This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Multiple browser windows open at startup

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

I have 4 IE windows launch at startup that go to some freeweb pages that seem to be blocked. After that I have all sorts of carp** installed on my laptop that I can remove with various spyware apps but all come back next time I boot.

Here is my log, any idea what is doing it?

Logfile of HijackThis v1.99.1
Scan saved at 9:32:14 AM, on 6/16/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\acs.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\ISS\issSensors\DesktopProtection\blackd.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\PatchLink\Update Agent\GRAVITIXSERVICE.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe
C:\WINDOWS\System32\CCM\CLICOMP\RemCtrl\Wuser32.exe
C:\WINDOWS\System32\CCM\CcmExec.exe
C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\WINDOWS\AGRSMMSG.exe
C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE
C:\Program Files\RightFax\FaxCtrl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Wireless Optical Rechargeable Mouse\moffice.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Wireless Optical Rechargeable Mouse\MOUSE32A.DAT
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe
C:\WINDOWS\wup.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\ms.exe
C:\xa.exe
C:\Program Files\Rswvsou\Cwev.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\ed.exe
C:\xdf.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\D-Link\AirPlus G Wireless Adapter Utility\AirPlus.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Trillian\trillian.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\HJT\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.xmradio.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.xmradio.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by XM Radio IT Department
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ChkAdmin] C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE
O4 - HKLM\..\Run: [RightFAX Print-to-Fax Driver] C:\Program Files\RightFax\\FaxCtrl.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Wireless Optical Rechargeable Mouse\moffice.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ymetray] "C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe"
O4 - HKLM\..\Run: [Client Update] C:\WINDOWS\wup.exe
O4 - HKLM\..\Run: [Virus Removal Tool] C:\ms.exe
O4 - HKLM\..\Run: [WinUpgrader] C:\xa.exe
O4 - HKLM\..\Run: [Nawuwas] C:\Program Files\Rswvsou\Cwev.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Antivirus Installer] C:\ed.exe
O4 - HKLM\..\Run: [Anti] C:\xdf.exe
O4 - HKLM\..\RunServices: [CPQDFWAG] C:\WINDOWS\Cpqdiag\CpqDfwAg.exe
O4 - HKLM\..\RunOnce: [MicrosoftAntiSpywareCleaner] C:\Program Files\Microsoft AntiSpyware\gcASCleaner.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: Monitor My eRooms.lnk = C:\Program Files\eRoom 5\ERClient.exe
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: D-Link AirPlus G Wireless Utility.lnk = ?
O4 - Global Startup: D-Link REG Utility.lnk = ?
O4 - Global Startup: TeamSite LaunchPad Startup.TSL.lnk = ?
O4 - Global Startup: VPN Client.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O15 - Trusted Zone: *.PATCHLINK.XMRADIO.COM (HKLM)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {32F09A50-CC2C-11D2-9CB0-000000000000} (iwlaunch.exe) - http://10.3.13.33/iw/launch/launchpad_setup.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/200312…meInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1100113716566
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O16 - DPF: {E876D003-BCDE-11D3-9131-000094B61529} (ERPageAddin Class) - https://eroom.xmradio.com/eRoomSetup/client.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = xmradio.com
O17 - HKLM\Software\..\Telephony: DomainName = xmradio.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = xmradio.com
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\acs.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\Program Files\ISS\issSensors\DesktopProtection\blackd.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Insight Local Alerter (CPQALERT) - Hewlett-Packard Company - C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
O23 - Service: cpqdmi - Compaq Computer Corporation - C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Remote Diagnostics Enabling Agent (DfwWebAgent) - Hewlett-Packard - C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: OracleOraHome92ClientCache - Unknown owner - D:\oracle\ora92\BIN\ONRSD.EXE
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PatchLink Update - Patchlink Corporation - C:\Program Files\PatchLink\Update Agent\GRAVITIXSERVICE.exe
O23 - Service: RapApp - Internet Security Systems, Inc. - C:\Program Files\ISS\issSensors\DesktopProtection\RapApp.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Win32Sl (WIN32SL) - Intel - C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe
We are sorry for the delay in replying to you. If you still require help, please post a fresh Hijackthis log as a reply to this thread. I'll receive an e-mail notification of your reply and will respond as soon as possible. Thank you for your patience.
I did a little online research and found a few things in the original log to remove. It seems to have taken care of the IE windows on start-up but would you mind taking a look at the current log to make sure all the bad stuff is off?

Thanks
Heather

Logfile of HijackThis v1.99.1
Scan saved at 8:09:36 AM, on 6/20/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\acs.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\ISS\issSensors\DesktopProtection\blackd.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe
C:\WINDOWS\System32\CCM\CLICOMP\RemCtrl\Wuser32.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\CCM\CcmExec.exe
C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe
C:\WINDOWS\System32\msiexec.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\WINDOWS\AGRSMMSG.exe
C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE
C:\Program Files\RightFax\FaxCtrl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Wireless Optical Rechargeable Mouse\moffice.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Wireless Optical Rechargeable Mouse\MOUSE32A.DAT
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\D-Link\AirPlus G Wireless Adapter Utility\AirPlus.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Trillian\trillian.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\PatchLink\Update Agent\GRAVITIXSERVICE.exe
C:\PROGRAM FILES\PATCHLINK\UPDATE AGENT\Dagent.exe
C:\Program Files\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.xmradio.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.xmradio.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by XM Radio IT Department
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ChkAdmin] C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE
O4 - HKLM\..\Run: [RightFAX Print-to-Fax Driver] C:\Program Files\RightFax\\FaxCtrl.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Wireless Optical Rechargeable Mouse\moffice.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ymetray] "C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\RunServices: [CPQDFWAG] C:\WINDOWS\Cpqdiag\CpqDfwAg.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Monitor My eRooms.lnk = C:\Program Files\eRoom 5\ERClient.exe
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: D-Link AirPlus G Wireless Utility.lnk = ?
O4 - Global Startup: D-Link REG Utility.lnk = ?
O4 - Global Startup: TeamSite LaunchPad Startup.TSL.lnk = ?
O4 - Global Startup: VPN Client.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.PATCHLINK.XMRADIO.COM (HKLM)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {32F09A50-CC2C-11D2-9CB0-000000000000} (iwlaunch.exe) - http://10.3.13.33/iw/launch/launchpad_setup.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/200312…meInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1100113716566
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O16 - DPF: {E876D003-BCDE-11D3-9131-000094B61529} (ERPageAddin Class) - https://eroom.xmradio.com/eRoomSetup/client.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = xmradio.com
O17 - HKLM\Software\..\Telephony: DomainName = xmradio.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = xmradio.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = xmradio.com
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\acs.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\Program Files\ISS\issSensors\DesktopProtection\blackd.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Insight Local Alerter (CPQALERT) - Hewlett-Packard Company - C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
O23 - Service: cpqdmi - Compaq Computer Corporation - C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Remote Diagnostics Enabling Agent (DfwWebAgent) - Hewlett-Packard - C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: OracleOraHome92ClientCache - Unknown owner - D:\oracle\ora92\BIN\ONRSD.EXE
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PatchLink Update - Patchlink Corporation - C:\Program Files\PatchLink\Update Agent\GRAVITIXSERVICE.exe
O23 - Service: RapApp - Internet Security Systems, Inc. - C:\Program Files\ISS\issSensors\DesktopProtection\RapApp.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Win32Sl (WIN32SL) - Intel - C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe
Hello Heather and welcome to TomCoyote. :wavey:

You appear to have done a good job at cleaning up the log. :thumbup:
I'd like you to run another scanner to make sure nothing else bad is on the computer.

Click here to download mwavscan.
  • Double-click it to run it.
  • Read then accept the agreement.
  • Check Drive, and select all local drives, scan all files, then press 'scan'. (This may take a while and will not fix anything)
  • Once it finds something, it will prompt you so click OK.
  • When it is completed, anything found will be displayed in the lower pane.
  • Highlight it, copy it (CTRL+C), and paste (CTRL+V) it in your next reply.
Note : It will find many orphaned registry entries so please do not be alarmed by the amount of items that show.

Post a HijackThis log and the mwavscan log as a reply to this thread.
Let us know how the computer is behaving now.
My computer is better but does seem slower than it used to be which is why I think there might be something I missed.

Here are the newest logs:

Object "DyFuCA Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "iSearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\MediaAccX.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\System32\iuctl.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\drivers\CpqP6Del.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Symantec\S32STAT.DLL". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\iuctl.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\DIMM.DLL". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "d:\Program Files\Starbase\StarGate SDK\Lib\StSDKCAPIEncryptContext.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "d:\Program Files\Starbase\StarGate SDK\Lib\StSDKNativeFileAccess.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "d:\Program Files\Starbase\StarGate SDK\Lib\StSDKOSEnvironment.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "d:\Program Files\Starbase\StarGate SDK\Lib\stjvl.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "d:\Program Files\Starbase\StarGate SDK\lib\starteam-sdk.jar". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "d:\Program Files\Starbase\StarGate SDK\lib\swingall.jar". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "d:\Program Files\Starbase\StarGate SDK\sdkUninst.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\pxsfs.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0B6DC6EE-C4FD-11d1-819A-00C04FB69B4D}" refers to invalid object "C:\Program Files\Common Files\Adobe\Shell\psicon.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0c097121-c5d6-47eb-841d-30bff71a71c4}" refers to invalid object "C:\WINDOWS\wt\webdriver\4.1.1\wtmulti.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{189504B8-50D1-4AA8-B4D6-95C8F58A6414}" refers to invalid object "C:\PROGRA~1\AIM\sb.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{21B4ACC4-8874-4AEC-AEAC-F567A249B4D4}" refers to invalid object "c:\program files\180searchassistant\salmhook.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{29FF67FF-8050-480f-9F30-CC41635F2F9D}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{35D67670-BC9C-11D3-8E63-009027BCC9D8}" refers to invalid object "C:\Program Files\eRoom 5\ERAddIn.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{40A4B81A-09EE-1100-B465-00AA006988E8}" refers to invalid object "C:\Program Files\eRoom 5\ERAddIn.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{40A4B81D-09EE-1100-B465-00AA006988E8}" refers to invalid object "C:\Program Files\eRoom 5\ERAddIn.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{40A4B81E-09EE-1100-B465-00AA006988E8}" refers to invalid object "C:\Program Files\eRoom 5\ERAddIn.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{4C836512-BB70-11D2-A5A7-00105A9C91C6}" refers to invalid object "C:\Program Files\Common Files\Macromedia \bin\XceedZip.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697406-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869740C-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869740E-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697412-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869741C-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869741E-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697422-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697426-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869742C-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697430-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697434-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697438-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869743C-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697440-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869744A-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869744E-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697452-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697456-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869745A-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869745C-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697464-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697466-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869746A-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869746E-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697472-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697476-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869747A-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869747C-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697480-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697482-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697486-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697488-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869748C-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869748E-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697494-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697498-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869749C-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586974A0-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586974A4-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586974A8-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586974AC-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586974B0-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586974B8-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586974BA-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586974C0-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586974C6-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586974CA-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586974CE-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586974D2-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586974D8-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586974DC-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586974E0-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586974E6-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586974EC-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586974F4-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586974F8-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586974FA-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586974FE-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697500-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697504-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697508-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869750C-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697510-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697514-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697518-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869751A-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697520-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697524-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697528-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869752C-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697530-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697532-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697538-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869753A-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697544-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697546-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869754A-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869754E-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697552-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697556-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869755A-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869755E-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697562-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697566-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869756A-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869756E-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697572-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697576-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869757A-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869757E-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697580-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697584-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697586-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869758A-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869758C-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697594-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{58697598-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5869759A-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586975A4-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586975AA-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586975B2-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586975B6-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586975BA-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586975BE-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586975C0-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586975C4-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586975C6-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586975CA-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586975CC-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586975D0-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586975D2-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586975DA-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586975DE-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{586975DF-56AB-11D5-B316-0800209CC2CE}" refers to invalid object "d:\PROGRA~1\Starbase\STARGA~1\lib\STARGA~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5CABFE45-C519-11D3-A8F5-00105AAA1FFC}" refers to invalid object "C:\Program Files\eRoom 5\ERAddIn.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{70B51430-B6CA-11D0-B9B9-00A0C922E750}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{7F23E6E5-0E79-4aee-B723-B1463805D5A9}" refers to invalid object "C:\WINDOWS\wt\webdriver\4.1.1\sound.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{8298d101-f992-43b7-8eca-5052d885b995}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{83D4679F-B6D7-11D2-BF36-00C04FB90A03}" refers to invalid object "C:\PROGRA~1\MESSEN~1\rtcimsp.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{8ECF83A0-1AC9-11D4-8501-00A0CC5D1F63}" refers to invalid object "C:\WINDOWS\wt\webdriver\4.1.1\wtwmplug.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{9421C78D-8EB5-4D13-2EA8-024AE265CE5C}" refers to invalid object "C:\Program Files\Sunbelt Software\CounterSpy Client\sunASThreatAudit.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A98ABF1C-107C-44E7-9254-2C3FF435D0C2}" refers to invalid object "C:\PROGRA~1\AIM\sb.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A9E69612-B80D-11D0-B9B9-00A0C922E750}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A}" refers to invalid object "C:\WINDOWS\wt\webdriver\4.1.1\wthostctl.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B9BA256A-075B-49ea-B9E2-7DBC2EF021D5}" refers to invalid object "C:\WINDOWS\wt\webdriver\4.1.1\sound.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{BE265956-6F5F-4790-9CAB-EDFAC64362EF}" refers to invalid object "C:\Program Files\AIM\rtvideo.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{DB797690-40E0-11D2-9BD5-0060082AE372}" refers to invalid object "C:\Program Files\Common Files\Macromedia \bin\XceedZip.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E876D003-BCDE-11D3-9131-000094B61529}" refers to invalid object "C:\Program Files\eRoom 5\ERAddIn.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{ECFBE6E0-1AC8-11D4-8501-00A0CC5D1F63}" refers to invalid object "C:\WINDOWS\wt\webdriver\4.1.1\wtwmplug.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{f612954d-3b0b-4c56-9563-227b7be624b4}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{FA13A9FA-CA9B-11D2-9780-00104B242EA3}" refers to invalid object "C:\WINDOWS\wt\webdriver\4.1.1\webdriver.dll". Action Taken: No Action Taken.
Entry "HKCR\Alg.AlgSetup" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.
Entry "HKCR\Alg.AlgSetup.1" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.
Entry "HKCR\ComPlusMetaData.MsCorHost" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken.
Entry "HKCR\ComPlusMetaData.MsCorHost.2" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken.
Entry "HKCR\MailFileAtt" refers to invalid object "{00020D05-0000-0000-C000-000000000046}". Action Taken: No Action Taken.
Entry "HKCR\mapifvbx.object" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken.
Entry "HKCR\mapifvbx.object.1" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken.
Entry "HKCR\Photoshop.OmgCombineOmgf.1" refers to invalid object "{9AA378F7-5FE5-4570-33DB-C403A25F833D}". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic.1" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\RTCCore.RTCClient" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken.
Entry "HKCR\RTCCore.RTCClient.1" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken.
Entry "HKCR\sunasDtServ.Agent" refers to invalid object "{ABA6B35D-3F5E-44E5-9FE2-F0E02720EC42}". Action Taken: No Action Taken.
Entry "HKCR\sunasDtServ.AgentDataStore" refers to invalid object "{E09B7103-05F6-4FA0-A244-AFCCB0668E3E}". Action Taken: No Action Taken.
Entry "HKCR\sunasDtServ.Agents" refers to invalid object "{6F888DC4-15EF-4E58-9A87-71713BB3A7AE}". Action Taken: No Action Taken.
Entry "HKCR\sunasDtServ.Common" refers to invalid object "{0EBBE452-CBF3-41D9-9FBF-4B07B2943FBE}". Action Taken: No Action Taken.
Entry "HKCR\sunasDtServ.DataStore" refers to invalid object "{F8564792-D478-4162-8F07-7B6F9A4D7D5F}". Action Taken: No Action Taken.
Entry "HKCR\sunasDtServ.EventObject" refers to invalid object "{F3F07A51-A7CF-45DC-B8A2-9719758A7121}". Action Taken: No Action Taken.
Entry "HKCR\sunasDtServ.Events" refers to invalid object "{3C28D6C7-297F-4687-814C-1C1BC47B289A}". Action Taken: No Action Taken.
Entry "HKCR\sunasDtServ.Explorer" refers to invalid object "{444598CA-89F4-4CCB-98F7-8D412125CBEB}". Action Taken: No Action Taken.
Entry "HKCR\sunasDtServ.Explorers" refers to invalid object "{DABC9585-5791-4C38-A33F-BB0C77A9A4B8}". Action Taken: No Action Taken.
Entry "HKCR\sunasDtServ.Inoculation" refers to invalid object "{D1A69F54-E98A-4EAF-AD49-7DE6F9352D76}". Action Taken: No Action Taken.
Entry "HKCR\sunasDtServ.Inoculations" refers to invalid object "{CA976C94-AFE1-4E59-AC3C-00DEF093687C}". Action Taken: No Action Taken.
Entry "HKCR\sunasDtServ.ManagedApps" refers to invalid object "{58C12E25-66BE-4D84-868C-2008CC427497}". Action Taken: No Action Taken.
Entry "HKCR\sunasDtServ.ManagedAppsExe" refers to invalid object "{2A58F9BD-518B-4080-B964-B849B58EC93D}". Action Taken: No Action Taken.
Entry "HKCR\sunasDtServ.ManagedAppsExes" refers to invalid object "{15F7410F-4AE9-47FB-8A9B-D1447279128D}". Action Taken: No Action Taken.
Entry "HKCR\sunasDtServ.ManagedAppsKey" refers to invalid object "{C3AA846C-5F18-47D2-940E-BFFA81A941AE}". Action Taken: No Action Taken.
Entry "HKCR\sunasDtServ.ManagedAppsKeys" refers to invalid object "{05D4EC19-D02F-4CFD-A7DB-0D15F9A77AC5}". Action Taken: No Action Taken.
Entry "HKCR\sunasDtServ.Manager" refers to invalid object "{C08637C7-7379-46BB-868E-63BBC830EEDC}". Action Taken: No Action Taken.
Entry "HKCR\sunasDtServ.Quarantine" refers to invalid object "{E7963E69-0830-44A3-BDFA-7582869EB93A}". Action Taken: No Action Taken.
Entry "HKCR\sunasDtServ.QuarantineContainer" refers to invalid object "{C8E26BB0-588A-4EC1-9342-8E756B147B46}". Action Taken: No Action Taken.
Entry "HKCR\sunasDtServ.QuarantineItem" refers to invalid object "{50A4066C-971D-4F1E-84BC-90D43D723DDE}". Action Taken: No Action Taken.
Entry "HKCR\sunasDtServ.ResourceStore" refers to invalid object "{5794C642-4E53-4C3E-84B3-02A615B6B137}". Action Taken: No Action Taken.
Entry "HKCR\sunasDtServ.Schedule" refers to invalid object "{8B3BD3F5-2C0F-4B2B-9407-C726C7DFB5DC}". Action Taken: No Action Taken.
Entry "HKCR\sunasDtServ.ScheduleScans" refers to invalid object "{66719EB5-1F77-429A-BFEE-23B3DF7793AE}". Action Taken: No Action Taken.
Entry "HKCR\sunasDtServ.Session" refers to invalid object "{703F1CB1-5E95-41EB-B841-07348D780885}". Action Taken: No Action Taken.
Entry "HKCR\sunasDtServ.ThreatData" refers to invalid object "{97641301-0964-42A0-A0A0-B725965CBD87}". Action Taken: No Action Taken.
Entry "HKCR\sunasDtServ.UpdateSchedule" refers to invalid object "{6476E647-EBEB-4DBD-8339-5DCC0611593B}". Action Taken: No Action Taken.
Entry "HKCR\SymWriter.pdb" refers to invalid object "{520DC67A-752E-11D3-8D56-00C04F680B2B}". Action Taken: No Action Taken.
Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.
Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr.1" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.
Entry "HKCR\YahooConnectorManager.YahooConnectorManager" refers to invalid object "{AF3094DA-A09B-4191-BFA4-716ADC3B76AC}}". Action Taken: No Action Taken.
File C:\DOCUME~1\hwhite\LOCALS~1\Temp\180sainstallernusalm.exe tagged as "not-a-virus:AdWare.180Solutions.g". Action Taken: No Action Taken.
File C:\DOCUME~1\hwhite\LOCALS~1\Temp\Del7.tmp infected by "Trojan-Downloader.Win32.Small.asf" Virus! Action Taken: No Action Taken.
File C:\DOCUME~1\hwhite\LOCALS~1\Temp\res8.tmp tagged as "not-a-virus:AdWare.180Solutions.g". Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06B40001.VBN infected by "Backdoor.Win32.Agent.jn" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09240001.VBN infected by "Backdoor.Win32.Agent.jn" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0D8C0000.VBN infected by "Backdoor.Win32.Agent.jn" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\hwhite\Local Settings\Application Data\Wildtangent\Cdacache\00\00\0F.dat tagged as "not-a-virus:AdWare.WildTangent.b". Action Taken: No Action Taken.
File C:\Documents and Settings\hwhite\Local Settings\Temp\180sainstallernusalm.exe tagged as "not-a-virus:AdWare.180Solutions.g". Action Taken: No Action Taken.
File C:\Documents and Settings\hwhite\Local Settings\Temp\Del7.tmp infected by "Trojan-Downloader.Win32.Small.asf" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\hwhite\Local Settings\Temp\res8.tmp tagged as "not-a-virus:AdWare.180Solutions.g". Action Taken: No Action Taken.
File C:\Program Files\Borland\StarTeam 2005\UninstallerData\uninstaller.jar tagged as not-a-virus:Tool.Win32.PrcView.3725. No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\89071C67-9B7F-4216-87CF-CD4F21\08F29FE1-5994-4D50-B59D-FA025D tagged as "not-a-virus:AdWare.180Solutions.j". Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\89071C67-9B7F-4216-87CF-CD4F21\A400A4C0-3565-4963-93AE-7B0B0F tagged as "not-a-virus:AdWare.180Solutions.g". Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\89071C67-9B7F-4216-87CF-CD4F21\C52ECE02-1FCD-4F97-834B-37F67B tagged as "not-a-virus:AdWare.180Solutions.g". Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\A2236A91-AEC4-42A0-9F28-FEA340\B908C175-DD3A-4979-99DC-A39E58 infected by "Trojan-Dropper.Win32.Agent.mm" Virus! Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\C8650E56-9EEC-400D-9A74-DD1486\0C36B46E-8EEA-42A8-84BB-788B23 tagged as "not-a-virus:AdWare.WinAD.at". Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\C8650E56-9EEC-400D-9A74-DD1486\54E18625-973C-41EE-8D3C-56F5D7 tagged as "not-a-virus:AdWare.WinAD.au". Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\C8650E56-9EEC-400D-9A74-DD1486\911C53FD-8504-49C0-AB32-17B5A2 tagged as "not-a-virus:AdWare.WinAD.ak". Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\C8650E56-9EEC-400D-9A74-DD1486\B82E80DD-C476-45AF-A10B-4A7D2E tagged as "not-a-virus:AdWare.WinAD.av". Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\E708DE27-912D-46AD-9148-73F49A\0DF23349-A22D-4DA7-B511-5735DE tagged as "not-a-virus:AdWare.WinAD.ak". Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\E708DE27-912D-46AD-9148-73F49A\70B66236-A107-4B76-83FB-A98D4D tagged as "not-a-virus:AdWare.WinAD.av". Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\E708DE27-912D-46AD-9148-73F49A\C8615B64-D564-44B9-B30B-6F5D10 tagged as "not-a-virus:AdWare.WinAD.at". Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\E708DE27-912D-46AD-9148-73F49A\D827ED1B-C51C-4913-BCE6-C176D3 tagged as "not-a-virus:AdWare.WinAD.au". Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\F7CB395D-DB23-49B5-A22B-2AF085\CB92F535-7CF3-4712-872E-4F0605 tagged as "not-a-virus:AdWare.180Solutions.j". Action Taken: No Action Taken.
File C:\Program Files\Mozilla Firefox\plugins\npzango.dll tagged as "not-a-virus:AdWare.WinAD.aw". Action Taken: No Action Taken.
File C:\Program Files\Rswvsou\Cwev.exe infected by "Trojan.Win32.Small.cy" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-772348764-1736515016-311576647-16185\Dc10.exe infected by "Trojan-Dropper.Win32.Agent.mm" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-772348764-1736515016-311576647-16185\Dc4.exe infected by "Trojan-Dropper.Win32.Agent.mm" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-772348764-1736515016-311576647-16185\Dc5.exe infected by "Trojan-Dropper.Win32.Agent.mm" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-772348764-1736515016-311576647-16185\Dc6.exe infected by "Trojan-Dropper.Win32.Agent.mm" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-772348764-1736515016-311576647-16185\Dc7.exe infected by "Backdoor.Win32.Rootodor.b" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-772348764-1736515016-311576647-16185\Dc8.exe infected by "Trojan-Dropper.Win32.Agent.mm" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-772348764-1736515016-311576647-16185\Dc9.exe infected by "Trojan-Dropper.Win32.Agent.mm" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{FF0BFC14-F55E-4AD5-8B8D-251C8687D982}\RP117\A0044980.exe infected by "Trojan-Dropper.Win32.PurityScan.q" Virus! Action Taken: No Action Taken.


And from hijackThis:

Logfile of HijackThis v1.99.1
Scan saved at 3:20:11 PM, on 6/20/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\acs.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\ISS\issSensors\DesktopProtection\blackd.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\PatchLink\Update Agent\GRAVITIXSERVICE.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe
C:\WINDOWS\System32\CCM\CLICOMP\RemCtrl\Wuser32.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\CCM\CcmExec.exe
C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\WINDOWS\AGRSMMSG.exe
C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE
C:\Program Files\RightFax\FaxCtrl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Wireless Optical Rechargeable Mouse\moffice.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Wireless Optical Rechargeable Mouse\MOUSE32A.DAT
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\D-Link\AirPlus G Wireless Adapter Utility\AirPlus.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Trillian\trillian.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\WISPTIS.EXE
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\taskmgr.exe
C:\PROGRA~1\INTERW~1\LAUNCH~1\iwlaunch.exe
C:\Program Files\Macromedia\HomeSite 5\HomeSite5.Exe
C:\Program Files\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.xmradio.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.xmradio.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by XM Radio IT Department
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ChkAdmin] C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE
O4 - HKLM\..\Run: [RightFAX Print-to-Fax Driver] C:\Program Files\RightFax\\FaxCtrl.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Wireless Optical Rechargeable Mouse\moffice.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ymetray] "C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\RunServices: [CPQDFWAG] C:\WINDOWS\Cpqdiag\CpqDfwAg.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Monitor My eRooms.lnk = C:\Program Files\eRoom 5\ERClient.exe
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: D-Link AirPlus G Wireless Utility.lnk = ?
O4 - Global Startup: D-Link REG Utility.lnk = ?
O4 - Global Startup: TeamSite LaunchPad Startup.TSL.lnk = ?
O4 - Global Startup: VPN Client.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.PATCHLINK.XMRADIO.COM (HKLM)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {32F09A50-CC2C-11D2-9CB0-000000000000} (iwlaunch.exe) - http://10.3.13.33/iw/launch/launchpad_setup.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/200312…meInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1100113716566
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O16 - DPF: {E876D003-BCDE-11D3-9131-000094B61529} (ERPageAddin Class) - https://eroom.xmradio.com/eRoomSetup/client.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = xmradio.com
O17 - HKLM\Software\..\Telephony: DomainName = xmradio.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = xmradio.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = xmradio.com
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\acs.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\Program Files\ISS\issSensors\DesktopProtection\blackd.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Insight Local Alerter (CPQALERT) - Hewlett-Packard Company - C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
O23 - Service: cpqdmi - Compaq Computer Corporation - C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Remote Diagnostics Enabling Agent (DfwWebAgent) - Hewlett-Packard - C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: OracleOraHome92ClientCache - Unknown owner - D:\oracle\ora92\BIN\ONRSD.EXE
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PatchLink Update - Patchlink Corporation - C:\Program Files\PatchLink\Update Agent\GRAVITIXSERVICE.exe
O23 - Service: RapApp - Internet Security Systems, Inc. - C:\Program Files\ISS\issSensors\DesktopProtection\RapApp.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Win32Sl (WIN32SL) - Intel - C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe
Open Microsoft Antispyware, click Tools < Summary scan and click Manage Spyware Quarantine. Remove (do not restore) all files from the Quarantine.

Open Symantec Antivirus and click reports. In quarantined items click "view report" and in the window that opens click Quarantined Items. Highlight each line in the left column and click Delete Item from the toolbar above. Repeat this procedure for the Backup Items. << This process may vary slightly on Symantec Antivirus as I have Norton Antivirus.

Please delete the following Files/Folders:

C:\Program Files\Mozilla Firefox\plugins\npzango.dll << File Only
C:\Program Files\Rswvsou << Whole Folder


Download CCleaner from here to clean temp files from your computer.
  • Double click on the file to start the installation of the program.
  • Select your language and click OK, then next.
  • Read the license agreement and click I Agree.
  • Click next to use the default install location. Click Install then finish to complete installation.
  • Double click the CCleaner shortcut on the desktop to start the program.
  • Click Options < Advanced and uncheck "Only delete files in Windows Temp folders older than 48 hours".
  • Click Run Cleaner to run the program.
  • After it has completed it's process, click Exit.
Caution : It is not recommended to use the 'Issues' tab as it is known to find legitimate items.

Here are a few optional items to fix with HijackThis which may help speed things up a bit.

Open HijackThis, run a scan, then check the following:
Automatic updates for ViewPoint products such as ViewPoint Media Player (as bundled with AOL, AOL Instant Messenger, Compuserve, etc) Recommended to check here and remove with Add/Remove Programs.
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

This installs the QuickTime System Tray icon. You can fix this with HJT, but you will also need to set it not to load in QuickTime itself to keep it from resetting itself: (1) Open Quick Time Player (2)Edit > Preferences > Quick Time Preferences (3)uncheck Quick Time System Tray icon on the Browser Plug-in Pane
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

With all other programs and browsers closed, click fix checked.


Reboot normally and post a new mwavscan log as a reply to this thread.
Here is the latest:


Logfile of HijackThis v1.99.1
Scan saved at 8:57:17 AM, on 6/21/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\acs.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\ISS\issSensors\DesktopProtection\blackd.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\PatchLink\Update Agent\GRAVITIXSERVICE.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe
C:\WINDOWS\System32\CCM\CLICOMP\RemCtrl\Wuser32.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\CCM\CcmExec.exe
C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe
C:\WINDOWS\System32\msiexec.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\WINDOWS\AGRSMMSG.exe
C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE
C:\Program Files\RightFax\FaxCtrl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Wireless Optical Rechargeable Mouse\moffice.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Wireless Optical Rechargeable Mouse\MOUSE32A.DAT
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
C:\Program Files\D-Link\AirPlus G Wireless Adapter Utility\AirPlus.exe
C:\Program Files\D-Link\AirPlus G Wireless Adapter Utility\Reg.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Trillian\trillian.exe
C:\WINDOWS\system32\userinit.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRAM FILES\PATCHLINK\UPDATE AGENT\Dagent.exe
C:\WINDOWS\system32\userinit.exe
C:\Program Files\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.xmradio.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.xmradio.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by XM Radio IT Department
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ChkAdmin] C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE
O4 - HKLM\..\Run: [RightFAX Print-to-Fax Driver] C:\Program Files\RightFax\\FaxCtrl.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Wireless Optical Rechargeable Mouse\moffice.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ymetray] "C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\RunServices: [CPQDFWAG] C:\WINDOWS\Cpqdiag\CpqDfwAg.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Monitor My eRooms.lnk = C:\Program Files\eRoom 5\ERClient.exe
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: D-Link AirPlus G Wireless Utility.lnk = ?
O4 - Global Startup: D-Link REG Utility.lnk = ?
O4 - Global Startup: TeamSite LaunchPad Startup.TSL.lnk = ?
O4 - Global Startup: VPN Client.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.PATCHLINK.XMRADIO.COM (HKLM)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {32F09A50-CC2C-11D2-9CB0-000000000000} (iwlaunch.exe) - http://10.3.13.33/iw/launch/launchpad_setup.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/200312…meInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1100113716566
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O16 - DPF: {E876D003-BCDE-11D3-9131-000094B61529} (ERPageAddin Class) - https://eroom.xmradio.com/eRoomSetup/client.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = xmradio.com
O17 - HKLM\Software\..\Telephony: DomainName = xmradio.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = xmradio.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = xmradio.com
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\acs.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\Program Files\ISS\issSensors\DesktopProtection\blackd.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Insight Local Alerter (CPQALERT) - Hewlett-Packard Company - C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
O23 - Service: cpqdmi - Compaq Computer Corporation - C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Remote Diagnostics Enabling Agent (DfwWebAgent) - Hewlett-Packard - C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: OracleOraHome92ClientCache - Unknown owner - D:\oracle\ora92\BIN\ONRSD.EXE
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PatchLink Update - Patchlink Corporation - C:\Program Files\PatchLink\Update Agent\GRAVITIXSERVICE.exe
O23 - Service: RapApp - Internet Security Systems, Inc. - C:\Program Files\ISS\issSensors\DesktopProtection\RapApp.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Win32Sl (WIN32SL) - Intel - C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe
Your new log appears clean. :)

Reset and Re-enable your System Restore to remove bad files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected.)

1. Right-click My Computer, and then click Properties.
2. On the System Restore tab, put a check mark in the 'Turn Off System Restore' check box.
3. Click OK, and then click Yes.
4. Restart the computer.
5. Repeat steps 1 - 2, this time clearing the box beside 'Turn Off System Restore', click 'OK'.


I suggest that you get these programs to help keep the computer clean:

Spyware Blaster - Blocks bad ActiveX items from installing on your computer. Spyware Blaster runs silently in the background.
SpywareGuard - Real-time protection from spyware installation attempts
ie-spyad - Puts over 8,000 bad URLs into your restricted sites for Internet Explorer.
Google Toolbar - Blocks many unwanted pop-ups in Internet Explorer.
Firefox - 'Safer' alternative to the Internet Explorer web browser.
ZoneAlarm - Free firewall program if you currently are not using one.

Update these regularly.

You may also want to read "How did I get infected in the first place" to learn how to better secure your computer.

Be sure to keep Windows and your Anti-virus updated.
Your welcome. Glad to be able to help you out.

As this topic has been resolved, the thread will be closed.

If you need this topic reopened, please request this by sending an email to us at the following link:
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI