 [Resolved] antivirus 2009 infection |
Welcome Guest to What the Tech! ( Log In | Register ) We specialize in the removal of malicious software (malware), but here you'll find free help and support for all your tech questions. We invite you to ask questions, share experiences, and learn. Explore our message boards, or register now to post messages of your own. Please Start Here. Register today (registration removes advertising)
  |
 Jul 24 2008, 01:39 PM
Post
#1
|
|
|
Authentic Member  Group: Authentic Member Posts: 55 Joined: 3-February 06 From: usa Member No.: 49,758 Operating System: windows xp  |
Logfile of HijackThis v1.99.1 Scan saved at 14:19: VIRUS ALERT!, on 7/24/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\ewido anti-malware\ewidoguard.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\Rundll32.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\system32\lexpps.exe C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\WINDOWS\system32\devldr32.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Microsoft Office\Office\OSA.EXE C:\Documents and Settings\Guest\Local Settings\Temp\GLB1A2B.EXE C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe C:\Documents and Settings\Lisa Gubbels\My Documents\My Downloads\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=ytie R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?.home=ytie R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=ytie R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo! R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn16\yt.dll N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.yahoo.com"); (C:\Documents and Settings\Lisa Gubbels\Application Data\Mozilla\Profiles\default\k29j6ghe.slt\prefs.js) N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Lisa Gubbels\Application Data\Mozilla\Profiles\default\k29j6ghe.slt\prefs.js) O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn16\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {769D8280-A207-4EEA-9963-F8B156C32855} - C:\WINDOWS\system32\khfETnnO.dll (file missing) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O2 - BHO: (no name) - {E325B849-8FC5-4DD9-9C66-B903A9D1537c} - C:\WINDOWS\system32\kjqemjsy.dll (file missing) O2 - BHO: (no name) - {F4717FF6-AD7A-451F-ABF6-1A504CAB0E3C} - C:\WINDOWS\system32\ssqNFVME.dll (file missing) O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn16\yt.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [BM57c5448d] Rundll32.exe "C:\WINDOWS\system32\njwercbh.dll",s O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Startup: Event Reminder.lnk = C:\Program Files\Mindscape\PrintMaster\PMREMIND.EXE O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O8 - Extra context menu item: &Search - http://kl.bar.need2find.com/KL/menusearch.html?p=KL O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O12 - Plugin for .html: C:\Program Files\Netscape\Netscape Browser\PLUGINS\npTrident.dll O14 - IERESET.INF: START_PAGE_URL=http://www.carrollsweb.com/ O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/...nst20040510.cab O16 - DPF: {5CB1506E-1DEA-4E63-89A7-E40E52AEA1FD} (OnagerCtrl Class) - http://usfulfillment.puretracks.com/onager.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/...lscbase5036.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1101619518390 O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://download.games.yahoo.com/games/web_...inematycoon.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL O20 - Winlogon Notify: khfETnnO - khfETnnO.dll (file missing) O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing) O21 - SSODL: kvxqmtre - {DAAB9506-CC26-4F94-9BB7-579DC2FB3B8E} - C:\WINDOWS\kvxqmtre.dll (file missing) O21 - SSODL: evgratsm - {9E033D33-B970-4171-9BBD-EFCEDC8E0EE1} - C:\WINDOWS\evgratsm.dll (file missing) O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Print Spooler Service (ecado46ioi0u5) - Unknown owner - C:\WINDOWS\system32\tpokeegs.exe (file missing) O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE |
 |
 
|
|
Jul 24 2008, 02:19 PM
Post
#2
|
|
 Expert  Group: Classroom Teacher Posts: 7,281 Joined: 14-December 04 From: Ontario, Canada Member No.: 20,259 Operating System: XP Pro SP3 Vista Ultimate SP1 32 & 64 Bit  |
Hello capri2001 and welcome to the What the Tech Forums
