jun23
Hi,
I've tried renaming the file to userinit.old but it says that a file already exists with that name.
What should I do?
Thanks,
Jun
Spyware / Malware / Virus Removal
[Resolved] what happened? (failtechie)
51 min read
oldman960
Hi Jun23,
That's interesting. Use Systemlook again with this script.
Thanks
That's interesting. Use Systemlook again with this script.
- Double-click SystemLook.exe to run it.
- Copy the content of the following codebox into the main textfield
- Do not copy the word CODE , please note the script starts with the :
filefind userinit.* :file c:\windows\system32\userinit.*
- Click the Look button to start the scan.
- When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Thanks
jun23
Hi,
here's the log from systemlook
SystemLook v1.0 by jpshortstuff (22.05.09)
Log created at 16:10 on 01/07/2009 by HP_Owner (Administrator - Elevation successful)
No Context: filefind
No Context: userinit.
========== file ==========
c:\windows\system32\userinit. - Unable to find/read file.
-=End Of File=-
oldman960
Hi Jun23,
Something is playing with us and the SystemLook script I gave you wasn't quite right.
Use SystemLook again with this script
Please go back to the previous instructions for copying the file, This time when renaming the file use userinit.ooo.
Stop if you are unable to rename it.
Let us know how you made out and post the SystemLook log.
Thanks
Something is playing with us and the SystemLook script I gave you wasn't quite right.
Use SystemLook again with this script
- Copy the content of the following codebox into the main textfield
- make sure the script ends with the *
- Do not copy the word CODE , please note the script starts with the :
:filefind userinit.*
Please go back to the previous instructions for copying the file, This time when renaming the file use userinit.ooo.
Stop if you are unable to rename it.
Let us know how you made out and post the SystemLook log.
Thanks
oldman960
Hi Jun23,
You still with us?
Thanks
jun23
Hi, sorry about replying so late.
I've copied the file userinit.exe onto the disc but i cant see the file on the disc using the infected computer.
I've tried using a different computer to copy the file but it said something about encoutering a problem when copying the file.
I have renamed the userinit file on the infected computer to userinit.ooo without any problems.
This is the log from Systemlook
SystemLook v1.0 by jpshortstuff (22.05.09)
Log created at 11:50 on 05/07/2009 by HP_Owner (Administrator - Elevation successful)
========== filefind ==========
Searching for "userinit."
No files found.
-=End Of File=-
oldman960
Hi Jun23,
That shows we can at least rename the file.
Until we can get a new copy of the file onto the infected machine, I'll have you rename userinit.ooo back to userinit.exe
Next, on the infected machine,
Open a new Notepad session
In the notepad
You will have a new file on your desktop called look.bat with an icon that looks like this bat.PNG
Double click look.bat to run it. When it's finished a notepad called log.txt should open. It can also be found in Windows Explorer at C:\
Please post the contents of that notepad.
Can you use a different machine to check for the presence of userinit.exe on the CD?
Thanks
That shows we can at least rename the file.
Until we can get a new copy of the file onto the infected machine, I'll have you rename userinit.ooo back to userinit.exe
Next, on the infected machine,
Open a new Notepad session
- Click the Start button, click run
- in the run box type notepad
- click ok
- In the notepad, Click "Format" and be certain that Word Wrap is not checked.
- Copy and paste all the text in the code box below into the Notepad.
PEV -l "%systemdrive%\userinit.*" > C:\log.txt notepad C:\log.txt
In the notepad
- Click File, Save as…, and set the Save in to your Desktop
- In the filename box, type (including quotation marks) as the filename: "look.bat"
- Click save
You will have a new file on your desktop called look.bat with an icon that looks like this bat.PNG
Double click look.bat to run it. When it's finished a notepad called log.txt should open. It can also be found in Windows Explorer at C:\
Please post the contents of that notepad.
Can you use a different machine to check for the presence of userinit.exe on the CD?
Thanks
jun23
Hi,
Earlier on the file didnt show up on the disc when I used the computer, and its showing now. Sorry for confusion.
Should I continue with the instructions from earlier on?
Here is the log from look.bat
Entries: 0 (0)
Directories: 0 Files: 0
Bytes: 0 Blocks: 0
oldman960
Hi Jun23,
That's ok.
Lot's of strange goings on. Let's try one more search before proceeding.
