What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Posting My Log

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Greetings,

Could you please take a look at my log and let me know what I should to to repair it. I do appreciate your help in advance.

———————————————————————————————-




Logfile of HijackThis v1.99.1
Scan saved at 10:13:04 PM, on 26/05/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\Explorer.EXE
C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\Toolbar\TBPS.exe
C:\WINNT\system32\internat.exe
C:\PROGRAM FILES\REX6000\IntellisyncForRex\rexsymon.exe
C:\PROGRA~1\Toolbar\PIB.exe
c:\WINNT\TBSSaver.scr
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\iraj\LOCALS~1\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50226
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50226
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50226
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.1.1.127:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\ycomp5_5_7_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - C:\PROGRA~1\Toolbar\toolbar.dll
O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [RexSyMon] C:\PROGRAM FILES\REX6000\IntellisyncForRex\rexsymon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O9 - Extra button: (no name) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O15 - Trusted IP range: 206.161.125.149
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: Microsoft WFC Forms Designer - file://D:\VJ98\wfcforms.cab
O16 - DPF: Visual Studio 6 Extensibility Libraries - file://D:\VJ98\vstudio6.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potc_x.cab
O16 - DPF: Yahoo! Spelldown - http://download.games.yahoo.com/games/clients/y/sdt1_x.cab
O16 - DPF: Yahoo! Tic-Tac-Toe - http://download.games.yahoo.com/games/clients/y/ft3_x.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/en/deleon/1…n/GoogleNav.cab
O16 - DPF: {707FC7B7-B227-4DF6-A606-0EC317BB08A1} (PhotosCtrlCA Class) - http://ca.f1.pg.photos.yahoo.com/ocx/ca/yexplorer1_9ca.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundl…ArcadeRdxIE.cab
O18 - Protocol: tpro - {FF76A5DA-6158-4439-99FF-EDC1B3FE100C} - C:\PROGRA~1\Toolbar\toolbar.dll
O23 - Service: .NET Framework Service (.NET Connection Service) - Unknown owner - C:\WINNT\svchost.exe (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Crypkey License - Unknown owner - C:\WINNT\SYSTEM32\crypserv.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: USB to Serial COM Port Messages (RexService) - Unknown owner - C:\WINNT\SYSTEM32\RexSvc.exe
O23 - Service: WebSeach Toolbar support NT service (TBPSSvc) - Unknown owner - C:\PROGRA~1\Toolbar\TBPSSvc.exe
O23 - Service: WinTools for IE service (WinToolsSvc) - Unknown owner - C:\Program Files\Common Files\WinTools\WToolsS.exe
Post #4
Hello applisha and welcome to TomCoyote. :wavey:

Download CWShredder.exe to your desktop from one of these places:

http://www.majorgeeks.com/download.php?det=3019
http://www.intermute.com/spysubtract/cwshr…r_download.html
http://cwshredder.net/bin/CWShredder.exe

Double click on CWShredder.exe to clean up clicking FIX to have it remove all it finds. Reboot when completed.


Disable the offending Service
  • Click Start < Run and type services.msc.
  • Scroll down to WebSeach Toolbar support NT service and right click on it.
  • Click Properties and under Service Status click Stop, then under Startup Type change it to Disabled.
  • Repeat this for the service : WinTools for IE service
Go to Add/Remove Programs and remove the following items (You will need an active internet connection during removal).
Web search toolbar
Win-tools easy installer


Open Hijackthis and click None of the above, just start the program. Click Config… < Misc Tools < Open Uninstall Manager. Click Save list… and save the file as uninstall_list.txt to a location of your choice. Copy/Past the results of this file in your next reply.


Move HijackThis to Permanent Folder:
You are running HijackThis from a Temp directory. These are cleaned up on a regular basis thus the program will be removed.
  • Go to Start > My Computer > and double click on C:.
  • Now right click an open area and click New > folder and change the folder name to HJT.
  • Move HijackThis from the Temp folder into this new folder.
Scan with HijackThis and post the new log as a reply to this thread. Include the uninstall_list.txt.
Post #5
Hi Alan,

I do appreciate your help, you just don't know how much! :)

I did what you asked me to do, before posting the logs and reports please note:

1- The Shredder said: "could not find any CW…" something like that.

2- About Websearch toold bar , I did stop it, however, I could not disable it. The message for both was: Unable to open service TBPSSvc for writing on local computer. Error 5: access is denied the same happened for disabling Win Tools for IE.

3- About add and removing of Win-Tools Easy Installer: I could not find it. Is it possible that I don't have it - or I might have it under another name?

These are the logs and reports you had requested:

I again thank you Alan.

Applisha

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

3D Galaxy Fighters
ACDSee
Ad-Aware SE Personal
Adobe Acrobat 5.0
Adobe ActiveShare 1.5
AVG Free Edition
Calling all Titans! (remove only)
Canon PhotoRecord
Canon PowerShot A30 TWAIN Driver
Canon Utilities File Viewer Utility 1.2
Canon Utilities PhotoStitch 3.1
Canon Utilities RAW Image Converter
Canon Utilities RemoteCapture 2.7
Canon Utilities ZoomBrowser EX
CCProxy 6.0
Chess.net for Windows
DriverLINX Port I/O Driver
Drome Racers
EAGLE 4.03
FirstClass® Client
Google Toolbar for Internet Explorer
High Heat Baseball 2000
HijackThis 1.99.1
HP Photo Imaging Software
HP Photo Printing Software
HP PrecisionScan LTX
HP Share-to-Web
InstallShield for Microsoft Visual C++ 6
Java 2 Runtime Environment Standard Edition v1.3.0_02
Java 2 SDK Standard Edition v1.3.0_02
Java 3D™ 1.2.1_01 SDK (OpenGL Version)
Java Web Start
Jeep 4x4: Trail of Life
Macromedia Shockwave Player
Mastering MFC Development Using Visual C++ 5
Math Workshop
Microsoft .NET Framework 1.1
Microsoft Internet Explorer 6 SP1
Microsoft Midtown Madness Trial Version
Microsoft Office 2000 Disc 2
Microsoft Office 2000 SR-1 Standard
Microsoft Office Web Components
Microsoft Visio Professional 2002 [ENG]
Microsoft Visual C++ 6.0 Professional Edition
Microsoft Visual J# .NET Redistributable Package 1.1
Microsoft Visual J++ 6.0
Microsoft Visual Studio .NET Professional 2003 - English
Microsoft Web Publishing Wizard 1.53
MSDN Library for Visual Studio .NET 2003
Netscape Communicator (Vidéotron Ltée)
OOPic Multi-Language Compiler
Owl and Mouse U.S. Map Puzzle
Parental Filter
Popup Manager (remove only)
Protel 99 SE Trial Version
QuickTime
RealArcade
RealPlayer
Recommended Hotfix - 421701D
Security iGuard
Shockwave
Sitekick™ They Came for the Ooze (YTV Edition) (remove only)
SolidWorks API SDK
Spybot - Search & Destroy 1.3
Super Huey 3
Test Drive 5 Demo
Test Drive Off-Road 3 Demo
UMLStudio 5.0
Viewpoint Media Player (Remove Only)
WildTangent Web Driver
Windows 2000 Hotfix - KB829558
Windows Media Player system update (9 Series)
WinMX
WinZip
Xircom Rex 6000 Drivers and Online Documents
Xircom Rex 6000 Tools
Xircom Rex 6000, Intellisync for Rex
Xircom USB to Serial Rex Cradle
Yahoo! Address AutoComplete
Yahoo! Anti-Spy
Yahoo! extras
Yahoo! Install Manager
Yahoo! Internet Mail
Yahoo! Messenger
Yahoo! Messenger Explorer Bar
Yahoo! Toolbar

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Logfile of HijackThis v1.99.1
Scan saved at 11:07:31 PM, on 02/06/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\Explorer.EXE
C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINNT\system32\internat.exe
C:\PROGRAM FILES\REX6000\IntellisyncForRex\rexsymon.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\iraj\LOCALS~1\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.1.1.127:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\ycomp5_5_7_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [RexSyMon] C:\PROGRAM FILES\REX6000\IntellisyncForRex\rexsymon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O9 - Extra button: (no name) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O15 - Trusted IP range: 206.161.125.149
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: Microsoft WFC Forms Designer - file://D:\VJ98\wfcforms.cab
O16 - DPF: Visual Studio 6 Extensibility Libraries - file://D:\VJ98\vstudio6.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potc_x.cab
O16 - DPF: Yahoo! Spelldown - http://download.games.yahoo.com/games/clients/y/sdt1_x.cab
O16 - DPF: Yahoo! Tic-Tac-Toe - http://download.games.yahoo.com/games/clients/y/ft3_x.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/en/deleon/1…n/GoogleNav.cab
O16 - DPF: {707FC7B7-B227-4DF6-A606-0EC317BB08A1} (PhotosCtrlCA Class) - http://ca.f1.pg.photos.yahoo.com/ocx/ca/yexplorer1_9ca.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundl…ArcadeRdxIE.cab
O23 - Service: .NET Framework Service (.NET Connection Service) - Unknown owner - C:\WINNT\svchost.exe (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Crypkey License - Unknown owner - C:\WINNT\SYSTEM32\crypserv.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: USB to Serial COM Port Messages (RexService) - Unknown owner - C:\WINNT\SYSTEM32\RexSvc.exe
O23 - Service: WinTools for IE service (WinToolsSvc) - Unknown owner - C:\Program Files\Common Files\WinTools\WToolsS.exe
Post #6
I notice that you have Spybot S&D 1.3 on your computer. They have recently updated this to v1.4 so you may want to get the newest version here.

Step 1
You have Security iGuard on your computer. This is on the Rogue/Suspect antispyware list as it badgers users into purchase, reported hijacking by affiliates. You can read about it here. This is optional but I strongly recommend removing this program with Add/Remove Programs.


