Hmm never asked for reboot but here are the log files.
ComboFix 08-11-09.04 - Dean 2008-11-10 9:13:53.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1199 [GMT -5:00]
Running from: c:\users\Dean\Desktop\ComboFix.exe
Command switches used :: c:\users\Dean\Desktop\CFScript.txt
* Created a new restore point
FILE ::
c:\windows\System32\11219664.dll
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\ooVoo
c:\program files\ooVoo\languages\ar_sa\ooVoo.mo
c:\program files\ooVoo\languages\bg_bg\ooVoo.mo
c:\program files\ooVoo\languages\de_DE\ooVoo.mo
c:\program files\ooVoo\languages\en_US\ooVoo.mo
c:\program files\ooVoo\languages\es_ES\ooVoo.mo
c:\program files\ooVoo\languages\fr_FR\ooVoo.mo
c:\program files\ooVoo\languages\he_IL\ooVoo.mo
c:\program files\ooVoo\languages\it_IT\ooVoo.mo
c:\program files\ooVoo\languages\ja_JP\ooVoo.mo
c:\program files\ooVoo\languages\ko_KR\ooVoo.mo
c:\program files\ooVoo\languages\pl_pl\ooVoo.mo
c:\program files\ooVoo\languages\pt_PT\ooVoo.mo
c:\program files\ooVoo\languages\ru_RU\ooVoo.mo
c:\program files\ooVoo\languages\tr_tr\ooVoo.mo
c:\program files\ooVoo\languages\zh_CN\ooVoo.mo
c:\program files\ooVoo\ooVoo.exe
c:\program files\oovooToolbar
c:\program files\oovooToolbar\install.ico
c:\program files\oovooToolbar\ooVooAPI.dll
c:\program files\oovooToolbar\oovooToolbar.dll
c:\program files\oovooToolbar\toolbar.ini
c:\program files\oovooToolbar\uninstall.exe
c:\users\Dean\AppData\Roaming\ooVoo Details
c:\users\Dean\AppData\Roaming\ooVoo Details\Cache\clericman4@oovoo.com_Pic.bin
c:\users\Dean\AppData\Roaming\ooVoo Details\Cache\clericman4@oovoo.com_VCard.bin
c:\users\Dean\AppData\Roaming\ooVoo Details\Cache\glyceryl@oovoo.com_Pic.bin
c:\users\Dean\AppData\Roaming\ooVoo Details\Cache\glyceryl@oovoo.com_VCard.bin
c:\users\Dean\AppData\Roaming\ooVoo Details\Cache\jennybeans@oovoo.com_Pic.bin
c:\users\Dean\AppData\Roaming\ooVoo Details\Cache\jennybeans@oovoo.com_VCard.bin
c:\users\Dean\AppData\Roaming\ooVoo Details\Cache\moedizzle@oovoo.com_VCard.bin
c:\users\Dean\AppData\Roaming\ooVoo Details\Cache\oddinarly@oovoo.com_VCard.bin
c:\users\Dean\AppData\Roaming\ooVoo Details\Cache\phaxen@oovoo.com_Pic.bin
c:\users\Dean\AppData\Roaming\ooVoo Details\Cache\phaxen@oovoo.com_VCard.bin
c:\users\Dean\AppData\Roaming\ooVoo Details\Cache\phillydfresh@oovoo.com_VCard.bin
c:\users\Dean\AppData\Roaming\ooVoo Details\Cache\puffsindeed@oovoo.com_Pic.bin
c:\users\Dean\AppData\Roaming\ooVoo Details\Cache\puffsindeed@oovoo.com_VCard.bin
c:\users\Dean\AppData\Roaming\ooVoo Details\Cache\xtipsx@oovoo.com_VCard.bin
c:\users\Dean\AppData\Roaming\ooVoo Details\Cache\xxthiefz0rxx@oovoo.com_Pic.bin
c:\users\Dean\AppData\Roaming\ooVoo Details\Cache\xxthiefz0rxx@oovoo.com_VCard.bin
c:\users\Dean\AppData\Roaming\ooVoo Details\Users\phaxen\_Pic_Custom.bin
c:\users\Dean\AppData\Roaming\ooVoo Details\Users\phaxen\{1C1E6A4A-63A2-0000-BDA2-95E8793D2E0D}.bin
c:\users\Dean\AppData\Roaming\ooVoo Details\Users\phaxen\clericman4@oovoo.com_Pic_Custom.bin
c:\users\Dean\AppData\Roaming\ooVoo Details\Users\phaxen\MFC.Hist
c:\users\Dean\AppData\Roaming\ooVoo Details\Users\phaxen\UD.Hist
c:\users\Dean\AppData\Roaming\ooVoo Details\Users\phaxen\VCall.Hist
c:\users\Dean\AppData\Roaming\oovooToolbar
c:\users\Dean\AppData\Roaming\oovooToolbar\contact_online2.bmp
c:\users\Dean\AppData\Roaming\oovooToolbar\ErrorPageTemplate.css