Use SystemLook with this script
Please post the log.
Thanks
That's ok.
Lot's of strange goings on. Let's try one more search before proceeding.Use SystemLook with this script
:filefind *userinit*
Please post the log.
Thanks
jun23
Hi,
here is the log from system look
SystemLook v1.0 by jpshortstuff (22.05.09)
Log created at 17:21 on 07/07/2009 by HP_Owner (Administrator - Elevation successful)
========== filefind ==========
Searching for "userinit"
No files found.
-=End Of File=-
oldman960
Hi Jun23,
This really getting strange. Just for clarification
Also was the file in the system32 folder?
On the infected machine please use Internet Explorer for this
Right click the attached file
Locate user.zip on your desktop
Please locate seek.bat,
Double click seek.bat to run it. Don't do any thing else.
You may see a black window, then shortly afterwards a notepad called pevv.txt should open. It can also be found in Windows Explorer at C:\
Next double click seek1.bat . A note pad called filefind.txt should open. It can also be found in Windows Explorer at C:\
Please post the contents of both notepads in your next reply.
Thanks
This really getting strange. Just for clarification
This is in reference to the first time you tried to rename the file. Was it on the infected computer?I've tried renaming the file to userinit.old but it says that a file already exists with that name.
Also was the file in the system32 folder?
On the infected machine please use Internet Explorer for this
Right click the attached file
- user.zip
- Click Save Target AS
- set the Save in box to Desktop
- Click Save
Locate user.zip on your desktop
- Right click user.zip
- select Extract here
Please locate seek.bat,
Double click seek.bat to run it. Don't do any thing else.
You may see a black window, then shortly afterwards a notepad called pevv.txt should open. It can also be found in Windows Explorer at C:\
Next double click seek1.bat . A note pad called filefind.txt should open. It can also be found in Windows Explorer at C:\
Please post the contents of both notepads in your next reply.
Thanks
jun23
Hi,
Yes, it was definitely in the system32 folder on the infected computer that I couldnt rename the file.
This is the pevv.txt from seek.bat
——w- 11,113 2004-08-04 03:00:00 C:\WINDOWS\I386\USERINIT.EX_
—-a-w- 3,428 2009-06-30 15:06:17 C:\WINDOWS\Prefetch\USERINIT.EXE-0743FDA9.pf
—-a-w- 24,576 2004-08-04 03:00:00 C:\WINDOWS\system32\userinit.exe
—-a-w- 8,704 2009-03-05 07:45:55 C:\WINDOWS\system32\userinit.old.exe
—-a-w- 24,576 2004-08-04 03:00:00 C:\WINDOWS\system32\userinit.ooo.exe
-c–a-w- 24,576 2004-08-04 03:00:00 C:\WINDOWS\system32\dllcache\userinit.exe
Entries: 6 (6)
Directories: 0 Files: 6
Bytes: 96,973 Blocks: 190
This is the filefind.txt from seek.bat1
c:\windows\i386\userinit.ex_
c:\windows\prefetch\userinit.exe-0743fda9.pf
c:\windows\system32\userinit.exe
c:\windows\system32\userinit.old.exe
c:\windows\system32\userinit.ooo.exe
c:\windows\system32\dllcache\userinit.exe
oldman960
Hi Jun23,
Those logs show that there is a good copy of the file on the infected computer, so we won't need to copy the new file.
Please follow these new instructions.
On the infected machine
Please disable this program and leave it disabled untill we are done.
SPYBOT TEATIMER
Next
Open hijackthis, do a system scan only and checkmark these lines, if present
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7070
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;
Close ALL other windows/browsers and click Fix Checked. Answer Yes if prompted. Close HJT.
Next
Please read through the instructions to familiarize yourself with what to expect when the tool runs.
Combofix is updated regularly, we will use a fresh copy.
Locate combofix.exe on your desktop, it has a icon that looks like a cat. Please right click it and select delete.
Download a new copy from one of the following links
Link 1
Link 2
Link 3
* IMPORTANT !!! Save ComboFix.exe to your Desktop
Notes:
1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do Not run combofix more than once. If you have problems please post back for further instructions.
3.CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Please post back with
Thanks
Those logs show that there is a good copy of the file on the infected computer, so we won't need to copy the new file.
Please follow these new instructions.
