pc slow, tried the usual....

jassi_9

Hi my pc has started to run slowly over the last few weeks...

i have run cc cleaner, scanned with avg (which didnt find much) and im currently using the latest version of kapersky....

im running an older intel celeron 2.79, 480 mb ram, xp sp 3.

What are my options? system restore, re-format hard-drive, or maybe add more ram?

the pc just runs slowly to be honest, im thinking of adding more ram, but im unsure which type i need to buy and where from, and also how much i can/should add......if this is indeed what i need to do?!

any advice would be really helpful, thanks..

4743hudsonj

Try here

If you don't want to upgrade to a new pc all together then RAM is the way to go, at least 1GB is advisable if possible. The scanner on the site will tell you al you need to know about what ram you need. Post back with the details though as they are not always the cheapest for RAM.

Laz123

You say it's started to run slower so it wouldn't indicate it's not only a ram issue, but that would certainly help.

Personally I format and reinstall xp at least once a year. It's a pain because the operation takes about a day to get the os up to scratch with updates, and longer to redo all progs. But it's worth it because the pc runs smoothly.

To be honest it's quicker than flaffing about for days on end trying to tinker.

aliEnRIK

You definitely need more ram

Aside from that ~
Download MALWAREBYTES (Make sure you click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_malwarebytes_anti_malware/
Open malwarebytes and goto UPDATE and click 'check for updates'. After its updated goto SCANNER and click PERFORM FULL SCAN then click SCAN
Post the log COMPLETE here AFTER youve deleted everything it finds


reboot

Download HIJACK THIS (Make sure you click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_hijackthis/
Click DO A SCAN AND SAVE A LOGFILE (Takes seconds) then post the log so we can see whats running
(do NOT do anything else with Hijack but scan and post the FULL log)

jaydeeuk1

Blow some of your MB profit on a new PC ya tight git

Or buy a stick of 512mb (probably DDR) ram, and do what 'rik says

In fact, pm your addess and I'll mail over a couple of sticks. Have about a terrabyte lying around the office!

jassi_9

4743hudsonj wrote: »

Try here

If you don't want to upgrade to a new pc all together then RAM is the way to go, at least 1GB is advisable if possible. The scanner on the site will tell you al you need to know about what ram you need. Post back with the details though as they are not always the cheapest for RAM.

thanks mate i did the scan and it said this:

Maximum Memory Capacity: 2048MB
Currently Installed Memory: 512MB
Available Memory Slots: 2
Total Memory Slots: 3
Dual Channel Support: No
CPU Manufacturer: GenuineIntel
CPU Family: Intel(R) Celeron(R) CPU 2.80GHz Model 2, Stepping 9
CPU Speed: 2788 MHz



it is saying £15.51 for another 512mb

£26.44 for 1GB (making it 1.5GB in total)

£52.88 for 2GB (removing the original 512mb)

is that a good price, and what can my system handle running xp, sp 3?

aliEnRIK: i will try what you suggested this evening after the footy, so thanks for that mate.

JayDeeUK1: What are you doing in this section! lol....i have already bought a new 2.8ghz dual coare, 4gb ram...and that is being installed this weekend too!!

thanks for all the help guys.....

ihatebt_2

If it's slowed down over the last few weeks, then that states it was previously ok, to state the obvious.

Some quick things to check:
- Did you install anything? Did that slow it down?
- Check Device Manager to see if anything is taking up a lot of processor/memory and act accordingly
- Check system logs to see if your hard drive has errors

Hint: Google is your friend.

jassi_9

Alienrik here are the results of the malware scan (i deleted everything in quarantine about 10 files):

Malwarebytes' Anti-Malware 1.42
Database version: 3303
Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512
06/12/2009 13:50:32
mbam-log-2009-12-06 (13-50-32).txt
Scan type: Full Scan (A:\|C:\|D:\|)
Objects scanned: 238674
Time elapsed: 1 hour(s), 50 minute(s), 1 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)


i am now about to re-boot and run the "highjack this" program, will post the results here whent its done..

