ffconfused
Topic Starter
Logfile of HijackThis v1.97.7
Scan saved at 6:10:54 PM, on 12/14/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\APPIR32.EXE
C:\WINDOWS\SYSTEM\MSAS32.EXE
C:\WINDOWS\ADDMI32.EXE
C:\WINDOWS\ATLIR32.EXE
C:\WINDOWS\CRTF32.EXE
C:\WINDOWS\CRTR32.EXE
C:\WINDOWS\IEHI32.EXE
C:\WINDOWS\SYSTEM\DEVLDR16.EXE
C:\WINDOWS\IEXO.EXE
C:\WINDOWS\IEAF.EXE
C:\WINDOWS\IPFC.EXE
C:\WINDOWS\JAVAHQ32.EXE
C:\WINDOWS\IPQK.EXE
C:\WINDOWS\MSNN.EXE
C:\WINDOWS\MSEN32.EXE
C:\WINDOWS\NTJB.EXE
C:\WINDOWS\NETTI32.EXE
C:\WINDOWS\NTDS32.EXE
C:\WINDOWS\NTLA.EXE
C:\WINDOWS\SYSTEM\APIGM32.EXE
C:\WINDOWS\SYSTEM\APIXR.EXE
C:\WINDOWS\SYSTEM\APPWH32.EXE
C:\WINDOWS\SYSTEM\ATLDH.EXE
C:\WINDOWS\SYSTEM\ATLTW32.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\SYSTEM\CRDV.EXE
C:\WINDOWS\SYSTEM\D3NQ.EXE
C:\WINDOWS\SYSTEM\IEFW32.EXE
C:\WINDOWS\SYSTEM\JAVATG.EXE
C:\WINDOWS\SYSTEM\JAVATS.EXE
C:\WINDOWS\SYSTEM\MFCHO32.EXE
C:\WINDOWS\SYSTEM\JAVAXC.EXE
C:\WINDOWS\SYSTEM\MFCVZ.EXE
C:\WINDOWS\SYSTEM\MFCLP32.EXE
C:\WINDOWS\SYSTEM\MSQU.EXE
C:\WINDOWS\SYSTEM\NETCI32.EXE
C:\WINDOWS\SYSTEM\NETDY.EXE
C:\WINDOWS\SYSTEM\NETKR32.EXE
C:\WINDOWS\SYSTEM\NTYE32.EXE
C:\WINDOWS\SYSTEM\SDKLN32.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\SDKOQ32.EXE
C:\WINDOWS\WINYS.EXE
C:\WINDOWS\SYSTEM\SYSTK.EXE
C:\WINDOWS\SYSIS32.EXE
C:\WINDOWS\WINAD32.EXE
C:\WINDOWS\SDKGC32.EXE
C:\WINDOWS\APPNX32.EXE
C:\WINDOWS\MSMQ.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\MOUSE\POINT32.EXE
C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 5\DIRECTCD\DIRECTCD.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\HP\HPCORETECH\HPCMPMGR.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\FBM SOFTWARE\ZEROSPYWARE 2004\NETGUARD.EXE
C:\PROGRAM FILES\FBM SOFTWARE\ZEROSPYWARE 2004\ZEROSPYWARE.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
C:\PROGRAM FILES\MSN\MSNCOREFILES\MSN.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE
C:\PROGRAM FILES\MSN\MSNIA\MSNIASVC.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ljmnb.dll/sp.html#37794
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ljmnb.dll/sp.html#37794
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ljmnb.dll/sp.html#37794
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ljmnb.dll/sp.html#37794
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\ljmnb.dll/sp.html#37794
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\ljmnb.dll/sp.html#37794
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN TOOLBAR\01.01.1601.0\EN-US\MSNTB.DLL
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_7_0.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [ConMgr.exe] "C:\PROGRAM FILES\EARTHLINK 5.0\CONMGR.EXE"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HP Component Manager] "C:\PROGRAM FILES\HP\HPCORETECH\HPCMPMGR.EXE"