On the infected machine
Please disable this program and leave it disabled untill we are done.
SPYBOT TEATIMER
- Launch Spybot S&D, go to the Mode menu and make sure "Advanced Mode" is selected.
- On the left hand side, click on Tools, then click on the Resident Icon in the list.
- Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
- Click on the "System Startup" icon in the List
- Uncheck the "TeaTimer" box and "OK" any prompts.
- If Teatimer gives you a warning that changes were made, click the "Allow Change" box when prompted.
- Exit Spybot S&D when done.
- (When we are done, you can re-enable Teatimer using the same steps but this time place a check next to "Resident TeaTimer" and check the "TeaTimer" box in System Startup.]
Next
Open hijackthis, do a system scan only and checkmark these lines, if present
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7070
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;
Close ALL other windows/browsers and click Fix Checked. Answer Yes if prompted. Close HJT.
Next
Please read through the instructions to familiarize yourself with what to expect when the tool runs.
Combofix is updated regularly, we will use a fresh copy.
Locate combofix.exe on your desktop, it has a icon that looks like a cat. Please right click it and select delete.
Download a new copy from one of the following links
Link 1
Link 2
Link 3
* IMPORTANT !!! Save ComboFix.exe to your Desktop
- Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
- Double click on ComboFix.exe & follow the prompts. Close all other windows/browser first.
Notes:
1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do Not run combofix more than once. If you have problems please post back for further instructions.
3.CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Please post back with
- combofix log
Thanks
oldman960
Hi Jun23,
You still with us?
jun23
Hi,
Here is the log from combo fix
ComboFix 09-07-12.01 - HP_Owner 12/07/2009 22:30.2.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.44.1033.18.511.318 [GMT 1:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
FW: COMODO Firewall Pro *disabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
FW: Norton Internet Worm Protection *enabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\HP_Owner\Local Settings\Application Data\{E05790AD-33D1-4A83-BC53-0A351B9CEF50}
c:\documents and settings\HP_Owner\Local Settings\Application Data\{E05790AD-33D1-4A83-BC53-0A351B9CEF50}\chrome.manifest
c:\documents and settings\HP_Owner\Local Settings\Application Data\{E05790AD-33D1-4A83-BC53-0A351B9CEF50}\chrome\content\_cfg.js
c:\documents and settings\HP_Owner\Local Settings\Application Data\{E05790AD-33D1-4A83-BC53-0A351B9CEF50}\chrome\content\c.js
c:\documents and settings\HP_Owner\Local Settings\Application Data\{E05790AD-33D1-4A83-BC53-0A351B9CEF50}\chrome\content\overlay.xul
c:\documents and settings\HP_Owner\Local Settings\Application Data\{E05790AD-33D1-4A83-BC53-0A351B9CEF50}\install.rdf
.
((((((((((((((((((((((((( Files Created from 2009-06-12 to 2009-07-12 )))))))))))))))))))))))))))))))
.
2009-07-12 18:58 . 2009-07-12 19:00 20798256 —-a-w- c:\documents and settings\HP_Owner\Application Data\Adobe\Acrobat\6.0\Updater\AdbeRdr70_enu_full.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-12 18:58 . 2008-12-20 10:47 ——– d—–w- c:\documents and settings\HP_Owner\Application Data\AdobeUM
2009-06-27 16:39 . 2008-12-20 09:11 ——– d—–w- c:\documents and settings\HP_Owner\Application Data\.ABC
2009-05-19 18:35 . 2009-05-19 18:35 ——– d—–w- c:\program files\Trend Micro
.
((((((((((((((((((((((((((((( SnapShot@2009-06-23_17.05.23 )))))))))))))))))))))))))))))))))))))))))
.