c:\users\Dean\AppData\Roaming\oovooToolbar\ErrorPageTemplate_search.css
c:\users\Dean\AppData\Roaming\oovooToolbar\findfriends2.bmp
c:\users\Dean\AppData\Roaming\oovooToolbar\graphred0.bmp
c:\users\Dean\AppData\Roaming\oovooToolbar\graphred0_5.bmp
c:\users\Dean\AppData\Roaming\oovooToolbar\graphred1.bmp
c:\users\Dean\AppData\Roaming\oovooToolbar\graphred1_5.bmp
c:\users\Dean\AppData\Roaming\oovooToolbar\graphred2.bmp
c:\users\Dean\AppData\Roaming\oovooToolbar\graphred2_5.bmp
c:\users\Dean\AppData\Roaming\oovooToolbar\graphred3.bmp
c:\users\Dean\AppData\Roaming\oovooToolbar\graphred3_5.bmp
c:\users\Dean\AppData\Roaming\oovooToolbar\graphred4.bmp
c:\users\Dean\AppData\Roaming\oovooToolbar\graphred4_5.bmp
c:\users\Dean\AppData\Roaming\oovooToolbar\graphred5.bmp
c:\users\Dean\AppData\Roaming\oovooToolbar\help.gif
c:\users\Dean\AppData\Roaming\oovooToolbar\logo3.bmp
c:\users\Dean\AppData\Roaming\oovooToolbar\mail3.bmp
c:\users\Dean\AppData\Roaming\oovooToolbar\news.bmp
c:\users\Dean\AppData\Roaming\oovooToolbar\ooVootoolbartb0501.cfg
c:\users\Dean\AppData\Roaming\oovooToolbar\p_yahoo.bmp
c:\users\Dean\AppData\Roaming\oovooToolbar\phone3.bmp
c:\users\Dean\AppData\Roaming\oovooToolbar\search.bmp
c:\users\Dean\AppData\Roaming\oovooToolbar\search.gif
c:\users\Dean\AppData\Roaming\oovooToolbar\search_fr.gif
c:\users\Dean\AppData\Roaming\oovooToolbar\searchmenu.bmp
c:\users\Dean\AppData\Roaming\oovooToolbar\slider.bmp
c:\users\Dean\AppData\Roaming\oovooToolbar\tabwelcome_en.html
c:\users\Dean\AppData\Roaming\oovooToolbar\tabwelcome_fr.html
c:\users\Dean\AppData\Roaming\oovooToolbar\yahoo_search.gif
.
((((((((((((((((((((((((( Files Created from 2008-10-10 to 2008-11-10 )))))))))))))))))))))))))))))))
.
2008-11-09 16:02 . 2008-11-09 16:02 <DIR> d-------- c:\users\Dean\{a7d71c9d-cc7d-441b-9602-1c2af080e2dd}
2008-11-09 15:25 . 2008-11-09 15:26 <DIR> d-------- c:\users\Dean\{0807ebe3-3b88-47f9-92e1-6a2bc606c633}
2008-11-09 15:17 . 2008-08-23 19:11 1,486,848 --a------ c:\windows\System32\nvcuda.dll
2008-11-09 15:17 . 2008-08-23 19:11 1,269,760 --a------ c:\windows\System32\nvsvs.dll
2008-11-09 15:17 . 2008-08-23 19:11 704,512 --a------ c:\windows\System32\nvsvsr.dll
2008-11-09 15:17 . 2008-08-23 19:11 196,608 --a------ c:\windows\System32\nvvsvc.exe
2008-11-09 15:17 . 2008-08-23 19:11 122,880 --a------ c:\windows\System32\nvcodhins.dll
2008-11-09 15:17 . 2008-08-23 19:11 122,880 --a------ c:\windows\System32\nvcodh.dll
2008-11-09 15:17 . 2008-08-23 19:11 122,880 --a------ c:\windows\System32\nvcod134.dll
2008-11-03 01:40 . 2008-11-03 01:40 <DIR> d-------- c:\users\All Users\Webcammax
2008-11-03 01:40 . 2008-11-03 01:40 <DIR> d-------- c:\programdata\Webcammax
2008-11-03 01:39 . 2008-11-03 01:40 <DIR> d-------- c:\program files\WebcamMax
2008-10-27 21:16 . 2008-10-27 21:16 <DIR> d-------- c:\users\Dean\AppData\Roaming\Webcammax
2008-10-27 21:15 . 2008-03-11 08:14 941,784 --a------ c:\windows\System32\drivers\CAMTHWDM.sys
2008-10-26 14:49 . 2008-10-26 14:55 <DIR> d-------- c:\program files\IGZones
2008-10-26 14:25 . 2008-10-26 14:25 25,280 --a------ c:\windows\System32\drivers\hamachi.sys
2008-10-23 08:46 . 2008-11-06 09:42 90,632 --a------ c:\windows\System32\drivers\avgtdix.sys
2008-10-21 14:12 . 2008-09-17 21:16 2,032,640 --a------ c:\windows\System32\win32k.sys
2008-10-21 14:12 . 2008-10-01 20:32 1,383,424 --a------ c:\windows\System32\mshtml.tlb