O4 - HKLM\..\Run: [devldr16.exe] C:\WINDOWS\SYSTEM\devldr16.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [MSNIA] C:\PROGRA~1\MSN\MSNIA\MSNIASVC.EXE
O4 - HKLM\..\RunServices: [MSAS32.EXE] C:\WINDOWS\SYSTEM\MSAS32.EXE
O4 - HKLM\..\RunServices: [APPIR32.EXE] C:\WINDOWS\APPIR32.EXE
O4 - HKLM\..\RunServices: [JAVAFU.EXE] C:\WINDOWS\JAVAFU.EXE
O4 - HKLM\..\RunServices: [APILW.EXE] C:\WINDOWS\SYSTEM\APILW.EXE
O4 - HKLM\..\RunServices: [IEHI32.EXE] C:\WINDOWS\IEHI32.EXE
O4 - HKLM\..\RunServices: [ADDMI32.EXE] C:\WINDOWS\ADDMI32.EXE
O4 - HKLM\..\RunServices: [APIOL32.EXE] C:\WINDOWS\APIOL32.EXE
O4 - HKLM\..\RunServices: [APPDJ32.EXE] C:\WINDOWS\APPDJ32.EXE
O4 - HKLM\..\RunServices: [APPJQ.EXE] C:\WINDOWS\APPJQ.EXE
O4 - HKLM\..\RunServices: [APPOI.EXE] C:\WINDOWS\APPOI.EXE
O4 - HKLM\..\RunServices: [ATLIR32.EXE] C:\WINDOWS\ATLIR32.EXE
O4 - HKLM\..\RunServices: [ATLUG.EXE] C:\WINDOWS\ATLUG.EXE
O4 - HKLM\..\RunServices: [CRTF32.EXE] C:\WINDOWS\CRTF32.EXE
O4 - HKLM\..\RunServices: [CRTR32.EXE] C:\WINDOWS\CRTR32.EXE
O4 - HKLM\..\RunServices: [CRYW32.EXE] C:\WINDOWS\CRYW32.EXE
O4 - HKLM\..\RunServices: [IEAF.EXE] C:\WINDOWS\IEAF.EXE
O4 - HKLM\..\RunServices: [IEXO.EXE] C:\WINDOWS\IEXO.EXE
O4 - HKLM\..\RunServices: [IPEL.EXE] C:\WINDOWS\IPEL.EXE
O4 - HKLM\..\RunServices: [IPFC.EXE] C:\WINDOWS\IPFC.EXE
O4 - HKLM\..\RunServices: [IPQK.EXE] C:\WINDOWS\IPQK.EXE
O4 - HKLM\..\RunServices: [JAVAHQ32.EXE] C:\WINDOWS\JAVAHQ32.EXE
O4 - HKLM\..\RunServices: [MFCJE32.EXE] C:\WINDOWS\MFCJE32.EXE
O4 - HKLM\..\RunServices: [MSCX.EXE] C:\WINDOWS\MSCX.EXE
O4 - HKLM\..\RunServices: [MSEN32.EXE] C:\WINDOWS\MSEN32.EXE
O4 - HKLM\..\RunServices: [MSNN.EXE] C:\WINDOWS\MSNN.EXE
O4 - HKLM\..\RunServices: [NETTI.EXE] C:\WINDOWS\NETTI.EXE
O4 - HKLM\..\RunServices: [NETTI32.EXE] C:\WINDOWS\NETTI32.EXE
O4 - HKLM\..\RunServices: [NTDS32.EXE] C:\WINDOWS\NTDS32.EXE
O4 - HKLM\..\RunServices: [NTJB.EXE] C:\WINDOWS\NTJB.EXE
O4 - HKLM\..\RunServices: [NTLA.EXE] C:\WINDOWS\NTLA.EXE
O4 - HKLM\..\RunServices: [APIGM32.EXE] C:\WINDOWS\SYSTEM\APIGM32.EXE
O4 - HKLM\..\RunServices: [APIXR.EXE] C:\WINDOWS\SYSTEM\APIXR.EXE
O4 - HKLM\..\RunServices: [APPWH32.EXE] C:\WINDOWS\SYSTEM\APPWH32.EXE
O4 - HKLM\..\RunServices: [ATLDH.EXE] C:\WINDOWS\SYSTEM\ATLDH.EXE
O4 - HKLM\..\RunServices: [ATLTW32.EXE] C:\WINDOWS\SYSTEM\ATLTW32.EXE
O4 - HKLM\..\RunServices: [CRDV.EXE] C:\WINDOWS\SYSTEM\CRDV.EXE
O4 - HKLM\..\RunServices: [D3FR32.EXE] C:\WINDOWS\SYSTEM\D3FR32.EXE
O4 - HKLM\..\RunServices: [D3NQ.EXE] C:\WINDOWS\SYSTEM\D3NQ.EXE
O4 - HKLM\..\RunServices: [IEFW32.EXE] C:\WINDOWS\SYSTEM\IEFW32.EXE
O4 - HKLM\..\RunServices: [IEVK32.EXE] C:\WINDOWS\SYSTEM\IEVK32.EXE
O4 - HKLM\..\RunServices: [JAVATG.EXE] C:\WINDOWS\SYSTEM\JAVATG.EXE
O4 - HKLM\..\RunServices: [JAVATS.EXE] C:\WINDOWS\SYSTEM\JAVATS.EXE
O4 - HKLM\..\RunServices: [JAVAXC.EXE] C:\WINDOWS\SYSTEM\JAVAXC.EXE
