My Logs

Ad-Aware SE Build 1.05 Logfile Created on:Tuesday, January 04, 2005 8:51:21 PM Created with Ad-Aware SE Personal, free for private use. Using definitions file:SE1R24 29.12.2004 »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» References detected during the scan: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» MRU List(TAC index:0):52 total references Tracking Cookie(TAC index:3):1 total references »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Definition File: ========================= Definitions File Loaded: Reference Number : SE1R24 29.12.2004 Internal build : 29 File location : C:\Program Files\Lavasoft\Ad-Aware SE Personal\defs.ref File size : 416382 Bytes Total size : 1313453 Bytes Signature data size : 1283765 Bytes Reference data size : 29176 Bytes Signatures total : 36484 Fingerprints total : 610 Fingerprints size : 23044 Bytes Target categories : 15 Target families : 633 Memory + processor status: ========================== Number of processors : 1 Processor architecture : Intel Pentium IV Memory available:25 % Total physical memory:260592 kb Available physical memory:64652 kb Total page file size:640664 kb Available on page file:167760 kb Total virtual memory:2097024 kb Available virtual memory:2006500 kb OS:Microsoft Windows XP Home Edition Service Pack 2 (Build 2600) Ad-Aware SE Settings =========================== Set : Search for negligible risk entries Set : Safe mode (always request confirmation) Set : Scan active processes Set : Scan registry Set : Deep-scan registry Set : Scan my IE Favorites for banned URLs Set : Scan my Hosts file Extended Ad-Aware SE Settings =========================== Set : Unload recognized processes & modules during scan Set : Obtain command line of scanned processes Set : Scan registry for all users instead of current user only Set : Always try to unload modules before deletion Set : During removal, unload Explorer and IE if necessary Set : Let Windows remove files in use at next reboot Set : Delete quarantined objects after restoring Set : Include basic Ad-Aware settings in log file Set : Include additional Ad-Aware settings in log file Set : Include reference summary in log file Set : Create log file for removal operations Set : Include module list in log file Set : Include alternate data stream details in log file Set : Show detail tooltips in results lists Set : Play sound at scan completion if scan locates critical objects 1-4-2005 8:51:21 PM - Scan started. (Custom mode) Listing running processes »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» #:1 [smss.exe] ModuleName : \SystemRoot\System32\smss.exe Command Line : n/a ProcessID : 452 ThreadCreationTime : 1-4-2005 1:50:43 AM BasePriority : Normal Scanning Module:\SystemRoot\System32\smss.exe… Scanning Module:C:\WINDOWS\system32\ntdll.dll… #:2 [csrss.exe] ModuleName : \??\C:\WINDOWS\system32\csrss.exe Command Line : C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestTh ProcessID : 500 ThreadCreationTime : 1-4-2005 1:50:50 AM BasePriority : Normal Scanning Module:\??\C:\WINDOWS\system32\csrss.exe… Scanning Module:C:\WINDOWS\system32\CSRSRV.dll… Scanning Module:C:\WINDOWS\system32\basesrv.dll… Scanning Module:C:\WINDOWS\system32\winsrv.dll… Scanning Module:C:\WINDOWS\system32\USER32.dll… Scanning Module:C:\WINDOWS\system32\KERNEL32.dll… Scanning Module:C:\WINDOWS\system32\GDI32.dll… Scanning Module:C:\WINDOWS\system32\LPK.DLL… Scanning Module:C:\WINDOWS\system32\USP10.dll… Scanning Module:C:\WINDOWS\system32\msvcrt.dll… Scanning Module:C:\WINDOWS\system32\ADVAPI32.dll… Scanning Module:C:\WINDOWS\system32\RPCRT4.dll… Scanning Module:C:\WINDOWS\system32\sxs.dll… Scanning Module:C:\WINDOWS\system32\Apphelp.dll… Scanning Module:C:\WINDOWS\system32\VERSION.dll… #:3 [winlogon.exe] ModuleName : \??\C:\WINDOWS\system32\winlogon.exe Command Line : winlogon.exe ProcessID : 524 ThreadCreationTime : 1-4-2005 1:50:52 AM BasePriority : High Scanning Module:\??\C:\WINDOWS\system32\winlogon.exe… Scanning Module:C:\WINDOWS\system32\AUTHZ.dll… Scanning Module:C:\WINDOWS\system32\CRYPT32.dll… Scanning Module:C:\WINDOWS\system32\MSASN1.dll… Scanning Module:C:\WINDOWS\system32\NDdeApi.dll… Scanning Module:C:\WINDOWS\system32\PROFMAP.dll… Scanning Module:C:\WINDOWS\system32\NETAPI32.dll… Scanning Module:C:\WINDOWS\system32\USERENV.dll… Scanning Module:C:\WINDOWS\system32\PSAPI.DLL… Scanning Module:C:\WINDOWS\system32\REGAPI.dll… Scanning Module:C:\WINDOWS\system32\Secur32.dll… Scanning Module:C:\WINDOWS\system32\SETUPAPI.dll… Scanning Module:C:\WINDOWS\system32\WINSTA.dll… Scanning Module:C:\WINDOWS\system32\WINTRUST.dll… Scanning Module:C:\WINDOWS\system32\IMAGEHLP.dll… Scanning Module:C:\WINDOWS\system32\WS2_32.dll… Scanning Module:C:\WINDOWS\system32\WS2HELP.dll… Scanning Module:C:\WINDOWS\system32\IMM32.DLL… Scanning Module:C:\WINDOWS\system32\MSGINA.dll… Scanning Module:C:\WINDOWS\system32\SHELL32.dll… Scanning Module:C:\WINDOWS\system32\SHLWAPI.dll… Scanning Module:C:\WINDOWS\system32\COMCTL32.dll… Scanning Module:C:\WINDOWS\system32\ODBC32.dll… Scanning Module:C:\WINDOWS\system32\comdlg32.dll… Scanning Module:C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll… Scanning Module:C:\WINDOWS\system32\odbcint.dll… Scanning Module:C:\WINDOWS\system32\SHSVCS.dll… Scanning Module:C:\WINDOWS\system32\sfc.dll… Scanning Module:C:\WINDOWS\system32\sfc_os.dll… Scanning Module:C:\WINDOWS\system32\ole32.dll… Scanning Module:C:\WINDOWS\system32\msctfime.ime… Scanning Module:C:\WINDOWS\system32\WINSCARD.DLL… Scanning Module:C:\WINDOWS\system32\WTSAPI32.dll… Scanning Module:C:\WINDOWS\system32\WINMM.dll… Scanning Module:C:\WINDOWS\system32\uxtheme.dll… Scanning Module:C:\WINDOWS\system32\cscdll.dll… Scanning Module:C:\WINDOWS\system32\WlNotify.dll… Scanning Module:C:\WINDOWS\system32\WINSPOOL.DRV… Scanning Module:C:\WINDOWS\system32\MPR.dll… Scanning Module:C:\WINDOWS\system32\rsaenh.dll… Scanning Module:C:\WINDOWS\system32\SAMLIB.dll… Scanning