+ 2006-01-04 18:20 . 2004-08-04 03:00 24576 c:\windows\system32\userinit.ooo.exe
+ 2006-01-04 18:20 . 2004-08-04 03:00 24576 c:\windows\system32\userinit.exe
+ 2006-01-04 18:20 . 2004-08-04 03:00 24576 c:\windows\system32\dllcache\userinit.exe
+ 2009-04-20 09:59 . 2009-04-20 09:59 25088 c:\windows\Installer\8f1b86.msi
+ 2009-04-20 09:59 . 2009-04-20 09:59 28160 c:\windows\Installer\8f1b7d.msi
+ 2009-04-20 09:57 . 2009-04-20 09:57 83456 c:\windows\Installer\8f1b64.msi
+ 2009-04-20 09:57 . 2009-04-20 09:57 59904 c:\windows\Installer\8f1b5d.msi
+ 2005-01-01 09:59 . 2005-01-01 09:59 84992 c:\windows\Installer\2bfba.msi
+ 2009-04-08 22:55 . 2009-04-08 22:55 62464 c:\windows\Installer\223a2a.msi
+ 2008-12-23 14:15 . 2008-12-23 14:15 48128 c:\windows\Installer\126b30e.msi
+ 2008-12-19 03:29 . 2004-08-04 03:00 66048 c:\windows\I386\WINNT32.MSI
+ 2006-01-04 18:20 . 2009-03-05 07:45 8704 c:\windows\system32\userinit.old.exe
+ 2005-01-01 10:12 . 2005-01-01 10:12 227840 c:\windows\Installer\edcd2.msi
+ 2005-01-01 10:12 . 2005-01-01 10:12 940544 c:\windows\Installer\edcc2.msi
+ 2005-01-01 10:12 . 2005-01-01 10:12 264704 c:\windows\Installer\edc1f.msi
+ 2005-01-01 10:11 . 2005-01-01 10:11 300032 c:\windows\Installer\edc1a.msi
+ 2005-01-01 10:11 . 2005-01-01 10:11 129536 c:\windows\Installer\edc0f.msi
+ 2005-01-01 10:11 . 2005-01-01 10:11 426496 c:\windows\Installer\edc0a.msi
+ 2005-01-01 10:11 . 2005-01-01 10:11 346112 c:\windows\Installer\edbe1.msi
+ 2005-01-01 10:11 . 2005-01-01 10:11 258560 c:\windows\Installer\edbd5.msi
+ 2005-01-01 10:11 . 2005-01-01 10:11 285184 c:\windows\Installer\edbc1.msi
+ 2005-01-01 10:10 . 2005-01-01 10:10 134144 c:\windows\Installer\edbba.msi
+ 2005-01-01 09:02 . 2005-01-01 09:02 264704 c:\windows\Installer\c3b1.msi
+ 2009-04-19 22:52 . 2009-04-19 22:52 140288 c:\windows\Installer\90d17.msi
+ 2009-04-19 22:52 . 2009-04-19 22:52 202752 c:\windows\Installer\90d11.msi
+ 2009-04-20 09:59 . 2009-04-20 09:59 431104 c:\windows\Installer\8f1bc4.msi
+ 2009-04-20 09:58 . 2009-04-20 09:58 152576 c:\windows\Installer\8f1b72.msi
+ 2009-04-20 09:55 . 2009-04-20 09:55 107008 c:\windows\Installer\8f1b4f.msi
+ 2009-04-20 09:54 . 2009-04-20 09:54 301056 c:\windows\Installer\8f1b41.msi
+ 2005-01-01 10:06 . 2005-01-01 10:06 280576 c:\windows\Installer\82540.msi
+ 2005-01-01 10:06 . 2005-01-01 10:06 246784 c:\windows\Installer\82524.msi
+ 2005-01-01 10:06 . 2005-01-01 10:06 388096 c:\windows\Installer\82519.msi
+ 2005-01-01 10:06 . 2005-01-01 10:06 207360 c:\windows\Installer\8250f.msi
+ 2005-01-01 10:06 . 2005-01-01 10:06 250880 c:\windows\Installer\824da.msi
+ 2005-01-01 10:06 . 2005-01-01 10:06 150528 c:\windows\Installer\824c7.msi
+ 2005-01-01 10:05 . 2005-01-01 10:05 315392 c:\windows\Installer\82409.msi
+ 2005-01-01 10:05 . 2005-01-01 10:05 123904 c:\windows\Installer\81e99.msi
+ 2005-01-01 10:03 . 2005-01-01 10:03 365568 c:\windows\Installer\81a10.msi
+ 2009-02-05 18:53 . 2009-02-05 18:53 323072 c:\windows\Installer\5a6a7f.msi
+ 2008-12-27 16:05 . 2008-12-27 16:05 772096 c:\windows\Installer\498e8.msi
+ 2008-12-27 15:55 . 2008-12-27 15:55 782336 c:\windows\Installer\498e4.msi