My name is Trevuren and I will be helping you with your problem. Identity Theft It looks like you have been infected by a few Backdoor Trojans. This allows hackers to remotely control your computer, steal critical system information and Download and Execute files Its very possible that anything could have been installed on your computer by the remote attacker, including opening other backdoors and installing rootkits. While we can attempt to clean what we see in your logs, we cannot guarantee that your computer will be completely in the clear since we have no way of knowing that has been done to the computer. Your computer could be completely compromised at this moment. It may be prudent to backup your information, reformat, and reinstall. More information on Remote Access Trojans can be found here. I suggest you do the following immediately:
If, however, you decide that the computer is not used for any sensitive work, or if you do not wish to reformat at this time, I can help you clean your computer to the best of my abilities. I must remind you that i cannot guarantee that your computer will be completely clean afterwards since we have no way of knowing what has been done to it. To help you make your decision, here are a few related articles that i suggest you read:
Should you have any questions, please feel free to ask. Please let me know what you decide to do in your next post. |
|
|
|
|
Jul 24 2008, 02:40 PM
Post
#3
|
|
|
Authentic Member Group: Authentic Member Posts: 55 Joined: 3-February 06 From: usa Member No.: 49,758 Operating System: windows xp |
I would like to try to remove this infection. This computer is mainly an 'internet computer' for games music & email. Important information is usually done on our laptop. i've already changed my passwords on everything. please keep in mind that I have a dial up connection and large files take hours to download. even a small 1.6 mb = 15 min.
Oh, I lied earlier. I said spybot would crash, when in fact it was SUPERantispyware. My spybot will not open. This post has been edited by capri2001: Jul 24 2008, 03:24 PM |
|
|
|
|
Jul 24 2008, 05:23 PM
Post
#4
|
|
|
Expert Group: Classroom Teacher Posts: 7,281 Joined: 14-December 04 From: Ontario, Canada Member No.: 20,259 Operating System: XP Pro SP3 Vista Ultimate SP1 32 & 64 Bit |
Download SDFix and save it to your Desktop.
Double click SDFix.exe and it will extract the files to %systemdrive% (Drive that contains the Windows Directory, typically C:\SDFix) Please then reboot your computer in Safe Mode by doing the following :
|
|
|
|
|
Jul 24 2008, 07:56 PM
Post
#5
|
|
|
Authentic Member Group: Authentic Member Posts: 55 Joined: 3-February 06 From: usa Member No.: 49,758 Operating System: windows xp |
SDFix will not open.
|
|
|
|
|
Jul 24 2008, 08:27 PM
Post
#6
|
|
|
Expert Group: Classroom Teacher Posts: 7,281 Joined: 14-December 04 From: Ontario, Canada Member No.: 20,259 Operating System: XP Pro SP3 Vista Ultimate SP1 32 & 64 Bit |
Did you receive any error messages?
|
|
|
|
|
Jul 24 2008, 08:59 PM
Post
#7
|
|
|
Authentic Member Group: Authentic Member Posts: 55 Joined: 3-February 06 From: usa Member No.: 49,758 Operating System: windows xp |
Nope, no error message. When I click on it, I get an hourglass for about 2 seconds, then its gone.
|
|
|
|
|
Jul 24 2008, 09:21 PM
Post
#8
|
|
|
Expert Group: Classroom Teacher Posts: 7,281 Joined: 14-December 04 From: Ontario, Canada Member No.: 20,259 Operating System: XP Pro SP3 Vista Ultimate SP1 32 & 64 Bit |
Please try the following 2 solutions. Try #1 first and that does not work, then and only then, try #2:
1. Goto Start Menu > Run > then copy and paste the following line: %systemroot%\system32\cmd.exe /K %systemdrive%\SDFix\apps\FixPath.exe Click OK, then type Y and press Enter when prompted, Reboot and start SDFix again 2. If SDFix still doesnt run check the %comspec% variable: Goto Start Menu > Right click My Computer > click properties > click Advanced Click Environment Variables and check that the ComSpec variable points to cmd.exe %SystemRoot%\system32\cmd.exe |
|
|
|
|
Jul 24 2008, 09:44 PM
Post
#9
|
|
|
Authentic Member Group: Authentic Member Posts: 55 Joined: 3-February 06 From: usa Member No.: 49,758 Operating System: windows xp |
1st choice didn't work, got a 'system cannot find the path specified'.