2008-10-21 14:12 . 2008-10-01 22:49 827,392 --a------ c:\windows\System32\wininet.dll
2008-10-21 14:11 . 2008-09-18 00:09 3,601,464 --a------ c:\windows\System32\ntkrnlpa.exe
2008-10-21 14:11 . 2008-09-18 00:09 3,549,240 --a------ c:\windows\System32\ntoskrnl.exe
2008-10-21 14:06 . 2008-10-21 14:06 <DIR> d-------- c:\users\Dean\AppData\Roaming\PeerNetworking
2008-10-16 20:27 . 2008-10-16 20:40 <DIR> d-------- c:\users\Dean\AppData\Roaming\TeamViewer
2008-10-16 20:27 . 2008-10-17 12:37 <DIR> d-------- c:\program files\TeamViewer3
2008-10-16 20:26 . 2008-10-16 20:26 <DIR> d-------- c:\users\Dean\temp
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-10 04:18 --------- d-----w c:\programdata\Google Updater
2008-11-09 20:55 --------- d-----w c:\programdata\NVIDIA
2008-11-07 03:42 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-02 05:56 --------- d-----w c:\users\Dean\AppData\Roaming\NoNameScript
2008-10-30 13:46 98,440 ----a-w c:\windows\system32\drivers\avgldx86.sys
2008-10-29 21:36 --------- d-----w c:\program files\Warcraft III
2008-10-26 19:47 --------- d-----w c:\users\Dean\AppData\Roaming\Hamachi
2008-10-25 18:31 --------- d-----w c:\users\Dean\AppData\Roaming\uTorrent
2008-10-21 19:28 --------- d-----w c:\program files\Windows Mail
2008-09-26 20:47 --------- d-----w c:\program files\Hamachi
2008-09-26 04:22 --------- d-----w c:\users\Dean\AppData\Roaming\AVGTOOLBAR
2008-09-24 02:58 --------- d-----w c:\users\Dean\AppData\Roaming\Skype
2008-09-23 20:11 56 ---ha-w c:\users\All Users\ezsidmv.dat
2008-09-23 20:11 56 ---ha-w c:\programdata\ezsidmv.dat
2008-09-23 20:11 --------- d-----w c:\users\Dean\AppData\Roaming\skypePM
2008-09-23 20:00 --------- d-----w c:\programdata\Skype
2008-09-23 20:00 --------- d-----w c:\program files\Skype
2008-09-23 20:00 --------- d-----w c:\program files\Common Files\Skype
2008-09-23 17:54 0 ---ha-w c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-09-22 18:09 --------- d-----w c:\program files\Alwil Software
2008-09-20 20:51 --------- d-----w c:\users\Dean\AppData\Roaming\LimeWire
2008-09-20 20:43 --------- d-----w c:\program files\LimeWire
2008-09-20 20:41 --------- d-----w c:\programdata\Kaspersky Lab Setup Files
2008-09-20 20:32 12,936 ----a-w c:\windows\system32\drivers\avgrkx86.sys
2008-09-20 20:32 10,520 ----a-w c:\windows\System32\avgrsstx.dll
2008-09-20 20:31 --------- d-----w c:\programdata\avg8
2008-09-15 01:35 --------- d-----w c:\users\Dean\AppData\Roaming\Ventrilo
2008-09-13 04:06 --------- d-----w c:\users\Dean\AppData\Roaming\WorldShift
2008-09-13 04:06 --------- d-----w c:\users\Dean\AppData\Roaming\DAEMON Tools Pro
2008-09-13 04:05 278,984 ----a-w c:\windows\system32\drivers\atksgt.sys
2008-09-13 04:05 25,416 ----a-w c:\windows\system32\drivers\lirsgt.sys
2008-09-13 03:58 --------- d-----w c:\program files\Playlogic
2008-09-13 03:55 --------- d-----w c:\program files\DAEMON Tools Pro
2008-09-13 03:54 --------- d-----w c:\programdata\DAEMON Tools Pro
2008-09-13 03:50 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-09-12 05:09 --------- d-----w c:\program files\THQ
2008-09-11 07:10 --------- d-----w c:\programdata\Media Center Programs
2008-09-06 21:34 2,829 ----a-w c:\windows\War3Unin.pif
2008-09-06 21:34 139,264 ----a-w c:\windows\War3Unin.exe
2008-09-03 22:58 66,872 ----a-w c:\windows\System32\PnkBstrA.exe
2008-05-06 18:40 174 --sha-w c:\program files\desktop.ini
.