Module:C:\WINDOWS\system32\msv1_0.dll… Scanning Module:C:\WINDOWS\system32\iphlpapi.dll… Scanning Module:C:\WINDOWS\system32\cscui.dll… Scanning Module:C:\WINDOWS\system32\xpsp2res.dll… Scanning Module:C:\WINDOWS\system32\NTMARTA.DLL… Scanning Module:C:\WINDOWS\system32\WLDAP32.dll… Scanning Module:C:\WINDOWS\system32\wdmaud.drv… Scanning Module:C:\WINDOWS\system32\msacm32.drv… Scanning Module:C:\WINDOWS\system32\MSACM32.dll… Scanning Module:C:\WINDOWS\system32\midimap.dll… Scanning Module:C:\WINDOWS\system32\COMRes.dll… Scanning Module:C:\WINDOWS\system32\OLEAUT32.dll… Scanning Module:C:\WINDOWS\system32\CLBCATQ.DLL… Scanning Module:C:\WINDOWS\system32\igfxsrvc.dll… Scanning Module:C:\WINDOWS\system32\hccutils.DLL… Scanning Module:C:\WINDOWS\system32\RASAPI32.dll… Scanning Module:C:\WINDOWS\system32\rasman.dll… Scanning Module:C:\WINDOWS\system32\TAPI32.dll… Scanning Module:C:\WINDOWS\system32\rtutils.dll… #:4 [services.exe] ModuleName : C:\WINDOWS\system32\services.exe Command Line : C:\WINDOWS\system32\services.exe ProcessID : 568 ThreadCreationTime : 1-4-2005 1:50:55 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Services and Controller app InternalName : services.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : services.exe Scanning Module:C:\WINDOWS\system32\services.exe… Scanning Module:C:\WINDOWS\system32\SCESRV.dll… Scanning Module:C:\WINDOWS\system32\umpnpmgr.dll… Scanning Module:C:\WINDOWS\system32\NCObjAPI.DLL… Scanning Module:C:\WINDOWS\system32\MSVCP60.dll… Scanning Module:C:\WINDOWS\system32\ShimEng.dll… Scanning Module:C:\WINDOWS\AppPatch\AcGenral.DLL… Scanning Module:C:\WINDOWS\system32\eventlog.dll… Scanning Module:C:\WINDOWS\system32\Cabinet.dll… #:5 [lsass.exe] ModuleName : C:\WINDOWS\system32\lsass.exe Command Line : C:\WINDOWS\system32\lsass.exe ProcessID : 580 ThreadCreationTime : 1-4-2005 1:50:55 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : LSA Shell (Export Version) InternalName : lsass.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : lsass.exe Scanning Module:C:\WINDOWS\system32\lsass.exe… Scanning Module:C:\WINDOWS\system32\LSASRV.dll… Scanning Module:C:\WINDOWS\system32\NTDSAPI.dll… Scanning Module:C:\WINDOWS\system32\DNSAPI.dll… Scanning Module:C:\WINDOWS\system32\SAMSRV.dll… Scanning Module:C:\WINDOWS\system32\cryptdll.dll… Scanning Module:C:\WINDOWS\system32\msprivs.dll… Scanning Module:C:\WINDOWS\system32\kerberos.dll… Scanning Module:C:\WINDOWS\system32\netlogon.dll… Scanning Module:C:\WINDOWS\system32\w32time.dll… Scanning Module:C:\WINDOWS\system32\schannel.dll… Scanning Module:C:\WINDOWS\system32\wdigest.dll… Scanning Module:C:\WINDOWS\system32\scecli.dll… Scanning Module:C:\WINDOWS\system32\ipsecsvc.dll… Scanning Module:C:\WINDOWS\system32\oakley.DLL… Scanning Module:C:\WINDOWS\system32\WINIPSEC.DLL… Scanning Module:C:\WINDOWS\system32\pstorsvc.dll… Scanning Module:C:\Program Files\NewDotNet\newdotnet6_38.dll… Scanning Module:C:\WINDOWS\system32\urlmon.dll… Scanning Module:C:\WINDOWS\system32\WININET.dll… Scanning Module:C:\WINDOWS\system32\psbase.dll… Scanning Module:C:\WINDOWS\system32\mswsock.dll… Scanning Module:C:\WINDOWS\system32\hnetcfg.dll… Scanning Module:C:\WINDOWS\System32\wshtcpip.dll… Scanning Module:C:\WINDOWS\system32\dssenh.dll… #:6 [svchost.exe] ModuleName : C:\WINDOWS\system32\svchost.exe Command Line : C:\WINDOWS\system32\svchost -k DcomLaunch ProcessID : 716 ThreadCreationTime : 1-4-2005 1:50:59 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe Scanning Module:C:\WINDOWS\system32\svchost.exe… Scanning Module:c:\windows\system32\rpcss.dll… Scanning Module:c:\windows\system32\termsrv.dll… Scanning Module:c:\windows\system32\ICAAPI.dll… Scanning Module:c:\windows\system32\mstlsapi.dll… Scanning Module:c:\windows\system32\ACTIVEDS.dll… Scanning Module:c:\windows\system32\adsldpc.dll… Scanning Module:c:\windows\system32\ATL.DLL… #:7 [svchost.exe] ModuleName : C:\WINDOWS\system32\svchost.exe Command Line : C:\WINDOWS\system32\svchost -k rpcss ProcessID : 808 ThreadCreationTime : 1-4-2005 1:51:01 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe Scanning Module:C:\WINDOWS\System32\winrnr.dll… Scanning Module:C:\WINDOWS\system32\rasadhlp.dll… #:8 [svchost.exe] ModuleName : C:\WINDOWS\System32\svchost.exe Command Line : C:\WINDOWS\System32\svchost.exe -k netsvcs ProcessID : 888 ThreadCreationTime : 1-4-2005 1:51:02 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe Scanning Module:c:\windows\system32\dhcpcsvc.dll… Scanning Module:c:\windows\system32\wzcsvc.dll… Scanning Module:c:\windows\system32\WMI.dll… Scanning Module:c:\windows\system32\ESENT.dll… Scanning Module:C:\WINDOWS\System32\rastls.dll… Scanning Module:C:\WINDOWS\system32\CRYPTUI.dll… Scanning Module:C:\WINDOWS\System32\MPRAPI.dll… Scanning Module:c:\windows\system32\schedsvc.dll… Scanning Module:C:\WINDOWS\System32\raschap.dll… Scanning Module:C:\WINDOWS\System32\MSIDLE.DLL… Scanning Module:c:\windows\system32\audiosrv.dll… Scanning Module:c:\windows\system32\wkssvc.dll… Scanning Module:c:\windows\system32\qmgr.dll… Scanning Module:c:\windows\system32\SHFOLDER.dll… Scanning Module:c:\windows\system32\WINHTTP.dll… Scanning Module:c:\windows\system32\cryptsvc.dll… Scanning Module:c:\windows\system32\certcli.dll… Scanning Module:c:\windows\system32\srvsvc.dll… Scanning Module:c:\windows\pchealth\helpctr\binaries\pchsvc.dll… Scanning Module:c:\windows\system32\es.dll… Scanning Module:c:\windows\system32\ersvc.dll… Scanning Module:c:\windows\system32\netman.dll… Scanning Module:c:\windows\system32\netshell.dll… Scanning Module:c:\windows\system32\credui.dll… Scanning Module:c:\windows\system32\WZCSAPI.DLL… Scanning Module:c:\windows\system32\wuauserv.dll… Scanning Module:c:\windows\system32\wbem\wmisvc.dll… Scanning Module:C:\WINDOWS\system32\VSSAPI.DLL… Scanning Module:C:\WINDOWS\system32\wuaueng.dll… Scanning Module:C:\WINDOWS\System32\ADVPACK.dll… Scanning