2nd choice, comspec, looks like its correct. Sorry |
|
|
|
|
Jul 24 2008, 10:02 PM
Post
#10
|
|
|
Expert Group: Classroom Teacher Posts: 7,281 Joined: 14-December 04 From: Ontario, Canada Member No.: 20,259 Operating System: XP Pro SP3 Vista Ultimate SP1 32 & 64 Bit |
Try to download and run the following:
Please download Deckard's System Scanner (DSS) to your desktop.
Note: some firewalls may warn that sigcheck.exe is trying to access the internet - please ensure that you allow sigcheck.exe permission to do so. QUOTE What DSS will do:
Post Logs:
If it fails to run, rename the file to oliver.exe instead of DSS.exe and try to run it. |
|
|
|
|
Jul 24 2008, 10:22 PM
Post
#11
|
|
|
Authentic Member Group: Authentic Member Posts: 55 Joined: 3-February 06 From: usa Member No.: 49,758 Operating System: windows xp |
I had no problems opening this file. Deckard's System Scanner v20071014.68 Run by Lisa Gubbels on 2008-07-24 23:07:55 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 95: 2008-07-25 04:08:05 UTC - RP375 - Deckard's System Scanner Restore Point 94: 2008-07-24 08:09:31 UTC - RP374 - Removed AVG 7.5 93: 2008-07-24 06:11:39 UTC - RP373 - Installed Java™ 6 Update 7 92: 2008-07-24 05:12:20 UTC - RP372 - System Checkpoint 91: 2008-07-22 20:34:16 UTC - RP371 - Last known good configuration -- First Restore Point -- 1: 2008-07-22 20:25:40 UTC - RP281 - System Checkpoint Backed up registry hives. Performed disk cleanup. -- HijackThis (run as Lisa Gubbels.exe) ---------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:09: VIRUS ALERT!, on 7/24/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\ewido anti-malware\ewidoguard.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\devldr32.exe C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\Rundll32.exe C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Microsoft Office\Office\OSA.EXE C:\Program Files\iPod\bin\iPodService.exe C:\Documents and Settings\Lisa Gubbels\Desktop\dss.exe C:\DOCUME~1\LISAGU~1\Desktop\ANTISP~1\Lisa Gubbels.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=ytie R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?.home=ytie R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=ytie R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo! R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn16\yt.dll N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.yahoo.com"); (C:\Documents and Settings\LISA GUBBELS\Application Data\Mozilla\Profiles\default\k29j6ghe.slt\prefs.js) N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\LISA GUBBELS\Application Data\Mozilla\Profiles\default\k29j6ghe.slt\prefs.js) O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn16\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {769D8280-A207-4EEA-9963-F8B156C32855} - C:\WINDOWS\system32\khfETnnO.dll (file missing) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O2 - BHO: (no name) - {E325B849-8FC5-4DD9-9C66-B903A9D1537c} - C:\WINDOWS\system32\kjqemjsy.dll (file missing) O2 - BHO: (no name) - {F4717FF6-AD7A-451F-ABF6-1A504CAB0E3C} - C:\WINDOWS\system32\ssqNFVME.dll (file missing) O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn16\yt.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [BM57c5448d] Rundll32.exe "C:\WINDOWS\system32\njwercbh.dll",s O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [MS Remote Procedure Call] msrpc32.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [Microsoft SCVHOST32 Protocol] scvhost32.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [Messenger Upgrade] Msnmgs.