+ 2008-12-27 16:45 . 2008-12-27 16:45 216576 c:\windows\Installer\3b0778.msi
+ 2005-01-01 09:59 . 2005-01-01 09:59 219136 c:\windows\Installer\2bfb0.msi
+ 2005-01-01 09:57 . 2005-01-01 09:57 508416 c:\windows\Installer\2bf24.msi
+ 2005-01-01 10:32 . 2005-01-01 10:32 377344 c:\windows\Installer\1ae3d.msi
+ 2005-01-01 09:23 . 2005-01-01 09:23 621056 c:\windows\Installer\14afac.msi
+ 2005-01-01 10:19 . 2005-01-01 10:19 271872 c:\windows\Installer\1378a8.msi
+ 2005-01-01 10:16 . 2005-01-01 10:16 368128 c:\windows\Installer\1378a3.msi
+ 2008-12-23 14:25 . 2008-12-23 14:25 501248 c:\windows\Installer\126b37a.msi
+ 2008-12-23 14:24 . 2008-12-23 14:24 501248 c:\windows\Installer\126b34c.msi
+ 2008-12-23 14:15 . 2008-12-23 14:15 501248 c:\windows\Installer\126b305.msi
+ 2008-12-23 14:15 . 2008-12-23 14:15 506880 c:\windows\Installer\126b2ff.msi
+ 2008-12-23 14:15 . 2008-12-23 14:15 516608 c:\windows\Installer\126b2f8.msi
+ 2008-12-23 14:15 . 2008-12-23 14:15 513024 c:\windows\Installer\126b2f1.msi
+ 2008-12-23 14:15 . 2008-12-23 14:15 501248 c:\windows\Installer\126b2eb.msi
+ 2006-01-04 18:20 . 2004-08-04 03:00 1326080 c:\windows\system32\webfldrs.msi
+ 2008-12-18 20:41 . 2005-01-01 09:23 9207808 c:\windows\system32\config\systemprofile\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142030}\Java 2 Runtime Environment, SE v1.4.2_03.msi
+ 2005-01-01 10:12 . 2005-01-01 10:12 1101312 c:\windows\Installer\edcc7.msi
+ 2005-01-01 10:04 . 2005-01-01 10:04 1034752 c:\windows\Installer\81e8b.msi
+ 2009-03-01 07:38 . 2009-03-01 07:38 5885952 c:\windows\Installer\38120.msi
+ 2005-01-01 09:58 . 2005-01-01 09:58 1159680 c:\windows\Installer\2bfa0.msi
+ 2005-01-01 09:57 . 2005-01-01 09:57 6654976 c:\windows\Installer\2bf2c.msi
+ 2005-01-01 10:57 . 2005-01-01 10:57 1346048 c:\windows\Installer\1cc7fb.msi
+ 2005-01-01 10:55 . 2005-01-01 10:55 5116928 c:\windows\Installer\1cc7f3.msi
+ 2005-01-01 10:32 . 2005-01-01 10:32 2247680 c:\windows\Installer\1ae35.msi
+ 2005-01-01 09:24 . 2005-01-01 09:24 1620992 c:\windows\Installer\14afb1.msi
+ 2008-12-23 14:26 . 2008-12-23 14:26 1640960 c:\windows\Installer\126b380.msi
+ 2008-12-23 14:25 . 2008-12-23 14:25 1652736 c:\windows\Installer\126b374.msi
+ 2008-12-23 14:25 . 2008-12-23 14:25 1652736 c:\windows\Installer\126b36e.msi
+ 2008-12-23 14:25 . 2008-12-23 14:25 1652736 c:\windows\Installer\126b368.msi
+ 2008-12-23 14:24 . 2008-12-23 14:24 2319872 c:\windows\Installer\126b352.msi
+ 2008-12-23 14:24 . 2008-12-23 14:24 1647616 c:\windows\Installer\126b346.msi
+ 2008-12-23 14:24 . 2008-12-23 14:24 1640960 c:\windows\Installer\126b33c.msi
+ 2008-12-23 14:24 . 2008-12-23 14:24 2022912 c:\windows\Installer\126b336.msi
+ 2008-12-23 14:24 . 2008-12-23 14:24 1713152 c:\windows\Installer\126b330.msi
+ 2008-12-23 14:18 . 2008-12-23 14:18 6179328 c:\windows\Installer\126b321.msi
+ 2008-12-23 14:16 . 2008-12-23 14:16 1934336 c:\windows\Installer\126b314.msi
+ 2008-12-23 14:14 . 2008-12-23 14:14 2397184 c:\windows\Installer\126b2e5.msi
+ 2005-01-01 09:21 . 2005-01-01 09:21 3443712 c:\windows\Installer\12054c.msi
+ 2009-01-04 19:39 . 2009-01-04 19:39 1247744 c:\windows\Installer\111ba5c.msi