O4 - HKLM\..\RunServices: [MFCHO32.EXE] C:\WINDOWS\SYSTEM\MFCHO32.EXE
O4 - HKLM\..\RunServices: [MFCVZ.EXE] C:\WINDOWS\SYSTEM\MFCVZ.EXE
O4 - HKLM\..\RunServices: [MFCLP32.EXE] C:\WINDOWS\SYSTEM\MFCLP32.EXE
O4 - HKLM\..\RunServices: [MSQU.EXE] C:\WINDOWS\SYSTEM\MSQU.EXE
O4 - HKLM\..\RunServices: [NETCI32.EXE] C:\WINDOWS\SYSTEM\NETCI32.EXE
O4 - HKLM\..\RunServices: [NETDY.EXE] C:\WINDOWS\SYSTEM\NETDY.EXE
O4 - HKLM\..\RunServices: [NETKR32.EXE] C:\WINDOWS\SYSTEM\NETKR32.EXE
O4 - HKLM\..\RunServices: [NTYE32.EXE] C:\WINDOWS\SYSTEM\NTYE32.EXE
O4 - HKLM\..\RunServices: [SDKLN32.EXE] C:\WINDOWS\SYSTEM\SDKLN32.EXE
O4 - HKLM\..\RunServices: [SDKOQ32.EXE] C:\WINDOWS\SYSTEM\SDKOQ32.EXE
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [SYSTK.EXE] C:\WINDOWS\SYSTEM\SYSTK.EXE
O4 - HKLM\..\RunServices: [WINYS.EXE] C:\WINDOWS\WINYS.EXE
O4 - HKLM\..\RunServices: [WINAD32.EXE] C:\WINDOWS\WINAD32.EXE
O4 - HKLM\..\RunServices: [SYSYT.EXE] C:\WINDOWS\SYSYT.EXE
O4 - HKLM\..\RunServices: [SYSIS32.EXE] C:\WINDOWS\SYSIS32.EXE
O4 - HKLM\..\RunServices: [SDKGC32.EXE] C:\WINDOWS\SDKGC32.EXE
O4 - HKLM\..\RunServices: [APPNX32.EXE] C:\WINDOWS\APPNX32.EXE
O4 - HKLM\..\RunServices: [MSMQ.EXE] C:\WINDOWS\MSMQ.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [NetGuard] "C:\Program Files\FBM Software\ZeroSpyware 2004\NetGuard.exe" -STARTUP
O4 - HKCU\..\Run: [ZeroSpyware] "C:\Program Files\FBM Software\ZeroSpyware 2004\ZeroSpyware.exe" -STARTUP
O4 - HKLM\..\RunOnce: [RemoveFileUAF] "C:\PROGRAM FILES\FBM SOFTWARE\ZEROSPYWARE 2004\FileDeleter.exe" C:\PROGRAM FILES\FBM SOFTWARE\ZEROSPYWARE 2004\uaf.dat
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Encarta Encyclopedia (HKLM)
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia (HKLM)
O9 - Extra button: Define (HKLM)
O9 - Extra 'Tools' menuitem: Define (HKLM)
O9 - Extra button: Send to PDA… (HKLM)
O9 - Extra 'Tools' menuitem: Send to PDA… (HKLM)
O9 - Extra button: Dell Home (HKCU)
O10 - Broken Internet access because of LSP provider 'fbm.dll' missing
O12 - Plugin for .mid: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin2.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.dellnet.com
O15 - Trusted Zone: http://*.windowsupdate.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab
O16 - DPF: {34805D32-AD89-469E-8503-A5666AEE4333} (RdxIE Class) - http://207.188.7.150/0958e73fbfb2e6198005/netzip/RdxIE.cab
O16 - DPF: {F621C77F-126F-4CA5-BC8B-2F64189E93A5} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.CAB
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…7599.5865162037
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mcinsc…55/mcinsctl.cab
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - http://download.mcafee.com/molbin/iss-loc/…284/mcfscan.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