Module:C:\WINDOWS\System32\mspatcha.dll… Scanning Module:c:\windows\system32\trkwks.dll… Scanning Module:c:\windows\system32\srsvc.dll… Scanning Module:c:\windows\system32\POWRPROF.dll… Scanning Module:c:\windows\system32\sens.dll… Scanning Module:c:\windows\system32\seclogon.dll… Scanning Module:C:\WINDOWS\System32\upnp.dll… Scanning Module:C:\WINDOWS\System32\SSDPAPI.dll… Scanning Module:C:\WINDOWS\System32\wbem\wbemcomn.dll… Scanning Module:c:\windows\system32\browser.dll… Scanning Module:C:\WINDOWS\System32\netcfgx.dll… Scanning Module:C:\WINDOWS\System32\CLUSAPI.dll… Scanning Module:c:\windows\system32\wscsvc.dll… Scanning Module:c:\windows\system32\msi.dll… Scanning Module:c:\windows\system32\ipnathlp.dll… Scanning Module:C:\WINDOWS\System32\msxml3.dll… Scanning Module:C:\WINDOWS\system32\comsvcs.dll… Scanning Module:C:\WINDOWS\system32\MTXCLU.DLL… Scanning Module:C:\WINDOWS\system32\WSOCK32.dll… Scanning Module:C:\WINDOWS\system32\colbact.DLL… Scanning Module:C:\WINDOWS\System32\RESUTILS.DLL… Scanning Module:C:\WINDOWS\System32\rasmans.dll… Scanning Module:C:\WINDOWS\System32\Wbem\wbemcore.dll… Scanning Module:C:\WINDOWS\System32\Wbem\esscli.dll… Scanning Module:C:\WINDOWS\System32\Wbem\FastProx.dll… Scanning Module:C:\WINDOWS\System32\wbem\wbemsvc.dll… Scanning Module:C:\WINDOWS\System32\wbem\wmiutils.dll… Scanning Module:C:\WINDOWS\System32\wbem\repdrvfs.dll… Scanning Module:c:\windows\system32\tapisrv.dll… Scanning Module:C:\WINDOWS\System32\wbem\wmiprvsd.dll… Scanning Module:C:\WINDOWS\System32\rastapi.dll… Scanning Module:C:\WINDOWS\System32\wbem\wbemess.dll… Scanning Module:C:\WINDOWS\System32\unimdm.tsp… Scanning Module:C:\WINDOWS\System32\uniplat.dll… Scanning Module:C:\WINDOWS\System32\unimdmat.dll… Scanning Module:C:\WINDOWS\system32\modemui.dll… Scanning Module:C:\WINDOWS\System32\kmddsp.tsp… Scanning Module:C:\WINDOWS\System32\ndptsp.tsp… Scanning Module:C:\WINDOWS\System32\ipconf.tsp… Scanning Module:C:\WINDOWS\System32\h323.tsp… Scanning Module:C:\WINDOWS\System32\hidphone.tsp… Scanning Module:C:\WINDOWS\System32\HID.DLL… Scanning Module:C:\WINDOWS\System32\rasppp.dll… Scanning Module:C:\WINDOWS\System32\ntlsapi.dll… Scanning Module:C:\WINDOWS\System32\RASDLG.dll… Scanning Module:C:\WINDOWS\System32\qmgrprxy.dll… Scanning Module:C:\WINDOWS\System32\cryptnet.dll… Scanning Module:C:\WINDOWS\System32\SensApi.dll… Scanning Module:C:\WINDOWS\System32\wuapi.dll… Scanning Module:C:\WINDOWS\System32\ACTXPRXY.DLL… #:9 [svchost.exe] ModuleName : C:\WINDOWS\System32\svchost.exe Command Line : C:\WINDOWS\System32\svchost.exe -k LocalService ProcessID : 980 ThreadCreationTime : 1-4-2005 1:51:03 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe Scanning Module:c:\windows\system32\lmhsvc.dll… Scanning Module:c:\windows\system32\webclnt.dll… Scanning Module:c:\windows\system32\ssdpsrv.dll… #:10 [spoolsv.exe] ModuleName : C:\WINDOWS\system32\spoolsv.exe Command Line : C:\WINDOWS\system32\spoolsv.exe ProcessID : 1152 ThreadCreationTime : 1-4-2005 1:51:08 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Spooler SubSystem App InternalName : spoolsv.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : spoolsv.exe Scanning Module:C:\WINDOWS\system32\spoolsv.exe… Scanning Module:C:\WINDOWS\system32\SPOOLSS.DLL… Scanning Module:C:\WINDOWS\system32\localspl.dll… Scanning Module:C:\WINDOWS\system32\cnbjmon.dll… Scanning Module:C:\WINDOWS\system32\pjlmon.dll… Scanning Module:C:\WINDOWS\system32\tcpmon.dll… Scanning Module:C:\WINDOWS\system32\usbmon.dll… Scanning Module:C:\WINDOWS\System32\spool\PRTPROCS\W32X86\WfxPrint2000.dll… Scanning Module:C:\WINDOWS\system32\win32spl.dll… Scanning Module:C:\WINDOWS\system32\NETRAP.dll… Scanning Module:C:\WINDOWS\system32\inetpp.dll… #:11 [explorer.exe] ModuleName : C:\WINDOWS\Explorer.EXE Command Line : C:\WINDOWS\Explorer.EXE ProcessID : 1372 ThreadCreationTime : 1-4-2005 1:51:13 AM BasePriority : Normal FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 6.00.2900.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Windows Explorer InternalName : explorer LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : EXPLORER.EXE Scanning Module:C:\WINDOWS\Explorer.EXE… Scanning Module:C:\WINDOWS\system32\BROWSEUI.dll… Scanning Module:C:\WINDOWS\system32\SHDOCVW.dll… Scanning Module:C:\WINDOWS\System32\themeui.dll… Scanning Module:C:\WINDOWS\System32\MSIMG32.dll… Scanning Module:C:\WINDOWS\system32\browselc.dll… Scanning Module:C:\WINDOWS\system32\LINKINFO.dll… Scanning Module:C:\WINDOWS\system32\ntshrui.dll… Scanning Module:C:\WINDOWS\System32\webcheck.dll… Scanning Module:C:\WINDOWS\System32\stobject.dll… Scanning Module:C:\WINDOWS\System32\BatMeter.dll… Scanning Module:C:\WINDOWS\System32\cabinet9.exe… Scanning Module:C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL… Scanning Module:C:\WINDOWS\System32\drprov.dll… Scanning Module:C:\WINDOWS\System32\ntlanman.dll… Scanning Module:C:\WINDOWS\System32\NETUI0.dll… Scanning Module:C:\WINDOWS\System32\NETUI1.dll… Scanning Module:C:\WINDOWS\System32\davclnt.dll… Scanning Module:C:\WINDOWS\system32\shdoclc.dll… Scanning Module:C:\Program Files\SpywareGuard\spywareguard.dll… Scanning Module:C:\WINDOWS\system32\MSVBVM60.DLL… Scanning Module:c:\Program Files\interMute\SpySubtract\sshook.dll… Scanning Module:C:\WINDOWS\system32\DUSER.dll… Scanning Module:C:\WINDOWS\system32\MLANG.dll… Scanning Module:C:\WINDOWS\System32\CFGMGR32.dll… Scanning Module:C:\WINDOWS\System32\mydocs.dll… Scanning Module:C:\Program Files\Common Files\Symantec Shared\Script Blocking\scrauth.dll… Scanning Module:C:\Program Files\Common Files\Symantec Shared\Script Blocking\ScrBlock.dll… Scanning Module:c:\windows\system32\jscript.dll… Scanning Module:C:\WINDOWS\system32\query.dll… Scanning Module:C:\Program Files\Common Files\System\OLE DB\OLEDB32.DLL… Scanning Module:C:\WINDOWS\system32\MSDART.DLL… Scanning Module:C:\Program Files\Common Files\System\OLE DB\OLEDB32R.DLL… Scanning Module:C:\WINDOWS\system32\PRINTUI.dll… Scanning Module:C:\WINDOWS\System32\zipfldr.dll… Scanning Module:C:\WINDOWS\System32\igfxpph.dll… Scanning Module:C:\WINDOWS\system32\igfxres.dll… Scanning Module:C:\WINDOWS\System32\igfxdev.dll… Scanning Module:C:\WINDOWS\system32\igfxress.dll… Scanning Module:C:\WINDOWS\System32\mscoree.dll… Scanning Module:C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\Shfusion.dll… Scanning Module:C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\MSVCR70.dll… Scanning Module:C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\gdiplus.dll… Scanning Module:C:\PROGRA~1\Yahoo!