+ 2003-11-03 22:06 . 2003-11-03 22:06 2250100 c:\windows\Cache\Adobe Reader 6.0.1\ENUBIG\Adobe Reader 6.0.1.msi
+ 2008-12-20 16:10 . 2007-01-19 13:20 16633344 c:\windows\Installer\MSN Messenger 8.1.0178\MsnMsgs.Msi
+ 2005-01-01 10:57 . 2005-01-01 10:57 11746816 c:\windows\Installer\1cc805.msi
+ 2008-12-23 14:30 . 2008-12-23 14:30 18181632 c:\windows\Installer\126b387.msi
+ 2005-01-01 10:36 . 2005-01-01 10:36 18887168 c:\windows\Downloaded Installations\{9836E876-FDBF-45FB-8D3B-9E1D9F7116CA}\iTunes.msi
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\j2re1.4.2_03\bin\jusched.exe" [2005-01-01 32881]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2008-12-18 26112]
"PS2"="c:\windows\system32\ps2.exe" [2004-10-25 90112]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"KBD"="c:\hp\KBD\KBD.EXE" [2003-02-11 61440]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 81920]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 221184]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-08-20 155648]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HPHUPD06"="c:\program files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-07 49152]
"HostManager"="c:\program files\Common Files\AOL\1229762181\ee\AOLSoftware.exe" [2006-09-26 50736]
"COMODO Firewall Pro"="c:\program files\COMODO\Firewall\cfp.exe" [2009-04-09 1655552]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-09-09 344064]
"AOLDialer"="c:\program files\Common Files\AOL\ACS\AOLDial.exe" [2007-12-07 71008]
"a0fa9d1c"="c:\windows\system32\smooroaa.dll" [BU]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-07-29 77824]
"SiSPower"="SiSPower.dll" - c:\windows\system32\SiSPower.dll [2004-09-24 49152]
"AlcWzrd"="ALCWZRD.EXE" - c:\windows\ALCWZRD.EXE [2004-07-29 2551808]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2004-06-29 88363]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]
"Spybot - Search & Destroy"="c:\program files\Spybot - Search & Destroy\SpybotSD.exe" [2008-11-13 5287768]
c:\documents and settings\HP_Owner\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
AOL 9.0 Tray Icon.lnk - c:\program files\AOL 9.0\aoltray.exe [2008-12-19 156784]
AOL Companion.lnk - c:\program files\AOL Companion\companion.exe [2008-12-19 250992]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-5-29 241664]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLAcsd.exe"=
"c:\\Program Files\\AOL 9.0\\waol.exe"=
"c:\\Program Files\\Common Files\\AOL\\1229762181\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\ABC\\abc.exe"=
"c:\\Program Files\\THQ\\Dawn of War - Soulstorm\\Soulstorm.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Windows Peer-to-Peer Grouping
"3540:UDP"= 3540:UDP:Peer Name Resolution Protocol (PNRP)
"7070:TCP"= 7070:TCP:nfr
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [09/04/2009 21:32 87056]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [09/04/2009 21:32 24208]
R3 PhTVTune;ASUS WDM TV Tuner;c:\windows\system32\drivers\PhTVTune.sys [01/01/2005 10:48 24544]
S0 pggrkatg;pggrkatg;c:\windows\system32\drivers\rrwpczyg.sys []
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
.