((((((((((((((((((((((((((((( snapshot@2008-11-09_10.14.46.20 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-11-07 01:02:09 51,200 ----a-w c:\windows\inf\infpub.dat
+ 2008-11-09 21:13:12 51,200 ----a-w c:\windows\inf\infpub.dat
- 2008-11-06 14:43:51 86,016 ----a-w c:\windows\inf\infstor.dat
+ 2008-11-09 21:13:10 86,016 ----a-w c:\windows\inf\infstor.dat
- 2008-11-07 01:02:08 143,360 ----a-w c:\windows\inf\infstrng.dat
+ 2008-11-09 21:13:12 143,360 ----a-w c:\windows\inf\infstrng.dat
- 2008-11-07 03:32:18 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-11-09 21:22:45 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
- 2008-11-09 15:12:07 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-11-10 14:17:06 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-11-10 14:17:06 262,144 ---ha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-11-08 02:18:11 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-11-10 04:18:12 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-11-08 02:18:11 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-11-10 04:18:12 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-11-08 02:18:11 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-11-10 04:18:12 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-11-09 15:06:41 262,144 ----a-w c:\windows\System32\config\systemprofile\ntuser.dat
+ 2008-11-10 14:12:19 262,144 ----a-w c:\windows\System32\config\systemprofile\ntuser.dat
+ 2008-08-24 00:11:00 795,104 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\dpinst.exe
+ 2008-08-24 00:11:00 483,328 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvapi.dll
+ 2008-08-24 00:11:00 122,880 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvcod.dll
+ 2008-08-24 00:11:00 143,360 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvcolor.exe
+ 2008-08-24 00:11:00 13,580,832 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvcpl.dll
+ 2008-08-24 00:11:00 797,216 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvcplui.exe
+ 2008-08-24 00:11:00 1,108,512 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvcpluir.dll
+ 2008-08-24 00:11:00 1,486,848 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvcuda.dll
+ 2008-08-24 00:11:00 5,963,776 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvd3dum.dll
+ 2008-08-24 00:11:00 3,996,192 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvdisps.dll
+ 2008-08-24 00:11:00 5,806,624 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvdispsr.dll
+ 2008-08-24 00:11:00 3,451,424 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvgames.dll
+ 2008-08-24 00:11:00 3,463,712 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvgamesr.dll
+ 2008-08-24 00:11:00 7,373,568 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvlddmkm.sys
+ 2008-08-24 00:11:00 236,064 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvmccs.dll
+ 2008-08-24 00:11:00 45,056 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvmccsrs.dll
+ 2008-08-24 00:11:00 195,104 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvmccss.dll
+ 2008-08-24 00:11:00 465,440 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvmccssr.dll
+ 2008-08-24 00:11:00 92,704 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvmctray.dll
+ 2008-08-24 00:11:00 1,264,160 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvmobls.dll
+ 2008-08-24 00:11:00 2,861,600 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvmoblsr.dll
+ 2008-08-24 00:11:00 9,011,200 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvoglv32.dll
+ 2008-08-24 00:11:00 612,896 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvsvc.dll
+ 2008-08-24 00:11:00 1,269,760 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvsvs.dll
+ 2008-08-24 00:11:00 704,512 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvsvsr.dll
+ 2008-08-24 00:11:00 453,152 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvudisp.exe
+ 2008-08-24 00:11:00 3,770,912 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvvitvs.dll
+ 2008-08-24 00:11:00 4,155,936 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvvitvsr.dll
+ 2008-08-24 00:11:00 196,608 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvvsvc.exe
+ 2008-08-24 00:11:00 2,502,656 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvwgf2um.dll
+ 2008-08-24 00:11:00 2,693,664 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvwss.dll
+ 2008-08-24 00:11:00 2,988,576 ----a-w c:\windows\System32\DriverStore\FileRepository\nv_disp.inf_725c6c13\nvwssr.dll
+ 2007-04-06 15:12:00 521,128 ----a-w c:\windows\System32\DriverStore\Temp\{df671fa7-5815-444f-be3f-c22f7cffff2c}\Package\dpinst.exe
+ 2007-04-06 15:12:00 4,673,536 ----a-w c:\windows\System32\DriverStore\Temp\{df671fa7-5815-444f-be3f-c22f7cffff2c}\Package\nvd3dum.dll