\Common\ymmapi20040613.dll… Scanning Module:C:\Program Files\Norton AntiVirus\NavShExt.dll… Scanning Module:C:\WINDOWS\System32\sendmail.dll… Scanning Module:C:\WINDOWS\System32\shgina.dll… Scanning Module:C:\WINDOWS\system32\wiashext.dll… Scanning Module:C:\WINDOWS\System32\sti.dll… Scanning Module:C:\Program Files\SpywareGuard\dlprotect.dll… #:12 [cisvc.exe] ModuleName : C:\WINDOWS\System32\cisvc.exe Command Line : C:\WINDOWS\System32\cisvc.exe ProcessID : 1500 ThreadCreationTime : 1-4-2005 1:51:16 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Content Index service InternalName : cisvc.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : cisvc.exe Scanning Module:C:\WINDOWS\System32\cisvc.exe… #:13 [navapsvc.exe] ModuleName : C:\Program Files\Norton AntiVirus\navapsvc.exe Command Line : "C:\Program Files\Norton AntiVirus\navapsvc.exe" ProcessID : 1532 ThreadCreationTime : 1-4-2005 1:51:18 AM BasePriority : Normal FileVersion : 8.07.17 ProductVersion : 8.07.17 ProductName : Norton AntiVirus CompanyName : Symantec Corporation FileDescription : Norton AntiVirus Auto-Protect Service InternalName : NAVAPSVC LegalCopyright : Copyright © 2000-2002 Symantec Corporation. All rights reserved. OriginalFilename : NAVAPSVC.EXE Scanning Module:C:\Program Files\Norton AntiVirus\navapsvc.exe… #:14 [svchost.exe] ModuleName : C:\WINDOWS\System32\svchost.exe Command Line : C:\WINDOWS\System32\svchost.exe -k imgsvc ProcessID : 1620 ThreadCreationTime : 1-4-2005 1:51:20 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe Scanning Module:c:\windows\system32\wiaservc.dll… Scanning Module:c:\windows\system32\mscms.dll… #:15 [hkcmd.exe] ModuleName : C:\WINDOWS\System32\hkcmd.exe Command Line : "C:\WINDOWS\System32\hkcmd.exe" ProcessID : 1880 ThreadCreationTime : 1-4-2005 1:51:28 AM BasePriority : Normal FileVersion : 3,0,0,1715 ProductVersion : 7,0,0,1715 ProductName : Intel® Common User Interface CompanyName : Intel Corporation FileDescription : hkcmd Module InternalName : HKCMD LegalCopyright : Copyright 1999-2002, Intel Corporation OriginalFilename : HKCMD.EXE Scanning Module:C:\WINDOWS\System32\hkcmd.exe… Scanning Module:C:\WINDOWS\System32\igfxhk.dll… #:16 [bcmsmmsg.exe] ModuleName : C:\WINDOWS\BCMSMMSG.exe Command Line : "C:\WINDOWS\BCMSMMSG.exe" ProcessID : 1892 ThreadCreationTime : 1-4-2005 1:51:28 AM BasePriority : Normal FileVersion : 3.5.25 08/27/2003 20:04:35 ProductVersion : 3.5.25 08/27/2003 20:04:35 ProductName : BCM Modem Messaging Applet CompanyName : Broadcom Corporation FileDescription : Modem Messaging Applet InternalName : smdmstat.exe LegalCopyright : Copyright © Broadcom Corporation 1998-2000 OriginalFilename : smdmstat.exe Scanning Module:C:\WINDOWS\BCMSMMSG.exe… #:17 [navapw32.exe] ModuleName : C:\PROGRA~1\NORTON~1\navapw32.exe Command Line : "C:\PROGRA~1\NORTON~1\navapw32.exe" ProcessID : 1920 ThreadCreationTime : 1-4-2005 1:51:28 AM BasePriority : Normal FileVersion : 8.07.17 ProductVersion : 8.07.17 ProductName : Norton AntiVirus CompanyName : Symantec Corporation FileDescription : Norton AntiVirus Agent InternalName : NAVAPW32 LegalCopyright : Copyright © 2000-2002 Symantec Corporation. All rights reserved. OriginalFilename : NAVAPW32.EXE Scanning Module:C:\PROGRA~1\NORTON~1\navapw32.exe… Scanning Module:C:\PROGRA~1\NORTON~1\apwutil.dll… Scanning Module:C:\PROGRA~1\NORTON~1\apwcmdnt.dll… Scanning Module:C:\PROGRA~1\NORTON~1\DefAlert.dll… Scanning Module:C:\PROGRA~1\NORTON~1\NAVProxy.dll… Scanning Module:C:\WINDOWS\system32\SYMREDIR.dll… Scanning Module:C:\WINDOWS\System32\mshtml.dll… Scanning Module:C:\WINDOWS\System32\msls31.dll… Scanning Module:C:\WINDOWS\system32\MSRATING.dll… Scanning Module:C:\WINDOWS\system32\msratelc.dll… Scanning Module:C:\WINDOWS\System32\MSCTF.dll… #:18 [directcd.exe] ModuleName : C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe Command Line : "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" ProcessID : 1964 ThreadCreationTime : 1-4-2005 1:51:29 AM BasePriority : Normal FileVersion : 5.2.0.91 ProductVersion : 5.2.0.91 ProductName : DirectCD CompanyName : Roxio FileDescription : DirectCD Application InternalName : DirectCD LegalCopyright : Copyright © 2001-2002, Roxio, Inc. OriginalFilename : Directcd.exe Scanning Module:C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe… Scanning Module:C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\CDUDFLIB.dll… Scanning Module:C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\UDFRWLIB.dll… Scanning Module:C:\WINDOWS\system32\oledlg.dll… Scanning Module:C:\WINDOWS\system32\OLEPRO32.DLL… #:19 [support.exe] ModuleName : C:\Program Files\Common Files\Dell\EUSW\Support.exe Command Line : "C:\Program Files\Common Files\Dell\EUSW\Support.exe" ProcessID : 2024 ThreadCreationTime : 1-4-2005 1:51:30 AM BasePriority : Normal FileVersion : 2, 0, 0, 33 ProductVersion : 1, 0, 0, 1 ProductName : Dell Support CompanyName : Dell FileDescription : Support InternalName : Support LegalCopyright : Copyright © 2002 OriginalFilename : Support.exe Scanning Module:C:\Program Files\Common Files\Dell\EUSW\Support.exe… Scanning Module:C:\Program Files\Common Files\Dell\EUSW\DellUtil.dll… Scanning Module:C:\Program Files\Common Files\Dell\EUSW\DDSM.dll… #:20 [realplay.exe] ModuleName : C:\Program Files\Real\RealPlayer\RealPlay.exe