Step 2
You still are running HijackThis from a temp directory. Please move it to a permanent folder before beginning the fix.

Move HijackThis to Permanent Folder:
You are running HijackThis from a Temp directory. These are cleaned up on a regular basis thus the program will be removed.
  • Go to Start > My Computer > and double click on C:.
  • Now right click an open area and click New > folder and change the folder name to HJT.
  • Move HijackThis from the Temp folder into this new folder.

Step 3
Disable the offending Service
  • Click Start < Run and type services.msc.
  • Scroll down to WebSeach Toolbar support NT service and right click on it.
  • Click Properties and under Service Status click Stop, then under Startup Type change it to Disabled.
  • Repeat this for the service : .NET Framework Service

Delete the offending Service
  • Open HijackThis and click Config -> Misc Tools -> Delete an NT service.
  • In the Delete window, type .NET Connection Service and press OK.
  • OK any prompts, close HijackThis, and restart your computer.
  • Repeat this for the service : WinToolsSvc.

Step 4
Open HijackThis, run a scan, then check the following:

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)

O15 - Trusted IP range: 206.161.125.149
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone

Optional items to check with HijackThis for improved performance.
Resource hog that launches common MS Office components to help speed up the launch of Office programs. Some users claim there's no difference with or without it but it isn't required either way.
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

With all other programs and browsers closed, click fix checked.


Step 5
Reboot normally and scan with HijackThis. Post the new log as a reply to this thread.
Please let us know of any complications you had and how the computer is behaving.
Post #7
Hi Alan,

Again, Thank you!

I did what you asked me.

1- About HJT being in my TEMP files: I removed it to the C, as per your request last time - or at least I thought I did! Apparently I failed to do it correctly, or what I did, did not work. This time I created a folder in my C and downlaoded HJT again, hope it is not running from my TEMP any more?

2- I am sending you two sets of logs because I have two users in the PC. One is admin, one is general.

3- Alan, since these new registires appeared in my PC (two weeks ago) my AVG can not get updated. Everytime it says: the up-date is not complete, restart the system, I do restart the system and again the same message. So I guess the AVG had been remained out-dated for 2 weeks now. Would you suggest what I should do?

Applisha

——————————————————————————————
Genral Log

Logfile of HijackThis v1.99.1
Scan saved at 10:32:59 PM, on 05/06/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\Explorer.EXE
C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINNT\system32\internat.exe
C:\PROGRAM FILES\REX6000\IntellisyncForRex\rexsymon.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\iraj\LOCALS~1\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.1.1.127:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost;
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\ycomp5_5_7_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [RexSyMon] C:\PROGRAM FILES\REX6000\IntellisyncForRex\rexsymon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O9 - Extra button: (no name) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O16 - DPF: Microsoft WFC Forms Designer - file://D:\VJ98\wfcforms.cab
O16 - DPF: Visual Studio 6 Extensibility Libraries - file://D:\VJ98\vstudio6.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potc_x.cab
O16 - DPF: Yahoo! Spelldown - http://download.games.yahoo.com/games/clients/y/sdt1_x.cab
O16 - DPF: Yahoo! Tic-Tac-Toe - http://download.games.yahoo.com/games/clients/y/ft3_x.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/en/deleon/1…n/GoogleNav.cab
O16 - DPF: {707FC7B7-B227-4DF6-A606-0EC317BB08A1} (PhotosCtrlCA Class) - http://ca.f1.pg.photos.yahoo.com/ocx/ca/yexplorer1_9ca.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundl…ArcadeRdxIE.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Crypkey License - Unknown owner - C:\WINNT\SYSTEM32\crypserv.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: USB to Serial COM Port Messages (RexService) - Unknown owner - C:\WINNT\SYSTEM32\RexSvc.exe

——————————————————————————————-

Admin Log


Logfile of HijackThis v1.99.1
Scan saved at 10:29:37 PM, on 05/06/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINNT\system32\crypserv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\RexSvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\HEWLET~1\PHOTOS~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINNT\system32\wuauclt.exe
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50226
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.1.1.127:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost;
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\ycomp5_5_7_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O8 - Extra context menu item: &Google Search - res://c:\winnt\downloaded program files\GoogleToolbar_en_1.1.70-deleon.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\winnt\downloaded program files\GoogleToolbar_en_1.1.70-deleon.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\winnt\downloaded program files\GoogleToolbar_en_1.1.70-deleon.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://c:\winnt\downloaded program files\GoogleToolbar_en_1.1.70-deleon.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page - res://c:\winnt\downloaded program files\GoogleToolbar_en_1.1.70-deleon.dll/cmtrans.html
O9 - Extra button: (no name) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O16 - DPF: Microsoft WFC Forms Designer - file://D:\VJ98\wfcforms.cab
O16 - DPF: Visual Studio 6 Extensibility Libraries - file://D:\VJ98\vstudio6.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potc_x.cab
O16 - DPF: Yahoo! Spelldown - http://download.games.yahoo.com/games/clients/y/sdt1_x.cab
O16 - DPF: Yahoo! Tic-Tac-Toe - http://download.games.yahoo.com/games/clients/y/ft3_x.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/en/deleon/1…n/GoogleNav.cab
O16 - DPF: {707FC7B7-B227-4DF6-A606-0EC317BB08A1} (PhotosCtrlCA Class) - http://ca.f1.pg.photos.yahoo.com/ocx/ca/yexplorer1_9ca.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundl…ArcadeRdxIE.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Crypkey License - Unknown owner - C:\WINNT\SYSTEM32\crypserv.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: USB to Serial COM Port Messages (RexService) - Unknown owner - C:\WINNT\SYSTEM32\RexSvc.exe
Post #8
Your General account appears clean. :)
Just one item remains in the Admin account.

Open HijackThis, run a scan, then check the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50226

With all other programs and browsers closed, click fix checked.


Some bad items are known to affect Antivirus programs. You may need to uninstall/reinstall AVG to get it working correctly again.


Post a fresh HijackThis log from the Admin account when the above steps are done.
Post #9
Good morning Alan,

The line you asked me to delete (R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50226) doesn't exist any more! I did NOT fix it, the only thing I can think of is: when I ran ad-aware a few times on Sunday night, ad-aware has fixed it for me? (or I am talking non-sense? :huh: ). The new log of my admin account follows:

PS. Alan one more thing: 90% of the times I cannot highlight texts for cut and paste for instance (using the mouse I mean). It highlighs and the highlight vanishes quickly before I am able to copy. It is very frustrating. Can these "bugs" affect this feature too? :(


Logfile of HijackThis v1.99.1
Scan saved at 9:47:33 AM, on 07/06/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINNT\system32\crypserv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\RexSvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\PROGRA~1\HEWLET~1\PHOTOS~1\HPSHAR~1\hpgs2wnf.exe
C:\WINNT\system32\wuauclt.exe
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\HijackThis.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.1.1.127:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost;
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\ycomp5_5_7_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O8 - Extra context menu item: &Google Search - res://c:\winnt\downloaded program files\GoogleToolbar_en_1.1.70-deleon.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\winnt\downloaded program files\GoogleToolbar_en_1.1.70-deleon.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\winnt\downloaded program files\GoogleToolbar_en_1.1.70-deleon.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://c:\winnt\downloaded program files\GoogleToolbar_en_1.1.70-deleon.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page - res://c:\winnt\downloaded program files\GoogleToolbar_en_1.1.70-deleon.dll/cmtrans.html
O9 - Extra button: (no name) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O16 - DPF: Microsoft WFC Forms Designer - file://D:\VJ98\wfcforms.cab
O16 - DPF: Visual Studio 6 Extensibility Libraries - file://D:\VJ98\vstudio6.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potc_x.cab
O16 - DPF: Yahoo! Spelldown - http://download.games.yahoo.com/games/clients/y/sdt1_x.cab
O16 - DPF: Yahoo! Tic-Tac-Toe - http://download.games.yahoo.com/games/clients/y/ft3_x.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/en/deleon/1…n/GoogleNav.cab
O16 - DPF: {707FC7B7-B227-4DF6-A606-0EC317BB08A1} (PhotosCtrlCA Class) - http://ca.f1.pg.photos.yahoo.com/ocx/ca/yexplorer1_9ca.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundl…ArcadeRdxIE.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Crypkey License - Unknown owner - C:\WINNT\SYSTEM32\crypserv.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: USB to Serial COM Port Messages (RexService) - Unknown owner - C:\WINNT\SYSTEM32\RexSvc.exe

I do thank you again, very much,

Applisha
Post #10
The new log appears clean.

I'd like you to try one more scan to make sure nothing is hiding from us.

Click here to download mwavscan.
  • Double-click it to run it.
  • Read then accept the agreement.
  • Check Drive, and select all local drives, scan all files, then press 'scan'. (This may take a while and will not fix anything)
  • Once it finds something, it will prompt you so click OK.
  • When it is completed, anything found will be displayed in the lower pane.
  • Highlight it, copy it (CTRL+C), and paste (CTRL+V) it in your next reply.
Note : It will find many orphaned registry entries so please do not be alarmed by the amount of items that show.
Post #11
Alan Good morning!

Holy! 72 viruses and 376 total errors Alan!

I just scanned the "general" user, NOT the admin account, please let me know if you want me to scan the PC through admin account too.

I did uninstall and re-install the AVG, still says: 'download is not complete, restart your computer' and no matter how many times I restart, the same happens. Good old days, before all these had happened, AVG was scanning my PC everytime I was tunring on the PC, it would take 2-3 minutes, but it would assure me there was not virus found.

Anyhow, the result of the scan you requested follows.

Have a great day and again thank you so very much.