+ 2007-04-06 15:12:00 2,379,776 ----a-w c:\windows\System32\DriverStore\Temp\{df671fa7-5815-444f-be3f-c22f7cffff2c}\Package\nvwssr.dll
- 2008-11-07 03:35:09 101,860 ----a-w c:\windows\System32\perfc009.dat
+ 2008-11-09 21:27:03 101,860 ----a-w c:\windows\System32\perfc009.dat
- 2008-11-07 03:35:09 597,122 ----a-w c:\windows\System32\perfh009.dat
+ 2008-11-09 21:27:03 597,122 ----a-w c:\windows\System32\perfh009.dat
- 2008-11-07 03:32:24 10,090 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1750895592-24388651-1354914393-1000_UserData.bin
+ 2008-11-09 21:22:17 10,674 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1750895592-24388651-1354914393-1000_UserData.bin
- 2008-11-07 03:32:24 81,184 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-11-09 21:22:17 83,358 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-11-07 03:32:23 37,638 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-11-09 21:06:36 37,990 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"="c:\windows\system32\msconfig.exe" [2008-01-19 227840]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-10-23 1235736]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-04-06 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-04-06 8429568]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-04-06 81920]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
GammaTray.lnk - c:\program files\MagicTune Premium\GammaTray.exe [2008-05-06 36864]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
--a------ 2008-03-25 15:21 50528 c:\program files\AIM6\aim6.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG8_TRAY]
--a------ 2008-10-23 08:46 1235736 c:\progra~1\AVG\AVG8\avgtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
--a------ 2006-09-28 14:21 57344 c:\program files\SlySoft\CloneCD\CloneCDTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Pro Agent]
--a------ 2008-07-30 06:54 200136 c:\program files\DAEMON Tools Pro\DTProAgent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
--a------ 2008-06-13 17:27 2752512 c:\program files\Electronic Arts\EADM\Core.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
--a------ 2008-01-19 02:33 125952 c:\windows\ehome\ehtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2007-04-06 10:12 8429568 c:\windows\System32\nvcpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2007-04-06 10:12 81920 c:\windows\System32\nvmctray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvSvc]
--a------ 2007-04-06 10:12 86016 c:\windows\System32\nvsvc.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb]
--a------ 2008-01-07 15:02 495616 c:\program files\Winamp Remote\bin\OrbTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-05-27 09:50 413696 c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2008-08-12 16:13 21741864 c:\program files\Skype\Phone\Skype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2008-03-29 23:42 1271032 c:\program files\Steam\Steam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 c:\program files\Java\jre1.6.0_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2008-01-15 17:54 37376 c:\program files\Winamp\winampa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
--a------ 2008-01-19 02:38 1008184 c:\program files\Windows Defender\MSASCui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
--a------ 2008-01-19 02:33 202240 c:\program files\Windows Media Player\wmpnscfg.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\XboxStat]
--a------ 2007-09-26 17:05 734264 c:\program files\Microsoft Xbox 360 Accessories\XBoxStat.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowsWelcomeCenter]
--a------ 2008-01-19 02:36 2153472 c:\windows\System32\oobefldr.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{64CCAC03-679B-42C6-AE7A-EF20759E02A5}c:\\nexon\\maplestory\\maplestory.exe"= UDP:c:\nexon\maplestory\maplestory.exe:MapleStory
"UDP Query User{76218712-475F-4EBE-8131-F10BA1D486AB}c:\\nexon\\maplestory\\maplestory.exe"= TCP:c:\nexon\maplestory\maplestory.exe:MapleStory
"TCP Query User{EB4737C2-484F-4876-8DF3-0C64561D4F20}c:\\program files\\ea games\\battlefield 2\\bf2_w32ded.exe"= UDP:c:\program files\ea games\battlefield 2\bf2_w32ded.exe:bf2_w32ded
"UDP Query User{9BEF9801-4483-4C1F-A9E9-0D172FFA05C9}c:\\program files\\ea games\\battlefield 2\\bf2_w32ded.exe"= TCP:c:\program files\ea games\battlefield 2\bf2_w32ded.exe:bf2_w32ded
"TCP Query User{43560610-263D-4F4F-AE45-441D6293F3BE}c:\\program files\\ccp\\eve\\bin\\exefile.exe"= UDP:c:\program files\ccp\eve\bin\exefile.exe:CCP ExeFile
"UDP Query User{5CC37E5A-7235-441D-9448-AE5FDA178D6C}c:\\program files\\ccp\\eve\\bin\\exefile.exe"= TCP:c:\program files\ccp\eve\bin\exefile.exe:CCP ExeFile