Command Line : "C:\Program Files\Real\RealPlayer\RealPlay.exe" SYSTEMBOOTHIDEPLAYER ProcessID : 2032 ThreadCreationTime : 1-4-2005 1:51:31 AM BasePriority : Normal FileVersion : 6.0.9.584 ProductVersion : 6.0.9.584 ProductName : RealPlayer (32-bit) CompanyName : RealNetworks, Inc. FileDescription : RealPlayer InternalName : REALPLAY LegalCopyright : Copyright © RealNetworks, Inc. 1995-2000 LegalTrademarks : RealAudio™ is a trademark of RealNetworks, Inc. OriginalFilename : REALPLAY.EXE Scanning Module:C:\Program Files\Real\RealPlayer\RealPlay.exe… Scanning Module:C:\WINDOWS\system32\PNCRT.dll… Scanning Module:C:\Program Files\Real\RealPlayer\rpap3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Common\pngu3266.dll… Scanning Module:C:\Program Files\Common Files\Real\Common\pnrs3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Common\rpcl3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Common\pnen3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\audp3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\auth3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\basc3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\Dbc_hbrf.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\Dbc_hbrr.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\memf3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\meta3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\mp3f3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\mp3m3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\mp3r3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\ntau3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\plus3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\pnxr3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\ppff3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\pxcg3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\pxcj3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\pxcp3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\pxff3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\pxgf3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\pxgr3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\pxjf3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\pxjr3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\pxpf3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\pxpr3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\pxre3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\rare3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\rn5a3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\rtff3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\rtre3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\rupf3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\rupr3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\rvre3260.dll… Scanning Module:C:\WINDOWS\system32\MSVFW32.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\sdpp3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\smlf3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\smlr3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\smmr3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\smpl3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\stub3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\swff3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Plugins\vidp3260.dll… Scanning Module:C:\Program Files\Real\RealPlayer\rnms3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Update\rnqu3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Update\rpup3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Update\upgr3260.dll… Scanning Module:C:\Program Files\Common Files\Real\Update\setu3260.dll… #:21 [cfd.exe] ModuleName : C:\Program Files\BroadJump\Client Foundation\CFD.exe Command Line : "C:\Program Files\BroadJump\Client Foundation\CFD.exe" ProcessID : 152 ThreadCreationTime : 1-4-2005 1:51:31 AM BasePriority : Normal Scanning Module:C:\Program Files\BroadJump\Client Foundation\CFD.exe… Scanning Module:C:\Program Files\BroadJump\Client Foundation\stlport_4_0_0_DDR.dll… Scanning Module:C:\Program Files\BroadJump\Client Foundation\BJIntlCore_1_1_DDR.dll… Scanning Module:C:\Program Files\BroadJump\Client Foundation\BJComRT.dll… Scanning Module:C:\Program Files\BroadJump\Client Foundation\BasicLoaderService.dll… Scanning Module:C:\Program Files\BroadJump\Client Foundation\AppProperties.dll… Scanning Module:C:\Program Files\BroadJump\Client Foundation\BJComBase.dll… Scanning Module:C:\Program Files\BroadJump\Client Foundation\TimerManager.dll… Scanning Module:C:\Program Files\BroadJump\Client Foundation\BJComSRCManager.dll… #:22 [tgcmd.exe] ModuleName : C:\Program Files\Support.com\bin\tgcmd.exe Command Line : "C:\Program Files\Support.com\bin\tgcmd.exe" /server /nosystray ProcessID : 344 ThreadCreationTime : 1-4-2005 1:51:34 AM BasePriority : Normal FileVersion : 5,5,479,0 ProductVersion : 5,5,479,0 ProductName : Support.com Scheduler and Command Dispatcher CompanyName : Support.com, Inc. FileDescription : Support.com Scheduler and Command Dispatcher InternalName : TGCMD LegalCopyright : Copyright 1997-2069 Support.com OriginalFilename : TGCMD.EXE Scanning Module:C:\Program Files\Support.com\bin\tgcmd.exe… Scanning Module:C:\Program Files\Support.com\bin\sdcmon.dll… #:23 [viewmgr.exe] ModuleName : C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe Command Line : "C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe" ProcessID : 388 ThreadCreationTime : 1-4-2005 1:51:36 AM BasePriority : Normal FileVersion : 2, 0, 0, 42 ProductVersion : 2, 0, 0, 42 ProductName : Viewpoint Manager CompanyName : Viewpoint Corporation FileDescription : ViewMgr InternalName : Viewpoint Manager LegalCopyright : Copyright © 2004 OriginalFilename : ViewMgr.exe Comments : Viewpoint Manager Scanning Module:C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe… Scanning Module:C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgrCore.dll… Scanning