Applisha
——————————————————————————————–


File C:\Documents and Settings\iraj\Desktop\ccproxysetup.exe tagged as not-a-virus:Server-Proxy.Win32.3proxy.CCProxy.60. No Action Taken.
File C:\Documents and Settings\iraj\Desktop\Setup.exe tagged as "not-a-virus:AdWare.PrecisionPop.b". Action Taken: No Action Taken.
Object "YourSiteBar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "FunWeb Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "FunWeb Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "FunWeb Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "FunWeb Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "FunWeb Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "FunWeb Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "SideFind Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "MyWebSearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "Wind Updates Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "HuntBar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "IBIS Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "FunWebProducts Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "mwsoemon Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "Gator Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "precisiontime Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "updater Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "WinAD Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "eZula Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "ISTsvc Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\popcaploader.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\Rovion.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\xscan53.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\YSBactivex.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\googlenav.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\swapit.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\cubis.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\QDow.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\ActiveInstall.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\Login.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\NewMsgButton.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\ActiveReceiver.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\ISTactivex.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\xscan53.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\Rovion.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\popcaploader.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\YSBactivex.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{00120005-B1BA-11CE-ABC6-F5B2E79D9E3F}" refers to invalid object "C:\PROGRA~1\Logitech\IMAGES~1\Ltocx12n.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{00120007-B1BA-11CE-ABC6-F5B2E79D9E3F}" refers to invalid object "C:\PROGRA~1\Logitech\IMAGES~1\Ltocx12n.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{00120070-B1BA-11CE-ABC6-F5B2E79D9E3F}" refers to invalid object "C:\Program Files\Logitech\ImageStudio\ltscr12n.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{00120074-B1BA-11CE-ABC6-F5B2E79D9E3F}" refers to invalid object "C:\Program Files\Logitech\ImageStudio\ltscr12n.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{00120075-B1BA-11CE-ABC6-F5B2E79D9E3F}" refers to invalid object "C:\Program Files\Logitech\ImageStudio\ltscr12n.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{00120076-B1BA-11CE-ABC6-F5B2E79D9E3F}" refers to invalid object "C:\Program Files\Logitech\ImageStudio\ltscr12n.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{00120077-B1BA-11CE-ABC6-F5B2E79D9E3F}" refers to invalid object "C:\Program Files\Logitech\ImageStudio\ltscr12n.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{00A6FAF4-072E-44cf-8957-5838F569A31D}" refers to invalid object "C:\Program Files\MyWebSearch\SrchAstt\3.bin\MWSSRCAS.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{032038A5-B655-11D3-BB7D-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSpool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{04B29FDD-F820-45CF-AD60-233FC7392676}" refers to invalid object "C:\Program Files\Logitech\ImageStudio\WASpLf.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0710C793-2117-11D5-B75D-005004C0C6BA}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{072809C8-B60E-11D3-BB7C-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFoldrs.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{07A52AE7-B6F0-11D3-BB7E-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSpool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{07D03588-7B5E-11D5-8784-0050DA2761C4}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{087EF34C-BBC4-11D3-BB8D-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImParser.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{08F6CFEE-9381-4796-8596-1D964DD9B762}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSpool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{09C1B8B7-C70C-43F5-9277-8576921ED70C}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFoldrs.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0B9A0840-1EC3-11D5-B75C-005004C0C6BA}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImTools.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{11B72805-205F-11D6-8855-0050DA2761C4}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImView.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{17A434C2-B48F-11D3-BB78-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFoldrs.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{25D41C19-246A-4643-B0CA-08F5D1D07EE6}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImParser.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{28D1EE40-E73D-422D-A2AC-D23F8D3071B2}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImParser.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2ACB0C00-4812-11D3-8233-0020186676FB}" refers to invalid object "C:\users\Michael\SerialDriver.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2ACB0C04-4812-11D3-8233-0020186676FB}" refers to invalid object "C:\users\Michael\SerialConfig.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2EE7969F-6FC8-4D04-89AC-5109298ABC39}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSupp.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{3334A48F-8E49-11D4-B72C-005004C0C6BA}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSpool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{35092AB4-B643-11D3-BB7D-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSpool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{3762BAB7-8E00-4B51-AA7E-E57ED7552794}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImMangr.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{390CE9F2-C4A0-11D4-8A92-0090271D4F88}" refers to invalid object "C:\Program Files\Yahoo!\Messenger\ycrwin32.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{41695A8E-6414-11D4-8FB3-00D0B7730277}" refers to invalid object "C:\Program Files\Yahoo!\Messenger\asw.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{42F2C9BA-614F-47c0-B3E3-ECFD34EED658}" refers to invalid object "C:\WINNT\Downloaded Program Files\YSBactivex.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{44C8EC50-93BD-4633-9A82-CA0D4F1DD3A7}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImImprt.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{4750EC81-293B-11D6-885E-0050DA2761C4}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImView.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{47B10849-77FA-463b-8973-10241FF9DB37}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{4EAA7268-FC1E-47C6-87EF-8915475CBC88}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{50E5E612-B7DD-11D3-BB7F-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImParser.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{55B613D4-E613-11D3-857A-005004BE235E}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImServ.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{56336BCA-3D8A-11d6-A00B-0050DA18DE71}" refers to invalid object "C:\DOCUME~1\iraj\LOCALS~1\Temp\InfoWindow.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5773A367-AD78-11D4-BCAF-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSpool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5862A1C2-7676-45AA-8C7D-2F803754D007}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{59EC0340-7506-11D2-B05F-00C04F7F89FE}" refers to invalid object "C:\PROGRA~1\AIM95\aimapi.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5FAEF4A9-C5D0-11D4-BCC1-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImMangr.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{6D587C7F-27A0-4416-A90D-FB337F9B406C}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImComUtl.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{6F8C74D3-FF34-4D3B-890E-2A89AD71BA5F}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSupp.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{76059BDF-B539-11d3-835D-0020186676FB}" refers to invalid object "C:\users\Michael\SerialController.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{77969C47-EBE5-486F-8730-F48B84284D88}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImComUtl.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{79F506BE-15AC-11d1-8BEF-00A0C90F26F7}" refers to invalid object "MSJAVA.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{7A2E77CA-BDE2-11D3-BB91-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImParser.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{7E58CC0F-BC50-11D3-855B-0050DA2761C4}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImView.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{7F23E6E5-0E79-4aee-B723-B1463805D5A9}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\sound.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{805FB5B9-6344-11D6-B7AF-005004C0C6BA}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSupp.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{84566316-EC70-11D5-881D-0050DA2761C4}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImView.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{8ECF83A0-1AC9-11D4-8501-00A0CC5D1F63}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\wtwmplug.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{96D04D6A-7B1E-48A9-BEA6-99F9FE8341C7}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{99180163-DA16-101A-935C-444553540000}" refers to invalid object "recncl.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{995F48E8-131F-4630-9FBE-98D9DBDABB05}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSpool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{9D9E81A6-2285-4118-A61E-237AA4CF20B8}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSupp.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{9F091FED-8AC7-46EA-94C6-1F12CF5E1BE9}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSupp.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A0C301D9-59A5-45eb-90E8-D60D8149F5A5}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImParser.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A43BC58F-4453-49FF-9929-9D1E78D90062}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImMangr.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A4845882-333F-11D0-B724-00AA0062CBB7}" refers to invalid object "C:\WINNT\System32\WBEM\WBEMSTUB.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A7256361-EC20-4E5B-B824-A692515700BD}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImComUtl.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A8D94870-BEA6-11D3-BB92-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSupp.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B385A628-C100-11D3-BB95-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImNotfy.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B5534644-E461-11D3-BBB2-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImAnim.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B84092B9-8658-11D5-8793-0050DA2761C4}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImTools.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B98AC5E0-DE20-11d1-A7CE-0000F81E8509}" refers to invalid object "C:\WINNT\System32\msjava.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B9BA256A-075B-49ea-B9E2-7DBC2EF021D5}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\sound.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{BC5F0300-F7BC-11d0-B9ED-40A708C10000}" refers to invalid object "MSJAVA.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{BFCA32C0-E917-11D3-B720-005004C0C6BA}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImBook.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{BFCA32C2-E917-11D3-B720-005004C0C6BA}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImBook.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{BFCA32C4-E917-11D3-B720-005004C0C6BA}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImBook.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C0CF353A-F029-11D3-857F-005004BE235E}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImServ.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C7681ACB-27AD-4025-8F53-643549159658}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{CA6417D5-2F70-4EF0-9BA2-ADA5EDF5A2DD}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSupp.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{CB073682-BD1F-11D3-BB90-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImMangr.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{CB382C7A-8852-458A-8900-C456C96FDB8C}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImView.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{CBF9925D-3C19-4F33-9DE4-446978645EBB}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{DA12A268-0ACB-11D4-859D-0050DA2761C4}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E07D3492-32B5-11D0-B724-00AA0062CBB7}" refers to invalid object "C:\WINNT\System32\WBEM\WBEMSTUB.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E1B6DE2A-F997-11D3-BBDB-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImImprt.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E6253BEA-C3B2-4FB0-8F7F-B5B8C83674E5}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImMangr.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E9BC70A8-D70C-11D3-BBAE-0050DA276194}" refers to invalid object "C:\PROGRA~1\INCRED~1\bin\IncMail.exe". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{EC8717B4-F660-11D3-ADE2-0050DA744DF1}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImImprt.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{EC8717B6-F660-11D3-ADE2-0050DA744DF1}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImImprt.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{EC8717B8-F660-11D3-ADE2-0050DA744DF1}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImImprt.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{EC8717C9-F660-11D3-ADE2-0050DA744DF1}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImImprt.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{ECFBE6E0-1AC8-11D4-8501-00A0CC5D1F63}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\wtwmplug.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{F1B4B6F1-55D1-11d6-B7AD-005004C0C6BA}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImImprt.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{F648D80F-2409-4EDA-847D-8E820B03451F}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImServ.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{F8984111-38B6-11D5-8725-0050DA2761C4}" refers to invalid object "C:\Program Files\IncrediMail\bin\IMShExt.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{FA13A9FA-CA9B-11D2-9780-00104B242EA3}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\webdriver.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{FEBD6230-F4F6-4E79-89CD-4BEBDC4A96AE}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{FFD709F0-AF39-11D2-B854-0000F81E8872}" refers to invalid object "msjava.dll". Action Taken: No Action Taken.
Entry "HKCR\ActMsg.Session" refers to invalid object "{3FA7DEB3-6438-101B-ACC1-00AA00423326}". Action Taken: No Action Taken.
Entry "HKCR\ComPlusMetaData.MsCorHost" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken.
Entry "HKCR\ComPlusMetaData.MsCorHost.2" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken.
Entry "HKCR\CSSfile" refers to invalid object "{F9202A92-B111-11D0-BB8D-00A0C90F2744}". Action Taken: No Action Taken.
Entry "HKCR\Downloader.IMDownloader" refers to invalid object "{F00F4763-7355-4725-82F7-0DA94A256D46}". Action Taken: No Action Taken.
Entry "HKCR\Downloader.IMDownloader.1" refers to invalid object "{F00F4763-7355-4725-82F7-0DA94A256D46}". Action Taken: No Action Taken.
Entry "HKCR\MailFileAtt" refers to invalid object "{00020D05-0000-0000-C000-000000000046}". Action Taken: No Action Taken.
Entry "HKCR\mapifvbx.object" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken.
Entry "HKCR\mapifvbx.object.1" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken.
Entry "HKCR\Microsoft.VSWizards.VisualJSharp.UpgradeWizard.VjpUpgradeWizardManager" refers to invalid object "{E969F948-F7DE-4037-BBE6-1BC5D9DC2D55}". Action Taken: No Action Taken.
Entry "HKCR\PhotoRecord.Album" refers to invalid object "{FEDCFFC1-BEC4-11D1-93B9-0060979C8AB8}". Action Taken: No Action Taken.
Entry "HKCR\PopupMgr.PopupManager" refers to invalid object "{08E74C67-99A6-45C7-94DA-A397A8FD8082}". Action Taken: No Action Taken.
Entry "HKCR\PopupMgr.PopupManager.1" refers to invalid object "{08E74C67-99A6-45C7-94DA-A397A8FD8082}". Action Taken: No Action Taken.
Entry "HKCR\SymWriter.pdb" refers to invalid object "{520DC67A-752E-11D3-8D56-00C04F680B2B}". Action Taken: No Action Taken.
Entry "HKCR\TSLV.TSLV" refers to invalid object "{612DE685-FCC5-11D1-8A36-00A0C9B82ABC}". Action Taken: No Action Taken.
Entry "HKCR\TSLV.TSLV.1" refers to invalid object "{612DE685-FCC5-11D1-8A36-00A0C9B82ABC}". Action Taken: No Action Taken.
Entry "HKCR\VJUpgradeEngineLib.VJUpgradeEngine_7_1.1" refers to invalid object "{B0AC6ABA-AB35-4AEE-8D3D-6C55FA34F6A9}". Action Taken: No Action Taken.
Entry "HKCR\WinAdServX.Installer" refers to invalid object "{15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6}". Action Taken: No Action Taken.
Entry "HKCR\YBIOCtrl.CompanionBHO.4" refers to invalid object "{02478D38-C3F9-4efb-9B51-7695ECA05670}". Action Taken: No Action Taken.
Entry "HKCR\ZoomBrowserEX.Document" refers to invalid object "{476A6961-6FF1-11D0-9742-00A0246B6561}". Action Taken: No Action Taken.
File C:\WINNT\system32\mac80ex.idf tagged as "not-a-virus:AdWare.BargainBuddy.l". Action Taken: No Action Taken.
File C:\DOCUME~1\iraj\LOCALS~1\Temp\backups\backup-20050515-094059-439.dll tagged as not-a-virus:Downloader.Win32.PopCap.b. No Action Taken.
File C:\DOCUME~1\iraj\LOCALS~1\Temp\down.cab tagged as "not-a-virus:AdWare.Wintol.y". Action Taken: No Action Taken.
File C:\DOCUME~1\iraj\LOCALS~1\Temp\down_.cab tagged as "not-a-virus:AdWare.Wintol.y". Action Taken: No Action Taken.
File C:\DOCUME~1\iraj\LOCALS~1\Temp\ICD2.tmp\QDow_AS2.dll infected by "Trojan-Downloader.Win32.QDown.s" Virus! Action Taken: No Action Taken.
File C:\DOCUME~1\iraj\LOCALS~1\Temp\ICD3.tmp\QDow_AS2.dll infected by "Trojan-Downloader.Win32.QDown.s" Virus! Action Taken: No Action Taken.
File C:\DOCUME~1\iraj\LOCALS~1\Temp\trickler_3210.ex_ tagged as "not-a-virus:AdWare.Gator.3210". Action Taken: No Action Taken.
File C:\DOCUME~1\iraj\LOCALS~1\Temp\webrebates.exe tagged as "not-a-virus:AdWare.WebRebates.g". Action Taken: No Action Taken.
File C:\CCProxy\CCProxy.exe tagged as not-a-virus:Server-Proxy.Win32.3proxy.CCProxy.60. No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy.zip infected by "Password-protected-EXE" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\iraj\Desktop\ccproxysetup.exe tagged as not-a-virus:Server-Proxy.Win32.3proxy.CCProxy.60. No Action Taken.
File C:\Documents and Settings\iraj\Desktop\Setup.exe tagged as "not-a-virus:AdWare.PrecisionPop.b". Action Taken: No Action Taken.
File C:\Documents and Settings\iraj\Local Settings\Temp\backups\backup-20050515-094059-439.dll tagged as not-a-virus:Downloader.Win32.PopCap.b. No Action Taken.
File C:\Documents and Settings\iraj\Local Settings\Temp\down.cab tagged as "not-a-virus:AdWare.Wintol.y". Action Taken: No Action Taken.
File C:\Documents and Settings\iraj\Local Settings\Temp\down_.cab tagged as "not-a-virus:AdWare.Wintol.y". Action Taken: No Action Taken.
File C:\Documents and Settings\iraj\Local Settings\Temp\ICD2.tmp\QDow_AS2.dll infected by "Trojan-Downloader.Win32.QDown.s" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\iraj\Local Settings\Temp\ICD3.tmp\QDow_AS2.dll infected by "Trojan-Downloader.Win32.QDown.s" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\iraj\Local Settings\Temp\trickler_3210.ex_ tagged as "not-a-virus:AdWare.Gator.3210". Action Taken: No Action Taken.
File C:\Documents and Settings\iraj\Local Settings\Temp\webrebates.exe tagged as "not-a-virus:AdWare.WebRebates.g". Action Taken: No Action Taken.
File C:\Downloads\Avalanche-dm[1].exe tagged as "not-a-virus:AdWare.Trymedia.a". Action Taken: No Action Taken.
File C:\Downloads\Avalanche-dm[2].exe tagged as "not-a-virus:AdWare.Trymedia.a". Action Taken: No Action Taken.
File C:\Games.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\jdk1.3.0_02\demo\applets\BarChart\Chart.class tagged as not-a-virus:Garbage.Java.Chart. No Action Taken.
File C:\Program Files\3DO\High Heat Baseball 2000\MPLAYNOW\MPLAYER\setup.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\Common Files\WinTools\WSup.exe tagged as "not-a-virus:AdWare.Wintol.aa". Action Taken: No Action Taken.
File C:\Program Files\Common Files\WinTools\WToolsB.dll tagged as "not-a-virus:AdWare.Wintol.y". Action Taken: No Action Taken.
File C:\Program Files\Common Files\WinTools\WToolsS.exe infected by "Trojan-Downloader.Win32.Wintool.f" Virus! Action Taken: No Action Taken.
File C:\Program Files\FreeSlide Website Entry Certificate\SaveInstCm.exe tagged as "not-a-virus:AdWare.SaveNow.c". Action Taken: No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL tagged as "not-a-virus:AdWare.FunWeb.d". Action Taken: No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch.e". Action Taken: No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch.j". Action Taken: No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL tagged as "not-a-virus:AdWare.TotalVelocity.MyWebSearch.b". Action Taken: No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch.e". Action Taken: No Action Taken.
File C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken.
File C:\Program Files\Netscape\Communicator\Program\Plugins\npwthost.dll tagged as "not-a-virus:AdWare.WildTangent.b". Action Taken: No Action Taken.
File C:\WINNT\Downloaded Program Files\CONFLICT.1\QDow_AS2.dll infected by "Trojan-Downloader.Win32.QDown.s" Virus! Action Taken: No Action Taken.
File C:\WINNT\Downloaded Program Files\QDow_AS2.dll infected by "Trojan-Downloader.Win32.QDown.s" Virus! Action Taken: No Action Taken.
File C:\WINNT\Downloaded Program Files\WinAdServX.dll tagged as "not-a-virus:AdWare.WinAD". Action Taken: No Action Taken.
File C:\WINNT\system32\mac80ex.idf tagged as "not-a-virus:AdWare.BargainBuddy.l". Action Taken: No Action Taken.
File C:\WINNT\Temporary Internet Files\Content.IE5\C1ODSDVT\nitrous.exitfuel[1].htm infected by "Trojan.JS.NoClose.i" Virus! Action Taken: No Action Taken.
File C:\WINNT\wt\wtvh.dll tagged as "not-a-virus:AdWare.WildTangent.b". Action Taken: No Action Taken.
Post #12
Click Here to download Killbox by Option^Explicit.
Extract the program to your desktop and double-click on its folder, then double-click on Killbox.exe to start the program.
In the killbox program, select the Delete on Reboot option.
In the field labeled Full Path of File to Delete enter the file paths listed below ONE AT A TIME (EXACTLY as it appears, please double check to make sure!):