O19 - User stylesheet: (file missing)
Scan saved at 6:10:54 PM, on 12/14/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\APPIR32.EXE
C:\WINDOWS\SYSTEM\MSAS32.EXE
C:\WINDOWS\ADDMI32.EXE
C:\WINDOWS\ATLIR32.EXE
C:\WINDOWS\CRTF32.EXE
C:\WINDOWS\CRTR32.EXE
C:\WINDOWS\IEHI32.EXE
C:\WINDOWS\SYSTEM\DEVLDR16.EXE
C:\WINDOWS\IEXO.EXE
C:\WINDOWS\IEAF.EXE
C:\WINDOWS\IPFC.EXE
C:\WINDOWS\JAVAHQ32.EXE
C:\WINDOWS\IPQK.EXE
C:\WINDOWS\MSNN.EXE
C:\WINDOWS\MSEN32.EXE
C:\WINDOWS\NTJB.EXE
C:\WINDOWS\NETTI32.EXE
C:\WINDOWS\NTDS32.EXE
C:\WINDOWS\NTLA.EXE
C:\WINDOWS\SYSTEM\APIGM32.EXE
C:\WINDOWS\SYSTEM\APIXR.EXE
C:\WINDOWS\SYSTEM\APPWH32.EXE
C:\WINDOWS\SYSTEM\ATLDH.EXE
C:\WINDOWS\SYSTEM\ATLTW32.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\SYSTEM\CRDV.EXE
C:\WINDOWS\SYSTEM\D3NQ.EXE
C:\WINDOWS\SYSTEM\IEFW32.EXE
C:\WINDOWS\SYSTEM\JAVATG.EXE
C:\WINDOWS\SYSTEM\JAVATS.EXE
C:\WINDOWS\SYSTEM\MFCHO32.EXE
C:\WINDOWS\SYSTEM\JAVAXC.EXE
C:\WINDOWS\SYSTEM\MFCVZ.EXE
C:\WINDOWS\SYSTEM\MFCLP32.EXE
C:\WINDOWS\SYSTEM\MSQU.EXE
C:\WINDOWS\SYSTEM\NETCI32.EXE
C:\WINDOWS\SYSTEM\NETDY.EXE
C:\WINDOWS\SYSTEM\NETKR32.EXE
C:\WINDOWS\SYSTEM\NTYE32.EXE
C:\WINDOWS\SYSTEM\SDKLN32.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\SDKOQ32.EXE
C:\WINDOWS\WINYS.EXE
C:\WINDOWS\SYSTEM\SYSTK.EXE
C:\WINDOWS\SYSIS32.EXE
C:\WINDOWS\WINAD32.EXE
C:\WINDOWS\SDKGC32.EXE
C:\WINDOWS\APPNX32.EXE
C:\WINDOWS\MSMQ.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\MOUSE\POINT32.EXE
C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 5\DIRECTCD\DIRECTCD.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\HP\HPCORETECH\HPCMPMGR.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\FBM SOFTWARE\ZEROSPYWARE 2004\NETGUARD.EXE
C:\PROGRAM FILES\FBM SOFTWARE\ZEROSPYWARE 2004\ZEROSPYWARE.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
C:\PROGRAM FILES\MSN\MSNCOREFILES\MSN.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE
C:\PROGRAM FILES\MSN\MSNIA\MSNIASVC.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ljmnb.dll/sp.html#37794
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ljmnb.dll/sp.html#37794
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ljmnb.dll/sp.html#37794
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ljmnb.dll/sp.html#37794
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\ljmnb.dll/sp.html#37794
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\ljmnb.dll/sp.html#37794
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN TOOLBAR\01.01.1601.0\EN-US\MSNTB.DLL
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_7_0.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [ConMgr.exe] "C:\PROGRAM FILES\EARTHLINK 5.0\CONMGR.EXE"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HP Component Manager] "C:\PROGRAM FILES\HP\HPCORETECH\HPCMPMGR.EXE"