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [Microsoft Data Machine] csdata32.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [MS Remote Procedure Call] msrpc32.exe (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [Microsoft Data Machine] csdata32.exe (User 'Default user') O4 - Startup: Event Reminder.lnk = C:\Program Files\Mindscape\PrintMaster\PMREMIND.EXE O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O8 - Extra context menu item: &Search - http://kl.bar.need2find.com/KL/menusearch.html?p=KL O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .html: C:\Program Files\Netscape\Netscape Browser\PLUGINS\npTrident.dll O14 - IERESET.INF: START_PAGE_URL=http://www.carrollsweb.com/ O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/...nst20040510.cab O16 - DPF: {5CB1506E-1DEA-4E63-89A7-E40E52AEA1FD} (OnagerCtrl Class) - http://usfulfillment.puretracks.com/onager.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/...lscbase5036.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1101619518390 O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://download.games.yahoo.com/games/web_...inematycoon.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL O20 - Winlogon Notify: khfETnnO - khfETnnO.dll (file missing) O21 - SSODL: kvxqmtre - {DAAB9506-CC26-4F94-9BB7-579DC2FB3B8E} - C:\WINDOWS\kvxqmtre.dll (file missing) O21 - SSODL: evgratsm - {9E033D33-B970-4171-9BBD-EFCEDC8E0EE1} - C:\WINDOWS\evgratsm.dll (file missing) O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Print Spooler Service (ecado46ioi0u5) - Unknown owner - C:\WINDOWS\system32\tpokeegs.exe (file missing) O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE -- End of file - 9286 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 ewido security suite driver - c:\program files\ewido anti-malware\guard.sys R1 SASDIFSV - c:\program files\superantispyware\sasdifsv.sys R3 SASENUM - c:\program files\superantispyware\sasenum.sys <Not Verified; SuperAdBlocker, Inc.; SuperAntiSpyware> R4 AVG Anti-Spyware Driver - c:\program files\grisoft\avg anti-spyware 7.5\guard.sys (file missing) R4 AvgAsCln (AVG Anti-Spyware Clean Driver) - c:\windows\system32\drivers\avgascln.sys (file missing) S3 wanatw (WAN Miniport (ATW)) - c:\windows\system32\drivers\wanatw4.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service> R2 ewido security suite guard - c:\program files\ewido anti-malware\ewidoguard.exe <Not Verified; ewido networks; guard> S2 ecado46ioi0u5 (Print Spooler Service) - c:\windows\system32\tpokeegs.exe /service (file missing) -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: 1394 Net Adapter Device ID: V1394\NIC1394\1001C1A710800 Manufacturer: Microsoft Name: 1394 Net Adapter PNP Device ID: V1394\NIC1394\1001C1A710800 Service: NIC1394 -- Scheduled Tasks ------------------------------------------------------------- 2008-07-24 22:24:01 256 --a------ C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job 2008-07-24 16:16:18 464 --a------ C:\WINDOWS\Tasks\EasyShare Registration RunOnce Task.job 2008-07-22 07:15:03 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job 2008-07-18 16:33:00 450 --a------ C:\WINDOWS\Tasks\EasyShare Registration Task.job 2008-06-06 20:35:00 400 --ah----- C:\WINDOWS\Tasks\{54C53962-0908-4242-85CB-3E4D91A3F061}_LISA_Lisa Gubbels.job -- Files created between 2008-06-24 and 2008-07-24 ----------------------------- 2008-07-24 16:55:15 0 d-------- C:\Program Files\spybot 2008-07-24 02:16:49 0 d-------- C:\Documents and Settings\Guest\Application Data\SUPERAntiSpyware.com 2008-07-24 01:53:42 0 d-------- C:\Program Files\Windows