Module:C:\WINDOWS\system32\oleacc.dll… #:24 [cabinet7.exe] ModuleName : C:\WINDOWS\System32\cabinet7.exe Command Line : "C:\WINDOWS\System32\cabinet7.exe" ProcessID : 412 ThreadCreationTime : 1-4-2005 1:51:37 AM BasePriority : Normal Scanning Module:C:\WINDOWS\System32\cabinet7.exe… #:25 [pupxpman.exe] ModuleName : C:\WINDOWS\system32\pupxpman.exe Command Line : "C:\WINDOWS\system32\pupxpman.exe" ProcessID : 488 ThreadCreationTime : 1-4-2005 1:51:37 AM BasePriority : Normal FileVersion : 1.04.0347 ProductVersion : 1.04.0347 ProductName : PwrUpManager CompanyName : ashampoo GmbH & Co. KG FileDescription : Ashampoo PowerUp XP InternalName : pupxpman LegalCopyright : ashampoo GmbH & Co. KG OriginalFilename : pupxpman.exe Scanning Module:C:\WINDOWS\system32\pupxpman.exe… Scanning Module:C:\WINDOWS\system32\TABCTL32.OCX… Scanning Module:C:\WINDOWS\system32\PUTREE.OCX… Scanning Module:C:\WINDOWS\system32\MFC42.DLL… #:26 [jusched.exe] ModuleName : C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe Command Line : "C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe" ProcessID : 920 ThreadCreationTime : 1-4-2005 1:51:39 AM BasePriority : Normal Scanning Module:C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe… #:27 [rundll32.exe] ModuleName : C:\WINDOWS\system32\rundll32.exe Command Line : "C:\WINDOWS\system32\rundll32.exe" C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s ProcessID : 1116 ThreadCreationTime : 1-4-2005 1:51:40 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Run a DLL as an App InternalName : rundll LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : RUNDLL.EXE Scanning Module:C:\WINDOWS\system32\rundll32.exe… #:28 [teatimer.exe] ModuleName : C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe Command Line : "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" ProcessID : 2056 ThreadCreationTime : 1-4-2005 1:51:47 AM BasePriority : Idle FileVersion : 1, 3, 0, 12 ProductVersion : 1, 3, 0, 12 ProductName : Spybot - Search & Destroy CompanyName : Safer Networking Limited FileDescription : System settings protector InternalName : TeaTimer LegalCopyright : © 2000-2004 Patrick M. Kolla / Safer Networking Limited. Alle Rechte vorbehalten. LegalTrademarks : "Spybot" und "Spybot - Search & Destroy" sind registrierte Warenzeichen. OriginalFilename : TeaTimer.exe Comments : Schützt Systemeinstellungen vor ungewollten Änderungen. Scanning Module:C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe… Scanning Module:C:\WINDOWS\system32\hhctrl.ocx… #:29 [w?wexec.exe] ModuleName : C:\WINDOWS\system32\w?wexec.exe Command Line : "C:\WINDOWS\system32\w?wexec.exe" ProcessID : 2076 ThreadCreationTime : 1-4-2005 1:51:47 AM BasePriority : Normal Scanning Module:C:\WINDOWS\system32\w?wexec.exe… #:30 [dlg.exe] ModuleName : C:\Program Files\Digital Line Detect\DLG.exe Command Line : "C:\Program Files\Digital Line Detect\DLG.exe" ProcessID : 2140 ThreadCreationTime : 1-4-2005 1:51:52 AM BasePriority : Normal FileVersion : 1, 0, 0, 1 ProductVersion : 1, 0, 0, 1 ProductName : BVRP Software TestLine CompanyName : BVRP Software FileDescription : Digital Line Detection InternalName : TestLine LegalCopyright : Copyright © 2001 OriginalFilename : TestLine.exe Scanning Module:C:\Program Files\Digital Line Detect\DLG.exe… Scanning Module:C:\Program Files\Digital Line Detect\BVRPDIAG.dll… Scanning Module:C:\Program Files\Digital Line Detect\broadcom.dll… Scanning Module:C:\WINDOWS\system32\bcmdmmoh.dll… #:31 [cmanager.exe] ModuleName : C:\Program Files\BellSouth\Connection Manager\CManager.exe Command Line : "C:\Program Files\BellSouth\Connection Manager\CManager.exe" ProcessID : 2152 ThreadCreationTime : 1-4-2005 1:51:52 AM BasePriority : Normal Scanning Module:C:\Program Files\BellSouth\Connection Manager\CManager.exe… Scanning Module:C:\Program Files\BellSouth\Connection Manager\BJIntlCore_1_1_DDR.dll… Scanning Module:C:\Program Files\BellSouth\Connection Manager\stlport_4_0_0_DDR.dll… Scanning Module:C:\Program Files\BellSouth\Connection Manager\BJIntlFormat_1_1_DDR.dll… Scanning Module:C:\Program Files\BellSouth\Connection Manager\wffDDR.dll… Scanning Module:C:\Program Files\BellSouth\Connection Manager\LIBEAY32_1-1-0_DDR.DLL… Scanning Module:C:\Program Files\BellSouth\Connection Manager\xerces-c_1_40_0_DDR.dll… Scanning Module:C:\Program Files\BellSouth\Connection Manager\BJComRT.dll… Scanning Module:C:\Program Files\BellSouth\Connection Manager\BasicLoaderService.dll… Scanning Module:C:\Program Files\BellSouth\Connection Manager\AppProperties.dll… Scanning Module:C:\Program Files\BellSouth\Connection Manager\BJComBase.dll… Scanning Module:C:\WINDOWS\system32\plugin.ocx… Scanning Module:C:\WINDOWS\System32\inetcomm.dll… Scanning Module:C:\WINDOWS\System32\MSOERT2.dll… Scanning Module:C:\WINDOWS\System32\inetres.dll… Scanning Module:C:\WINDOWS\System32\msimtf.dll… #:32 [alg.exe] ModuleName : C:\WINDOWS\System32\alg.exe Command Line : C:\WINDOWS\System32\alg.exe ProcessID : 2180 ThreadCreationTime : 1-4-2005 1:51:54 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Application Layer Gateway Service InternalName : ALG.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : ALG.exe Scanning Module:C:\WINDOWS\System32\alg.exe… #:33 [spysub.exe] ModuleName : C:\Program Files\interMute\SpySubtract\SpySub.exe Command Line : "C:\Program Files\interMute\SpySubtract\SpySub.exe" -autostart ProcessID : 2196 ThreadCreationTime : 1-4-2005 1:51:54 AM BasePriority : Normal FileVersion : 1, 0, 1, 49 ProductVersion : 2.60 ProductName : SpySubtract CompanyName : InterMute, Inc. FileDescription : SpySubtract Program EXE InternalName : SpySub.exe LegalCopyright : Copyright © 2004 InterMute, Inc. All rights reserved. OriginalFilename : SpySub.exe Scanning Module:C:\Program Files\interMute\SpySubtract\SpySub.exe… Scanning Module:c:\Program Files\interMute\SpySubtract\en-us.dll… Scanning Module:C:\WINDOWS\system32\RICHED32.DLL… Scanning Module:C:\WINDOWS\system32\RICHED20.dll… Scanning Module:c:\Program Files\interMute\SpySubtract\ssengine.dll… Scanning Module:C:\Program Files\Common Files\System\ADO\MSADO15.DLL… Scanning Module:C:\WINDOWS\System32\msjetoledb40.dll… Scanning Module:C:\WINDOWS\System32\msjet40.dll… Scanning Module:C:\WINDOWS\System32\mswstr10.dll… Scanning Module:C:\WINDOWS\System32\msjter40.dll… Scanning Module:C:\WINDOWS\System32\MSJINT40.DLL… Scanning Module:C:\WINDOWS\System32\msjtes40.dll… Scanning Module:C:\WINDOWS\system32\VBAJET32.DLL… Scanning Module:C:\WINDOWS\system32\expsrv.dll… Scanning Module:C:\Program Files\Common Files\System\ADO\MSADRH15.DLL… Scanning Module:C:\WINDOWS\System32\mshtmled.dll… #:34 [sgmain.exe] ModuleName : C:\Program Files\SpywareGuard\sgmain.exe Command Line : "C:\Program Files\SpywareGuard\sgmain.exe" ProcessID : 2312 ThreadCreationTime : 1-4-2005 1:51:55 AM BasePriority : Normal FileVersion : 2.02.0001 ProductVersion : 2.02.0001 ProductName : SpywareGuard FileDescription : SpywareGuard InternalName : sgmain LegalCopyright : Copyright © 2002-2003 Javacool Software LLC OriginalFilename : sgmain.exe Comments : SpywareGuard Scanning Module:C:\Program Files\SpywareGuard\sgmain.exe… Scanning Module:C:\WINDOWS\system32\mscomctl.ocx… Scanning Module:C:\WINDOWS\system32\asycfilt.dll… Scanning Module:C:\WINDOWS\system32\RICHTX32.OCX… Scanning Module:C:\WINDOWS\System32\scrrun.dll… #:35 [wscntfy.exe] ModuleName : C:\WINDOWS\system32\wscntfy.exe Command Line : C:\WINDOWS\system32\wscntfy.exe ProcessID : 2340 ThreadCreationTime : 1-4-2005 1:51:56 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Windows Security Center Notification App InternalName : wscntfy.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : wscntfy.exe Scanning Module:C:\WINDOWS\system32\wscntfy.exe… #:36 [sgbhp.exe] ModuleName : C:\Program Files\SpywareGuard\sgbhp.exe Command Line : "C:\Program Files\SpywareGuard\sgbhp.exe" ProcessID : 2476 ThreadCreationTime : 1-4-2005 1:52:00 AM BasePriority : Normal FileVersion : 2.02.0001 ProductVersion : 2.02.0001 ProductName : SG Browser Hijacking Protection FileDescription : SG Browser Hijacking Protection InternalName : sgbhp LegalCopyright : Copyright © 2002-2003 Javacool Software LLC. OriginalFilename : sgbhp.exe Comments : SG Browser Hijacking Protection Scanning Module:C:\Program Files\SpywareGuard\sgbhp.exe… #:37 [ccd.exe] ModuleName : C:\PROGRA~1\BROADJ~1\CORREC~1\CCD.exe Command Line : C:\PROGRA~1\BROADJ~1\CORREC~1\CCD.exe -Embedding ProcessID : 2580 ThreadCreationTime : 1-4-2005 1:52:04 AM BasePriority : Normal Scanning Module:C:\PROGRA~1\BROADJ~1\CORREC~1\CCD.exe… Scanning Module:C:\PROGRA~1\BROADJ~1\CORREC~1\BJIntlCore_1_1_DDR.dll… Scanning Module:C:\PROGRA~1\BROADJ~1\CORREC~1\stlport_4_0_0_DDR.dll… Scanning Module:C:\PROGRA~1\BROADJ~1\CORREC~1\BJComRT.dll… Scanning Module:C:\PROGRA~1\BROADJ~1\CORREC~1\BasicLoaderService.dll… Scanning Module:C:\PROGRA~1\BROADJ~1\CORREC~1\AppProperties.dll… Scanning Module:C:\PROGRA~1\BROADJ~1\CORREC~1\BJComBase.dll… Scanning Module:C:\PROGRA~1\BROADJ~1\CORREC~1\BJComSRCManager.dll… Scanning Module:C:\PROGRA~1\BROADJ~1\CORREC~1\CCMonitor.dll… Scanning Module:C:\WINDOWS\system32\ICMP.DLL… Scanning Module:C:\PROGRA~1\BROADJ~1\CORREC~1\CCPropertyBag.dll… Scanning Module:C:\PROGRA~1\BROADJ~1\CORREC~1\CCCpeMgr.dll… Scanning Module:C:\PROGRA~1\BROADJ~1\CORREC~1\CCConnectionMgr.dll… Scanning Module:C:\PROGRA~1\BROADJ~1\CORREC~1\CCEthernetMgr.dll… Scanning Module:C:\PROGRA~1\BROADJ~1\CORREC~1\CCDunMgr.dll… Scanning Module:C:\PROGRA~1\BROADJ~1\CORREC~1\BJRas_2_0_DDR.dll… Scanning Module:C:\PROGRA~1\BROADJ~1\CORREC~1\CCDunSamMgr.dll… Scanning Module:C:\PROGRA~1\BROADJ~1\CORREC~1\CCNtsMgr.dll… #:38 [cidaemon.exe] ModuleName : C:\WINDOWS\system32\cidaemon.exe Command Line : "cidaemon.exe" DownLevelDaemon "c:\program files\dell\support\ui\search\catalog.wci" 196672l 1500l ProcessID : 3632 ThreadCreationTime : 1-4-2005 1:58:42 AM BasePriority : Idle FileVersion : 5.1.2600.0 (xpclient.010817-1148) ProductVersion : 5.1.2600.0 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Indexing Service filter daemon InternalName : cidaemon.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : cidaemon.exe Scanning Module:C:\WINDOWS\system32\cidaemon.exe… #:39 [homelandnetwork.exe] ModuleName : C:\Program Files\HomelandNetwork\HomelandNetwork.exe Command Line : "C:\Program Files\HomelandNetwork\HomelandNetwork.exe" ProcessID : 584 ThreadCreationTime : 1-4-2005 2:45:40 AM BasePriority : Normal FileVersion : 1.0.0.17 ProductVersion : 1.0.0.17 ProductName : Homeland Network CompanyName : Homeland Network FileDescription : Homeland Notifier InternalName : HomelandNetwork.exe LegalCopyright : © Homeland Systems. All rights reserved. OriginalFilename : HomelandNetwork.exe Scanning Module:C:\Program Files\HomelandNetwork\HomelandNetwork.exe… #:40 [cmd.exe] ModuleName : C:\WINDOWS\system32\cmd.exe Command Line : "C:\WINDOWS\system32\cmd.exe" ProcessID : 2936 ThreadCreationTime : 1-4-2005 4:20:11 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Windows Command Processor InternalName : cmd LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : Cmd.Exe Scanning Module:C:\WINDOWS\system32\cmd.exe… #:41 [csrss.exe] ModuleName : \??\C:\WINDOWS\system32\csrss.exe Command Line : C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestTh ProcessID : 4052 ThreadCreationTime : 1-4-2005 10:21:22 PM BasePriority : Normal #:42 [winlogon.exe] ModuleName : \??\C:\WINDOWS\system32\winlogon.exe Command Line : winlogon.exe ProcessID : 256 ThreadCreationTime : 1-4-2005 10:21:24 PM BasePriority : High #:43 [explorer.exe] ModuleName : C:\WINDOWS\Explorer.EXE Command Line : C:\WINDOWS\Explorer.EXE ProcessID : 2452 ThreadCreationTime : 1-4-2005 10:21:33 PM BasePriority : Normal FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 6.00.2900.2180 ProductName : Microsoft® Windows® Operating System