O4 - HKLM\..\Run: [devldr16.exe] C:\WINDOWS\SYSTEM\devldr16.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [MSNIA] C:\PROGRA~1\MSN\MSNIA\MSNIASVC.EXE
O4 - HKLM\..\RunServices: [MSAS32.EXE] C:\WINDOWS\SYSTEM\MSAS32.EXE
O4 - HKLM\..\RunServices: [APPIR32.EXE] C:\WINDOWS\APPIR32.EXE
O4 - HKLM\..\RunServices: [JAVAFU.EXE] C:\WINDOWS\JAVAFU.EXE
O4 - HKLM\..\RunServices: [APILW.EXE] C:\WINDOWS\SYSTEM\APILW.EXE
O4 - HKLM\..\RunServices: [IEHI32.EXE] C:\WINDOWS\IEHI32.EXE
O4 - HKLM\..\RunServices: [ADDMI32.EXE] C:\WINDOWS\ADDMI32.EXE
O4 - HKLM\..\RunServices: [APIOL32.EXE] C:\WINDOWS\APIOL32.EXE
O4 - HKLM\..\RunServices: [APPDJ32.EXE] C:\WINDOWS\APPDJ32.EXE
O4 - HKLM\..\RunServices: [APPJQ.EXE] C:\WINDOWS\APPJQ.EXE
O4 - HKLM\..\RunServices: [APPOI.EXE] C:\WINDOWS\APPOI.EXE
O4 - HKLM\..\RunServices: [ATLIR32.EXE] C:\WINDOWS\ATLIR32.EXE
O4 - HKLM\..\RunServices: [ATLUG.EXE] C:\WINDOWS\ATLUG.EXE
O4 - HKLM\..\RunServices: [CRTF32.EXE] C:\WINDOWS\CRTF32.EXE
O4 - HKLM\..\RunServices: [CRTR32.EXE] C:\WINDOWS\CRTR32.EXE
O4 - HKLM\..\RunServices: [CRYW32.EXE] C:\WINDOWS\CRYW32.EXE
O4 - HKLM\..\RunServices: [IEAF.EXE] C:\WINDOWS\IEAF.EXE
O4 - HKLM\..\RunServices: [IEXO.EXE] C:\WINDOWS\IEXO.EXE
O4 - HKLM\..\RunServices: [IPEL.EXE] C:\WINDOWS\IPEL.EXE
O4 - HKLM\..\RunServices: [IPFC.EXE] C:\WINDOWS\IPFC.EXE
O4 - HKLM\..\RunServices: [IPQK.EXE] C:\WINDOWS\IPQK.EXE
O4 - HKLM\..\RunServices: [JAVAHQ32.EXE] C:\WINDOWS\JAVAHQ32.EXE
O4 - HKLM\..\RunServices: [MFCJE32.EXE] C:\WINDOWS\MFCJE32.EXE
O4 - HKLM\..\RunServices: [MSCX.EXE] C:\WINDOWS\MSCX.EXE
O4 - HKLM\..\RunServices: [MSEN32.EXE] C:\WINDOWS\MSEN32.EXE
O4 - HKLM\..\RunServices: [MSNN.EXE] C:\WINDOWS\MSNN.EXE
O4 - HKLM\..\RunServices: [NETTI.EXE] C:\WINDOWS\NETTI.EXE
O4 - HKLM\..\RunServices: [NETTI32.EXE] C:\WINDOWS\NETTI32.EXE
O4 - HKLM\..\RunServices: [NTDS32.EXE] C:\WINDOWS\NTDS32.EXE
O4 - HKLM\..\RunServices: [NTJB.EXE] C:\WINDOWS\NTJB.EXE
O4 - HKLM\..\RunServices: [NTLA.EXE] C:\WINDOWS\NTLA.EXE
O4 - HKLM\..\RunServices: [APIGM32.EXE] C:\WINDOWS\SYSTEM\APIGM32.EXE
O4 - HKLM\..\RunServices: [APIXR.EXE] C:\WINDOWS\SYSTEM\APIXR.EXE
O4 - HKLM\..\RunServices: [APPWH32.EXE] C:\WINDOWS\SYSTEM\APPWH32.EXE
O4 - HKLM\..\RunServices: [ATLDH.EXE] C:\WINDOWS\SYSTEM\ATLDH.EXE
O4 - HKLM\..\RunServices: [ATLTW32.EXE] C:\WINDOWS\SYSTEM\ATLTW32.EXE
O4 - HKLM\..\RunServices: [CRDV.EXE] C:\WINDOWS\SYSTEM\CRDV.EXE
O4 - HKLM\..\RunServices: [D3FR32.EXE] C:\WINDOWS\SYSTEM\D3FR32.EXE
O4 - HKLM\..\RunServices: [D3NQ.EXE] C:\WINDOWS\SYSTEM\D3NQ.EXE
O4 - HKLM\..\RunServices: [IEFW32.EXE] C:\WINDOWS\SYSTEM\IEFW32.EXE
O4 - HKLM\..\RunServices: [IEVK32.EXE] C:\WINDOWS\SYSTEM\IEVK32.EXE
O4 - HKLM\..\RunServices: [JAVATG.EXE] C:\WINDOWS\SYSTEM\JAVATG.EXE
O4 - HKLM\..\RunServices: [JAVATS.EXE] C:\WINDOWS\SYSTEM\JAVATS.EXE
O4 - HKLM\..\RunServices: [JAVAXC.EXE] C:\WINDOWS\SYSTEM\JAVAXC.EXE