C:\WINNT\system32\mac80ex.idf
C:\Documents and Settings\iraj\Desktop\Setup.exe
C:\Documents and Settings\iraj\Local Settings\Temp\down.cab
C:\Documents and Settings\iraj\Local Settings\Temp\down_.cab
C:\Documents and Settings\iraj\Local Settings\Temp\ICD2.tmp\QDow_AS2.dll
C:\Documents and Settings\iraj\Local Settings\Temp\ICD3.tmp\QDow_AS2.dll
C:\Documents and Settings\iraj\Local Settings\Temp\trickler_3210.ex_
C:\Documents and Settings\iraj\Local Settings\Temp\webrebates.exe
C:\Downloads\Avalanche-dm[1].exe
C:\Downloads\Avalanche-dm[2].exe
C:\Program Files\Common Files\WinTools\WSup.exe
C:\Program Files\Common Files\WinTools\WToolsB.dll
C:\Program Files\Common Files\WinTools\WToolsS.exe
C:\Program Files\FreeSlide Website Entry Certificate\SaveInstCm.exe
C:\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR
C:\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE
C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL
C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
C:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
C:\WINNT\Downloaded Program Files\CONFLICT.1\QDow_AS2.dll
C:\WINNT\Downloaded Program Files\QDow_AS2.dll
C:\WINNT\Downloaded Program Files\WinAdServX.dll
C:\WINNT\system32\mac80ex.idf
C:\WINNT\Temporary Internet Files\Content.IE5\C1ODSDVT\nitrous.exitfuel[1].htm

Press the button that looks like a red circle with a white X in it after each one. When it asks if you would like to delete on reboot, press the YES button, when it asks if you want to reboot now, press the NO button. Do this after each one until you have entered the LAST file path I have listed above. After that LAST file path has been entered, press the YES button at both prompts so that your computer restarts.
If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just restart manually.


After rebooting normally, delete the following folders:

C:\Program Files\Common Files\WinTools
C:\Program Files\MyWebSearch


Download and install CleanUp!. Here is the info page on it.
  • Click Start > All Programs > "CleanUp!" > "CleanUp!".
  • A dialog will appear. Click on the button labeled "CleanUp!".
  • Reboot.

Post a fresh HijackThis log and mwavscan log from the Admin account.
Post #13
Good Morning Alan,

I did everything you'd asked me to do.

I provided these two logs through admin account.

I wish you a great day,

Applisha
ps. Thank you!

——————————————————————————————–
Object "YourSiteBar Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "FunWeb Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "FunWeb Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "FunWeb Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "FunWeb Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "FunWeb Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "FunWeb Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "IBIS Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "MyWebSearch Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "Wind Updates Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "HuntBar Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "mwsoemon Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "Gator Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "precisiontime Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "eZula Spyware/Adware" found in File System! Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\popcaploader.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\QDow_AS2.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\Rovion.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\xscan53.ocx". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\YSBactivex.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\googlenav.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\swapit.ocx". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\cubis.ocx". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\QDow.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\ActiveInstall.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\Login.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\NewMsgButton.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\ActiveReceiver.ocx". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\WinAdServX.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\ISTactivex.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\xscan53.ocx". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\Rovion.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\popcaploader.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\QDow_AS2.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\YSBactivex.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{00120005-B1BA-11CE-ABC6-F5B2E79D9E3F}" refers to invalid object "C:\PROGRA~1\Logitech\IMAGES~1\Ltocx12n.ocx". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{00120007-B1BA-11CE-ABC6-F5B2E79D9E3F}" refers to invalid object "C:\PROGRA~1\Logitech\IMAGES~1\Ltocx12n.ocx". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{00120070-B1BA-11CE-ABC6-F5B2E79D9E3F}" refers to invalid object "C:\Program Files\Logitech\ImageStudio\ltscr12n.ocx". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{00120074-B1BA-11CE-ABC6-F5B2E79D9E3F}" refers to invalid object "C:\Program Files\Logitech\ImageStudio\ltscr12n.ocx". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{00120075-B1BA-11CE-ABC6-F5B2E79D9E3F}" refers to invalid object "C:\Program Files\Logitech\ImageStudio\ltscr12n.ocx". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{00120076-B1BA-11CE-ABC6-F5B2E79D9E3F}" refers to invalid object "C:\Program Files\Logitech\ImageStudio\ltscr12n.ocx". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{00120077-B1BA-11CE-ABC6-F5B2E79D9E3F}" refers to invalid object "C:\Program Files\Logitech\ImageStudio\ltscr12n.ocx". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{00A6FAF4-072E-44cf-8957-5838F569A31D}" refers to invalid object "C:\Program Files\MyWebSearch\SrchAstt\3.bin\MWSSRCAS.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}" refers to invalid object "C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{032038A5-B655-11D3-BB7D-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSpool.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{04B29FDD-F820-45CF-AD60-233FC7392676}" refers to invalid object "C:\Program Files\Logitech\ImageStudio\WASpLf.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{0710C793-2117-11D5-B75D-005004C0C6BA}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{072809C8-B60E-11D3-BB7C-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFoldrs.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{07A52AE7-B6F0-11D3-BB7E-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSpool.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}" refers to invalid object "C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{07D03588-7B5E-11D5-8784-0050DA2761C4}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{087EF34C-BBC4-11D3-BB8D-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImParser.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{08F6CFEE-9381-4796-8596-1D964DD9B762}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSpool.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{09C1B8B7-C70C-43F5-9277-8576921ED70C}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFoldrs.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{0B9A0840-1EC3-11D5-B75C-005004C0C6BA}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImTools.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70}" refers to invalid object "C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{11B72805-205F-11D6-8855-0050DA2761C4}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImView.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{17A434C2-B48F-11D3-BB78-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFoldrs.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{25D41C19-246A-4643-B0CA-08F5D1D07EE6}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImParser.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{28D1EE40-E73D-422D-A2AC-D23F8D3071B2}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImParser.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{2ACB0C00-4812-11D3-8233-0020186676FB}" refers to invalid object "C:\users\Michael\SerialDriver.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{2ACB0C04-4812-11D3-8233-0020186676FB}" refers to invalid object "C:\users\Michael\SerialConfig.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{2EE7969F-6FC8-4D04-89AC-5109298ABC39}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSupp.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{3334A48F-8E49-11D4-B72C-005004C0C6BA}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSpool.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{35092AB4-B643-11D3-BB7D-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSpool.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{3762BAB7-8E00-4B51-AA7E-E57ED7552794}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImMangr.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{390CE9F2-C4A0-11D4-8A92-0090271D4F88}" refers to invalid object "C:\Program Files\Yahoo!\Messenger\ycrwin32.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{41695A8E-6414-11D4-8FB3-00D0B7730277}" refers to invalid object "C:\Program Files\Yahoo!\Messenger\asw.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{42F2C9BA-614F-47c0-B3E3-ECFD34EED658}" refers to invalid object "C:\WINNT\Downloaded Program Files\YSBactivex.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{44C8EC50-93BD-4633-9A82-CA0D4F1DD3A7}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImImprt.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{4750EC81-293B-11D6-885E-0050DA2761C4}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImView.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{47B10849-77FA-463b-8973-10241FF9DB37}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{4EAA7268-FC1E-47C6-87EF-8915475CBC88}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{50E5E612-B7DD-11D3-BB7F-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImParser.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{55B613D4-E613-11D3-857A-005004BE235E}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImServ.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{56336BCA-3D8A-11d6-A00B-0050DA18DE71}" refers to invalid object "C:\DOCUME~1\iraj\LOCALS~1\Temp\InfoWindow.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{5773A367-AD78-11D4-BCAF-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSpool.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{5862A1C2-7676-45AA-8C7D-2F803754D007}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{59EC0340-7506-11D2-B05F-00C04F7F89FE}" refers to invalid object "C:\PROGRA~1\AIM95\aimapi.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{5FAEF4A9-C5D0-11D4-BCC1-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImMangr.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{6D587C7F-27A0-4416-A90D-FB337F9B406C}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImComUtl.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{6F8C74D3-FF34-4D3B-890E-2A89AD71BA5F}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSupp.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{76059BDF-B539-11d3-835D-0020186676FB}" refers to invalid object "C:\users\Michael\SerialController.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{77969C47-EBE5-486F-8730-F48B84284D88}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImComUtl.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{79F506BE-15AC-11d1-8BEF-00A0C90F26F7}" refers to invalid object "MSJAVA.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{7A2E77CA-BDE2-11D3-BB91-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImParser.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{7E58CC0F-BC50-11D3-855B-0050DA2761C4}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImView.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{7F23E6E5-0E79-4aee-B723-B1463805D5A9}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\sound.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{805FB5B9-6344-11D6-B7AF-005004C0C6BA}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSupp.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{84566316-EC70-11D5-881D-0050DA2761C4}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImView.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{8ECF83A0-1AC9-11D4-8501-00A0CC5D1F63}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\wtwmplug.ax". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{96D04D6A-7B1E-48A9-BEA6-99F9FE8341C7}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{99180163-DA16-101A-935C-444553540000}" refers to invalid object "recncl.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{995F48E8-131F-4630-9FBE-98D9DBDABB05}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSpool.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{9D9E81A6-2285-4118-A61E-237AA4CF20B8}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSupp.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{9F091FED-8AC7-46EA-94C6-1F12CF5E1BE9}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSupp.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{A0C301D9-59A5-45eb-90E8-D60D8149F5A5}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImParser.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{A43BC58F-4453-49FF-9929-9D1E78D90062}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImMangr.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{A4845882-333F-11D0-B724-00AA0062CBB7}" refers to invalid object "C:\WINNT\System32\WBEM\WBEMSTUB.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{A7256361-EC20-4E5B-B824-A692515700BD}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImComUtl.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{A8D94870-BEA6-11D3-BB92-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSupp.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{B385A628-C100-11D3-BB95-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImNotfy.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{B5534644-E461-11D3-BBB2-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImAnim.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{B813095C-81C0-4E40-AA14-67520372B987}" refers to invalid object "C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{B84092B9-8658-11D5-8793-0050DA2761C4}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImTools.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{B98AC5E0-DE20-11d1-A7CE-0000F81E8509}" refers to invalid object "C:\WINNT\System32\msjava.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{B9BA256A-075B-49ea-B9E2-7DBC2EF021D5}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\sound.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{BC5F0300-F7BC-11d0-B9ED-40A708C10000}" refers to invalid object "MSJAVA.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{BFCA32C0-E917-11D3-B720-005004C0C6BA}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImBook.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{BFCA32C2-E917-11D3-B720-005004C0C6BA}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImBook.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{BFCA32C4-E917-11D3-B720-005004C0C6BA}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImBook.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{C0CF353A-F029-11D3-857F-005004BE235E}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImServ.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{C7681ACB-27AD-4025-8F53-643549159658}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7}" refers to invalid object "C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{CA6417D5-2F70-4EF0-9BA2-ADA5EDF5A2DD}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSupp.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{CB073682-BD1F-11D3-BB90-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImMangr.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{CB382C7A-8852-458A-8900-C456C96FDB8C}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImView.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{CBF9925D-3C19-4F33-9DE4-446978645EBB}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{CFF4CE82-3AA2-451F-9B77-7165605FB835}" refers to invalid object "C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{DA12A268-0ACB-11D4-859D-0050DA2761C4}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{E07D3492-32B5-11D0-B724-00AA0062CBB7}" refers to invalid object "C:\WINNT\System32\WBEM\WBEMSTUB.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{E1B6DE2A-F997-11D3-BBDB-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImImprt.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{E6253BEA-C3B2-4FB0-8F7F-B5B8C83674E5}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImMangr.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{E9BC70A8-D70C-11D3-BBAE-0050DA276194}" refers to invalid object "C:\PROGRA~1\INCRED~1\bin\IncMail.exe". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{EC8717B4-F660-11D3-ADE2-0050DA744DF1}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImImprt.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{EC8717B6-F660-11D3-ADE2-0050DA744DF1}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImImprt.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{EC8717B8-F660-11D3-ADE2-0050DA744DF1}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImImprt.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{EC8717C9-F660-11D3-ADE2-0050DA744DF1}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImImprt.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{ECFBE6E0-1AC8-11D4-8501-00A0CC5D1F63}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\wtwmplug.ax". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{F1B4B6F1-55D1-11d6-B7AD-005004C0C6BA}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImImprt.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{F648D80F-2409-4EDA-847D-8E820B03451F}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImServ.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{F8984111-38B6-11D5-8725-0050DA2761C4}" refers to invalid object "C:\Program Files\IncrediMail\bin\IMShExt.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{FA13A9FA-CA9B-11D2-9780-00104B242EA3}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\webdriver.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{FEBD6230-F4F6-4E79-89CD-4BEBDC4A96AE}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{FFD709F0-AF39-11D2-B854-0000F81E8872}" refers to invalid object "msjava.dll". Action Taken: No Action Taken.