"TCP Query User{AE6C95B1-64CB-4255-A440-37657D01990A}c:\\program files\\mirc\\uninstall.exe _=c\program files\mirc\mirc.exe"= UDP:c:\program files\mirc\uninstall.exe _=c\program files\mirc\mirc.exe:mIRC
"UDP Query User{D4AFB2BE-4BF3-46E8-824B-66BC6AA28944}c:\\program files\\mirc\\uninstall.exe _=c\program files\mirc\mirc.exe"= TCP:c:\program files\mirc\uninstall.exe _=c\program files\mirc\mirc.exe:mIRC
"{950EDD3B-8D40-4AA0-AB4F-6F3DE1F5A8CD}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{E933B1BF-3D62-4608-83C1-907EE0242D1D}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{54179456-72A7-41E1-B223-3C0974A70050}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{61BDF907-58BB-4EAD-83E3-89FAAF1C6C52}"= UDP:c:\program files\Electronic Arts\Battlefield 2142\BF2142.exe:Battlefield 2
"{6606EDBD-8B54-45F8-9020-16CC65F080CA}"= TCP:c:\program files\Electronic Arts\Battlefield 2142\BF2142.exe:Battlefield 2
"{A090A68B-1EDC-49BE-B3EB-4807AE2CE5AC}"= UDP:c:\program files\Sega\Universe At War Earth Assault\UAWEA.exe:Universe at War Earth Assault
"{3342C375-C957-4E5E-A801-5058DF0D25E4}"= TCP:c:\program files\Sega\Universe At War Earth Assault\UAWEA.exe:Universe at War Earth Assault
"{B896ACE7-4C8E-47F4-AA57-5E60F4A6D634}"= UDP:c:\program files\Sierra Entertainment\World in Conflict\wic.exe:World in Conflict
"{52997E27-DFD7-4069-B081-2B326883E009}"= TCP:c:\program files\Sierra Entertainment\World in Conflict\wic.exe:World in Conflict
"{11B5172C-9CD5-4A9D-9D71-C793D5FF01EB}"= UDP:c:\program files\Sierra Entertainment\World in Conflict\wic_online.exe:World in Conflict - Online Only
"{D9182564-D276-4075-8AE1-1FFDB920C2A8}"= TCP:c:\program files\Sierra Entertainment\World in Conflict\wic_online.exe:World in Conflict - Online Only
"{6FA4DD91-5242-4D36-AE9E-5D61B1D9CA54}"= UDP:c:\program files\Sierra Entertainment\World in Conflict\wic_ds.exe:World in Conflict - Dedicated Server
"{1B0857FA-2407-481D-9C5E-7E2283C664ED}"= TCP:c:\program files\Sierra Entertainment\World in Conflict\wic_ds.exe:World in Conflict - Dedicated Server
"{438CD315-614D-4F59-B540-F2C9CD816EE1}"= UDP:c:\program files\Winamp Remote\bin\Orb.exe:Orb
"{60152EEC-784B-46D9-B4AB-DE616B6AF7F5}"= TCP:c:\program files\Winamp Remote\bin\Orb.exe:Orb
"{16A05885-6C40-419B-9AD8-09170A7AFB79}"= UDP:c:\program files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{DFB793D0-1865-4B57-A676-CA69B309F2F6}"= TCP:c:\program files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{0F1A98FA-7B5C-4825-AE0D-C2A5A79FE305}"= UDP:c:\program files\Winamp Remote\bin\OrbIR.exe:OrbIR
"{3C1A373D-8AD5-4D6E-A0A0-0AFCD148FBA2}"= TCP:c:\program files\Winamp Remote\bin\OrbIR.exe:OrbIR
"{3EEC58BD-58A9-47E5-93EB-54CB19BED76A}"= UDP:c:\program files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
"{D58899FA-E1DA-4445-B3A3-DC5F4FC9F355}"= TCP:c:\program files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
"{4BEBF878-25BC-4074-9034-58B8EB83D9A9}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
"{FD8BB968-38E9-4358-82A6-0F5D63389517}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
"{E083792A-D115-4AC3-86CF-4D5465249009}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
"{601DB9B5-6B05-4A07-911D-E543D643DDAA}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
"{DDCABF9D-A1DC-44AE-ADED-AA68150790F1}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
"{81C21E34-E222-4D91-9D6B-3D23E6D447D0}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
"{78EA274D-4285-470A-BD0F-8752A0B87DAC}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
"{D2576619-D51B-4DBC-A7B0-0EE578EDB7A8}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
"{DE9105C2-B9B1-455A-9C37-162AB50A2480}"= UDP:c:\program files\AIM6\aim6.exe:AIM
"{C766C4B3-3AFB-434A-9412-1878E723C09A}"= TCP:c:\program files\AIM6\aim6.exe:AIM
"TCP Query User{031D6352-A9DE-4415-8C31-FA9FA90D209B}c:\\users\\dean\\program files\\utorrent\\utorrent.exe"= UDP:c:\users\dean\program files\utorrent\utorrent.exe:utorrent.exe
"UDP Query User{2C1E54DB-03E6-45FA-95F2-16478AF1F3C6}c:\\users\\dean\\program files\\utorrent\\utorrent.exe"= TCP:c:\users\dean\program files\utorrent\utorrent.exe:utorrent.exe
"{92660E8B-3266-4186-89D6-A4DDD872EFBE}"= UDP:c:\programdata\NexonUS\NGM\NGM.exe:Nexon Game Manager
"{4CCF7DE0-1EF6-462E-BEB9-9476B3F30CAC}"= TCP:c:\programdata\NexonUS\NGM\NGM.exe:Nexon Game Manager
"{A685AF62-2636-4B61-98D3-ED179DA1589C}"= UDP:c:\nexon\Combat Arms\NMService.exe:Nexon Messenger Core
"{4CAC8DA7-4924-418E-B15C-9D5B08AD068C}"= TCP:c:\nexon\Combat Arms\NMService.exe:Nexon Messenger Core
"{139D8427-79E9-4D1B-ACCD-AD902D3E9C89}"= UDP:c:\program files\Stardock Games\Sins of a Solar Empire\Sins of a Solar Empire.exe:Sins of a Solar Empire