- - - - ORPHANS REMOVED - - - -
BHO-{001B00AE-7860-4251-AB09-F5084B6016EC} - (no file)
BHO-{051C4D78-98FA-4B6D-ADF3-79904CC8B7AF} - (no file)
BHO-{09EABA3C-397E-4F2C-8840-5AD3D8BDDFDB} - (no file)
BHO-{0C8A0741-B54F-4CFA-85F8-494662FE8E41} - (no file)
BHO-{0EDF10DE-12F8-44B7-83F4-E2AFEEDC0183} - (no file)
BHO-{1CE272AD-E408-451E-A08B-B0048D907B33} - (no file)
BHO-{1E1949F7-B16A-47EA-85B2-A89939417F61} - (no file)
BHO-{1EF042BE-1F1F-44AC-B301-E6E794691394} - (no file)
BHO-{1F0DB968-B499-4C0F-84A7-A5D30660E822} - (no file)
BHO-{216187C0-423C-4123-908E-7246D86886A0} - (no file)
BHO-{216D8D75-DEE0-499F-8F87-DDE12FE03DF8} - (no file)
BHO-{27BD3C51-BC2E-49E0-9C6B-F0D0D010CE80} - (no file)
BHO-{2FC7A6B7-EFAA-4AFC-989D-02310398F83A} - (no file)
BHO-{303B270C-AA0A-4DE6-91A7-FD452C9631DC} - (no file)
BHO-{3081BC85-2BB3-4238-BB8E-0D5F930892C3} - (no file)
BHO-{33A4125A-0E9E-4959-B46E-A34689E8DD73} - (no file)
BHO-{340DA371-C36E-4C98-85B4-3A29C3A5A0F9} - (no file)
BHO-{350A958B-8897-4FA6-BA8E-C0202CD3F30E} - (no file)
BHO-{35A71AF0-50BA-4074-93E6-6F097384689F} - (no file)
BHO-{36B0CE3B-2389-48E4-92E4-00ED8579DC74} - (no file)
BHO-{3B31C0ED-586A-408E-9CF3-D12DCD23376E} - (no file)
BHO-{40167E6E-9DF0-423B-9094-9578D043C432} - (no file)
BHO-{444B7843-A646-4525-A5E7-6F4CD7CE0628} - (no file)
BHO-{46AAF4BD-32DD-4E49-91B8-33B70119D9AC} - (no file)
BHO-{46CB60B7-610C-4A58-9E1A-32B16F37B211} - (no file)
BHO-{511512CB-CFAC-49E0-BD1D-F5DF656A1C8A} - (no file)
BHO-{538DF27D-F49D-40B1-9644-A696C2071B78} - (no file)
BHO-{5817FDBD-3462-4B7B-9E8A-7842189010BE} - (no file)
BHO-{633808CA-C1BE-4EA7-9279-1C8282BF07FF} - (no file)
BHO-{67520427-1A9C-44CE-A679-BAC8122D8746} - (no file)
BHO-{690E9E38-8FDB-48C7-8CD1-534E73F2666B} - (no file)
BHO-{69432058-704F-4E6E-B1A4-493C1F3723F3} - (no file)
BHO-{6EF9FD7C-C8B9-4F63-9271-26015961B294} - (no file)
BHO-{74ED29C2-3B04-491F-B00E-3B1383159E91} - (no file)
BHO-{75E0D66C-5620-4BCF-9962-AA78188164EC} - (no file)
BHO-{765402F7-A14D-4279-88A8-EE51096F18D3} - (no file)
BHO-{7A1F6839-AA47-4EF9-A879-E83E6AABB99A} - (no file)
BHO-{7A4C7266-E6EF-4361-8A86-696BD89C7239} - (no file)
BHO-{81125015-08af-4a04-9512-f21ec33a1f93} - (no file)
BHO-{841FDACB-8EC2-4512-A9A7-51E090448A11} - (no file)
BHO-{882F2FE5-61B3-4765-845A-485582732E33} - (no file)
BHO-{887A2277-9875-4300-90B0-E56D56791EC3} - (no file)
BHO-{8EDC0272-3960-41BC-91BF-1E3B32615FF0} - (no file)
BHO-{90BE6A4A-895D-46D4-9051-6EE6465390DC} - (no file)
BHO-{9731BF4D-69EA-46F8-9F1E-8AAEA2EDB36E} - (no file)
BHO-{979C9B28-D9DD-45D2-A910-642990B3DACD} - (no file)
BHO-{9C2F459E-AA22-4CD2-B56D-E3D8878117A5} - (no file)
BHO-{9DA61E8E-66C6-4576-8B9D-DCB3EAAF13C2} - (no file)
BHO-{A0584506-0BC5-4623-8702-83E1EB3934D9} - (no file)
BHO-{A0A17DFB-BD47-4618-B187-1A0E1B799EA9} - (no file)
BHO-{A19120DB-8D7D-4BF2-A126-6C58DEEB04AD} - (no file)
BHO-{A230C57E-46FE-4278-88DC-FFC3F296F16C} - (no file)
BHO-{A3081139-B6D2-4DF3-B460-7DC729729457} - (no file)