thanks

jassi_9

ok i just ran hijack this and here are the results:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:11:26, on 06/12/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.blueyonder.co.uk/search/search.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://dial.blueyonder.co.uk
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.blueyonder.co.uk/search/search.jsp
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://dogpile.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by blueyonder
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKCU\..\RunServices: [Regmgr] scvhost.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Regmgr] scvhost.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunServices: [Regmgr] scvhost.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunServices: [Regmgr] scvhost.exe (User 'Default user')
O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: InterCasino £££ - {03588886-5C50-4645-BD5D-F105F84417DE} - http://www.intercasino.co.uk/ (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: InterCasino £££ - {03588886-5C50-4645-BD5D-F105F84417DE} - http://www.intercasino.co.uk/ (file missing) (HKCU)
O9 - Extra button: InterCasino $$$ - {909AAEB6-C2CB-4AB5-A7BB-C33B72AB4BFB} - http://www.intercasino.com (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: InterCasino $$$ - {909AAEB6-C2CB-4AB5-A7BB-C33B72AB4BFB} - http://www.intercasino.com (file missing) (HKCU)
O9 - Extra button: Playboy Casino GBP - {C8B54920-5DFB-11DB-B0DE-0800200C9A66} - http://www.playboycasino.com (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Playboy Casino GBP - {C8B54920-5DFB-11DB-B0DE-0800200C9A66} - http://www.playboycasino.com (file missing) (HKCU)
O9 - Extra button: Playboy Casino USD - {D62F3523-3F8C-4F1B-B888-FAEE3F4B8CF2} - http://www.playboycasino.com (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Playboy Casino USD - {D62F3523-3F8C-4F1B-B888-FAEE3F4B8CF2} - http://www.playboycasino.com (file missing) (HKCU)
O10 - Broken Internet access because of LSP provider 'c:\windows\system32\lspwbq.dll' missing
O14 - IERESET.INF: START_PAGE_URL=http://dial.blueyonder.co.uk
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1113481971343
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9BF607E0-4CC1-4099-9A07-362C9E4FB090} - http://live.pdbox.co.kr:8057/WStarter.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {CA11EB7C-1C85-4577-8A49-9E28EFB30184} - http://www.umediaserver.net/bin/UMediaControl4.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} - http://ps.itv.mop.com/update/update/GUpdate-1.0.0.10-signed.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
--
End of file - 8082 bytes

aliEnRIK

What items were in quarantine, and how long have they been there?

TICK these in hijack and click to FIX them ~
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O9 - Extra button: InterCasino £££ - {03588886-5C50-4645-BD5D-F105F84417DE} - http://www.intercasino.co.uk/ (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: InterCasino £££ - {03588886-5C50-4645-BD5D-F105F84417DE} - http://www.intercasino.co.uk/ (file missing) (HKCU)
O9 - Extra button: InterCasino $$$ - {909AAEB6-C2CB-4AB5-A7BB-C33B72AB4BFB} - http://www.intercasino.com (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: InterCasino $$$ - {909AAEB6-C2CB-4AB5-A7BB-C33B72AB4BFB} - http://www.intercasino.com (file missing) (HKCU)
O9 - Extra button: Playboy Casino GBP - {C8B54920-5DFB-11DB-B0DE-0800200C9A66} - http://www.playboycasino.com (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Playboy Casino GBP - {C8B54920-5DFB-11DB-B0DE-0800200C9A66} - http://www.playboycasino.com (file missing) (HKCU)
O9 - Extra button: Playboy Casino USD - {D62F3523-3F8C-4F1B-B888-FAEE3F4B8CF2} - http://www.playboycasino.com (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Playboy Casino USD - {D62F3523-3F8C-4F1B-B888-FAEE3F4B8CF2} - http://www.playboycasino.com (file missing) (HKCU)
O16 - DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} - http://ps.itv.mop.com/update/update/....10-signed.cab

Run LSPFIX (Somethings not quite right with your internet) ~
http://www.cexx.org/LSPFix.exe

then ~
Please run COMBOFIX

Shut down your anti virus
Follow the simple instructions it gives
Post the COMPLETE log it creates here (Split into sections if need be)

If it comes up with a RENAMING error then RIGHT click the exe file and RENAME and call it QWERTY (Making the complete file name 'QWERTY.exe') Or SAVE as 'QWERTY' on download

jassi_9

hi mate this is the full log that combo fix gave me:

ComboFix 09-12-05.06 - r d 06/12/2009 14:56.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.479.243 [GMT 0:00]
Running from: c:\documents and settings\r d\Desktop\qwerty.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\recycler\S-1-5-21-11671569-2779650084-2115268048-1003
C:\test.txt
c:\windows\system32\MabryObj.dll
.
((((((((((((((((((((((((( Files Created from 2009-11-06 to 2009-12-06 )))))))))))))))))))))))))))))))
.
2009-12-06 14:10 . 2009-12-06 14:10

---

d

---

w- c:\program files\Trend Micro
2009-12-06 11:46 . 2009-12-03 16:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-06 11:46 . 2009-12-03 16:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-06 11:46 . 2009-12-06 11:47

---

d

---

w- c:\program files\Malwarebytes' Anti-Malware
2009-12-05 14:47 . 2009-12-05 14:47 2944 ---hatw- c:\windows\system32\muIO.sys
2009-11-12 12:17 . 2009-12-06 15:15 466976 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-11-12 12:17 . 2009-12-06 15:15 3125280 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-11-12 12:17 . 2009-11-12 12:17

---

d

---

w- c:\program files\Kaspersky Lab
2009-11-10 10:54 . 2009-12-05 02:23

---

d

---

w- c:\documents and settings\r d\Application Data\Skype
2009-11-10 10:52 . 2009-11-10 10:52

---

d

---

w- c:\program files\Common Files\Skype
2009-11-10 10:52 . 2009-11-10 10:53

---

d

---

r- c:\program files\Skype
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-06 15:20 . 2008-10-09 10:13

---

d

---

w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-12-06 15:15 . 2009-11-12 12:17 2676 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-12-06 15:15 . 2009-11-12 12:17 25496 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-12-05 12:16 . 2009-08-09 13:07 1 ----a-w- c:\documents and settings\r d\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys
2009-12-05 12:16 . 2008-06-05 01:13

---

d

---

w- c:\documents and settings\r d\Application Data\OpenOffice.org2
2009-12-04 22:25 . 2008-08-19 15:40

---

d

---

w- c:\documents and settings\r d\Application Data\skypePM
2009-11-23 02:59 . 2008-08-04 21:57

---

d

---

w- c:\program files\PFG FX Trader
2009-11-20 13:38 . 2008-12-06 00:00

---

d

---

w- c:\documents and settings\r d\Application Data\VSO
2009-11-13 16:01 . 2008-07-05 00:10

---

d

---

w- c:\program files\HOTALBUMMyBOX
2009-11-10 10:52 . 2008-08-19 15:35

---

d

---

w- c:\documents and settings\All Users\Application Data\Skype
2009-11-09 22:54 . 2009-10-23 15:49

---

d

---

w- c:\program files\eToro
2009-11-05 19:19 . 2008-05-06 13:33

---

d

---

w- c:\program files\Spybot - Search & Destroy
2009-11-05 19:19 . 2005-12-12 13:19

---

d

---

w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-11-05 11:02 . 2009-11-05 11:02

---

d

---

w- c:\documents and settings\r d\Application Data\Malwarebytes
2009-11-05 11:02 . 2009-11-05 11:02

---

d

---

w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-05 10:51 . 2009-11-05 10:51

---

d

---

w- c:\program files\Alwil Software
2009-11-05 10:42 . 2009-11-03 17:38

---

d

---

w- c:\documents and settings\All Users\Application Data\McAfee
2009-11-05 09:43 . 2009-11-03 17:52

---

d

---

w- c:\documents and settings\All Users\Application Data\SiteAdvisor
2009-11-04 22:47 . 2009-11-04 22:47

---

d

---

w- c:\documents and settings\LocalService\Application Data\SACore
2009-11-02 17:21 . 2009-11-02 17:21