Entry "HKCR\ActMsg.Session" refers to invalid object "{3FA7DEB3-6438-101B-ACC1-00AA00423326}". Action Taken: No Action Taken.

Entry "HKCR\ComPlusMetaData.MsCorHost" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken.

Entry "HKCR\ComPlusMetaData.MsCorHost.2" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken.

Entry "HKCR\CSSfile" refers to invalid object "{F9202A92-B111-11D0-BB8D-00A0C90F2744}". Action Taken: No Action Taken.

Entry "HKCR\Downloader.IMDownloader" refers to invalid object "{F00F4763-7355-4725-82F7-0DA94A256D46}". Action Taken: No Action Taken.

Entry "HKCR\Downloader.IMDownloader.1" refers to invalid object "{F00F4763-7355-4725-82F7-0DA94A256D46}". Action Taken: No Action Taken.

Entry "HKCR\MailFileAtt" refers to invalid object "{00020D05-0000-0000-C000-000000000046}". Action Taken: No Action Taken.

Entry "HKCR\mapifvbx.object" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken.

Entry "HKCR\mapifvbx.object.1" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken.

Entry "HKCR\Microsoft.VSWizards.VisualJSharp.UpgradeWizard.VjpUpgradeWizardManager" refers to invalid object "{E969F948-F7DE-4037-BBE6-1BC5D9DC2D55}". Action Taken: No Action Taken.

Entry "HKCR\PhotoRecord.Album" refers to invalid object "{FEDCFFC1-BEC4-11D1-93B9-0060979C8AB8}". Action Taken: No Action Taken.

Entry "HKCR\PopupMgr.PopupManager" refers to invalid object "{08E74C67-99A6-45C7-94DA-A397A8FD8082}". Action Taken: No Action Taken.

Entry "HKCR\PopupMgr.PopupManager.1" refers to invalid object "{08E74C67-99A6-45C7-94DA-A397A8FD8082}". Action Taken: No Action Taken.

Entry "HKCR\SymWriter.pdb" refers to invalid object "{520DC67A-752E-11D3-8D56-00C04F680B2B}". Action Taken: No Action Taken.

Entry "HKCR\TSLV.TSLV" refers to invalid object "{612DE685-FCC5-11D1-8A36-00A0C9B82ABC}". Action Taken: No Action Taken.

Entry "HKCR\TSLV.TSLV.1" refers to invalid object "{612DE685-FCC5-11D1-8A36-00A0C9B82ABC}". Action Taken: No Action Taken.

Entry "HKCR\VJUpgradeEngineLib.VJUpgradeEngine_7_1.1" refers to invalid object "{B0AC6ABA-AB35-4AEE-8D3D-6C55FA34F6A9}". Action Taken: No Action Taken.

Entry "HKCR\WinAdServX.Installer" refers to invalid object "{15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6}". Action Taken: No Action Taken.

Entry "HKCR\YBIOCtrl.CompanionBHO.4" refers to invalid object "{02478D38-C3F9-4efb-9B51-7695ECA05670}". Action Taken: No Action Taken.

Entry "HKCR\ZoomBrowserEX.Document" refers to invalid object "{476A6961-6FF1-11D0-9742-00A0246B6561}". Action Taken: No Action Taken.

File C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\backups\backup-20050515-102849-215.dll tagged as "not-a-virus:AdWare.WebSearch.am". Action Taken: No Action Taken.

File C:\CCProxy\CCProxy.exe tagged as not-a-virus:Server-Proxy.Win32.3proxy.CCProxy.60. No Action Taken.

File C:\Documents and Settings\adm\Local Settings\Application Data\Wildtangent\Cdacache\00\00\0D.dat tagged as "not-a-virus:AdWare.WildTangent.b". Action Taken: No Action Taken.

File C:\Documents and Settings\Administrator\Local Settings\Temp\backups\backup-20050515-102849-215.dll tagged as "not-a-virus:AdWare.WebSearch.am". Action Taken: No Action Taken.

File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy.zip infected by "Password-protected-EXE" Virus! Action Taken: No Action Taken.

File C:\Documents and Settings\iraj\Desktop\ccproxysetup.exe tagged as not-a-virus:Server-Proxy.Win32.3proxy.CCProxy.60. No Action Taken.

File C:\Documents and Settings\yen\Desktop\mp56200full.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

File C:\Downloads\Avalanche-dm[2].exe tagged as "not-a-virus:AdWare.Trymedia.a". Action Taken: No Action Taken.

File C:\Games.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

File C:\jdk1.3.0_02\demo\applets\BarChart\Chart.class tagged as not-a-virus:Garbage.Java.Chart. No Action Taken.

File C:\Program Files\3DO\High Heat Baseball 2000\MPLAYNOW\MPLAYER\setup.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

File C:\Program Files\FreeSlide Website Entry Certificate\SaveInstCm.exe tagged as "not-a-virus:AdWare.SaveNow.c". Action Taken: No Action Taken.

File C:\Program Files\Netscape\Communicator\Program\Plugins\npwthost.dll tagged as "not-a-virus:AdWare.WildTangent.b". Action Taken: No Action Taken.

File C:\RECYCLER\S-1-5-21-1614895754-854245398-1060284298-1000\Dc47.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

File C:\WINNT\wt\wtvh.dll tagged as "not-a-virus:AdWare.WildTangent.b". Action Taken: No Action Taken.