"{4ED5E072-A613-4E26-9B81-33FCA8242381}"= TCP:c:\program files\Stardock Games\Sins of a Solar Empire\Sins of a Solar Empire.exe:Sins of a Solar Empire
"TCP Query User{DA89EAC7-E635-497A-BCD4-2791F70E0209}c:\\program files\\mirc\\mirc.exe"= UDP:c:\program files\mirc\mirc.exe:mIRC
"UDP Query User{91DB992A-AE7D-48A0-9450-CFBC6E8E0E57}c:\\program files\\mirc\\mirc.exe"= TCP:c:\program files\mirc\mirc.exe:mIRC
"{255B158F-4E39-497C-B458-2DB382CBD764}"= UDP:c:\users\Dean\Program Files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{4DE80F6E-AD15-43E1-AF66-15851E3F4107}"= TCP:c:\users\Dean\Program Files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"TCP Query User{9D30FEEF-CD6A-4BAB-8C32-E93F4BE70142}c:\\program files\\aspyr\\guitar hero iii\\gh3.exe"= UDP:c:\program files\aspyr\guitar hero iii\gh3.exe:Guitar Hero III
"UDP Query User{CEA15E7F-D713-4D11-85F7-4D83230F5F95}c:\\program files\\aspyr\\guitar hero iii\\gh3.exe"= TCP:c:\program files\aspyr\guitar hero iii\gh3.exe:Guitar Hero III
"TCP Query User{26A9B3B1-29C3-4FCA-ADD4-E45E6905714C}c:\\program files\\electronic arts\\eadm\\core.exe"= UDP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager
"UDP Query User{A34285AD-3F48-48FD-A4C2-5A7FC7FA7FC3}c:\\program files\\electronic arts\\eadm\\core.exe"= TCP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager
"{AF26ABE9-CD4B-4D68-AFBC-DF3ADDDBBD37}"= UDP:c:\program files\EA GAMES\Battlefield 2\BF2.exe:Battlefield 2
"{FC2E9B77-AA73-4518-B43F-88BC015A3056}"= TCP:c:\program files\EA GAMES\Battlefield 2\BF2.exe:Battlefield 2
"TCP Query User{14A0C5FF-55D2-4F9F-833E-D240D258B4E0}c:\\ijji\\english\\u_gbound.exe"= UDP:c:\ijji\english\u_gbound.exe:<ijji Downloader>
"UDP Query User{0E50D8E3-4BF7-4F03-834B-DB58DF0B8A05}c:\\ijji\\english\\u_gbound.exe"= TCP:c:\ijji\english\u_gbound.exe:<ijji Downloader>
"TCP Query User{596119E7-C847-42E6-B920-5E00161823C9}c:\\ijji\\english\\gunbound revolution\\gunbound.gme"= UDP:c:\ijji\english\gunbound revolution\gunbound.gme:GunBound
"UDP Query User{D8A38433-8292-4AE3-B426-B92365BA01FD}c:\\ijji\\english\\gunbound revolution\\gunbound.gme"= TCP:c:\ijji\english\gunbound revolution\gunbound.gme:GunBound
"TCP Query User{5C7713FA-4C3E-4240-8585-DF7F9E246E39}c:\\program files\\warcraft iii\\war3.exe"= UDP:c:\program files\warcraft iii\war3.exe:Warcraft III
"UDP Query User{40F3A658-0A9C-4653-B21D-4DB766DC8B7A}c:\\program files\\warcraft iii\\war3.exe"= TCP:c:\program files\warcraft iii\war3.exe:Warcraft III
"{306937A3-0FF7-4E28-AD46-1F237EDD6615}"= UDP:c:\program files\Playlogic\WorldShift\bin\WorldShift.exe:WorldShift
"{BDAB8D7D-1D88-48EC-AF4F-8A1B4CBB8A1A}"= TCP:c:\program files\Playlogic\WorldShift\bin\WorldShift.exe:WorldShift
"{DA31153D-EC44-4C55-8DC6-1BE7AE4A3F83}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe
"{F1777826-9244-45DC-A43D-EE337CF564FF}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
"{A3B28527-F5A8-4F17-A859-C47E71B495C3}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe
"{74B7AF2C-762D-4D81-8A75-7CEC786DDF1F}"= c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{13DB11B1-9497-4E5E-B06A-C3EE34977B23}c:\\program files\\warcraft iii\\war3.exe"= UDP:c:\program files\warcraft iii\war3.exe:Warcraft III
"UDP Query User{EAD11FF0-3578-42C5-A5CC-D15898E04096}c:\\program files\\warcraft iii\\war3.exe"= TCP:c:\program files\warcraft iii\war3.exe:Warcraft III
"TCP Query User{831F420F-B95D-4636-A6EA-C4B323BB96F0}c:\\program files\\electronic arts\\eadm\\core.exe"= UDP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager
"UDP Query User{D8141D13-7EEB-49BA-90B2-E09A0DCE3092}c:\\program files\\electronic arts\\eadm\\core.exe"= TCP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager
"{5E2A8198-C0BC-41B1-B359-E141F145E577}"= UDP:c:\nexon\Combat Arms\NMService.exe:Nexon Messenger Core
"{757BDA30-9D50-4CFE-8C6C-76E49650DA5A}"= TCP:c:\nexon\Combat Arms\NMService.exe:Nexon Messenger Core
"TCP Query User{6D1B0F3D-772A-474E-A593-F0575D81C440}c:\\program files\\microsoft games\\age of empires\\empiresx.exe"= UDP:c:\program files\microsoft games\age of empires\empiresx.exe:Age of Empires, the Rise of Rome
"UDP Query User{2505F921-B7EE-4DF4-8A67-5DB1B6EAA494}c:\\program files\\microsoft games\\age of empires\\empiresx.exe"= TCP:c:\program files\microsoft games\age of empires\empiresx.exe:Age of Empires, the Rise of Rome
"TCP Query User{8E7F6B57-B2B6-4494-8433-97FFC8F8D559}c:\\windows\\system32\\dplaysvr.exe"= UDP:c:\windows\system32\dplaysvr.exe:Microsoft DirectPlay Helper
"UDP Query User{7F2E59A5-2350-47FA-B2F6-FC3FAA42609B}c:\\windows\\system32\\dplaysvr.exe"= TCP:c:\windows\system32\dplaysvr.exe:Microsoft DirectPlay Helper
"TCP Query User{6AE62F6A-0D2A-426D-B65A-CBAD5CC3CCB2}c:\\program files\\microsoft games\\age of empires\\empiresx.exe"= UDP:c:\program files\microsoft games\age of empires\empiresx.exe:Age of Empires, the Rise of Rome