---

d

---

w- c:\program files\AVG
2009-09-25 05:37 . 2005-02-18 15:19 667136 ----a-w- c:\windows\system32\wininet.dll
2009-09-25 05:37 . 2004-08-04 07:56 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-09-17 12:00 . 2006-01-25 14:51 52488 ----a-w- c:\documents and settings\r d\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-11 14:18 . 2002-09-19 20:26 136192 ----a-w- c:\windows\system32\msv1_0.dll
2008-10-30 23:55 . 2008-02-05 15:05 11776 ----a-w- c:\program files\new job cover letter2008.wps
2008-08-23 13:49 . 2008-08-23 13:49 5126750 ----a-w- c:\program files\TVUPlayer.zip
2008-08-23 13:41 . 2008-08-23 13:41 3328542 ----a-w- c:\program files\SopCast.zip
2008-06-10 09:48 . 2008-06-10 09:48 20405 ----a-w- c:\program files\newcvlatest.rtf
2008-06-09 13:27 . 2008-06-09 13:27 22776 ----a-w- c:\program files\bobnewcvl&gnew.odt
2008-03-14 22:26 . 2008-03-14 22:26 37375 ----a-w- c:\program files\openoffice.org-xsltfilter.cab
2008-03-14 22:26 . 2008-03-14 22:26 2489204 ----a-w- c:\program files\openoffice.org-writer.cab
2008-03-14 22:26 . 2008-03-14 22:26 207388 ----a-w- c:\program files\openoffice.org-testtool.cab
2008-03-14 22:26 . 2008-03-14 22:26 2504855 ----a-w- c:\program files\openoffice.org-pyuno.cab
2008-03-14 22:26 . 2008-03-14 22:26 51973 ----a-w- c:\program files\openoffice.org-onlineupdate.cab
2008-03-14 22:26 . 2008-03-14 22:26 1090334 ----a-w- c:\program files\openoffice.org-math.cab
2008-03-14 22:25 . 2008-03-14 22:25 118910 ----a-w- c:\program files\openoffice.org-javafilter.cab
2008-03-14 22:25 . 2008-03-14 22:25 1254017 ----a-w- c:\program files\openoffice.org-impress.cab
2008-03-14 22:25 . 2008-03-14 22:25 86870 ----a-w- c:\program files\openoffice.org-graphicfilter.cab
2008-03-14 22:25 . 2008-03-14 22:25 2769 ----a-w- c:\program files\openoffice.org-emailmerge.cab
2008-03-14 22:25 . 2008-03-14 22:25 919329 ----a-w- c:\program files\openoffice.org-draw.cab
2008-03-14 22:25 . 2008-03-14 22:25 2031954 ----a-w- c:\program files\openoffice.org-core09.cab
2008-03-14 22:25 . 2008-03-14 22:25 293054 ----a-w- c:\program files\openoffice.org-core08.cab
2008-03-14 22:25 . 2008-03-14 22:25 3842531 ----a-w- c:\program files\openoffice.org-core07.cab
2008-03-14 22:25 . 2008-03-14 22:25 28861971 ----a-w- c:\program files\openoffice.org-core06.cab
2008-03-14 22:21 . 2008-03-14 22:21 18636793 ----a-w- c:\program files\openoffice.org-core05.cab
2008-03-14 22:19 . 2008-03-14 22:19 16453751 ----a-w- c:\program files\openoffice.org-core04.cab
2008-03-14 22:18 . 2008-03-14 22:18 9118219 ----a-w- c:\program files\openoffice.org-core03.cab
2008-03-14 22:18 . 2008-03-14 22:18 3860200 ----a-w- c:\program files\openoffice.org-core02.cab
2008-03-14 22:18 . 2008-03-14 22:18 15102497 ----a-w- c:\program files\openoffice.org-core01.cab
2008-03-14 22:17 . 2008-03-14 22:17 4696905 ----a-w- c:\program files\openoffice.org-calc.cab
2008-03-14 22:17 . 2008-03-14 22:17 1802028 ----a-w- c:\program files\openoffice.org-base.cab
2008-03-14 22:17 . 2008-03-14 22:17 43005 ----a-w- c:\program files\openoffice.org-activex.cab
2008-03-14 22:17 . 2008-03-14 22:17 217 ----a-w- c:\program files\setup.ini
2008-03-14 22:17 . 2008-03-14 22:17 4372992 ----a-w- c:\program files\openofficeorg24.msi
2008-01-29 13:49 . 2008-01-29 13:49 7339 ----a-w- c:\program files\rnewcvl&gnoaddress.rtf
2008-01-17 16:05 . 2008-01-17 15:37 10752 ----a-w- c:\program files\new job cover letter.wps
2008-01-11 12:35 . 2008-01-11 12:12 7448 ----a-w- c:\program files\rnewcvl&g.doc
2008-01-11 12:01 . 2007-08-08 15:24 7516 ----a-w- c:\program files\r cv julie pincher new2 latest.doc.rtf
2008-01-11 11:58 . 2007-08-08 15:16 7998 ----a-w- c:\program files\r cv new1 latest.rtf
2007-11-17 01:06 . 2007-11-17 01:05 206143560 ----a-w- c:\program files\UBCD4WinV306.exe
2007-08-08 14:22 . 2007-08-07 16:14 8801 ----a-w- c:\program files\r cv new latest.doc
2007-08-07 16:13 . 2006-10-19 11:10 7930 ----a-w- c:\program files\r cv latest.doc.rtf
2006-10-20 12:48 . 2006-10-20 12:48 7557 ----a-w- c:\program files\rCurriculumvitaenewversion2.doc
2006-10-18 15:53 . 2006-08-17 14:24 7713 ----a-w- c:\program files\rCurriculumvitae new 1.doc.rtf
2006-03-24 10:55 . 2006-03-24 10:55 33280 ----a-w- c:\program files\rCurriculumvitae.doc
2006-03-22 13:55 . 2006-03-22 13:55 14208 ----a-w- c:\program files\rcv[1][1].doc.rtf
2006-03-20 16:15 . 2006-03-20 16:06 6986 ----a-w- c:\program files\rcv.doc.rtf
2006-03-16 12:21 . 2006-03-16 12:15 9216 ----a-w- c:\program files\CVDisplay.aspx
2006-02-28 19:40 . 2006-02-28 19:40 529 ----a-w- c:\program files\sol_now5a_bb.asx
2006-02-25 15:12 . 2006-02-25 15:12 625 ----a-w- c:\program files\stv.asx
2006-02-08 20:39 . 2006-02-08 19:40 437 ----a-w- c:\program files\espn.asx
2006-02-08 11:12 . 2006-02-07 15:28 726626806 ----a-w- c:\program files\Steven Gerrard -My Story
2006-02-08 04:06 . 2006-02-07 18:10 705067008 ----a-w- c:\program files\Zinedine Zidane - Comme dans un Rave.avi
2006-02-07 13:57 . 2006-02-07 13:57 56254 ----a-w- c:\program files\steven gerrard my story.torrent
2006-02-04 22:23 . 2006-02-04 22:23 2417608 ----a-w- c:\program files\Super_Internet_TV_6[1].2___Patch.rar
2006-01-23 12:52 . 2006-01-23 12:52 155117072 ----a-w- c:\program files\diego maradona.wmv
2006-01-23 11:56 . 2006-01-23 11:56 34165669 ----a-w- c:\program files\ronaldhino.zip
2006-01-23 11:17 . 2006-01-23 11:17 27059281 ----a-w- c:\program files\steven gerarrd.zip
2002-03-11 09:06 . 2002-03-11 09:06 1822520 ----a-w- c:\program files\instmsiw.exe
2002-03-11 08:45 . 2002-03-11 08:45 1708856 ----a-w- c:\program files\instmsia.exe
2005-06-03 09:54 . 2005-06-03 09:54 56 --sha-r- c:\windows\system32\87215C1791.sys
2005-06-03 09:54 . 2005-06-03 09:54 1682 --sha-w- c:\windows\system32\KGyGaAvL.sys
.

---

Sigcheck

---

[-] 2005-01-28 12:44 . 140EF97B64F560FD78643CAE2CDAD838 . 25088 . . [10.0.3790.3802] . . c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MsPMSNSv.dll
[-] 2005-01-28 12:44 . 140EF97B64F560FD78643CAE2CDAD838 . 25088 . . [10.0.3790.3802] . . c:\windows\system32\mspmsnsv.dll
[-] 2004-08-04 07:56 . C086483E3DBA8C1C0A687EC8D5B3D4C1 . 52224 . . [9.0.1.56] . . c:\windows\ServicePackFiles\i386\mspmsnsv.dll
[-] 2002-11-26 20:03 . 36678803A8030EE9A771935CFC1848BD . 52224 . . [9.0.1.56] . . c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\MsPMSNSv.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4