———————————————————————————————–

Logfile of HijackThis v1.99.1
Scan saved at 9:12:53 AM, on 16/06/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINNT\system32\crypserv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\RexSvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\HEWLET~1\PHOTOS~1\HPSHAR~1\hpgs2wnf.exe
C:\WINNT\system32\wuauclt.exe
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\HijackThis.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.1.1.127:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost;
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\ycomp5_5_7_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O8 - Extra context menu item: &Google Search - res://c:\winnt\downloaded program files\GoogleToolbar_en_1.1.70-deleon.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\winnt\downloaded program files\GoogleToolbar_en_1.1.70-deleon.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\winnt\downloaded program files\GoogleToolbar_en_1.1.70-deleon.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://c:\winnt\downloaded program files\GoogleToolbar_en_1.1.70-deleon.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page - res://c:\winnt\downloaded program files\GoogleToolbar_en_1.1.70-deleon.dll/cmtrans.html
O9 - Extra button: (no name) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O16 - DPF: Microsoft WFC Forms Designer - file://D:\VJ98\wfcforms.cab
O16 - DPF: Visual Studio 6 Extensibility Libraries - file://D:\VJ98\vstudio6.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potc_x.cab
O16 - DPF: Yahoo! Spelldown - http://download.games.yahoo.com/games/clients/y/sdt1_x.cab
O16 - DPF: Yahoo! Tic-Tac-Toe - http://download.games.yahoo.com/games/clients/y/ft3_x.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/en/deleon/1…n/GoogleNav.cab
O16 - DPF: {707FC7B7-B227-4DF6-A606-0EC317BB08A1} (PhotosCtrlCA Class) - http://ca.f1.pg.photos.yahoo.com/ocx/ca/yexplorer1_9ca.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundl…ArcadeRdxIE.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Crypkey License - Unknown owner - C:\WINNT\SYSTEM32\crypserv.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: USB to Serial COM Port Messages (RexService) - Unknown owner - C:\WINNT\SYSTEM32\RexSvc.exe
Post #14
Almost done. :)

Double-click on Killbox.exe to start the program.
In the killbox program, select the Delete on Reboot option.
In the field labeled Full Path of File to Delete enter the file paths listed below ONE AT A TIME (EXACTLY as it appears, please double check to make sure!):

C:\Downloads\Avalanche-dm[2].exe
C:\jdk1.3.0_02\demo\applets\BarChart\Chart.class
C:\Program Files\FreeSlide Website Entry Certificate\SaveInstCm.exe

Press the button that looks like a red circle with a white X in it after each one. When it asks if you would like to delete on reboot, press the YES button, when it asks if you want to reboot now, press the NO button. Do this after each one until you have entered the LAST file path I have listed above. After that LAST file path has been entered, press the YES button at both prompts so that your computer restarts.
If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just restart manually.


Post a fresh HijackThis log and mwavscan log from the Admin account.
Post #15
Good morning Alan,

I did what you asked me to do, through the admin account - I hope you did mean that I should have deleted those three lines and also do the two scans through admin account.

Alan, it still says 27 viruses. Also highlighting the texts are a real headaches :( I highlight, it vanishes. I have to highlight the texts at least 5 or 6 times till may be it stays so I can copy it. :huh:

The logs you requested follows.

Have a great weekend, :)

Applisha

———————————————————————————————–
Object "YourSiteBar Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "FunWeb Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "FunWeb Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "FunWeb Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "FunWeb Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "FunWeb Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "FunWeb Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "IBIS Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "MyWebSearch Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "Wind Updates Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "HuntBar Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "mwsoemon Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "Gator Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "precisiontime Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "eZula Spyware/Adware" found in File System! Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\popcaploader.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\QDow_AS2.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\Rovion.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\xscan53.ocx". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\YSBactivex.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\googlenav.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\swapit.ocx". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\cubis.ocx". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\QDow.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\ActiveInstall.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\Login.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\NewMsgButton.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\ActiveReceiver.ocx". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\WinAdServX.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\ISTactivex.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\xscan53.ocx". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\Rovion.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\popcaploader.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\QDow_AS2.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\YSBactivex.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{00120005-B1BA-11CE-ABC6-F5B2E79D9E3F}" refers to invalid object "C:\PROGRA~1\Logitech\IMAGES~1\Ltocx12n.ocx". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{00120007-B1BA-11CE-ABC6-F5B2E79D9E3F}" refers to invalid object "C:\PROGRA~1\Logitech\IMAGES~1\Ltocx12n.ocx". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{00120070-B1BA-11CE-ABC6-F5B2E79D9E3F}" refers to invalid object "C:\Program Files\Logitech\ImageStudio\ltscr12n.ocx". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{00120074-B1BA-11CE-ABC6-F5B2E79D9E3F}" refers to invalid object "C:\Program Files\Logitech\ImageStudio\ltscr12n.ocx". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{00120075-B1BA-11CE-ABC6-F5B2E79D9E3F}" refers to invalid object "C:\Program Files\Logitech\ImageStudio\ltscr12n.ocx". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{00120076-B1BA-11CE-ABC6-F5B2E79D9E3F}" refers to invalid object "C:\Program Files\Logitech\ImageStudio\ltscr12n.ocx". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{00120077-B1BA-11CE-ABC6-F5B2E79D9E3F}" refers to invalid object "C:\Program Files\Logitech\ImageStudio\ltscr12n.ocx". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{00A6FAF4-072E-44cf-8957-5838F569A31D}" refers to invalid object "C:\Program Files\MyWebSearch\SrchAstt\3.bin\MWSSRCAS.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}" refers to invalid object "C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{032038A5-B655-11D3-BB7D-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSpool.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{04B29FDD-F820-45CF-AD60-233FC7392676}" refers to invalid object "C:\Program Files\Logitech\ImageStudio\WASpLf.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{0710C793-2117-11D5-B75D-005004C0C6BA}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{072809C8-B60E-11D3-BB7C-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFoldrs.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{07A52AE7-B6F0-11D3-BB7E-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSpool.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}" refers to invalid object "C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{07D03588-7B5E-11D5-8784-0050DA2761C4}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{087EF34C-BBC4-11D3-BB8D-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImParser.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{08F6CFEE-9381-4796-8596-1D964DD9B762}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSpool.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{09C1B8B7-C70C-43F5-9277-8576921ED70C}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFoldrs.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{0B9A0840-1EC3-11D5-B75C-005004C0C6BA}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImTools.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70}" refers to invalid object "C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{11B72805-205F-11D6-8855-0050DA2761C4}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImView.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{17A434C2-B48F-11D3-BB78-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFoldrs.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{25D41C19-246A-4643-B0CA-08F5D1D07EE6}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImParser.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{28D1EE40-E73D-422D-A2AC-D23F8D3071B2}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImParser.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{2ACB0C00-4812-11D3-8233-0020186676FB}" refers to invalid object "C:\users\Michael\SerialDriver.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{2ACB0C04-4812-11D3-8233-0020186676FB}" refers to invalid object "C:\users\Michael\SerialConfig.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{2EE7969F-6FC8-4D04-89AC-5109298ABC39}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSupp.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{3334A48F-8E49-11D4-B72C-005004C0C6BA}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSpool.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{35092AB4-B643-11D3-BB7D-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSpool.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{3762BAB7-8E00-4B51-AA7E-E57ED7552794}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImMangr.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{390CE9F2-C4A0-11D4-8A92-0090271D4F88}" refers to invalid object "C:\Program Files\Yahoo!\Messenger\ycrwin32.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{41695A8E-6414-11D4-8FB3-00D0B7730277}" refers to invalid object "C:\Program Files\Yahoo!\Messenger\asw.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{42F2C9BA-614F-47c0-B3E3-ECFD34EED658}" refers to invalid object "C:\WINNT\Downloaded Program Files\YSBactivex.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{44C8EC50-93BD-4633-9A82-CA0D4F1DD3A7}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImImprt.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{4750EC81-293B-11D6-885E-0050DA2761C4}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImView.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{47B10849-77FA-463b-8973-10241FF9DB37}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{4EAA7268-FC1E-47C6-87EF-8915475CBC88}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{50E5E612-B7DD-11D3-BB7F-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImParser.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{55B613D4-E613-11D3-857A-005004BE235E}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImServ.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{56336BCA-3D8A-11d6-A00B-0050DA18DE71}" refers to invalid object "C:\DOCUME~1\iraj\LOCALS~1\Temp\InfoWindow.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{5773A367-AD78-11D4-BCAF-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSpool.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{5862A1C2-7676-45AA-8C7D-2F803754D007}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{59EC0340-7506-11D2-B05F-00C04F7F89FE}" refers to invalid object "C:\PROGRA~1\AIM95\aimapi.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{5FAEF4A9-C5D0-11D4-BCC1-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImMangr.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{6D587C7F-27A0-4416-A90D-FB337F9B406C}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImComUtl.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{6F8C74D3-FF34-4D3B-890E-2A89AD71BA5F}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSupp.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{76059BDF-B539-11d3-835D-0020186676FB}" refers to invalid object "C:\users\Michael\SerialController.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{77969C47-EBE5-486F-8730-F48B84284D88}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImComUtl.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{79F506BE-15AC-11d1-8BEF-00A0C90F26F7}" refers to invalid object "MSJAVA.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{7A2E77CA-BDE2-11D3-BB91-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImParser.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{7E58CC0F-BC50-11D3-855B-0050DA2761C4}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImView.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{7F23E6E5-0E79-4aee-B723-B1463805D5A9}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\sound.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{805FB5B9-6344-11D6-B7AF-005004C0C6BA}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSupp.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{84566316-EC70-11D5-881D-0050DA2761C4}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImView.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{8ECF83A0-1AC9-11D4-8501-00A0CC5D1F63}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\wtwmplug.ax". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{96D04D6A-7B1E-48A9-BEA6-99F9FE8341C7}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{99180163-DA16-101A-935C-444553540000}" refers to invalid object "recncl.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{995F48E8-131F-4630-9FBE-98D9DBDABB05}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSpool.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{9D9E81A6-2285-4118-A61E-237AA4CF20B8}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSupp.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{9F091FED-8AC7-46EA-94C6-1F12CF5E1BE9}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSupp.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{A0C301D9-59A5-45eb-90E8-D60D8149F5A5}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImParser.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{A43BC58F-4453-49FF-9929-9D1E78D90062}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImMangr.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{A4845882-333F-11D0-B724-00AA0062CBB7}" refers to invalid object "C:\WINNT\System32\WBEM\WBEMSTUB.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{A7256361-EC20-4E5B-B824-A692515700BD}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImComUtl.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{A8D94870-BEA6-11D3-BB92-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSupp.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{B385A628-C100-11D3-BB95-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImNotfy.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{B5534644-E461-11D3-BBB2-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImAnim.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{B813095C-81C0-4E40-AA14-67520372B987}" refers to invalid object "C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{B84092B9-8658-11D5-8793-0050DA2761C4}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImTools.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{B98AC5E0-DE20-11d1-A7CE-0000F81E8509}" refers to invalid object "C:\WINNT\System32\msjava.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{B9BA256A-075B-49ea-B9E2-7DBC2EF021D5}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\sound.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{BC5F0300-F7BC-11d0-B9ED-40A708C10000}" refers to invalid object "MSJAVA.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{BFCA32C0-E917-11D3-B720-005004C0C6BA}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImBook.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{BFCA32C2-E917-11D3-B720-005004C0C6BA}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImBook.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{BFCA32C4-E917-11D3-B720-005004C0C6BA}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImBook.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{C0CF353A-F029-11D3-857F-005004BE235E}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImServ.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{C7681ACB-27AD-4025-8F53-643549159658}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7}" refers to invalid object "C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{CA6417D5-2F70-4EF0-9BA2-ADA5EDF5A2DD}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImSupp.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{CB073682-BD1F-11D3-BB90-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImMangr.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{CB382C7A-8852-458A-8900-C456C96FDB8C}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImView.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{CBF9925D-3C19-4F33-9DE4-446978645EBB}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{CFF4CE82-3AA2-451F-9B77-7165605FB835}" refers to invalid object "C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{DA12A268-0ACB-11D4-859D-0050DA2761C4}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{E07D3492-32B5-11D0-B724-00AA0062CBB7}" refers to invalid object "C:\WINNT\System32\WBEM\WBEMSTUB.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{E1B6DE2A-F997-11D3-BBDB-0050DA276194}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImImprt.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{E6253BEA-C3B2-4FB0-8F7F-B5B8C83674E5}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImMangr.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{E9BC70A8-D70C-11D3-BBAE-0050DA276194}" refers to invalid object "C:\PROGRA~1\INCRED~1\bin\IncMail.exe". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{EC8717B4-F660-11D3-ADE2-0050DA744DF1}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImImprt.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{EC8717B6-F660-11D3-ADE2-0050DA744DF1}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImImprt.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{EC8717B8-F660-11D3-ADE2-0050DA744DF1}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImImprt.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{EC8717C9-F660-11D3-ADE2-0050DA744DF1}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImImprt.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{ECFBE6E0-1AC8-11D4-8501-00A0CC5D1F63}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\wtwmplug.ax". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{F1B4B6F1-55D1-11d6-B7AD-005004C0C6BA}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImImprt.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{F648D80F-2409-4EDA-847D-8E820B03451F}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImServ.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{F8984111-38B6-11D5-8725-0050DA2761C4}" refers to invalid object "C:\Program Files\IncrediMail\bin\IMShExt.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{FA13A9FA-CA9B-11D2-9780-00104B242EA3}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\webdriver.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{FEBD6230-F4F6-4E79-89CD-4BEBDC4A96AE}" refers to invalid object "C:\Program Files\IncrediMail\bin\ImFeat.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{FFD709F0-AF39-11D2-B854-0000F81E8872}" refers to invalid object "msjava.dll". Action Taken: No Action Taken.

