Slow internet connection, Help please!

[as_118]

Hi. I'm suffering from slow internet connection for 2 months already.

I have contact my ISP about it, but they say my connection have no problem.

I tried to use Kaspersky Internet Security 7.0 to scan my comp. and got no virus detected. (with def. file up-to date)

Then I used SUPERAntiSpyware Free version to have a complete scan in Safe mode, still also cannot find anything. (with def. file up-to date)

It is very annoying when you have slow internet... I cannot use MSNIM and check e-mail... please help! ><

I did got warning from KIS 7.0 told me that i got hacker's attack, but it got protected.

I did also found that my IE 7.0's homepage being changed 2 days ago, but I don't know why...

here is my HJT report (scan when all IE closed and disconnect internet)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:31:09, on 16/6/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\sistray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live 登入小幫手 - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Foxy 下載 - res://C:\Program Files\Foxy\Foxy.exe/download.htm
O8 - Extra context menu item: Foxy 搜尋 - res://C:\Program Files\Foxy\Foxy.exe/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java 主控台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: 網頁防護統計 - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1203754248937
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 4497 bytes

Please help! ><

[Jintan]

Welcome to HijackThis.de as_118,

No infection showing here. the log shows "?????" in some places, which usually indicates a non-English version of XP. What language is your copy there? I do see Windows Live. I have had a few requests that were actually just situations related to the installation of that, such as it changing the homepage to it's own Live page. How long have you had that installed?

[as_118]

Hi Jintan. Thank you for reading this entry.

I'm using XP Chinese Traditional (Hong Kong) version and my MSN installed for about 3 months.

The IE homepage changed to an china web which is not related to Live page... I have changed it back to about:blank and it didn't change back again.

I don't know why I have such a slow internet connection... the ISP provides me 6Mb bandwidth... but I always suffering from slow connection... that's why I scared that I got infections of troj. / spyware... which controled my internet activities...

[Jintan]

I am on a system with language packs installed and can see the Chinese characters in the log now. Let's take a more detailed look at things.


To keep them from interfering with the repairs, be sure to temporarily disable all antivirus/anti-spyware softwares while these steps are being completed. This can usually be done through right clicking the software's Taskbar icons, or accessing each software through Start - Programs.


Download Deckard's System Scanner (dss.exe) to your Desktop. Note: You must be logged onto an account with administrator privileges.

Making sure dss.exe is directly on your desktop, go to Start - Run, and copy/paste the following (then press OK):

"%userprofile%\desktop\dss.exe" /config

When the DSS Configuration display opens click the "Check All" button (if the "Uncheck All" button shows, click that, then click "Check All"). Next, Under Main Log, uncheck the following:

System Restore
Temp Cleanup
Process Modules

Then under Options, place a check next to the following:

Backup Registry Hives

Don't make any other changes at this time. Then click the "Scan!" button to start the scan.

Once the scan has completed a textbox will appear - copy/paste those contents back here (main.txt). Also a second text file, extra.txt, will show as minimized in your Task Bar. Maximize/Open this, and copy/paste those contents back here along with the main.txt please. (The logs can also be found in the C:\Deckard\System Scanner folder)

You can use extra posts here if needed for that.


If the "Run" command does not work due to the system language differences, use this instead (I mentally thank Mosaic1 each time I need this):

Open Notepad (Start - Run, type Notepad then press OK), and copy the following and paste it into the open Notepad textbox.

Dim Wshshell, Desk
Set Wshshell = Wscript.CreateObject("Wscript.shell")
Desk = Wshshell.RegRead("HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Desktop") & "\"
Wshshell.run Chr(34)  & Desk  & "dss.exe" & Chr(34) & " /config"

Save this to your desktop as "dssrun.vbs"

Be sure to include the "" quotes in the name. Then click on dssrun.vbs and the Deckards display should open.

[as_118]

Sorry Jintan about the late reply... i have been busying with school works these days...

I can't post the log here as when i post more then a certain words... it cannot load the post reply page...

I can't upload it to the free file hosting website too...

what can I do?

[Jintan]

You can break it into parts, and use extra posts. See how this person did it here for an example of that.

[as_118]

Sorry Jintan... I still cannot post the logs at home...

I will try to upload both main.txt and extra.txt here tomorrow at my friends computer... sorry for the delay once again... :'[

[Jintan]

If you get them posted we can then assess maybe why so many difficulties from your computer and address them first.

[as_118]

If you get them posted we can then assess maybe why so many difficulties from your computer and address them first.

Dear Jintan, Here are my logs:

Thanks.

[Jintan]

Let's post those here in the thread:

Deckard's System Scanner v20071014.68
Run by ³¯µÏ on 2008-06-26 10:17:39
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Backed up registry hives.



-- HijackThis (run as ³¯µÏ.exe) --------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:18:11, on 26/6/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\sistray.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\³¯µÏ\®à*±\dss.exe
C:\WINDOWS\system32\conime.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\³¯µÏ.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live µn¤J¤pÀ°¤â - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Foxy ¤U¸ü - res://C:\Program Files\Foxy\Foxy.exe/download.htm
O8 - Extra context menu item: Foxy ·j´M - res://C:\Program Files\Foxy\Foxy.exe/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java ¥D±±¥x - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: ºô*¶¨¾Å@²Î*p - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1203754248937
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 4478 bytes

-- File Associations -----------------------------------------------------------

.cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R2 npkcrypt - c:\program files\gamania\maplestory\npkcrypt.sys <Not Verified; INCA Internet Co., Ltd.; nProtect KeyCrypt Driver>
R3 npkcusb - c:\program files\gamania\maplestory\npkcusb.sys <Not Verified; INCA Internet Co., Ltd.; nProtect KeyCrypt Driver>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 EPSONStatusAgent2 (EPSON Printer Status Agent2) - c:\program files\common files\epson\ebapi\sagent2.exe <Not Verified; SEIKO EPSON CORPORATION; EPSON Bidirectional Printer>

S3 ServiceLayer - "c:\program files\pc connectivity solution\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution>


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A}
Description: Nokia 3500c
Device ID: ROOT\WPD\0000
Manufacturer: Nokia
Name: Nokia 3500c
PNP Device ID: ROOT\WPD\0000
Service: WUDFRd


-- Scheduled Tasks -------------------------------------------------------------

2008-06-22 22:00:00 340 --a------ C:\WINDOWS\Tasks\SmartDefrag.job


-- Files created between 2008-05-26 and 2008-06-26 -----------------------------

2008-06-26 10:16:45 0 dr-h----- C:\Documents and Settings\³¯µÏ\Recent
2008-06-19 20:44:16 0 d-------- C:\Program Files\TeamViewer3
2008-06-16 18:03:02 0 d-------- C:\Documents and Settings\Administrator\Application Data\Teleca
2008-06-16 18:02:58 0 d-------- C:\Documents and Settings\Administrator\Application Data\Sony Ericsson
2008-06-16 17:47:28 0 d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
2008-06-16 17:42:26 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-06-16 17:42:22 0 d-------- C:\Program Files\SUPERAntiSpyware
2008-06-16 17:42:22 0 d-------- C:\Documents and Settings\³¯µÏ\Application Data\SUPERAntiSpyware.com
2008-06-16 17:42:07 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-06-15 22:36:07 0 d-------- C:\Program Files\Trend Micro
2008-06-06 15:51:52 0 d-------- C:\WINDOWS\pss
2008-06-05 00:08:33 0 d-------- C:\WINDOWS\Prefetch
2008-06-05 00:04:10 0 d-------- C:\Documents and Settings\All Users\¡u¶}©l¡v
2008-06-05 00:03:13 0 d-------- C:\WINDOWS\system32\zh-cht
2008-06-05 00:03:13 0 d-------- C:\WINDOWS\system32\bits
2008-06-05 00:03:13 0 d-------- C:\WINDOWS\l2schemas
2008-06-04 23:42:58 110592 -----n--- C:\WINDOWS\system32\TVMode.dll <Not Verified; Silicon Integrated Systems Corporation; TVModeLib Dynamic Link Library>
2008-06-04 23:42:58 65536 -----n--- C:\WINDOWS\system32\SiSHook.dll <Not Verified; Silicon Integrated Systems Corporation; SiSHook Dynamic Link Library>
2008-06-04 23:42:58 135168 -----n--- C:\WINDOWS\system32\SiSApCom.dll <Not Verified; Silicon Integrated Systems Corporation; SiSApCom Dynamic Link Library>
2008-06-04 23:42:55 262144 --a------ C:\WINDOWS\system32\sistray.exe <Not Verified; Silicon Integrated Systems Corporation; SiS (R) Compatible Super VGA SiSTray application>
2008-06-04 23:42:47 53248 --a------ C:\WINDOWS\system32\SiSPower.dll <Not Verified; Silicon Integrated Systems Corporation; SiS (R) Power Scheme Library>
2008-06-04 23:42:47 208896 --a------ C:\WINDOWS\Progress.exe <Not Verified; ; Progress Application>
2008-06-04 23:42:47 49152 --a------ C:\WINDOWS\InstFunc.exe
2008-06-04 23:42:47 12288 --a------ C:\WINDOWS\InstFunc.dll <Not Verified; Silicon Integrated Systems Corporation; SiS (R) VGA Install Function Dynamic Link Library>
2008-06-04 23:42:32 0 d-------- C:\Program Files\SiS VGA Utilities V3.84
2008-06-04 23:25:53 0 d-------- C:\Program Files\CCleaner
2008-06-04 22:01:42 0 d-------- C:\Documents and Settings\³¯µÏ\Application Data\TeamViewer
2008-06-04 22:01:33 0 d-------- C:\Documents and Settings\³¯µÏ\temp
2008-05-30 15:16:02 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-29 21:55:43 0 d-------- C:\Documents and Settings\Administrator\Application Data\Adobe
2008-05-29 21:01:09 0 d-------- C:\Documents and Settings\Administrator\Favorites
2008-05-29 21:01:09 0 d--hs---- C:\Documents and Settings\Administrator\Cookies
2008-05-29 21:01:09 0 dr-h----- C:\Documents and Settings\Administrator\Application Data
2008-05-29 21:01:09 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2008-05-29 21:01:08 0 d-------- C:\Documents and Settings\Administrator\®à*±
2008-05-29 21:01:08 0 d--h----- C:\Documents and Settings\Administrator\Templates
2008-05-29 21:01:08 0 dr-h----- C:\Documents and Settings\Administrator\SendTo
2008-05-29 21:01:08 0 d--h----- C:\Documents and Settings\Administrator\Recent
2008-05-29 21:01:08 0 d--h----- C:\Documents and Settings\Administrator\PrintHood
2008-05-29 21:01:08 786432 --ah----- C:\Documents and Settings\Administrator\NTUSER.DAT
2008-05-29 21:01:08 0 d--h----- C:\Documents and Settings\Administrator\NetHood
2008-05-29 21:01:08 0 d-------- C:\Documents and Settings\Administrator\My Documents
2008-05-29 21:01:08 0 d--h----- C:\Documents and Settings\Administrator\Local Settings
2008-05-29 21:01:08 0 dr------- C:\Documents and Settings\Administrator\¡u¶}©l¡v¥\¯àªí
2008-05-26 16:33:25 0 d--h----- C:\WINDOWS\PIF
2008-05-26 16:14:01 0 d-------- C:\Documents and Settings\³¯µÏ\Application Data\WinRAR


-- Find3M Report ---------------------------------------------------------------

2008-06-20 17:17:03 0 d-------- C:\Documents and Settings\³¯µÏ\Application Data\Mozilla
2008-06-17 23:55:59 0 d-------- C:\Documents and Settings\³¯µÏ\Application Data\OpenOffice.org2
2008-06-16 17:42:07 0 d-------- C:\Program Files\Common Files
2008-06-11 21:56:17 0 d-------- C:\Program Files\Foxy
2008-06-05 00:15:53 216576 --a------ C:\WINDOWS\system32\uxtheme.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows(R) Operating System>
2008-06-05 00:11:03 275598 --a------ C:\WINDOWS\system32\prfh0404.dat
2008-06-05 00:11:03 79392 --a------ C:\WINDOWS\system32\prfc0404.dat
2008-06-05 00:03:25 0 d-------- C:\Program Files\Messenger
2008-06-05 00:03:13 0 d-------- C:\Program Files\Movie Maker
2008-06-05 00:01:10 0 d-------- C:\Program Files\Windows NT
2008-06-04 23:43:00 0 d-------- C:\Program Files\sisagp
2008-06-04 23:42:55 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-06-04 23:24:15 0 d-------- C:\Program Files\Windows Live
2008-05-27 18:31:41 10 --a------ C:\WINDOWS\popcinfo.dat
2008-05-22 21:11:34 1160 --a------ C:\WINDOWS\mozver.dat
2008-05-22 21:09:36 0 --a------ C:\WINDOWS\nsreg.dat
2008-04-18 21:28:16 720896 --a------ C:\WINDOWS\iun6002.exe <Not Verified; Indigo Rose Corporation; Setup Factory 6.0 Runtime Module>
2008-03-27 22:12:18 348160 --a------ C:\WINDOWS\system32\msvcr71.dll <Not Verified; Microsoft Corporation; MicrosoftR Visual Studio .NET>
2008-03-27 22:12:18 499712 --a------ C:\WINDOWS\system32\msvcp71.dll <Not Verified; Microsoft Corporation; MicrosoftR Visual Studio .NET>


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion \Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [03/08/2004 22:32]
"PHIME2002ASync"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP. exe" [14/04/2008 22:01]
"PHIME2002A"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP. exe" [14/04/2008 22:01]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [28/06/2007 12:51]
"SoundMan"="SOUNDMAN.EXE" [16/04/2007 15:28 C:\WINDOWS\soundman.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [09/07/2001 11:50]
"SiSPower"="SiSPower.dll" [20/03/2008 18:58 C:\WINDOWS\system32\SiSPower.dll]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [14/04/2008 22:00]

[HKEY_USERS\.default\software\microsoft\windows\currentversio n\run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog

C:\Documents and Settings\All Users\¡u¶}©l¡v¥\¯àªí\µ{¦¡¶°\±Ò°Ê\
Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2008/6/4 ¤U¤È 11:42:55]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\ policies\explorer]
"NoMovingBands"=0 (0x0)
"NoCloseDragDropBands"=0 (0x0)
"NoSetTaskbar"=0 (0x0)
"NoToolbarsOnTaskbar"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion \Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [13/05/2008 10:13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 19/04/2007 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
C:\WINDOWS\System32\dimsntfy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.d ll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot \Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot \Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
eapsvcs eaphost
dot3svc dot3svc

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
napagent
hkmsvc




-- End of Deckard's System Scanner: finished at 2008-06-26 10:20:50 ------------