Here's how to post a Hijack This log

Download "HijackThis" here
When downloading, choose "save to disk" and NOT open!

Now create a new folder for it, C:\Hijackthis, for example.
After unzipping the file. to C:\Hijack This, you'll end up with the file itself, which is Hijackthis.exe, and that's the one you'll need to doubleclick.'

When the program launches, hit the "Scan" button
When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, and save the log anywhere you like.

Now if you doubleclick the log file.Go to Edit > Select all, then to Edit > copy.
Now you've copied the entire text to the Windows Clipboard (this happens behind your back.)

Next, go back to this forum thread, and click "Add Reply".
In an empty area click your RIGHT mouse button, and choose 'Paste' from the context menu.
There's your Hijack This log.

Please go to add and remove programs and remove,
Viewpoint
NewDotNet

Close all Browser and Program Windows and have HijackThis fix the following.
Do this by checking the box beside each and then clicking on Fix checked.

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank

O2 - BHO: (no name) - {8DA5457F-A8AA-4CCF-A842-70E6FD274094} - (no file)
O2 - BHO: (no name) - {4AFC165C-B232-77C7-D30B-12550BF07A49} - (no file)
O2 - BHO: (no name) - {01144A99-F30E-A5FE-5F4F-89CAC9D3999C} - C:\WINDOWS\system32\nptw.dll

O3 - Toolbar: (no name) - {B195B3B3-8A05-11D3-97A4-0004ACA6948E} - (no file)

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -
O16 - DPF: {B843DA96-2B2D-447E-90AB-B92929AA11AF} -
O16 - DPF: {00000075-9980-0010-8000-00AA00389B71} -
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) -
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) -

Then Download System Security Suite. Extract it from the zip file into a folder.
http://www.igorshpak.net/software/3ssetup104.zip
Under "items to clear" click all. Then click "clear selected items"

Go here and run online scans (all), allow them to delete whatever they find:

TrendMicro HouseCall
Panda ActiveScan
Note any thing that can't be fixed
Reboot when done. Rescan with HJT and post a new log here.

Reboot and Rescan with HJT and post a new log here.
Also please describe how your computer behaves at the moment.

You have one (or more) of these programs running on your machine and that is good.

Winpatrol
Spywareguard
Spybot s&d (Teatimer option)<<<

But prior to doing the fix below with hijackthis they need to be turned off.
Please do the following.

Right click the running icon of spybot's teatimer, and choose exit.<<<
Right click the running icon of winpatrol, and choose exit.
Right click the running icon of Spywareguard, it will open the program, Menu, file, exit, and confirm the programs close.

Unless they are turned off they could interfer with the fix by hijackthis.



Download this file rem.zip from
http://forums.skads.org/index.php?showtopic=80
unzip it to the system32 folder.
Reboot into safe mode.
Please reboot into safe mode (continually tap the F8 key while your system is starting, select Safe Mode from the menu).
Run rem.bat, wait untill it closes.

Reboot back to normal, post the log.txt which will be at this location c:\log.txt
And a new Hijackthis log.

Should you need instructions for ;
Showing hidden files and folders in Windows.
Reboot in safe mode.
Click the underlined links above.

Print these instructions or copy them to a note pad.


The following have randomly named file names, and as such are normally malware.
Follow their process tree. Right click on the file and go to Properties.
Then go to the Version tab to see what company name it's from:
If it's from some name you never heard of or if it's blank,
Please check for removal and delete the file in bold also.
Some of these files might have hidden atributes.

O4 - HKLM\..\Run: [ce664f553569] C:\WINDOWS\System32\cabinet7.exe
O4 - HKLM\..\Run: [7s7V3qW] wuprcdlg.exe


Reboot in SAFE MODE.

In safe mode navigate to the
C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.<<
Then reboot in safe mode
Rescan with HJT and post a new log here.

Should you need instructions for ;
Showing hidden files and folders in Windows.
Reboot in safe mode.
Click the underlined links above.


Reboot in SAFE MODE.
Some of these files might have hidden atributes.
Delete the following file(s) listed in bold

C:\documents and settings\jerome\local settings\temp\NMa.exe
C:\documents and settings\jerome\local settings\temp\95iz.exe
C:\documents and settings\jerome\local settings\temp\OZfLF3FZt.exe


Close all Browser and Program Windows and have HijackThis fix the following.
Do this by checking the box beside each and then clicking on Fix checked.
O4 - HKLM\..\Run: [NMa] C:\documents and settings\jerome\local settings\temp\NMa.exe
O4 - HKLM\..\Run: [95iz] C:\documents and settings\jerome\local settings\temp\95iz.exe
O4 - HKLM\..\Run: [NMa.exe] C:\documents and settings\jerome\local settings\temp\NMa.exe
O4 - HKLM\..\Run: [95iz.exe] C:\documents and settings\jerome\local settings\temp\95iz.exe
O4 - HKLM\..\Run: [OZfLF3FZt.exe] C:\documents and settings\jerome\local settings\temp\OZfLF3FZt.exe
O4 - HKLM\..\Run: [OZfLF3FZt] C:\documents and settings\jerome\local settings\temp\OZfLF3FZt.exe


Then In safe mode navigate to the C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.<<

Hello jerome johnson.

Little Eagle will be away for a couple weeks. He asked me to help out here.

Please Open Spybot S&D, click Mode>Advanced>Tools>Resident and remove the check from the Tea Timer box. You can reinstate it later but we don't want it interfering with what we need to do. Reboot when done.


I suggest you do this:


Use Add/Remove Programs and remove:
SpyHunter



Run Hijack This again and put a check by these.

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe

O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server /nosystray

O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\\SpyHunter.exe

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKCU\..\Run: [Gnyeti] C:\WINDOWS\system32\w?wexec.exe

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} -

O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} -

Close ALL windows and browsers except HijackThis and click "Fix checked"


Restart in Safe Mode:
Restart your computer.

Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen.
Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.


Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Search for and delete these files if listed:

C:\WINDOWS\system32\w?wexec.exe Be sure the file you delete is w?wexec.exe


Do this also if these Temp Folders are part of your OS.

Also in safe mode navigate to the C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.


Next navigate to the C:\Documents and Settings\(EVERY USER)\Local Settings\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

Finally go to Control Panel > Internet Options. On the General tab under "Temporary Internet Files" Click "Delete Files". Put a check by "Delete Offline Content" and click OK. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK.


Empty the Recycle Bin

Reboot and "copy/paste" a new log file into this thread.

Use ALT/CTRL/DEL and end the process for Tea Timer.



Run Hijack This again and put a check by these.

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} -

O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} -

Close ALL windows and browsers except HijackThis and click "Fix checked"


Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.