"UDP Query User{D6D3BB79-3F8E-401A-8946-FBC85CB639B1}c:\\program files\\microsoft games\\age of empires\\empiresx.exe"= TCP:c:\program files\microsoft games\age of empires\empiresx.exe:Age of Empires, the Rise of Rome
"TCP Query User{5B8F11F3-52B5-406F-B748-C64A03EB1B86}c:\\windows\\system32\\dplaysvr.exe"= UDP:c:\windows\system32\dplaysvr.exe:Microsoft DirectPlay Helper
"UDP Query User{F8937B95-4108-4182-AD98-EB0A167E0360}c:\\windows\\system32\\dplaysvr.exe"= TCP:c:\windows\system32\dplaysvr.exe:Microsoft DirectPlay Helper
"TCP Query User{274422AB-BD13-4451-9882-065F09FA1838}c:\\program files\\oovoo\\oovoo.exe"= UDP:c:\program files\oovoo\oovoo.exe:ooVoo
"UDP Query User{5E4FED7B-2828-4623-B4C4-CB53191968D4}c:\\program files\\oovoo\\oovoo.exe"= TCP:c:\program files\oovoo\oovoo.exe:ooVoo
"{0A9EFEA6-06ED-430B-803C-F8A53A8A6DCA}"= Disabled:UDP:443:ooVoo TCP port 443
"{B499F0E5-2A48-4A27-81F0-EEE9890788C2}"= Disabled:TCP:443:ooVoo UDP port 443
"{B62B3371-B2DA-4D24-996F-33433E7C12DB}"= Disabled:UDP:37674:ooVoo TCP port 37674
"{D01451B4-A625-480F-8AD2-1E89CEEB8C30}"= Disabled:TCP:37674:ooVoo UDP port 37674
"{F7221266-6099-4A27-8E8F-4643591C8A47}"= Disabled:TCP:37675:ooVoo UDP port 37675
"TCP Query User{7CEAE316-9B03-4428-BCEF-FE58E02BB2F5}c:\\program files\\mirc\\mirc.exe"= UDP:c:\program files\mirc\mirc.exe:mIRC
"UDP Query User{764C6A62-545C-452E-A76A-70A7CCBCEFA3}c:\\program files\\mirc\\mirc.exe"= TCP:c:\program files\mirc\mirc.exe:mIRC
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\Drivers\avgrkx86.sys [2008-09-20 12936]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-10-30 98440]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-11-06 90632]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-10-23 874776]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-09-20 231704]
R2 CAMTHWDM;WebcamMax, WDM Video Capture;c:\windows\system32\DRIVERS\CAMTHWDM.sys [2008-03-11 941784]
R2 TeamViewer;TeamViewer 3;c:\program files\TeamViewer3\TeamViewer_Service.exe [2008-10-07 185640]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
R3 xcbdaNtsc;ViXS Tuner Card (NTSC);c:\windows\system32\DRIVERS\xcbda.sys [2006-11-17 147328]
S3 PPJoyBus;Parallel Port Joystick Bus device driver;c:\windows\system32\drivers\PPJoyBus.sys [2004-10-24 13952]
S3 PPortJoystick;Parallel Port Joystick device driver;c:\windows\system32\drivers\PPortJoy.sys [2004-10-24 28800]
S3 UMPass;Microsoft UMPass Driver;c:\windows\system32\DRIVERS\umpass.sys [2008-01-19 7680]
S4 Steam Client Service;Steam Client Service;c:\program files\Common Files\Steam\SteamService.exe [2008-07-06 87288]
.
Contents of the 'Scheduled Tasks' folder
2008-11-09 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2007-08-02 08:20]
2008-09-25 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2007-08-02 08:20]
2008-11-10 c:\windows\Tasks\User_Feed_Synchronization-{9F664F7E-F9C6-4BC8-8F86-D2ED866C1F26}.job
- c:\windows\system32\msfeedssync.exe [2008-01-19 02:33]
.
- - - - ORPHANS REMOVED - - - -
BHO-{A057A204-BACC-4D26-8087-36EE87E26986} - c:\progra~1\OOVOOT~1\OOVOOT~1.DLL
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-11-10 09:17:29
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-11-10 9:19:27
ComboFix-quarantined-files.txt 2008-11-10 14:19:23
ComboFix2.txt 2008-11-09 15:16:07
Pre-Run: 164,519,657,472 bytes free
Post-Run: 164,487,311,360 bytes free
422 --- E O F --- 2008-10-21 19:19:04
And the Hijack log.
Logfile of HijackThis v1.99.1
Scan saved at 9:30:33 AM, on 11/10/2008
Platform: Unknown Windows (WinNT 6.00.1905 SP1)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Running processes:
C:\Windows\system32\Dwm.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\MagicTune Premium\GammaTray.exe
C:\Windows\system32\taskeng.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\DAEMON Tools Pro\DTProShellHlp.exe
C:\Windows\Explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Dean\Desktop\hijack\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.yahoo.comR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - Global Startup: GammaTray.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
http://fpdownload2.macromedia.com/get/s ... wflash.cabO18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - (no file)
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: MagicTuneEngine - Unknown owner - C:\Program Files\MagicTune Premium\MagicTuneEngine.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: TeamViewer 3 (TeamViewer) - Unknown owner - C:\Program Files\TeamViewer3\TeamViewer_Service.exe" -service (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
Posted: Sun Nov 09, 2008 12:09 am