Live Safety Center 2008-07-23 04:32:55 0 d-------- C:\Program Files\Antivirus 2009 2008-07-22 15:37:22 118784 --a------ C:\WINDOWS\system32\fmsjukrw.dll 2008-07-22 15:35:13 103424 --a------ C:\WINDOWS\system32\njwercbh.dll 2008-07-22 15:25:19 639 --ahs---- C:\WINDOWS\system32\EMVFNqss.ini2 2008-07-22 15:18:19 33152 --a------ C:\WINDOWS\system32\rqRIYolj.dll 2008-07-22 15:17:32 0 d-------- C:\Documents and Settings\Lisa Gubbels\Application Data\TmpRecentIcons 2008-07-22 15:17:17 163840 --a------ C:\WINDOWS\erms.exe 2008-07-22 15:17:16 155648 --a------ C:\WINDOWS\agpqlrfm.exe 2008-07-16 20:48:00 1747 --a------ C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache 2008-07-01 18:18:44 23 --a------ C:\Documents and Settings\Lisa Gubbels\jagex_runescape_preferences.dat -- Find3M Report --------------------------------------------------------------- 2008-07-24 20:04:05 39 --a------ C:\WINDOWS\popcinfot.dat 2008-07-24 03:31:04 19589 --a----c- C:\WINDOWS\mozver.dat 2008-07-24 03:09:51 0 d-------- C:\Documents and Settings\Lisa Gubbels\Application Data\AVG7 2008-07-24 01:52:08 117456 --a------ C:\logfile 2008-07-22 21:27:43 0 d-------- C:\Program Files\ewido anti-malware 2008-07-11 00:09:45 0 d-------- C:\Program Files\CA Yahoo! Anti-Spy 2008-07-06 22:03:30 0 d-------- C:\Program Files\Lexmark X1100 Series 2008-06-27 10:59:02 0 d-------- C:\Documents and Settings\Lisa Gubbels\Application Data\AdobeUM 2008-06-15 19:44:07 0 d-------- C:\Program Files\BlueVoda Website Builder 2008-06-15 19:42:20 737280 --a------ C:\WINDOWS\iun6002.exe <Not Verified; Indigo Rose Corporation; Setup Factory 6.0 Runtime Module> 2008-05-26 03:05:41 0 d-------- C:\Program Files\Common Files\Scanner 2008-05-26 03:05:28 0 d-------- C:\Program Files\Yahoo! -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{769D8280-A207-4EEA-9963-F8B156C32855}] C:\WINDOWS\system32\khfETnnO.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E325B849-8FC5-4DD9-9C66-B903A9D1537c}] C:\WINDOWS\system32\kjqemjsy.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F4717FF6-AD7A-451F-ABF6-1A504CAB0E3C}] C:\WINDOWS\system32\ssqNFVME.dll [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{4E7BD74F-2B8D-469E-86BD-FD60BB9AAE3A}"= C:\PROGRA~1\BFGTOO~1\BFGTOO~1.DLL [04/28/2005 16:42: VIRUS ALERT! 1274880] [-HKEY_CLASSES_ROOT\CLSID\{4E7BD74F-2B8D-469E-86BD-FD60BB9AAE3A}] [HKEY_CLASSES_ROOT\bfgtoolbar.BFGTOOLBAR] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Lexmark X1100 Series"="C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" [08/19/2003 09:43: VIRUS ALERT!] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [06/29/2007 06:24: VIRUS ALERT!] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [09/14/2007 10:00: VIRUS ALERT!] "BM57c5448d"="C:\WINDOWS\system32\njwercbh.dll" [07/22/2008 15:35: VIRUS ALERT!] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [04/15/2008 01:00: VIRUS ALERT!] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [01/19/2007 12:54: VIRUS ALERT!] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [03/30/2006 17:45: VIRUS ALERT!] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 02:56: VIRUS ALERT!] [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "Microsoft Data Machine"=csdata32.exe [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "MS Remote Procedure Call"=msrpc32.exe "Microsoft SCVHOST32 Protocol"=scvhost32.exe "Messenger Upgrade"=Msnmgs.exe C:\Documents and Settings\Lisa Gubbels\Start Menu\Programs\Startup\ Event Reminder.lnk - C:\Program Files\Mindscape\PrintMaster\PMREMIND.EXE [9/30/2007 11:59:34 PM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Microsoft Find Fast.lnk - C:\Program Files\Microsoft Office\Office\FINDFAST.EXE [8/19/1997] Office Startup.lnk - C:\Program Files\Microsoft Office\Office\OSA.EXE [8/19/1997] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) "DisableTaskMgr"=0 (0x0) "NoDispCPL"=1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoToolbarCustomize"=0 (0x0) "StartMenuLogoff"=1 (0x1) "NoStartMenuMorePrograms"=1 (0x1) "NoSetFolders"=1 (0x1) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [12/20/2006 12:55: VIRUS ALERT! 77824] "{769D8280-A207-4EEA-9963-F8B156C32855}"= C:\WINDOWS\system32\khfETnnO.dll [ ] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "kvxqmtre"= {DAAB9506-CC26-4F94-9BB7-579DC2FB3B8E} - C:\WINDOWS\kvxqmtre.dll [ ] "evgratsm"= {9E033D33-B970-4171-9BBD-EFCEDC8E0EE1} - C:\WINDOWS\evgratsm.dll [ ] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL 04/15/2008 01:00: VIRUS ALERT! 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\khfETnnO] khfETnnO.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\ssqNFVME [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices-] "Microsoft Data Machine"=csdata32.exe "fukerservice"=fukerz.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b43056c3-d379-11d8-b038-806d6172696f}] AutoRun\command- E:\install.EXE id= ver=1.0.0.0 -- Hosts ----------------------------------------------------------------------- 127.0.0.1 www.007guard.com 127.0.0.1 007guard.com 127.0.0.1 008i.com 127.0.0.1 www.008k.com 127.0.0.1 008k.com 127.0.0.1 www.00hq.com 127.0.0.1 00hq.com 127.0.0.1 010402.com 127.0.0.1 www.032439.com 127.0.0.1 032439.com 7967 more entries in hosts file. -- End of Deckard's System Scanner: finished at 2008-07-24 23:11:35 ------------ Deckard's System Scanner v20071014.68 Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft Windows XP Home Edition (build 2600) SP 2.0 Architecture: X86; Language: English CPU 0: Intel® Pentium® 4 CPU 2.00GHz Percentage of Memory in Use: 59% Physical Memory (total/avail): 511.3 MiB / 209.35 MiB Pagefile Memory (total/avail): 1504.55 MiB / 1179.17 MiB Virtual Memory (total/avail): 2047.88 MiB / 1942.59 MiB A: is Removable (No Media) C: is Fixed (NTFS) - 93.15 GiB total, 75 GiB free. D: is CDROM (No Media) E: is CDROM (UDF) \\.\PHYSICALDRIVE0 - WDC WD1000BB-00CAA1 - 93.16 GiB - 1 partition \PARTITION0 (bootable) - Installable File System - 93.15 GiB - C: -- Security Center ------------------------------------------------------------- AUOptions is scheduled to auto-install. Windows Internal Firewall is enabled. AntivirusOverride is set. [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Grisoft\\AVG Free\\avgw.exe"="C:\\Program Files\\Grisoft\\AVG Free\\avgw.exe:*:Enabled:AVG Free Edition for Windows" "C:\\Program Files\\ewido anti-malware\\SecuritySuite.exe"="C:\\Program Files\\ewido anti-malware\\SecuritySuite.exe:*:Enabled:ewido anti-malware" "C:\\Program Files\\Gateway\\HPA\\GWMenu.exe"="C:\\Program Files\\Gateway\\HPA\\GWMenu.exe:*:Enabled:GW Recovery Program" "C:\\Program Files\\InterActual\\InterActual Player\\iPlayer.exe"="C:\\Program Files\\InterActual\\InterActual Player\\iPlayer.exe:*:Enabled:InterActual Player" "C:\\Program Files\\Netscape\\Netscape Browser\\netscape.exe"="C:\\Program Files\\Netscape\\Netscape Browser\\netscape.exe:*:Enabled:Netscape Browser" "C:\\Program Files\\Ares Lite Edition\\AresLite.exe"="C:\\Program Files\\Ares Lite Edition\\AresLite.exe:*:Disabled:AresLite" "C:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe"="C:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe:*:Disabled:BearShare" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Lavasoft\\Ad-Aware SE Personal\\Ad-Aware.exe"="C:\\Program Files\\Lavasoft\\Ad-Aware SE Personal\\Ad-Aware.exe:*:Enabled:Ad-Aware SE Personal" "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" "C:\\Program Files\\Kazaa\\kazaa.exe"="C:\\Program Files\\Kazaa\\kazaa.exe:*:Disabled:Kazaa" "C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"="C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe:*:Enabled:EasyShare" "C:\\WINDOWS\\system32\\LEXPPS.EXE"="C:\\WINDOWS\\system32\\LEXPPS.EXE:*:Disabled:LEXPPS.EXE" "C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox" "C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe"="C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe:*:Enabled:AVG Anti-Spyware" "C:\\Program Files\\SUPERAntiSpyware\\SUPERANTISPYWARE.EXE"="C:\\Program Files\\SUPERAntiSpyware\\SUPERANTISPYWARE.EXE:*:Enabled:SUPERAntiSpyware Free Edition" "C:\\Program Files\\ABBYY FineReader 5.0 Sprint\\Sprint.exe"="C:\\Program Files\\ABBYY FineReader 5.0 Sprint\\Sprint.exe:*:Enabled:ABBYY FineReader 5.0 Sprint" "C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"="C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe:*:Disabled:Kodak Software Updater" "C:\\Program Files\\Netscape\\Netscape\\Netscp.exe"="C:\\Program Files\\Netscape\\Netscape\\Netscp.exe:*:Disabled:Navigator" "C:\\Program Files\\Disney\\Disney Online\\PiratesOnline\\Launcher1.exe"="C:\\Program Files\\Disney\\Disney Online\\PiratesOnline\\Launcher1.exe:*:Disabled:Pirates of the Caribbean Online" "C:\\Program Files\\Real\\RealPlayer\\trueplay.exe"="C:\\Program Files\\Real\\RealPlayer\\trueplay.exe:*:Disabled:RealOne Player" "C:\\Program Files\\Winamp\\winamp.exe"="C:\\Program Files\\Winamp\\winamp.exe:*:Disabled:Winamp" "C:\\Program Files\\xerox\\nwwia\\xrxftplt.exe"="C:\\Program Files\\xerox\\nwwia\\xrxftplt.exe:*:Disabled:XrxFTPLt Application" -- Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\Lisa Gubbels\Application Data CLASSPATH=.;C:\Program Files\Java\jre1.6.0_02\lib\ext\QTJava.zip CLIENTNAME=Console CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=HENRY ComSpec=C:\WINDOWS\system32\cmd.exe FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Documents and Settings\Lisa Gubbels LOGONSERVER=\\HENRY NUMBER_OF_PROCESSORS=1 OS=Windows_NT Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\QuickTime\QTSystem\ PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 15 Model 2 Stepping 4, GenuineIntel PROCESSOR_LEVEL=15 PROCESSOR_REVISION=0204 ProgramFiles=C:\Program Files PROMPT=$P$G QTJAVA=C:\Program Files\Java\jre1.6.0_02\lib\ext\QTJava.zip SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\LISAGU~1\LOCALS~1\Temp TMP=C:\DOCUME~1\LISAGU~1\LOCALS~1\Temp USERDOMAIN=HENRY USERNAME=Lisa Gubbels USERPROFILE=C:\Documents and Settings\Lisa Gubbels windir=C:\WINDOWS -- User Profiles --------------------------------------------------------------- Lisa Gubbels (admin) Administrator (admin) Guest (guest) -- Add/Remove Programs --------------------------------------------------------- --> C:\Program Files\Common Files\Real\Update_OB\rnuninst.exe RealNetworks|RealPlayer|6.0 --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf ABBYY FineReader 5.0 Sprint --> MsiExec.exe /X{D1696920-9794-4BBC-8A30-7A88763DE5A2} Ad-Aware SE Personal --> C:\PROGRA~1\Lavasoft\AD-AWA~1\UNWISE.EXE C:\PROGRA~1\Lavasoft\AD-AWA~1\INSTALL.LOG Adobe Flash Player 9 ActiveX --> C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe Adobe Flash Player Plugin --> C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe Adobe Reader 7.0.9 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70900000002} Adobe Shockwave Player --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log Amazon MP3 Downloader 1.0.3 --> C:\Program Files\Amazon\MP3 Downloader\Uninstall.exe Apple Mobile Device Support --> MsiExec.exe /I{3EBD3749-304E-4A4C-9575-C00E5F015217} Apple Software Update --> MsiExec.exe /I{B74F042E-E1B9-4A5B-8D46-387BB172F0A4} Aquatic of Sherwood --> "C:\Program Files\Realore\Aquatic of Sherwood\unins000.exe" BlueVoda Website Builder 10.12 --> C:\WINDOWS\iun6002.exe "C:\Program Files\BlueVoda Website Builder\irunin.ini" Bob the Builder --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{36373CE1-6999-11D5-96DC-98302790D441}\setup.exe" Bookworm Adventures Deluxe 1.0 --> C:\Program Files\PopCap Games\Bookworm Adventures Deluxe\PopUninstall.exe "C:\Program Files\PopCap Games\Bookworm Adventures Deluxe\Install.log" CA Yahoo! Anti-Spy (remove only) --> "C:\Program Files\CA Yahoo! Anti-Spy\uninstall.exe" CCScore --> MsiExec.exe /I{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992} Compatibility Pack for the 2007 Office system --> MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE} Coupon Printer for Windows --> "C:\Program Files\Coupons\uninstall.exe" "/U:C:\Program Files\Coupons\Uninstall\uninstall.xml" Curious George Demo v1.0 --> "C:\Program Files\Namco\Curious George Demo\uninstall.exe" Curious George Screen Saver --> C:\WINDOWS\system32\Curious George.scr /u Day-and-Night Screen Saver --> C:\WINDOWS\system32\Day-and-Night.scr /u Desktop Weather by The Weather Channel --> C:\PROGRA~1\THEWEA~1\DESKTO~1\UNWISE.EXE C:\PROGRA~1\THEWEA~1\DESKTO~1\INSTALL.LOG Disney Pirates of the Caribbean Online --> C:\Program Files\Disney\Disney Online\PiratesOnline\uninst.exe DVD Decoder Pak for Windows XP --> MsiExec.exe /X{92C5DB3D-9D6F-4324-BB11-57825F4C2635} EA.com Matchup --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2F173C40-563E-11D4-89C5-0010ADDAAC33}\setup.exe" -l0x0 Uninstall EA.com Update --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9AB97F52-512B-43EF-AAEC-4825C17B32ED}\setup.exe" -l0x0 Uninstall eMusic - 50 Free MP3 offer --> "C:\Program Files\Winamp\eMusic\Uninst-eMusic-promotion.exe" ESSBrwr --> MsiExec.exe /I{643EAE81-920C-4931-9F0B-4B343B225CA6} ESSCDBK --> MsiExec.exe /I{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD} ESScore --> MsiExec.exe /I{42938595-0D83-404D-9F73-F8177FDD531A} ESSgui --> MsiExec.exe /I{91517631-A9F3-4B7C-B482-43E0068FD55A} ESSini --> MsiExec.exe /I{8E92D746-CD9F-4B90-9668-42B74C14F765} ESSPCD --> MsiExec.exe /I{14D4ED84-6A9A-45A0-96F6-1753768C3CB5} ESSPDock --> MsiExec.exe /I{FCDB1C92-03C6-4C76-8625-371224256091} ESSSONIC --> MsiExec.exe /I{073F22CE-9A5B-4A40-A604-C7270AC6BF34} ESSTOOLS --> MsiExec.exe /I{8A502E38-29C9-49FA-BCFA-D727CA062589} essvatgt --> MsiExec.exe /I{2D03B6F8-DF36-4980-B7B6-5B93D5BA3A8F} ewido anti-malware --> C:\Program Files\ewido anti-malware\Uninstall.exe Feeding Frenzy 2 1.0 --> C:\Program Files\PopCap Games\Feeding Frenzy 2\PopUninstall.exe "C:\Program Files\PopCap Games\Feeding Frenzy 2\Install.log" fflink --> MsiExec.exe /I{608D2A3C-6889-4C11-9B54-A42F45ACBFDB} Finding Nemo: Nemo's Underwater World of Fun Special Edition --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{77FCC1D4-E78E-46A4-80A6-7F456FA9AC90} NemoUWF2Uninstall Free Mp3 Wma Converter V 1.7.2 --> "C:\Program Files\Free Audio Pack\unins000.exe" Frogger v3.0e --> C:\WINDOWS\SCEEunin.exe C:\WINDOWS\Froggersetup.ini Gateway Drivers and Applicati |