O4 - HKLM\..\RunServices: [MFCHO32.EXE] C:\WINDOWS\SYSTEM\MFCHO32.EXE
O4 - HKLM\..\RunServices: [MFCVZ.EXE] C:\WINDOWS\SYSTEM\MFCVZ.EXE
O4 - HKLM\..\RunServices: [MFCLP32.EXE] C:\WINDOWS\SYSTEM\MFCLP32.EXE
O4 - HKLM\..\RunServices: [MSQU.EXE] C:\WINDOWS\SYSTEM\MSQU.EXE
O4 - HKLM\..\RunServices: [NETCI32.EXE] C:\WINDOWS\SYSTEM\NETCI32.EXE
O4 - HKLM\..\RunServices: [NETDY.EXE] C:\WINDOWS\SYSTEM\NETDY.EXE
O4 - HKLM\..\RunServices: [NETKR32.EXE] C:\WINDOWS\SYSTEM\NETKR32.EXE
O4 - HKLM\..\RunServices: [NTYE32.EXE] C:\WINDOWS\SYSTEM\NTYE32.EXE
O4 - HKLM\..\RunServices: [SDKLN32.EXE] C:\WINDOWS\SYSTEM\SDKLN32.EXE
O4 - HKLM\..\RunServices: [SDKOQ32.EXE] C:\WINDOWS\SYSTEM\SDKOQ32.EXE
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [SYSTK.EXE] C:\WINDOWS\SYSTEM\SYSTK.EXE
O4 - HKLM\..\RunServices: [WINYS.EXE] C:\WINDOWS\WINYS.EXE
O4 - HKLM\..\RunServices: [WINAD32.EXE] C:\WINDOWS\WINAD32.EXE
O4 - HKLM\..\RunServices: [SYSYT.EXE] C:\WINDOWS\SYSYT.EXE
O4 - HKLM\..\RunServices: [SYSIS32.EXE] C:\WINDOWS\SYSIS32.EXE
O4 - HKLM\..\RunServices: [SDKGC32.EXE] C:\WINDOWS\SDKGC32.EXE
O4 - HKLM\..\RunServices: [APPNX32.EXE] C:\WINDOWS\APPNX32.EXE
O4 - HKLM\..\RunServices: [MSMQ.EXE] C:\WINDOWS\MSMQ.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [NetGuard] "C:\Program Files\FBM Software\ZeroSpyware 2004\NetGuard.exe" -STARTUP
O4 - HKCU\..\Run: [ZeroSpyware] "C:\Program Files\FBM Software\ZeroSpyware 2004\ZeroSpyware.exe" -STARTUP
O4 - HKLM\..\RunOnce: [RemoveFileUAF] "C:\PROGRAM FILES\FBM SOFTWARE\ZEROSPYWARE 2004\FileDeleter.exe" C:\PROGRAM FILES\FBM SOFTWARE\ZEROSPYWARE 2004\uaf.dat
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Encarta Encyclopedia (HKLM)
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia (HKLM)
O9 - Extra button: Define (HKLM)
O9 - Extra 'Tools' menuitem: Define (HKLM)
O9 - Extra button: Send to PDA… (HKLM)
O9 - Extra 'Tools' menuitem: Send to PDA… (HKLM)
O9 - Extra button: Dell Home (HKCU)
O10 - Broken Internet access because of LSP provider 'fbm.dll' missing
O12 - Plugin for .mid: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin2.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.dellnet.com
O15 - Trusted Zone: http://*.windowsupdate.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab
O16 - DPF: {34805D32-AD89-469E-8503-A5666AEE4333} (RdxIE Class) - http://207.188.7.150/0958e73fbfb2e6198005/netzip/RdxIE.cab
O16 - DPF: {F621C77F-126F-4CA5-BC8B-2F64189E93A5} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.CAB
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…7599.5865162037
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mcinsc…55/mcinsctl.cab
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - http://download.mcafee.com/molbin/iss-loc/…284/mcfscan.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
O19 - User stylesheet: (file missing)