BHO-{A377CB11-8F15-4DAE-BB3E-ABBD65B1002D} - (no file)
BHO-{A5C775ED-DFA0-417F-A84D-1850A3484F9E} - (no file)
BHO-{A7788911-F6E2-42A1-BEEC-739001DDC8FD} - (no file)
BHO-{A9F1B5BD-99CB-4280-AD15-F59808DE8FAF} - (no file)
BHO-{AC10C684-C169-469F-8F8E-D057CD5FD0B9} - (no file)
BHO-{AF912E8A-CA9E-4A9F-AA86-190C6AE9CFDE} - (no file)
BHO-{B1387124-3580-4FC6-B866-3090489DEE59} - (no file)
BHO-{B23E8909-C3F4-43F7-833A-9403598D6066} - (no file)
BHO-{B309E0DF-A0FB-4391-8DD4-AF1F901AB0C3} - (no file)
BHO-{B324C745-5811-40DF-962D-4BBCE6031155} - (no file)
BHO-{B4672FFB-E4C6-40E2-9013-F8EDAB6F3B89} - (no file)
BHO-{B4AA5C1C-31B4-472C-8B69-1415FC0F9AA4} - (no file)
BHO-{B7F1CA51-A658-4824-8034-538C96E86BE8} - (no file)
BHO-{BB4531ED-E666-4F13-B0D1-BFFAB935B300} - (no file)
BHO-{C85B854A-A280-4B4C-8D36-2D8E3B83F591} - (no file)
BHO-{CF2038DD-3204-4FD1-9AD1-C2B532E42779} - (no file)
BHO-{D1AAECDA-9484-4226-B7E3-B2D718B3D076} - (no file)
BHO-{D32943BD-A447-45DC-9F0A-27FF4E826B30} - (no file)
BHO-{D701BC89-4050-49FC-A78B-933E976411BC} - (no file)
BHO-{D9C33BF9-5318-4B94-9DBC-B6F1F3BB585E} - (no file)
BHO-{DAB439E3-70F7-492A-9E1A-D3612E066DB5} - (no file)
BHO-{DB135C85-892F-44FF-B5BC-25F3CE421C85} - (no file)
BHO-{DBD21D7E-DCD3-477B-B6A7-06123403BC48} - (no file)
BHO-{DDAF548A-4E81-4FF6-A5C7-BF5CA6721465} - (no file)
BHO-{DFA0C81E-4192-4B00-8541-01D024C20998} - (no file)
BHO-{E0E5477E-5B2E-4566-A967-52A27FF39768} - (no file)
BHO-{E21D36C8-AC9B-4A98-8084-8E71BB61B123} - (no file)
BHO-{E5DC1D5C-BC91-459A-85B3-97F481B05B5A} - (no file)
BHO-{EAFAFB62-C6FF-4B95-A0C0-756A17327F48} - (no file)
BHO-{F1A449AC-5AC7-4B4D-BD32-DCCB6BE57F89} - (no file)
BHO-{FF715C15-D67C-4CC2-A66D-69426256129F} - (no file)
HKLM-RunOnce- - (no file)
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=EN_GB&c;=Q105&bd;=pavilion&pf;=desktop
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iesearch&locale;=EN_GB&c;=Q105&bd;=pavilion&pf;=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iesearch&locale;=EN_GB&c;=Q105&bd;=pavilion&pf;=desktop
uInternet Connection Wizard,ShellNext = hxxp://www.bt.net/digitaldemo
IE: &AOL; Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
FF - ProfilePath - c:\documents and settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\17ibpqgm.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.explosm.net/comics
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava11.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava12.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava13.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava14.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava32.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJPI142_03.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPOJI610.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.
**************************************************************************
Sorry for replying so late,
Jun
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI