/Written: 01/12/2008 10:59:30 AM
  Event ID/Source: 1000 / Application Error
  Event Description:
  Faulting application game.exe, version 1.0.0.1, faulting module unknown, version 0.0.0.0, fault address 0x6056c690.
  Processing media-specific event for [game.exe!ws!]
  
  Event Record #/Type2535 / Warning
  Event Submitted/Written: 01/10/2008 03:45:13 PM
  Event ID/Source: 3 / SQLBrowser
  Event Description:
  The configuration of the AdminConnection\TCP protocol in the SQL instance SQLEXPRESS is not valid.
  
  -- Security Event Log ----------------------------------------------------------
  
  No Errors/Warnings found.
  
  -- System Event Log ------------------------------------------------------------
  
  Event Record #/Type10644 / Warning
  Event Submitted/Written: 01/20/2008 07:50:11 AM
  Event ID/Source: 4 / bcm4sbxp
  Event Description:
  Broadcom 440x 10/100 Integrated Controller: The network link is down. Check to make sure the network cable is properly connected.
  
  Event Record #/Type10643 / Warning
  Event Submitted/Written: 01/20/2008 07:41:30 AM
  Event ID/Source: 2504 / Server
  Event Description:
  The server could not bind to the transport \Device\NetBT_Tcpip_{B83CBDDD-0703-4282-9BDD-A1A059EC3E38}.
  
  Event Record #/Type10642 / Warning
  Event Submitted/Written: 01/20/2008 07:41:28 AM
  Event ID/Source: 1007 / Dhcp
  Event Description:
  Your computer has automatically configured the IP address for the Network
  Card with network address 00C09F97FDD3. The IP address being used is 169.254.94.177.
  
  Event Record #/Type10641 / Warning
  Event Submitted/Written: 01/20/2008 07:41:21 AM
  Event ID/Source: 1003 / Dhcp
  Event Description:
  Your computer was not able to renew its address from the network (from the
  DHCP Server) for the Network Card with network address 00C09F97FDD3. The following
  error occurred:
  %%121.
  Your computer will continue to try and obtain an address on its own from
  the network address (DHCP) server.
  
  Event Record #/Type10640 / Warning
  Event Submitted/Written: 01/20/2008 07:40:53 AM
  Event ID/Source: 1003 / Dhcp
  Event Description:
  Your computer was not able to renew its address from the network (from the
  DHCP Server) for the Network Card with network address 00C09F97FDD3. The following
  error occurred:
  %%1223.
  Your computer will continue to try and obtain an address on its own from
  the network address (DHCP) server.
  
  -- End of Deckard's System Scanner: finished at 2008-01-20 07:54:13 ------------
  
  
• ndmmxiaomayi

  20 Jan 08, 18:58

  Thumbdrive virus...
  
  

  [*]Please download Flash_Disinfector and save it to your desktop.
  [*]Double click to run it.
  [*]You will be prompted to plug in your flash drive. Plug it in.
  [*]Flash_Disinfector will start disinfecting your flash and hard drives. This takes a few seconds. Your desktop will disappear in the meantime.
  [*]When done, a message box will appear. Click OK. Your desktop should now appear. If it doesn't, press Ctrl + Shift + Esc to open Task Manager.
  [*]Click on File > New Task (Run...). Type in explorer.exe and press Enter. Your desktop should now appear.

  
  
  Next...
  
  Please backup your registry before proceeding to any of the steps.
  
  Download ERUNT from Derfisch or Aumha and save it to your desktop.
  
  Follow the steps from Creating a Backup Copy of the Windows XP Registry section of this site to back up your registry: http://billjr.spaces.live.com/blog/cns!28CBD6442F406227!292.entry
  
  After backing up the registry, copy and paste the following in blue into Notepad.
  
  Windows Registry Editor Version 5.00
  
  [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winosz32]
  
  Save it as fix.reg
  
  Save As Type - Change it to All Files
  
  Then double click on this file to merge with the registry.
  
  Other than that, don't think got any other issues.
• abao

  20 Jan 08, 19:10

  i killed that before... now its just a missing registry key.
  
  thanks btw
  really appreciate your expertise.
• ndmmxiaomayi

  20 Jan 08, 21:58

  No problems.
  
  Not my expertise. Must thank the teachers teaching me.