Entry "HKCR\ActMsg.Session" refers to invalid object "{3FA7DEB3-6438-101B-ACC1-00AA00423326}". Action Taken: No Action Taken.

Entry "HKCR\ComPlusMetaData.MsCorHost" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken.

Entry "HKCR\ComPlusMetaData.MsCorHost.2" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken.

Entry "HKCR\CSSfile" refers to invalid object "{F9202A92-B111-11D0-BB8D-00A0C90F2744}". Action Taken: No Action Taken.

Entry "HKCR\Downloader.IMDownloader" refers to invalid object "{F00F4763-7355-4725-82F7-0DA94A256D46}". Action Taken: No Action Taken.

Entry "HKCR\Downloader.IMDownloader.1" refers to invalid object "{F00F4763-7355-4725-82F7-0DA94A256D46}". Action Taken: No Action Taken.

Entry "HKCR\MailFileAtt" refers to invalid object "{00020D05-0000-0000-C000-000000000046}". Action Taken: No Action Taken.

Entry "HKCR\mapifvbx.object" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken.

Entry "HKCR\mapifvbx.object.1" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken.

Entry "HKCR\Microsoft.VSWizards.VisualJSharp.UpgradeWizard.VjpUpgradeWizardManager" refers to invalid object "{E969F948-F7DE-4037-BBE6-1BC5D9DC2D55}". Action Taken: No Action Taken.

Entry "HKCR\PhotoRecord.Album" refers to invalid object "{FEDCFFC1-BEC4-11D1-93B9-0060979C8AB8}". Action Taken: No Action Taken.

Entry "HKCR\PopupMgr.PopupManager" refers to invalid object "{08E74C67-99A6-45C7-94DA-A397A8FD8082}". Action Taken: No Action Taken.

Entry "HKCR\PopupMgr.PopupManager.1" refers to invalid object "{08E74C67-99A6-45C7-94DA-A397A8FD8082}". Action Taken: No Action Taken.

Entry "HKCR\SymWriter.pdb" refers to invalid object "{520DC67A-752E-11D3-8D56-00C04F680B2B}". Action Taken: No Action Taken.

Entry "HKCR\TSLV.TSLV" refers to invalid object "{612DE685-FCC5-11D1-8A36-00A0C9B82ABC}". Action Taken: No Action Taken.

Entry "HKCR\TSLV.TSLV.1" refers to invalid object "{612DE685-FCC5-11D1-8A36-00A0C9B82ABC}". Action Taken: No Action Taken.

Entry "HKCR\VJUpgradeEngineLib.VJUpgradeEngine_7_1.1" refers to invalid object "{B0AC6ABA-AB35-4AEE-8D3D-6C55FA34F6A9}". Action Taken: No Action Taken.

Entry "HKCR\WinAdServX.Installer" refers to invalid object "{15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6}". Action Taken: No Action Taken.

Entry "HKCR\YBIOCtrl.CompanionBHO.4" refers to invalid object "{02478D38-C3F9-4efb-9B51-7695ECA05670}". Action Taken: No Action Taken.

Entry "HKCR\ZoomBrowserEX.Document" refers to invalid object "{476A6961-6FF1-11D0-9742-00A0246B6561}". Action Taken: No Action Taken.

File C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\backups\backup-20050515-102849-215.dll tagged as "not-a-virus:AdWare.WebSearch.am". Action Taken: No Action Taken.

File C:\CCProxy\CCProxy.exe tagged as not-a-virus:Server-Proxy.Win32.3proxy.CCProxy.60. No Action Taken.

File C:\Documents and Settings\adm\Local Settings\Application Data\Wildtangent\Cdacache\00\00\0D.dat tagged as "not-a-virus:AdWare.WildTangent.b". Action Taken: No Action Taken.

File C:\Documents and Settings\Administrator\Local Settings\Temp\backups\backup-20050515-102849-215.dll tagged as "not-a-virus:AdWare.WebSearch.am". Action Taken: No Action Taken.

File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy.zip infected by "Password-protected-EXE" Virus! Action Taken: No Action Taken.

File C:\Documents and Settings\iraj\Desktop\ccproxysetup.exe tagged as not-a-virus:Server-Proxy.Win32.3proxy.CCProxy.60. No Action Taken.

File C:\Documents and Settings\yen\Desktop\mp56200full.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

File C:\Games.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

File C:\Program Files\3DO\High Heat Baseball 2000\MPLAYNOW\MPLAYER\setup.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

File C:\Program Files\Netscape\Communicator\Program\Plugins\npwthost.dll tagged as "not-a-virus:AdWare.WildTangent.b". Action Taken: No Action Taken.

File C:\RECYCLER\S-1-5-21-1614895754-854245398-1060284298-1000\Dc47.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

File C:\WINNT\wt\wtvh.dll tagged as "not-a-virus:AdWare.WildTangent.b". Action Taken: No Action Taken.


———————————————————————————————
Logfile of HijackThis v1.99.1
Scan saved at 8:05:36 AM, on 17/06/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINNT\system32\crypserv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\RexSvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINNT\system32\wuauclt.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe
C:\PROGRA~1\HEWLET~1\PHOTOS~1\HPSHAR~1\hpgs2wnf.exe
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\HijackThis.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.1.1.127:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost;
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\ycomp5_5_7_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O8 - Extra context menu item: &Google Search - res://c:\winnt\downloaded program files\GoogleToolbar_en_1.1.70-deleon.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\winnt\downloaded program files\GoogleToolbar_en_1.1.70-deleon.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\winnt\downloaded program files\GoogleToolbar_en_1.1.70-deleon.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://c:\winnt\downloaded program files\GoogleToolbar_en_1.1.70-deleon.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page - res://c:\winnt\downloaded program files\GoogleToolbar_en_1.1.70-deleon.dll/cmtrans.html
O9 - Extra button: (no name) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O16 - DPF: Microsoft WFC Forms Designer - file://D:\VJ98\wfcforms.cab
O16 - DPF: Visual Studio 6 Extensibility Libraries - file://D:\VJ98\vstudio6.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potc_x.cab
O16 - DPF: Yahoo! Spelldown - http://download.games.yahoo.com/games/clients/y/sdt1_x.cab
O16 - DPF: Yahoo! Tic-Tac-Toe - http://download.games.yahoo.com/games/clients/y/ft3_x.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/en/deleon/1…n/GoogleNav.cab
O16 - DPF: {707FC7B7-B227-4DF6-A606-0EC317BB08A1} (PhotosCtrlCA Class) - http://ca.f1.pg.photos.yahoo.com/ocx/ca/yexplorer1_9ca.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundl…ArcadeRdxIE.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Crypkey License - Unknown owner - C:\WINNT\SYSTEM32\crypserv.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: USB to Serial COM Port Messages (RexService) - Unknown owner - C:\WINNT\SYSTEM32\RexSvc.exe

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI