What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

What a mess!

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
No complications while following your directions.


Here is the result of the FindFiles.bat

Volume in drive C has no label.
Volume Serial Number is 6CE0-79F8

Directory of C:\WINNT\System32


Directory of C:\Documents and Settings\Owner\Desktop



next comes the HJT log from the last step of your instructions

Logfile of HijackThis v1.99.1
Scan saved at 8:55:27 PM, on 10/6/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINNT\System32\NMSSvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\wanmpsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINNT\SM1BG.EXE
C:\Program Files\QuickTime\qttask.exe
C:\WINNT\system32\PROMon.exe
C:\Program Files\Saitek\Software\Profiler.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINNT\System32\igfxtray.exe
C:\WINNT\System32\hkcmd.exe
C:\WINNT\system32\SK9910DM.EXE
C:\WINNT\GWMDMMSG.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\Documents and Settings\Owner\Desktop\hjt\HijackThis.exe

N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/bookmark/7_0/home.html"); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\x6vbj4wt.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\x6vbj4wt.slt\prefs.js)
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [SM1BG] C:\WINNT\SM1BG.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe
O4 - HKLM\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Keyboard Preload Check] C:\OEMDRVRS\KEYB\Preload.exe /DEVID: /CLASS:Keyboard /RunValue:"Keyboard Preload Check"
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [Hot Key Kbd 9910 Daemon] SK9910DM.EXE
O4 - HKLM\..\Run: [GWMDMpi] C:\WINNT\GWMDMpi.exe
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [eMusicClient Systray] C:\Program Files\eMusic\eMusicClient.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\Netscape\Netscape\Netscp.exe" -turbo
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .avi: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npavi32.dll
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .wmv: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npdsplay.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://www.songtouch.com/Install.exe
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.yahoo.com/…ebio5_0_2_7.cab
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Pacsptisvr.exe
O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe


The forum won't let me post the complete MWAV scan because of it's size. Over half of that scan information comes from C:\Program Files\Norton AntiVirus\Quarantine\ so I have cut that section out and will send it at your request. Here is the MWAV scan with the Norton Quarantine section removed.

Object "surfsidekick Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "surfsidekick Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bigtrafficnet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bigtrafficnet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bigtrafficnet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bigtrafficnet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bigtrafficnet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bigtrafficnet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "downloadware Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "surfsidekick Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "ibis Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "kazaa Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "media access Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "mediamotor Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "prositefinder Adware" found in File System! Action Taken: No Action Taken.
Object "surfsidekick Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "kazaa Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "downloadware Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "surfsidekick Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "emusicclient Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "abetterinternet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "toprebates Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "istbar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "180solutions Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "betterinternet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "spediabar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "spediabar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "unknown pest Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "coolwebsearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "elite toolbar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "nn_bar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "redv Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "tv media display Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "surfsidekick Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "tvmedia Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "aureate Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "browseraid Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "ezula Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "spediabar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "netpal Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bargainbuddy Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bargainbuddy Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bargainbuddy Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bargainbuddy Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "redv Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "clientman Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "rapidblaster Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "rapidblaster Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "rapidblaster Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "easysearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "easysearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "easysearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "startsurfing Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "cydoor.topicks.a Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "delfin media viewer Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "cws.therealsearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "cws.therealsearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\Install.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\installer_MARKETING11.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\loader2.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\MediaTicketsInstaller.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\QDow.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\ycomp5_0_2_7.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\minigolf_affiliate.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\System32\ObjSafe.tlb". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\ycomp5_0_2_7.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Sony Shared\OpenMG\ekb\newekb020723.txt". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Sony Shared\AVLib\CDDBControl.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Sony Shared\AVLib\CDDBUI.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Sony Shared\OpenMG\ekb\newekb040130.txt". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\System32\ObjSafe.tlb". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\QDow.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\minigolf_affiliate.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\MediaTicketsInstaller.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\AppsInstalled.htm". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\HDPlugin1019.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\loader2.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\Install.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\AOL\AOL Toolbar\bullet.gid". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\installer_MARKETING11.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe" refers to invalid object "C:\WINNT\System32\cmmgr32.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\Napster" refers to invalid object "C:\Program Files\Napster\Napster". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\NetMDDriver" refers to invalid object "C:\Program Files\Sony\Net MD Driver\NetMDDriver". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\ORUN32.EXE" refers to invalid object "C:\WINNT\ORUN32.EXE". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\PCDoctor.exe" refers to invalid object "C:\Program Files\PC-Doctor for Windows\PCDoctor.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\pcshw" refers to invalid object "C:\WINNT\system32\pkshguyc.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\pshower" refers to invalid object "C:\WINNT\system32\pshwr.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\Robot Arena 2.exe" refers to invalid object "C:\Program Files\Infogrames\Robot Arena 2\Robot Arena 2.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\setup.exe" refers to invalid object "C:\Program Files\Cypress Semiconductor\Cypress USB Mass Storage Driver Installation\setup.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\udfrinst.exe" refers to invalid object "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\udfrinst.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\yourapp.Exe" refers to invalid object "C:\Program Files\Saitek\Software\yourapp.Exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Documents and Settings\Owner\Favorites\Financial Links\". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".016". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".ADB". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".class". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".hdmp". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".hiv". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".HMT". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".ldi". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".mdmp". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".mez". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".MF". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".partial". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".pf". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".rar". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".rgi". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".rgs". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".trace". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object "OpenWithList". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "180sa". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "180search Toolbar". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "3fmg05c4". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "55ootilq". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "BargainBuddy". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "bdeplayer". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "bsto-1". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "CashBack". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "ContextSidebar". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Dbi". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "DelFin Media Viewer". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "DisplayUtility". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "DMO". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "eMusicSetup". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Internet Optimizer Active Alert". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Internet Optimizer Software Installer". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "InternetOffers". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "ISTsvc". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "jejklofn". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Media Gateway". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "MediaLoads Enhanced". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "mediamotor". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "msbb". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "NaviSearch". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Netscape (7.01)". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "o53cmn1d". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "OpenMG HotFix3.1-02-08-09-01". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "OpenMG HotFix3.1-02-08-15-01". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "OpenMG HotFix3.1-02-10-08-01". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "PopCap Browser Plugin". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Power Scan". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q328310". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q329048". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q329115". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q329170". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q329390". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q329441". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q329834". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q810565". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q810577". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q810833". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Quick Links". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "RapidBlaster". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Registry Cleaner (Trial)_is1". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Related Sites Toolbar". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "SaveNow". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "ShopAtHomeSelect Agent". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "sjpl6n3k". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "The Weather Channel". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "TSA". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "UrlSidebar". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "WAFAIE". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "wcmdmgr.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "WildTangent CDA". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "WSEM Update". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "wtdmmp". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "wtwebdriver". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Yahoo! Messenger Explorer Bar". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "YourSiteBar". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Zeno Browser Enhancer". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{117C01B5-9D68-4A15-85E2-A7CDFA82CEB9}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{78355062-A04F-B34B-B43C-1E4B1AE732B5}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{7B802DE5-84E5-4503-965B-2ABFFC78506A}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{ba11561e-f0c3-4e6b-9548-79ef48cc4087}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{EDCD4CE3-DE92-49A9-87F9-FE09B2FBA16C}". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{09C8F745-942E-5623-C3CD-0A582FBD330A}" refers to invalid object "C:\WINNT\Uavirkul.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0A99FD75-B264-48FC-AE49-924A646964B8}" refers to invalid object "C:\PROGRA~1\COMMON~1\AOL\AOLTOO~1\smartbox.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0C365A54-70B7-4317-A68F-AAD8D3F45DA7}" refers to invalid object "C:\Program Files\Netscape\Netscape\ISimpleDOMNodeMarshal.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0d780b96-de60-4dd4-b598-f7b497bf61f1}" refers to invalid object "C:\WINNT\System32\jkdnn.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0F27C90A-876E-4C49-867B-AD55030F1721}" refers to invalid object "C:\WINNT\System32\PdePgHlp.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{10AF3945-2E81-4C59-AF6E-B8B428E34074}" refers to invalid object "C:\Program Files\Common Files\AOL\1124219809\ee\AOLSvcMgr.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{19EBE968-E1FA-4A2C-A3BC-8FA20E627017}" refers to invalid object "C:\WINNT\System32\CTPdeSrvps.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{27d04fd1-4830-4c4b-9159-c4109b5e9930}" refers to invalid object "C:\WINNT\System32\czgyyo.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2E65E760-B7E6-4CFB-A105-1E8891A00F82}" refers to invalid object "C:\WINNT\System32\CTPdeSrv.exe". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{307A6C42-0000-0010-8000-00AA00389B71}" refers to invalid object "C:\Documents and Settings\Owner\My Documents\Warcraft III Demo\blizzard.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{390CE9F2-C4A0-11D4-8A92-0090271D4F88}" refers to invalid object "C:\Program Files\Yahoo!\Messenger\ycrwin32.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{41695A8E-6414-11D4-8FB3-00D0B7730277}" refers to invalid object "C:\Program Files\Yahoo!\Messenger\asw.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{4681B27C-CD92-4AFF-B5F6-1C53970344B6}" refers to invalid object "C:\WINNT\system32\bho.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{475c0fb2-25ad-4941-838e-fad3c318ebf2}" refers to invalid object "C:\WINNT\system32\fkgee.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{4a9d1d79-ed61-43e7-8ff3-331eba262d5a}" refers to invalid object "C:\WINNT\System32\pqckk.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5BD5F66E-F849-4C96-ABAA-5D1D2851D590}" refers to invalid object "C:\Program Files\Yahoo!\Common\YIeTagBm.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{618bba25-d0d4-4f95-bbc9-06b63971520d}" refers to invalid object "C:\WINNT\system32\jkdnn.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{660B82AF-A571-4A19-AC54-5E6E63969676}" refers to invalid object "C:\PROGRA~1\COMMON~1\AOL\AOLTOO~1\smartbox.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{6D0CBE3C-B37B-41BD-C224-4BC0032E03D8}" refers to invalid object "C:\WINNT\system32\kgiu\vfrwwnl.exe". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{724D478A-2BD0-4DB4-AE42-288B1E346EF7}" refers to invalid object "C:\Program Files\FCEngine\Plugin.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{7808E17A-5595-EFF3-B4F7-334DD5E2FED3}" refers to invalid object "C:\WINNT\system32\tsdbqbn\kiifqad.exe". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{7F23E6E5-0E79-4aee-B723-B1463805D5A9}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\sound.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{83D4679F-B6D7-11D2-BF36-00C04FB90A03}" refers to invalid object "C:\PROGRA~1\MESSEN~1\rtcimsp.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{8ECF83A0-1AC9-11D4-8501-00A0CC5D1F63}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\wtwmplug.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{91DA6287-52F0-4CCF-9D67-72842C9BB367}" refers to invalid object "C:\PROGRA~1\SHOCKW~1.COM\RICOCH~1\ui\SwDRM.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{923b521e-0419-4cc3-afd8-846f13851e8a}" refers to invalid object "C:\WINNT\System32\aqnkk.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{94E86640-4E0D-4D4C-A4D3-E3526D6945A6}" refers to invalid object "C:\WINNT\system32\6lo4svc.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{990d457e-28d5-405d-b36e-586f47778765}" refers to invalid object "C:\WINNT\System32\pqckk.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A786130F-8AD7-0435-D4EC-5D6FE45B13DC}" refers to invalid object "C:\WINNT\system32\vfcgci\gudblq.exe". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B9BA256A-075B-49ea-B9E2-7DBC2EF021D5}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\sound.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{BEE9C324-3E00-11D4-823D-00D0B74C5265}" refers to invalid object "C:\Program Files\Real\RealArcade\RNArcade.exe". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{BF68E15A-9904-ED33-B74D-505FE4F95631}" refers to invalid object "C:\WINNT\Uavirkul.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{c8de42d9-763a-4c97-bdbd-1df218562ca5}" refers to invalid object "C:\WINNT\System32\pqckk.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{CAB4C70E-9CC3-CCBD-5F31-A5886091594C}" refers to invalid object "C:\WINNT\system32\mnqx\pybmsdjd.exe". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{DF0C0C7C-14F0-40AB-93C9-D71E6E3DE6DD}" refers to invalid object "C:\WINNT\srchfst.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{ECFBE6E0-1AC8-11D4-8501-00A0CC5D1F63}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\wtwmplug.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{EE7CB360-F635-449D-BBB1-0D844F2A269D}" refers to invalid object "C:\Program Files\Common Files\AOL\AOL Toolbar\AOLHelper.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{FA13A9FA-CA9B-11D2-9780-00104B242EA3}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\webdriver.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{FB887D9A-F578-1E57-C0A6-2A14B4DE0830}" refers to invalid object "C:\WINNT\system32\uvortlc\svakpcl.exe". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{1B8B502E-465B-4022-BE4F-FB6D9F808A18}" refers to invalid object "C:\Program Files\FCEngine\Plugin.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{390CE9E4-C4A0-11D4-8A92-0090271D4F88}" refers to invalid object "C:\Program Files\Yahoo!\Messenger\ycrwin32.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{3C2D2A1E-031F-4397-9614-87C932A848E0}" refers to invalid object "C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{41695A81-6414-11D4-8FB3-00D0B7730277}" refers to invalid object "C:\Program Files\Yahoo!\Messenger\asw.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{547DDE29-2299-4C8F-B613-DA17A62CF102}" refers to invalid object "C:\WINNT\system32\bho.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{5C5D478A-085F-4C8C-9B60-825BB9F463E2}" refers to invalid object "C:\Program Files\Real\RealArcade\iegcplug.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{5FE16E42-47D1-471A-BEFF-9C650F9F43BB}" refers to invalid object "C:\Program Files\Common Files\AOL\AOL Toolbar\AOLHelper.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{732C6D41-A4DE-4FAE-957A-5769722BA855}" refers to invalid object "C:\WINNT\System32\PdePgHlp.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{7638761F-0CE1-4E68-9692-D623527A6B7B}" refers to invalid object "C:\WINNT\system32\pkshguyc.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{863ACC54-F798-44FC-BFFD-E849D99FEEEF}" refers to invalid object "C:\Program Files\Yahoo!\Common\YIeTagBm.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{B162D478-EF46-4475-B1FE-216BDEDB7FAD}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\wtmulti.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{B7E20302-C22C-4AF2-9D75-C3EB6EEE9DD8}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\wthostctl.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{BC8542C4-719E-49D5-90C6-CCB81A8FAC55}" refers to invalid object "C:\Program Files\Shockwave.com\Ricochet Lost Worlds\ui\SwDRM.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{D72EC833-A24A-4A71-8BE1-31C224629287}" refers to invalid object "C:\WINNT\wt\webdriver\WTHost.exe". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{DCB43485-19FB-4D6D-BB3D-73C7F48D5F00}" refers to invalid object "C:\Program Files\Messenger\rtcimsp.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{F0ED1949-59F9-447D-A8B9-FBDCEBC85198}" refers to invalid object "C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBarBHO.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{F99B46D1-9DE1-432B-8E89-D1D751341F8C}" refers to invalid object "C:\PROGRA~1\COMMON~1\AOL\AOLTOO~1\smartbox.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{FA13AA2E-CA9B-11D2-9780-00104B242EA3}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\webdriver.dll". Action Taken: No Action Taken.
Entry "HKCR\.sll" refers to invalid object "SSLFile". Action Taken: No Action Taken.
Entry "HKCR\Adaptec.EasyCDACMWrapperV2" refers to invalid object "{5FD43CC1-7D99-11d4-B45D-0020E06221F4}". Action Taken: No Action Taken.
Entry "HKCR\Adaptec.EasyCDACMWrapperV2.5" refers to invalid object "{5FD43CC1-7D99-11d4-B45D-0020E06221F4}". Action Taken: No Action Taken.
Entry "HKCR\Alg.AlgSetup" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.
Entry "HKCR\Alg.AlgSetup.1" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.
Entry "HKCR\Automap.Map.NA" refers to invalid object "{A49EEA00-9231-4C77-AA9E-2F89D72B4804}". Action Taken: No Action Taken.
Entry "HKCR\Automap.Map.NA.9" refers to invalid object "{A49EEA00-9231-4C77-AA9E-2F89D72B4804}". Action Taken: No Action Taken.
Entry "HKCR\Automap.Template.NA.9" refers to invalid object "{A49EEA00-9231-4C77-AA9E-2F89D72B4804}". Action Taken: No Action Taken.
Entry "HKCR\BHO.Adware" refers to invalid object "{4006DCA3-433D-4FC8-AC36-42DA7797DCB7}". Action Taken: No Action Taken.
Entry "HKCR\BHO.Adware.1" refers to invalid object "{4006DCA3-433D-4FC8-AC36-42DA7797DCB7}". Action Taken: No Action Taken.
Entry "HKCR\communicator.COMMUNICATOR" refers to invalid object "{4E7BD74F-2B8D-469E-8DBC-A42EB79CB428}". Action Taken: No Action Taken.
Entry "HKCR\Connection Manager Profile\shell\open\command" refers to invalid object "C:\WINNT\System32\CMMGR32.EXE "%1"". Action Taken: No Action Taken.
Entry "HKCR\Convcom.OmgConvOmgfDivide" refers to invalid object "{5F50C571-B3FC-4B91-BA21-99D025F6ECC4}". Action Taken: No Action Taken.
Entry "HKCR\Convcom.OmgConvOmgfDivide.1" refers to invalid object "{5F50C571-B3FC-4B91-BA21-99D025F6ECC4}". Action Taken: No Action Taken.
Entry "HKCR\DirectSoundFXChorusPage" refers to invalid object "{60129CFD-2E9B-4098-AA4B-D6CFADA265C3}". Action Taken: No Action Taken.
Entry "HKCR\Dsdmoprp.DirectSoundFXChorusPage" refers to invalid object "{60129CFD-2E9B-4098-AA4B-D6CFADA265C3}". Action Taken: No Action Taken.
Entry "HKCR\Dsdmoprp.DirectSoundFXChorusPage.1" refers to invalid object "{60129CFD-2E9B-4098-AA4B-D6CFADA265C3}". Action Taken: No Action Taken.
Entry "HKCR\DSP.DSP" refers to invalid object "{9C123EA9-AEC9-4f75-BBC0-7565FA1398966}". Action Taken: No Action Taken.
Entry "HKCR\DSP.DSPDMOProp_Chorus.1" refers to invalid object "{6F63B172-5543-4593-91CE-EDBA65B9FACDB}". Action Taken: No Action Taken.
Entry "HKCR\FunTools.PicShow" refers to invalid object "{4487598C-2EC7-43A2-870E-6D8D720FDD9F}". Action Taken: No Action Taken.
Entry "HKCR\FunTools.PicShow.1" refers to invalid object "{4487598C-2EC7-43A2-870E-6D8D720FDD9F}". Action Taken: No Action Taken.
Entry "HKCR\Ihxiuyiiam.Ikybhqal.1" refers to invalid object "{9FABF03A-4478-46B8-A2AC-CF334233DE83}". Action Taken: No Action Taken.
Entry "HKCR\Kvpqakbg.Lusxffcgsc.5" refers to invalid object "{8BA5C287-CA41-4D6F-B545-7E838CC5AD62}". Action Taken: No Action Taken.
Entry "HKCR\msbackupfile\shell\open\command" refers to invalid object "%SystemRoot%\system32\ntbackup.exe". Action Taken: No Action Taken.
Entry "HKCR\Netscape.Help.1" refers to invalid object "{60403D81-872B-11CF-ACC8-0080C82BE3B6}". Action Taken: No Action Taken.
Entry "HKCR\NN_Bar_Dummy.NN_BarDummy" refers to invalid object "{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}". Action Taken: No Action Taken.
Entry "HKCR\NN_Bar_Dummy.NN_BarDummy.1" refers to invalid object "{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}". Action Taken: No Action Taken.
Entry "HKCR\Omgconv2.OmgAt3ToOmgf" refers to invalid object "{5F9F8BEA-39A4-4EB7-85E4-8B5733FD3034}". Action Taken: No Action Taken.
Entry "HKCR\Omgconv2.OmgAt3ToOmgf.1" refers to invalid object "{5F9F8BEA-39A4-4EB7-85E4-8B5733FD3034}". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic.1" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\ppifile\shell\open\command" refers to invalid object "%SystemRoot%\System32\msppcnfg.exe /Config %1". Action Taken: No Action Taken.
Entry "HKCR\RTCCore.RTCClient" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken.
Entry "HKCR\RTCCore.RTCClient.1" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken.
Entry "HKCR\SAFRCFileDlg.FileOpen" refers to invalid object "{5F889CE8-3B09-4CFF-B70A-83730CC00627}". Action Taken: No Action Taken.
Entry "HKCR\SAFRCFileDlg.FileOpen.1" refers to invalid object "{5F889CE8-3B
Post #17 last edited
The mwavscan didn't show up fully in the post as it was way too big. I can see several remnants of the malware still in the registry so I need you to run a couple of scanners to try to remove some of them.

Let's cleanup the items quarantined by Norton
  • Open Norton Antivirus and click "reports".
  • In quarantined items click "view report" and in the window that opens click Quarantined Items.
  • Highlight each line in the left column and click Delete Item from the toolbar above.
  • Repeat this procedure for the Backup Items.
Please download and install Ad-Aware SE and Spybot S&D according to the following instructions. If you already have these programs, please make sure they are the latest version (Ad-Aware SE Personal 1.06, Spybot Search and Destroy 1.4), than run scans as described below.

Scanning With Spybot S&D:
  • Downloaded and Install Spybot S&D accepting the Default Settings.
  • In the Menu Bar at the top of the Spybot window you will see 'Mode'. Make certain that 'default mode' has a check mark beside it.
  • Close ALL windows except Spybot S&D.
  • Click the button to ‘Search for Updates’ then download and install the Updates.
  • Next click the button ‘Check for Problems’
  • When Spybot is complete, it will be showing ‘RED’ entries bold 'Black' entries and ‘GREEN’ entries in the window.
  • Make certain there is a check mark beside all of the RED entries ONLY.
  • Choose ‘Fix Selected Problems’ and allow Spybot to fix the RED entries.
  • REBOOT to complete the scan and clear memory.
  • Do not enable Tea Timer until the log is clean as it will prevent the fix from working.
Scanning With Ad-Aware SE:
  • Download and Install Ad-Aware SE, keeping the default options. However, some of the settings will need to be changed before your first scan.
  • Close ALL windows except Ad-Aware SE.
  • Click on the‘world’ icon at the top right of the Ad-Aware SE window and let AdAware SE update the reference list for the adware and malware.
  • Once the update is finished click on the ‘Gear’ icon (second from the left at the top of the window) to access the preferences/settings window.
    • In the ‘General’ window make sure the following are selected in green:
      • Automatically save log-file
      • Automatically quarantine objects prior to removal
      • Safe Mode (always request confirmation)
    • Under Definitions:
      • Prompt to udate outdated definitions - set the number of days
    • Click on the ‘Scanning’ button on the left and select in green :
      • Under Driver, Folders & Files:
        • Scan Within Archives
      • Under Select drives & folders to scan -
        • choose all hard drives
      • Under Memory & Registry: all green
      • Scan active processes
      • Scan registry
      • Deep-scan registry
      • Scan my IE favorites for banned URLs
      • Scan my Hosts file
    • Click on the ‘Advanced’ button on the left and select in green:
      • Under Shell Integration:
        • Move deleted files to recycle bin
      • Under Logfile Detail Level: (all green)
        • include addtional object information
        • DESELECT - include negligible objects information
        • include environment information
      • Under Alternate Data Streams:
        • Don't log streams smaller than 0 bytes
        • Don't log ADS with the following names: CA_INOCULATEIT
    • Click the ‘Tweak’ button and select in green:
      • Under the ‘Scanning Engine’:
        • Unload recognized processes during scanning
        • Scan registry for all users instead of current user only
      • Under the ‘Cleaning Engine’:
        • Always try to unload modules before deletion
        • During removal, unload Explorer and IE if necessary
        • Let Windows remove files in use at next reboot
      • Under the Log Files:
        • Include basic Ad-aware SE settings in logfile
        • Include additional Ad-aware SE settings in logfile
        • Create logfile for removal operations.
        • Please do not check or make green: Include Module list in logfile
  • Click on ‘Proceed’ to save the settings.
  • Click ‘Start’
    • Choose:'Perform Full System Scan'
    • DESELECT "Search for negligible risk entries", as negligible risk entries (MRU's) are not considered to be a threat.
  • Click ‘Next’ and Ad-Aware SE will scan your hard drive(s) with the options you have selected and clean automatically.
  • If Ad-Aware SE finds bad entries, you will receive a list of what it found in the window, click "Next".
  • The bad files will be listed, right click the pane and click "Select all objects" - this will put a check mark in the box at the side, click "Next" again and click "OK" at the prompt "# objects will be removed. Continue?".
  • Save the logfile when asked.
  • REBOOT to complete the removal of what Ad-Aware SE found.
These are items that didn't show in the post but were in the email reply I received. Delete these folders:

C:\Program Files\dialers
C:\Program Files\ICONS
C:\Program Files\MouseStick
C:\Program Files\Movies
C:\Program Files\ProSiteFinder


Download CCleaner to clean temp files from your computer.
  • Double click on the file to start the installation of the program.
  • Select your language and click OK, then next.
  • Read the license agreement and click I Agree.
  • Click next to use the default install location. Click Install then finish to complete installation.
  • Double click the CCleaner shortcut on the desktop to start the program.
  • Click Options < Advanced and uncheck "Only delete files in Windows Temp folders older than 48 hours".
  • Click Run Cleaner to run the program.
  • After it has completed it's process, click Exit.
Caution : It is not recommended to use the 'Issues' tab as it is known to find legitimate items.


Re-run the mwavscan and post the new mwavscan log as a reply to this thread. If it is still too large to fit in one post, try to split it in half and post each half in a seperate post. If it is still too large, send it to me here. (In the subject line of the email, use TomCoyote - Doggins)
Post #18
results of the mwav scan


Object "bigtrafficnet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bigtrafficnet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bigtrafficnet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bigtrafficnet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bigtrafficnet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bigtrafficnet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "downloadware Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "ibis Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "kazaa Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "mediamotor Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "prositefinder Adware" found in File System! Action Taken: No Action Taken.
Object "kazaa Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "downloadware Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "emusicclient Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "abetterinternet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "toprebates Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "istbar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "180solutions Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "spediabar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "spediabar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "unknown pest Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "coolwebsearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "elite toolbar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "nn_bar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "tvmedia Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "aureate Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "browseraid Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "ezula Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "spediabar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "netpal Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bargainbuddy Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bargainbuddy Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bargainbuddy Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bargainbuddy Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "startsurfing Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "cydoor.topicks.a Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "delfin media viewer Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "cws.therealsearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "cws.therealsearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\Install.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\installer_MARKETING11.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\loader2.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\MediaTicketsInstaller.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\QDow.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\ycomp5_0_2_7.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\minigolf_affiliate.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\System32\ObjSafe.tlb". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\ycomp5_0_2_7.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Sony Shared\OpenMG\ekb\newekb020723.txt". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Sony Shared\AVLib\CDDBControl.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Sony Shared\AVLib\CDDBUI.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Sony Shared\OpenMG\ekb\newekb040130.txt". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\System32\ObjSafe.tlb". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\QDow.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\minigolf_affiliate.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\MediaTicketsInstaller.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\AppsInstalled.htm". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\HDPlugin1019.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\loader2.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\Install.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\AOL\AOL Toolbar\bullet.gid". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\installer_MARKETING11.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe" refers to invalid object "C:\WINNT\System32\cmmgr32.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\Napster" refers to invalid object "C:\Program Files\Napster\Napster". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\NetMDDriver" refers to invalid object "C:\Program Files\Sony\Net MD Driver\NetMDDriver". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\ORUN32.EXE" refers to invalid object "C:\WINNT\ORUN32.EXE". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\PCDoctor.exe" refers to invalid object "C:\Program Files\PC-Doctor for Windows\PCDoctor.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\pcshw" refers to invalid object "C:\WINNT\system32\pkshguyc.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\pshower" refers to invalid object "C:\WINNT\system32\pshwr.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\Robot Arena 2.exe" refers to invalid object "C:\Program Files\Infogrames\Robot Arena 2\Robot Arena 2.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\setup.exe" refers to invalid object "C:\Program Files\Cypress Semiconductor\Cypress USB Mass Storage Driver Installation\setup.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\udfrinst.exe" refers to invalid object "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\udfrinst.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\yourapp.Exe" refers to invalid object "C:\Program Files\Saitek\Software\yourapp.Exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Documents and Settings\Owner\Favorites\Financial Links\". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".016". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".ADB". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".class". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".hdmp". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".hiv". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".HMT". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".ldi". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".mdmp". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".mez". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".MF". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".partial". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".pf". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".rar". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".ref". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".rgi". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".rgs". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".trace". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object "OpenWithList". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "180sa". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "180search Toolbar". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "3fmg05c4". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "55ootilq". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "BargainBuddy". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "bdeplayer". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "bsto-1". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "CashBack". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "ContextSidebar". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Dbi". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "DelFin Media Viewer". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "DisplayUtility". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "DMO". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "eMusicSetup". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Internet Optimizer Active Alert". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Internet Optimizer Software Installer". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "InternetOffers". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "ISTsvc". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "jejklofn". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Media Gateway". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "MediaLoads Enhanced". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "mediamotor". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "msbb". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "NaviSearch". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Netscape (7.01)". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "o53cmn1d". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "OpenMG HotFix3.1-02-08-09-01". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "OpenMG HotFix3.1-02-08-15-01". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "OpenMG HotFix3.1-02-10-08-01". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "PopCap Browser Plugin". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Power Scan". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q328310". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q329048". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q329115". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q329170". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q329390". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q329441". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q329834". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q810565". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q810577". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q810833". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Quick Links". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "RapidBlaster". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Registry Cleaner (Trial)_is1". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Related Sites Toolbar". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "SaveNow". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "ShopAtHomeSelect Agent". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "sjpl6n3k". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Surf SideKick". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "The Weather Channel". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "TSA". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "UrlSidebar". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "WAFAIE". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "wcmdmgr.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "WildTangent CDA". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "WSEM Update". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "wtdmmp". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "wtwebdriver". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Yahoo! Messenger Explorer Bar". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "YourSiteBar". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Zeno Browser Enhancer". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{117C01B5-9D68-4A15-85E2-A7CDFA82CEB9}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{78355062-A04F-B34B-B43C-1E4B1AE732B5}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{7B802DE5-84E5-4503-965B-2ABFFC78506A}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{ba11561e-f0c3-4e6b-9548-79ef48cc4087}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{EDCD4CE3-DE92-49A9-87F9-FE09B2FBA16C}". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{09C8F745-942E-5623-C3CD-0A582FBD330A}" refers to invalid object "C:\WINNT\Uavirkul.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0A99FD75-B264-48FC-AE49-924A646964B8}" refers to invalid object "C:\PROGRA~1\COMMON~1\AOL\AOLTOO~1\smartbox.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0C365A54-70B7-4317-A68F-AAD8D3F45DA7}" refers to invalid object "C:\Program Files\Netscape\Netscape\ISimpleDOMNodeMarshal.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0d780b96-de60-4dd4-b598-f7b497bf61f1}" refers to invalid object "C:\WINNT\System32\jkdnn.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0F27C90A-876E-4C49-867B-AD55030F1721}" refers to invalid object "C:\WINNT\System32\PdePgHlp.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{10AF3945-2E81-4C59-AF6E-B8B428E34074}" refers to invalid object "C:\Program Files\Common Files\AOL\1124219809\ee\AOLSvcMgr.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{19EBE968-E1FA-4A2C-A3BC-8FA20E627017}" refers to invalid object "C:\WINNT\System32\CTPdeSrvps.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{27d04fd1-4830-4c4b-9159-c4109b5e9930}" refers to invalid object "C:\WINNT\System32\czgyyo.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2E65E760-B7E6-4CFB-A105-1E8891A00F82}" refers to invalid object "C:\WINNT\System32\CTPdeSrv.exe". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{307A6C42-0000-0010-8000-00AA00389B71}" refers to invalid object "C:\Documents and Settings\Owner\My Documents\Warcraft III Demo\blizzard.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{390CE9F2-C4A0-11D4-8A92-0090271D4F88}" refers to invalid object "C:\Program Files\Yahoo!\Messenger\ycrwin32.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{41695A8E-6414-11D4-8FB3-00D0B7730277}" refers to invalid object "C:\Program Files\Yahoo!\Messenger\asw.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{475c0fb2-25ad-4941-838e-fad3c318ebf2}" refers to invalid object "C:\WINNT\system32\fkgee.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{4a9d1d79-ed61-43e7-8ff3-331eba262d5a}" refers to invalid object "C:\WINNT\System32\pqckk.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5BD5F66E-F849-4C96-ABAA-5D1D2851D590}" refers to invalid object "C:\Program Files\Yahoo!\Common\YIeTagBm.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{618bba25-d0d4-4f95-bbc9-06b63971520d}" refers to invalid object "C:\WINNT\system32\jkdnn.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{660B82AF-A571-4A19-AC54-5E6E63969676}" refers to invalid object "C:\PROGRA~1\COMMON~1\AOL\AOLTOO~1\smartbox.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{6D0CBE3C-B37B-41BD-C224-4BC0032E03D8}" refers to invalid object "C:\WINNT\system32\kgiu\vfrwwnl.exe". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{724D478A-2BD0-4DB4-AE42-288B1E346EF7}" refers to invalid object "C:\Program Files\FCEngine\Plugin.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{7808E17A-5595-EFF3-B4F7-334DD5E2FED3}" refers to invalid object "C:\WINNT\system32\tsdbqbn\kiifqad.exe". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{7F23E6E5-0E79-4aee-B723-B1463805D5A9}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\sound.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{83D4679F-B6D7-11D2-BF36-00C04FB90A03}" refers to invalid object "C:\PROGRA~1\MESSEN~1\rtcimsp.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{8ECF83A0-1AC9-11D4-8501-00A0CC5D1F63}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\wtwmplug.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{91DA6287-52F0-4CCF-9D67-72842C9BB367}" refers to invalid object "C:\PROGRA~1\SHOCKW~1.COM\RICOCH~1\ui\SwDRM.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{923b521e-0419-4cc3-afd8-846f13851e8a}" refers to invalid object "C:\WINNT\System32\aqnkk.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{94E86640-4E0D-4D4C-A4D3-E3526D6945A6}" refers to invalid object "C:\WINNT\system32\6lo4svc.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{9869EFB4-18E9-11D3-A837-00104B9E30B5}" refers to invalid object "C:\DOCUME~1\Owner\LOCALS~1\Temp\CmdLineExt02.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{990d457e-28d5-405d-b36e-586f47778765}" refers to invalid object "C:\WINNT\System32\pqckk.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A786130F-8AD7-0435-D4EC-5D6FE45B13DC}" refers to invalid object "C:\WINNT\system32\vfcgci\gudblq.exe". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B9BA256A-075B-49ea-B9E2-7DBC2EF021D5}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\sound.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{BEE9C324-3E00-11D4-823D-00D0B74C5265}" refers to invalid object "C:\Program Files\Real\RealArcade\RNArcade.exe". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{BF68E15A-9904-ED33-B74D-505FE4F95631}" refers to invalid object "C:\WINNT\Uavirkul.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{c8de42d9-763a-4c97-bdbd-1df218562ca5}" refers to invalid object "C:\WINNT\System32\pqckk.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{CAB4C70E-9CC3-CCBD-5F31-A5886091594C}" refers to invalid object "C:\WINNT\system32\mnqx\pybmsdjd.exe". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{DF0C0C7C-14F0-40AB-93C9-D71E6E3DE6DD}" refers to invalid object "C:\WINNT\srchfst.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{ECFBE6E0-1AC8-11D4-8501-00A0CC5D1F63}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\wtwmplug.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{EE7CB360-F635-449D-BBB1-0D844F2A269D}" refers to invalid object "C:\Program Files\Common Files\AOL\AOL Toolbar\AOLHelper.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{FA13A9FA-CA9B-11D2-9780-00104B242EA3}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\webdriver.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{FB887D9A-F578-1E57-C0A6-2A14B4DE0830}" refers to invalid object "C:\WINNT\system32\uvortlc\svakpcl.exe". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{1B8B502E-465B-4022-BE4F-FB6D9F808A18}" refers to invalid object "C:\Program Files\FCEngine\Plugin.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{390CE9E4-C4A0-11D4-8A92-0090271D4F88}" refers to invalid object "C:\Program Files\Yahoo!\Messenger\ycrwin32.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{3C2D2A1E-031F-4397-9614-87C932A848E0}" refers to invalid object "C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{41695A81-6414-11D4-8FB3-00D0B7730277}" refers to invalid object "C:\Program Files\Yahoo!\Messenger\asw.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{5C5D478A-085F-4C8C-9B60-825BB9F463E2}" refers to invalid object "C:\Program Files\Real\RealArcade\iegcplug.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{5FE16E42-47D1-471A-BEFF-9C650F9F43BB}" refers to invalid object "C:\Program Files\Common Files\AOL\AOL Toolbar\AOLHelper.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{7061853F-0B2B-4347-9618-3BD988A64DDA}" refers to invalid object "C:\DOCUME~1\Owner\LOCALS~1\Temp\Word8.0\MSForms.exd". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{732C6D41-A4DE-4FAE-957A-5769722BA855}" refers to invalid object "C:\WINNT\System32\PdePgHlp.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{7638761F-0CE1-4E68-9692-D623527A6B7B}" refers to invalid object "C:\WINNT\system32\pkshguyc.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{863ACC54-F798-44FC-BFFD-E849D99FEEEF}" refers to invalid object "C:\Program Files\Yahoo!\Common\YIeTagBm.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{9869EFA6-18E9-11D3-A837-00104B9E30B5}" refers to invalid object "C:\DOCUME~1\Owner\LOCALS~1\Temp\CmdLineExt02.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{B162D478-EF46-4475-B1FE-216BDEDB7FAD}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\wtmulti.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{B7E20302-C22C-4AF2-9D75-C3EB6EEE9DD8}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\wthostctl.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{BC8542C4-719E-49D5-90C6-CCB81A8FAC55}" refers to invalid object "C:\Program Files\Shockwave.com\Ricochet Lost Worlds\ui\SwDRM.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{D72EC833-A24A-4A71-8BE1-31C224629287}" refers to invalid object "C:\WINNT\wt\webdriver\WTHost.exe". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{DCB43485-19FB-4D6D-BB3D-73C7F48D5F00}" refers to invalid object "C:\Program Files\Messenger\rtcimsp.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{F0ED1949-59F9-447D-A8B9-FBDCEBC85198}" refers to invalid object "C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBarBHO.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{F99B46D1-9DE1-432B-8E89-D1D751341F8C}" refers to invalid object "C:\PROGRA~1\COMMON~1\AOL\AOLTOO~1\smartbox.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{FA13AA2E-CA9B-11D2-9780-00104B242EA3}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\webdriver.dll". Action Taken: No Action Taken.
Entry "HKCR\.sll" refers to invalid object "SSLFile". Action Taken: No Action Taken.
Entry "HKCR\Adaptec.EasyCDACMWrapperV2" refers to invalid object "{5FD43CC1-7D99-11d4-B45D-0020E06221F4}". Action Taken: No Action Taken.
Entry "HKCR\Adaptec.EasyCDACMWrapperV2.5" refers to invalid object "{5FD43CC1-7D99-11d4-B45D-0020E06221F4}". Action Taken: No Action Taken.
Entry "HKCR\Alg.AlgSetup" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.
Entry "HKCR\Alg.AlgSetup.1" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.
Entry "HKCR\Automap.Map.NA" refers to invalid object "{A49EEA00-9231-4C77-AA9E-2F89D72B4804}". Action Taken: No Action Taken.
Entry "HKCR\Automap.Map.NA.9" refers to invalid object "{A49EEA00-9231-4C77-AA9E-2F89D72B4804}". Action Taken: No Action Taken.
Entry "HKCR\Automap.Template.NA.9" refers to invalid object "{A49EEA00-9231-4C77-AA9E-2F89D72B4804}". Action Taken: No Action Taken.
Entry "HKCR\communicator.COMMUNICATOR" refers to invalid object "{4E7BD74F-2B8D-469E-8DBC-A42EB79CB428}". Action Taken: No Action Taken.
Entry "HKCR\Connection Manager Profile\shell\open\command" refers to invalid object "C:\WINNT\System32\CMMGR32.EXE "%1"". Action Taken: No Action Taken.
Entry "HKCR\Convcom.OmgConvOmgfDivide" refers to invalid object "{5F50C571-B3FC-4B91-BA21-99D025F6ECC4}". Action Taken: No Action Taken.
Entry "HKCR\Convcom.OmgConvOmgfDivide.1" refers to invalid object "{5F50C571-B3FC-4B91-BA21-99D025F6ECC4}". Action Taken: No Action Taken.
Entry "HKCR\DirectSoundFXChorusPage" refers to invalid object "{60129CFD-2E9B-4098-AA4B-D6CFADA265C3}". Action Taken: No Action Taken.
Entry "HKCR\Dsdmoprp.DirectSoundFXChorusPage" refers to invalid object "{60129CFD-2E9B-4098-AA4B-D6CFADA265C3}". Action Taken: No Action Taken.
Entry "HKCR\Dsdmoprp.DirectSoundFXChorusPage.1" refers to invalid object "{60129CFD-2E9B-4098-AA4B-D6CFADA265C3}". Action Taken: No Action Taken.
Entry "HKCR\DSP.DSP" refers to invalid object "{9C123EA9-AEC9-4f75-BBC0-7565FA1398966}". Action Taken: No Action Taken.
Entry "HKCR\DSP.DSPDMOProp_Chorus.1" refers to invalid object "{6F63B172-5543-4593-91CE-EDBA65B9FACDB}". Action Taken: No Action Taken.
Entry "HKCR\FunTools.PicShow" refers to invalid object "{4487598C-2EC7-43A2-870E-6D8D720FDD9F}". Action Taken: No Action Taken.
Entry "HKCR\FunTools.PicShow.1" refers to invalid object "{4487598C-2EC7-43A2-870E-6D8D720FDD9F}". Action Taken: No Action Taken.
Entry "HKCR\Ihxiuyiiam.Ikybhqal.1" refers to invalid object "{9FABF03A-4478-46B8-A2AC-CF334233DE83}". Action Taken: No Action Taken.
Entry "HKCR\Kvpqakbg.Lusxffcgsc.5" refers to invalid object "{8BA5C287-CA41-4D6F-B545-7E838CC5AD62}". Action Taken: No Action Taken.
Entry "HKCR\msbackupfile\shell\open\command" refers to invalid object "%SystemRoot%\system32\ntbackup.exe". Action Taken: No Action Taken.
Entry "HKCR\Netscape.Help.1" refers to invalid object "{60403D81-872B-11CF-ACC8-0080C82BE3B6}". Action Taken: No Action Taken.
Entry "HKCR\NN_Bar_Dummy.NN_BarDummy" refers to invalid object "{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}". Action Taken: No Action Taken.
Entry "HKCR\NN_Bar_Dummy.NN_BarDummy.1" refers to invalid object "{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}". Action Taken: No Action Taken.
Entry "HKCR\Omgconv2.OmgAt3ToOmgf" refers to invalid object "{5F9F8BEA-39A4-4EB7-85E4-8B5733FD3034}". Action Taken: No Action Taken.
Entry "HKCR\Omgconv2.OmgAt3ToOmgf.1" refers to invalid object "{5F9F8BEA-39A4-4EB7-85E4-8B5733FD3034}". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic.1" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\ppifile\shell\open\command" refers to invalid object "%SystemRoot%\System32\msppcnfg.exe /Config %1". Action Taken: No Action Taken.
Entry "HKCR\RTCCore.RTCClient" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken.
Entry "HKCR\RTCCore.RTCClient.1" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken.
Entry "HKCR\SAFRCFileDlg.FileOpen" refers to invalid object "{5F889CE8-3B09-4CFF-B70A-83730CC00627}". Action Taken: No Action Taken.
Entry "HKCR\SAFRCFileDlg.FileOpen.1" refers to invalid object "{5F889CE8-3B09-4CFF-B70A-83730CC00627}". Action Taken: No Action Taken.
Entry "HKCR\SAPI.SpMemoryStream" refers to invalid object "{5FB7EF7D-DFF4-468a-B6B7-2FCBD188F994}". Action Taken: No Action Taken.
Entry "HKCR\SAPI.SpMemoryStream.1" refers to invalid object "{5FB7EF7D-DFF4-468a-B6B7-2FCBD188F994}". Action Taken: No Action Taken.
Entry "HKCR\Tbidkuwayyum.Peglva.3" refers to invalid object "{D39AC12B-0CC9-4421-988B-651AC845E04F}". Action Taken: No Action Taken.
Entry "HKCR\Tthmbv.Pwfdohhjhtim.5" refers to invalid object "{4D7D8169-E751-4A04-A52C-24CB45BD5CE3}". Action Taken: No Action Taken.
Entry "HKCR\ViewBarBHO.BHO" refers to invalid object "{A7327C09-B521-4EDB-8509-7D2660C9EC98}". Action Taken: No Action Taken.
Entry "HKCR\ViewBarBHO.BHO.1" refers to invalid object "{A7327C09-B521-4EDB-8509-7D2660C9EC98}". Action Taken: No Action Taken.
Entry "HKCR\Wiaacmgr.EventPrompt" refers to invalid object "{5f4baad0-4d59-4fcd-b213-783ce7a92f22}". Action Taken: No Action Taken.
Entry "HKCR\Wiaacmgr.EventPrompt.1" refers to invalid object "{5f4baad0-4d59-4fcd-b213-783ce7a92f22}". Action Taken: No Action Taken.
Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.
Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr.1" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.
Entry "HKCR\YIeTagBm.YahooTaggedBM" refers to invalid object "{65D886A2-7CA7-479B-BB95-14D1EFB7946A}". Action Taken: No Action Taken.
Entry "HKCR\YIeTagBm.YahooTaggedBM.1" refers to invalid object "{65D886A2-7CA7-479B-BB95-14D1EFB7946A}". Action Taken: No Action Taken.
Entry "HKCR\Yiried.Dhjymefwnuhh.7" refers to invalid object "{A53479CE-BCA0-480B-B000-5494EB3EC202}". Action Taken: No Action Taken.
File C:\WINNT\NDNuninstall4_88.exe tagged as "not-a-virus:AdWare.NewDotNet". Action Taken: No Action Taken.
File C:\WINNT\NDNuninstall5_48.exe tagged as "not-a-virus:AdWare.NewDotNet". Action Taken: No Action Taken.
File C:\WINNT\pf78.exe tagged as "not-a-virus:AdWare.Win32.CASClient.a". Action Taken: No Action Taken.
File C:\WINNT\ssk3b5doublemedia.exe infected by "Trojan-Dropper.Win32.Small.qn" Virus! Action Taken: No Action Taken.
File C:\WINNT\wmplayer.exe infected by "Backdoor.Win32.Dumador.cx" Virus! Action Taken: No Action Taken.
File C:\WINNT\system32\3fmg05c4.ini tagged as "not-a-virus:AdWare.Win32.Sahat.ao". Action Taken: No Action Taken.
File C:\WINNT\system32\55ootilq.ini tagged as "not-a-virus:AdWare.Win32.Sahat.ao". Action Taken: No Action Taken.
File C:\WINNT\system32\Desire-uninstall.exe tagged as "not-a-virus:Dialer.Win32.gen". Action Taken: No Action Taken.
File C:\WINNT\system32\ezndlw.dll infected by "Trojan-Clicker.Win32.Agent.aw" Virus! Action Taken: No Action Taken.
File C:\WINNT\system32\InstallerV5.exe infected by "Backdoor.Win32.HacDef.bo" Virus! Action Taken: No Action Taken.
File C:\WINNT\system32\jejklofn.ini tagged as "not-a-virus:AdWare.Win32.Sahat.ao". Action Taken: No Action Taken.
File C:\WINNT\system32\miqrksfe.exe tagged as "not-a-virus:AdWare.NaviPromo.g". Action Taken: No Action Taken.
File C:\WINNT\system32\o53cmn1d.ini tagged as "not-a-virus:AdWare.Win32.Sahat.ao". Action Taken: No Action Taken.
File C:\WINNT\system32\sjpl6n3k.ini tagged as "not-a-virus:AdWare.Win32.Sahat.ao". Action Taken: No Action Taken.
File C:\WINNT\system32\WinNB57.dll tagged as "not-a-virus:AdWare.Win32.Mirar.b". Action Taken: No Action Taken.
File C:\WINNT\system32\WinNB57.dll_tobedeleted tagged as "not-a-virus:AdWare.Win32.Mirar.b". Action Taken: No Action Taken.
File C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\KM9V2KTL\AppWrap[1].exe infected by "Trojan-Downloader.Win32.Small.ru" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\U52ZI1SZ\AppWrap[2].exe infected by "Trojan-Downloader.Win32.Small.ru" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ISearchTechISTsvc.zip infected by "Password-protected-EXE" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ISearchTechISTsvc1.zip infected by "Password-protected-EXE" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ISearchTechSlotch.zip infected by "Password-protected-EXE" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC2.zip infected by "Password-protected-EXE" Virus! Action Taken: No Action Taken.
File C:\Program Files\Common Files\Download\mc-58-12-0000119.exe tagged as "not-a-virus:AdWare.Win32.Maxifiles.l". Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\58F242CC.exe tagged as "not-a-virus:AdWare.Win32.BetterInternet.a". Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\59266A4A.exe tagged as "not-a-virus:AdWare.Win32.BetterInternet.a". Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc1.exe infected by "Trojan-Clicker.Win32.Instas.a" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc113.tmp\mxTarget.cab tagged as "not-a-virus:AdWare.BiSpy.m". Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc156.tmp\mxTarget.cab tagged as "not-a-virus:AdWare.BiSpy.m". Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc245.exe infected by "Trojan-Downloader.Win32.Agent.ct" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc248.exe tagged as "not-a-virus:AdWare.Midable.b". Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc249.exe tagged as "not-a-virus:AdWare.Win32.Adstart.e". Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc253.exe tagged as "not-a-virus:AdWare.AdSrve.b". Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc277.exe infected by "Trojan-Downloader.Win32.Adroar" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc278.exe infected by "Trojan-Clicker.Win32.Agent.aw" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc331.dll infected by "Trojan-Clicker.Win32.Agent.aw" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc343.exe tagged as "not-a-virus:AdWare.Win32.PurityScan.bu". Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc371.exe tagged as "not-a-virus:AdWare.TotalVelocity.v". Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\41IB01U3\js[1].html infected by "Trojan-Downloader.JS.Cobase.b" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\41IB01U3\MediaTicketsInstaller[1].cab tagged as "not-a-virus:AdWare.MediaTickets.f". Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\41IB01U3\mtrslib2[1].js infected by "Exploit.HTML.CodeBaseExec" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\41IB01U3\setup4[1].exe tagged as "not-a-virus:AdWare.Win32.IEDriver.a". Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\41IB01U3\setup_silent_26221[1].exe tagged as "not-a-virus:AdWare.MDH.a". Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\41IB01U3\tbd1[1].html infected by "Exploit.HTML.CodeBaseExec" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\41IB01U3\tbd1[2].html infected by "Exploit.HTML.CodeBaseExec" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\41IB01U3\tbd1[3].html infected by "Exploit.HTML.CodeBaseExec" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\41IB01U3\tbd1[4].html infected by "Exploit.HTML.CodeBaseExec" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\41IB01U3\ysb_prompt[1].php infected by "Trojan-Downloader.JS.IstBar.j" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\CHAFGXU3\CAWTABKT tagged as "not-a-virus:AdWare.Win32.Sahat.v". Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\CHAFGXU3\js[1].html infected by "Exploit.HTML.CodeBaseExec" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\CHAFGXU3\js[2].html infected by "Exploit.HTML.CodeBaseExec" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\CHAFGXU3\loader2[1].ocx infected by "Trojan-Downloader.Win32.Agent.ex" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\CHAFGXU3\mashka[1].php infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\CHAFGXU3\prompt[1].js infected by "Trojan-Downloader.JS.WinAD.a" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\CHAFGXU3\prompt[2].js infected by "Trojan-Downloader.JS.WinAD.a" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\CHAFGXU3\tbd1[1].html infected by "Exploit.HTML.CodeBaseExec" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\CHAFGXU3\tbd1[2].html infected by "Exploit.HTML.CodeBaseExec" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\CHAFGXU3\tbd1[3].html infected by "Exploit.HTML.CodeBaseExec" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\CHAFGXU3\tb_setup[1].cab tagged as "not-a-virus:AdWare.Win32.WebSearch.ba". Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\CHAFGXU3\traspec7[1].exe tagged as "not-a-virus:AdWare.Win32.WebRebates.l". Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\GPUVS12Z\all_files8[1].exe tagged as "not-a-virus:AdWare.AdSrve.b". Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\GPUVS12Z\bbi8031[1].exe tagged as "not-a-virus:AdWare.BargainBuddy.l". Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\GPUVS12Z\install[1].exe tagged as "not-a-virus:AdWare.Win32.Adstart.e". Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\GPUVS12Z\tbd1[1].html infected by "Exploit.HTML.CodeBaseExec" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\GPUVS12Z\tbd1[2].html infected by "Exploit.HTML.CodeBaseExec" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\GPUVS12Z\tbd1[3].html infected by "Exploit.HTML.CodeBaseExec" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\GPUVS12Z\tbd1[4].html infected by "Exploit.HTML.CodeBaseExec" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\WLM7SLYF\addit[1].exe tagged as "not-a-virus:AdWare.Midable.b". Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\WLM7SLYF\js[2].html infected by "Exploit.HTML.CodeBaseExec" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\WLM7SLYF\tbd1[1].html infected by "Exploit.HTML.CodeBaseExec" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\WLM7SLYF\tbd1[2].html infected by "Exploit.HTML.CodeBaseExec" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\WLM7SLYF\tbd1[3].html infected by "Exploit.HTML.CodeBaseExec" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\WLM7SLYF\tbd1[4].html infected by "Exploit.HTML.CodeBaseExec" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\WLM7SLYF\tbd1[5].html infected by "Exploit.HTML.CodeBaseExec" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\WLM7SLYF\tbd1[6].html infected by "Exploit.HTML.CodeBaseExec" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc475.IE5\WLM7SLYF\ticket[1].html infected by "Trojan-Clicker.JS.Linker.j" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc62\bde632.tmp tagged as "not-a-virus:AdWare.Win32.Altnet.i". Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc62\bde64E.tmp tagged as "not-a-virus:AdWare.Win32.BrilliantDigital.35684". Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc62\bde652.tmp tagged as "not-a-virus:AdWare.Win32.BrilliantDigital.35
Post #19
I think this is where the post split the mwav log.
This should be the last part.
The first entry here, I believe, is the same as the last entry in the previous post.
Included here because it got truncated in the previous post.
Total number of entries from the mwav scan is 137.



File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc62\bde652.tmp tagged as "not-a-virus:AdWare.Win32.BrilliantDigital.3567". Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc68\FNuninstaller.EX_ tagged as "not-a-virus:AdWare.ClearSearch.n". Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500\Dc76.tmp\minigolf_affiliate.exe infected by "Trojan-Downloader.NSIS.Agent.g" Virus! Action Taken: No Action Taken.
File C:\WINNT\NDNuninstall4_88.exe tagged as "not-a-virus:AdWare.NewDotNet". Action Taken: No Action Taken.
File C:\WINNT\NDNuninstall5_48.exe tagged as "not-a-virus:AdWare.NewDotNet". Action Taken: No Action Taken.
File C:\WINNT\pf78.exe tagged as "not-a-virus:AdWare.Win32.CASClient.a". Action Taken: No Action Taken.
File C:\WINNT\ssk3b5doublemedia.exe infected by "Trojan-Dropper.Win32.Small.qn" Virus! Action Taken: No Action Taken.
File C:\WINNT\system32\3fmg05c4.ini tagged as "not-a-virus:AdWare.Win32.Sahat.ao". Action Taken: No Action Taken.
File C:\WINNT\system32\55ootilq.ini tagged as "not-a-virus:AdWare.Win32.Sahat.ao". Action Taken: No Action Taken.
File C:\WINNT\system32\Desire-uninstall.exe tagged as "not-a-virus:Dialer.Win32.gen". Action Taken: No Action Taken.
File C:\WINNT\system32\ezndlw.dll infected by "Trojan-Clicker.Win32.Agent.aw" Virus! Action Taken: No Action Taken.
File C:\WINNT\system32\InstallerV5.exe infected by "Backdoor.Win32.HacDef.bo" Virus! Action Taken: No Action Taken.
File C:\WINNT\system32\jejklofn.ini tagged as "not-a-virus:AdWare.Win32.Sahat.ao". Action Taken: No Action Taken.
File C:\WINNT\system32\miqrksfe.exe tagged as "not-a-virus:AdWare.NaviPromo.g". Action Taken: No Action Taken.
File C:\WINNT\system32\o53cmn1d.ini tagged as "not-a-virus:AdWare.Win32.Sahat.ao". Action Taken: No Action Taken.
File C:\WINNT\system32\sjpl6n3k.ini tagged as "not-a-virus:AdWare.Win32.Sahat.ao". Action Taken: No Action Taken.
File C:\WINNT\system32\WinNB57.dll tagged as "not-a-virus:AdWare.Win32.Mirar.b". Action Taken: No Action Taken.
File C:\WINNT\system32\WinNB57.dll_tobedeleted tagged as "not-a-virus:AdWare.Win32.Mirar.b". Action Taken: No Action Taken.
File C:\WINNT\Temp\~os2B.tmp\ossproxy.exe tagged as "not-a-virus:AdWare.Win32.RK.c". Action Taken: No Action Taken.
File C:\WINNT\Temp\~os2B.tmp\rk.bin tagged as "not-a-virus:AdWare.Win32.RK.c". Action Taken: No Action Taken.
File C:\WINNT\wmplayer.exe infected by "Backdoor.Win32.Dumador.cx" Virus! Action Taken: No Action Taken.
Post #20
Please set your computer to show all files.
  • Double-click My Computer.
  • Click the Tools menu, and then click Folder Options.
  • Click the View tab.
  • Clear "Hide file extensions for known file types."
  • Under the "Hidden files" folder, select "Show hidden files and folders."
  • Clear "Hide protected operating system files."
  • Click Apply, and then click OK.
You will need to reverse this process when all steps are done.


Delete the following files/folder:

These Files

C:\WINNT\NDNuninstall4_88.exe
C:\WINNT\NDNuninstall5_48.exe
C:\WINNT\pf78.exe
C:\WINNT\ssk3b5doublemedia.exe
C:\WINNT\wmplayer.exe
C:\WINNT\system32\3fmg05c4.ini
C:\WINNT\system32\55ootilq.ini
C:\WINNT\system32\Desire-uninstall.exe
C:\WINNT\system32\ezndlw.dll
C:\WINNT\system32\InstallerV5.exe
C:\WINNT\system32\jejklofn.ini
C:\WINNT\system32\miqrksfe.exe
C:\WINNT\system32\o53cmn1d.ini
C:\WINNT\system32\sjpl6n3k.ini
C:\WINNT\system32\WinNB57.dll
C:\WINNT\system32\WinNB57.dll_tobedeleted
C:\Program Files\Common Files\Download\mc-58-12-0000119.exe

This Folder

C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500


Please delete your temporary files:
Go > Start > Run and type cleanmgr and click OK.
Scan your system for files to remove.
Make sure Temporary Files, Temporary Internet Files and Recycle Bin are the only things checked.
Click OK to remove those files.
Click Yes to confirm deletion.


Reboot the computer and scan with Hijackthis. Post the new log as a reply to this thread. Include a fresh mwavscan log.
Let me know how the computer is behaving now.
Post #21
The machine is running smoothly.
Perhaps a little slow, but not bad.
By the way, I mentioned it is my nephew's machine…
I still have it at my house, so it is still unplugged from the internet (network cable is physically unplugged).


Before I post the logs you requested, I thought I should mention that I noticed the following still exist:

The folder
c:\program files\180search assistant programs

it contains
c:\program files\180search assistant programs\180search toolbar

and that contains the following two files:
c:\program files\180search assistant programs\180search toolbar\180ST.dll
c:\program files\180search assistant programs\180search toolbar\180STUninstaller.exe


also the following empty folders exist:
c:\program files\maxspeed
c:\program files\delfin


One more thing, then on to the logs.

As you requested, I deleted this folder:
C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-500

but next to it is another one, which I did not delete, called
C:\RECYCLER\S-1-5-21-658426523-200488306-268462415-1013



OK, here is the fresh HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 5:20:44 AM, on 10/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINNT\System32\NMSSvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\wanmpsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINNT\SM1BG.EXE
C:\Program Files\QuickTime\qttask.exe
C:\WINNT\system32\PROMon.exe
C:\Program Files\Saitek\Software\Profiler.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINNT\System32\igfxtray.exe
C:\WINNT\System32\hkcmd.exe
C:\WINNT\system32\SK9910DM.EXE
C:\WINNT\GWMDMMSG.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\WINNT\system32\wuauclt.exe
C:\Documents and Settings\Owner\Desktop\hjt\HijackThis.exe

N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/bookmark/7_0/home.html"); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\x6vbj4wt.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\x6vbj4wt.slt\prefs.js)
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [SM1BG] C:\WINNT\SM1BG.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe
O4 - HKLM\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Keyboard Preload Check] C:\OEMDRVRS\KEYB\Preload.exe /DEVID: /CLASS:Keyboard /RunValue:"Keyboard Preload Check"
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [Hot Key Kbd 9910 Daemon] SK9910DM.EXE
O4 - HKLM\..\Run: [GWMDMpi] C:\WINNT\GWMDMpi.exe
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [eMusicClient Systray] C:\Program Files\eMusic\eMusicClient.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\Netscape\Netscape\Netscp.exe" -turbo
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .avi: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npavi32.dll
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .wmv: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npdsplay.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://www.songtouch.com/Install.exe
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.yahoo.com/…ebio5_0_2_7.cab
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Pacsptisvr.exe
O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe



And the new mwav scan
48 entries, and the first 44 were very early in the scan

Object "bigtrafficnet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bigtrafficnet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bigtrafficnet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bigtrafficnet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bigtrafficnet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bigtrafficnet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "downloadware Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "ibis Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "kazaa Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "mediamotor Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "prositefinder Adware" found in File System! Action Taken: No Action Taken.
Object "kazaa Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "downloadware Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "emusicclient Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "abetterinternet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "toprebates Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "istbar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "180solutions Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "spediabar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "spediabar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "unknown pest Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "coolwebsearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "elite toolbar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "tvmedia Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "aureate Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "browseraid Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "ezula Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "spediabar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "netpal Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bargainbuddy Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bargainbuddy Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bargainbuddy Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "bargainbuddy Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "startsurfing Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "cydoor.topicks.a Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "delfin media viewer Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "cws.therealsearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "cws.therealsearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\Install.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\installer_MARKETING11.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\loader2.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\MediaTicketsInstaller.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\QDow.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\ycomp5_0_2_7.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\minigolf_affiliate.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\System32\ObjSafe.tlb". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\ycomp5_0_2_7.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Sony Shared\OpenMG\ekb\newekb020723.txt". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Sony Shared\AVLib\CDDBControl.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Sony Shared\AVLib\CDDBUI.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Sony Shared\OpenMG\ekb\newekb040130.txt". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\System32\ObjSafe.tlb". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\QDow.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\minigolf_affiliate.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\MediaTicketsInstaller.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\AppsInstalled.htm". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\HDPlugin1019.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\loader2.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\Install.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\AOL\AOL Toolbar\bullet.gid". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\installer_MARKETING11.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe" refers to invalid object "C:\WINNT\System32\cmmgr32.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\Napster" refers to invalid object "C:\Program Files\Napster\Napster". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\NetMDDriver" refers to invalid object "C:\Program Files\Sony\Net MD Driver\NetMDDriver". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\ORUN32.EXE" refers to invalid object "C:\WINNT\ORUN32.EXE". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\PCDoctor.exe" refers to invalid object "C:\Program Files\PC-Doctor for Windows\PCDoctor.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\pcshw" refers to invalid object "C:\WINNT\system32\pkshguyc.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\pshower" refers to invalid object "C:\WINNT\system32\pshwr.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\Robot Arena 2.exe" refers to invalid object "C:\Program Files\Infogrames\Robot Arena 2\Robot Arena 2.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\setup.exe" refers to invalid object "C:\Program Files\Cypress Semiconductor\Cypress USB Mass Storage Driver Installation\setup.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\udfrinst.exe" refers to invalid object "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\udfrinst.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\yourapp.Exe" refers to invalid object "C:\Program Files\Saitek\Software\yourapp.Exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Documents and Settings\Owner\Favorites\Financial Links\". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".016". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".ADB". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".class". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".dll_tobedeleted". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".hdmp". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".hiv". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".HMT". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".ldi". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".mdmp". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".mez". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".MF". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".partial". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".pf". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".rar". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".ref". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".rgi". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".rgs". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".trace". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object "OpenWithList". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "180sa". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "180search Toolbar". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "3fmg05c4". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "55ootilq". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "BargainBuddy". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "bdeplayer". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "bsto-1". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "CashBack". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "ContextSidebar". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Dbi". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "DelFin Media Viewer". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "DisplayUtility". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "DMO". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "eMusicSetup". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Internet Optimizer Active Alert". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Internet Optimizer Software Installer". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "InternetOffers". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "ISTsvc". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "jejklofn". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Media Gateway". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "MediaLoads Enhanced". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "mediamotor". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "msbb". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "NaviSearch". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Netscape (7.01)". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "o53cmn1d". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "OpenMG HotFix3.1-02-08-09-01". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "OpenMG HotFix3.1-02-08-15-01". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "OpenMG HotFix3.1-02-10-08-01". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "PopCap Browser Plugin". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Power Scan". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q328310". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q329048". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q329115". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q329170". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q329390". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q329441". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q329834". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q810565". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q810577". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q810833". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Quick Links". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "RapidBlaster". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Registry Cleaner (Trial)_is1". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Related Sites Toolbar". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "SaveNow". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "ShopAtHomeSelect Agent". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "sjpl6n3k". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Surf SideKick". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "The Weather Channel". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "TSA". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "UrlSidebar". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "WAFAIE". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "wcmdmgr.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "WildTangent CDA". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "WSEM Update". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "wtdmmp". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "wtwebdriver". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Yahoo! Messenger Explorer Bar". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "YourSiteBar". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Zeno Browser Enhancer". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{117C01B5-9D68-4A15-85E2-A7CDFA82CEB9}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{78355062-A04F-B34B-B43C-1E4B1AE732B5}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{7B802DE5-84E5-4503-965B-2ABFFC78506A}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{ba11561e-f0c3-4e6b-9548-79ef48cc4087}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{EDCD4CE3-DE92-49A9-87F9-FE09B2FBA16C}". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{09C8F745-942E-5623-C3CD-0A582FBD330A}" refers to invalid object "C:\WINNT\Uavirkul.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0A99FD75-B264-48FC-AE49-924A646964B8}" refers to invalid object "C:\PROGRA~1\COMMON~1\AOL\AOLTOO~1\smartbox.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0C365A54-70B7-4317-A68F-AAD8D3F45DA7}" refers to invalid object "C:\Program Files\Netscape\Netscape\ISimpleDOMNodeMarshal.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0d780b96-de60-4dd4-b598-f7b497bf61f1}" refers to invalid object "C:\WINNT\System32\jkdnn.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0F27C90A-876E-4C49-867B-AD55030F1721}" refers to invalid object "C:\WINNT\System32\PdePgHlp.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{10AF3945-2E81-4C59-AF6E-B8B428E34074}" refers to invalid object "C:\Program Files\Common Files\AOL\1124219809\ee\AOLSvcMgr.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{19EBE968-E1FA-4A2C-A3BC-8FA20E627017}" refers to invalid object "C:\WINNT\System32\CTPdeSrvps.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{27d04fd1-4830-4c4b-9159-c4109b5e9930}" refers to invalid object "C:\WINNT\System32\czgyyo.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2E65E760-B7E6-4CFB-A105-1E8891A00F82}" refers to invalid object "C:\WINNT\System32\CTPdeSrv.exe". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{307A6C42-0000-0010-8000-00AA00389B71}" refers to invalid object "C:\Documents and Settings\Owner\My Documents\Warcraft III Demo\blizzard.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{390CE9F2-C4A0-11D4-8A92-0090271D4F88}" refers to invalid object "C:\Program Files\Yahoo!\Messenger\ycrwin32.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{3B88442F-E746-2BC2-D371-60550C86733F}" refers to invalid object "C:\WINNT\System32\ezndlw.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{41695A8E-6414-11D4-8FB3-00D0B7730277}" refers to invalid object "C:\Program Files\Yahoo!\Messenger\asw.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{475c0fb2-25ad-4941-838e-fad3c318ebf2}" refers to invalid object "C:\WINNT\system32\fkgee.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{4a9d1d79-ed61-43e7-8ff3-331eba262d5a}" refers to invalid object "C:\WINNT\System32\pqckk.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5BD5F66E-F849-4C96-ABAA-5D1D2851D590}" refers to invalid object "C:\Program Files\Yahoo!\Common\YIeTagBm.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{618bba25-d0d4-4f95-bbc9-06b63971520d}" refers to invalid object "C:\WINNT\system32\jkdnn.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{660B82AF-A571-4A19-AC54-5E6E63969676}" refers to invalid object "C:\PROGRA~1\COMMON~1\AOL\AOLTOO~1\smartbox.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{6D0CBE3C-B37B-41BD-C224-4BC0032E03D8}" refers to invalid object "C:\WINNT\system32\kgiu\vfrwwnl.exe". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{724D478A-2BD0-4DB4-AE42-288B1E346EF7}" refers to invalid object "C:\Program Files\FCEngine\Plugin.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{7808E17A-5595-EFF3-B4F7-334DD5E2FED3}" refers to invalid object "C:\WINNT\system32\tsdbqbn\kiifqad.exe". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{7F23E6E5-0E79-4aee-B723-B1463805D5A9}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\sound.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{83D4679F-B6D7-11D2-BF36-00C04FB90A03}" refers to invalid object "C:\PROGRA~1\MESSEN~1\rtcimsp.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{8ECF83A0-1AC9-11D4-8501-00A0CC5D1F63}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\wtwmplug.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{91DA6287-52F0-4CCF-9D67-72842C9BB367}" refers to invalid object "C:\PROGRA~1\SHOCKW~1.COM\RICOCH~1\ui\SwDRM.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{923b521e-0419-4cc3-afd8-846f13851e8a}" refers to invalid object "C:\WINNT\System32\aqnkk.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{94E86640-4E0D-4D4C-A4D3-E3526D6945A6}" refers to invalid object "C:\WINNT\system32\6lo4svc.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{9869EFB4-18E9-11D3-A837-00104B9E30B5}" refers to invalid object "C:\DOCUME~1\Owner\LOCALS~1\Temp\CmdLineExt02.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{990d457e-28d5-405d-b36e-586f47778765}" refers to invalid object "C:\WINNT\System32\pqckk.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A786130F-8AD7-0435-D4EC-5D6FE45B13DC}" refers to invalid object "C:\WINNT\system32\vfcgci\gudblq.exe". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B9BA256A-075B-49ea-B9E2-7DBC2EF021D5}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\sound.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{BEE9C324-3E00-11D4-823D-00D0B74C5265}" refers to invalid object "C:\Program Files\Real\RealArcade\RNArcade.exe". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{BF68E15A-9904-ED33-B74D-505FE4F95631}" refers to invalid object "C:\WINNT\Uavirkul.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{c8de42d9-763a-4c97-bdbd-1df218562ca5}" refers to invalid object "C:\WINNT\System32\pqckk.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{CAB4C70E-9CC3-CCBD-5F31-A5886091594C}" refers to invalid object "C:\WINNT\system32\mnqx\pybmsdjd.exe". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{DF0C0C7C-14F0-40AB-93C9-D71E6E3DE6DD}" refers to invalid object "C:\WINNT\srchfst.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{ECFBE6E0-1AC8-11D4-8501-00A0CC5D1F63}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\wtwmplug.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{EE7CB360-F635-449D-BBB1-0D844F2A269D}" refers to invalid object "C:\Program Files\Common Files\AOL\AOL Toolbar\AOLHelper.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{FA13A9FA-CA9B-11D2-9780-00104B242EA3}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\webdriver.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{FB887D9A-F578-1E57-C0A6-2A14B4DE0830}" refers to invalid object "C:\WINNT\system32\uvortlc\svakpcl.exe". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{1B8B502E-465B-4022-BE4F-FB6D9F808A18}" refers to invalid object "C:\Program Files\FCEngine\Plugin.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{390CE9E4-C4A0-11D4-8A92-0090271D4F88}" refers to invalid object "C:\Program Files\Yahoo!\Messenger\ycrwin32.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{3C2D2A1E-031F-4397-9614-87C932A848E0}" refers to invalid object "C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{41695A81-6414-11D4-8FB3-00D0B7730277}" refers to invalid object "C:\Program Files\Yahoo!\Messenger\asw.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{5C5D478A-085F-4C8C-9B60-825BB9F463E2}" refers to invalid object "C:\Program Files\Real\RealArcade\iegcplug.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{5FE16E42-47D1-471A-BEFF-9C650F9F43BB}" refers to invalid object "C:\Program Files\Common Files\AOL\AOL Toolbar\AOLHelper.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{7061853F-0B2B-4347-9618-3BD988A64DDA}" refers to invalid object "C:\DOCUME~1\Owner\LOCALS~1\Temp\Word8.0\MSForms.exd". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{732C6D41-A4DE-4FAE-957A-5769722BA855}" refers to invalid object "C:\WINNT\System32\PdePgHlp.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{7638761F-0CE1-4E68-9692-D623527A6B7B}" refers to invalid object "C:\WINNT\system32\pkshguyc.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{863ACC54-F798-44FC-BFFD-E849D99FEEEF}" refers to invalid object "C:\Program Files\Yahoo!\Common\YIeTagBm.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{9869EFA6-18E9-11D3-A837-00104B9E30B5}" refers to invalid object "C:\DOCUME~1\Owner\LOCALS~1\Temp\CmdLineExt02.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{B162D478-EF46-4475-B1FE-216BDEDB7FAD}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\wtmulti.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{B7E20302-C22C-4AF2-9D75-C3EB6EEE9DD8}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\wthostctl.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{BC8542C4-719E-49D5-90C6-CCB81A8FAC55}" refers to invalid object "C:\Program Files\Shockwave.com\Ricochet Lost Worlds\ui\SwDRM.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{D72EC833-A24A-4A71-8BE1-31C224629287}" refers to invalid object "C:\WINNT\wt\webdriver\WTHost.exe". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{DCB43485-19FB-4D6D-BB3D-73C7F48D5F00}" refers to invalid object "C:\Program Files\Messenger\rtcimsp.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{F0ED1949-59F9-447D-A8B9-FBDCEBC85198}" refers to invalid object "C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBarBHO.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{F99B46D1-9DE1-432B-8E89-D1D751341F8C}" refers to invalid object "C:\PROGRA~1\COMMON~1\AOL\AOLTOO~1\smartbox.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{FA13AA2E-CA9B-11D2-9780-00104B242EA3}" refers to invalid object "C:\WINNT\wt\webdriver\4.1.1\webdriver.dll". Action Taken: No Action Taken.
Entry "HKCR\.sll" refers to invalid object "SSLFile". Action Taken: No Action Taken.
Entry "HKCR\Adaptec.EasyCDACMWrapperV2" refers to invalid object "{5FD43CC1-7D99-11d4-B45D-0020E06221F4}". Action Taken: No Action Taken.
Entry "HKCR\Adaptec.EasyCDACMWrapperV2.5" refers to invalid object "{5FD43CC1-7D99-11d4-B45D-0020E06221F4}". Action Taken: No Action Taken.
Entry "HKCR\Alg.AlgSetup" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.
Entry "HKCR\Alg.AlgSetup.1" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.
Entry "HKCR\Automap.Map.NA" refers to invalid object "{A49EEA00-9231-4C77-AA9E-2F89D72B4804}". Action Taken: No Action Taken.
Entry "HKCR\Automap.Map.NA.9" refers to invalid object "{A49EEA00-9231-4C77-AA9E-2F89D72B4804}". Action Taken: No Action Taken.
Entry "HKCR\Automap.Template.NA.9" refers to invalid object "{A49EEA00-9231-4C77-AA9E-2F89D72B4804}". Action Taken: No Action Taken.
Entry "HKCR\communicator.COMMUNICATOR" refers to invalid object "{4E7BD74F-2B8D-469E-8DBC-A42EB79CB428}". Action Taken: No Action Taken.
Entry "HKCR\Connection Manager Profile\shell\open\command" refers to invalid object "C:\WINNT\System32\CMMGR32.EXE "%1"". Action Taken: No Action Taken.
Entry "HKCR\Convcom.OmgConvOmgfDivide" refers to invalid object "{5F50C571-B3FC-4B91-BA21-99D025F6ECC4}". Action Taken: No Action Taken.
Entry "HKCR\Convcom.OmgConvOmgfDivide.1" refers to invalid object "{5F50C571-B3FC-4B91-BA21-99D025F6ECC4}". Action Taken: No Action Taken.
Entry "HKCR\DirectSoundFXChorusPage" refers to invalid object "{60129CFD-2E9B-4098-AA4B-D6CFADA265C3}". Action Taken: No Action Taken.
Entry "HKCR\Dsdmoprp.DirectSoundFXChorusPage" refers to invalid object "{60129CFD-2E9B-4098-AA4B-D6CFADA265C3}". Action Taken: No Action Taken.
Entry "HKCR\Dsdmoprp.DirectSoundFXChorusPage.1" refers to invalid object "{60129CFD-2E9B-4098-AA4B-D6CFADA265C3}". Action Taken: No Action Taken.
Entry "HKCR\DSP.DSP" refers to invalid object "{9C123EA9-AEC9-4f75-BBC0-7565FA1398966}". Action Taken: No Action Taken.
Entry "HKCR\DSP.DSPDMOProp_Chorus.1" refers to invalid object "{6F63B172-5543-4593-91CE-EDBA65B9FACDB}". Action Taken: No Action Taken.
Entry "HKCR\FunTools.PicShow" refers to invalid object "{4487598C-2EC7-43A2-870E-6D8D720FDD9F}". Action Taken: No Action Taken.
Entry "HKCR\FunTools.PicShow.1" refers to invalid object "{4487598C-2EC7-43A2-870E-6D8D720FDD9F}". Action Taken: No Action Taken.
Entry "HKCR\Ihxiuyiiam.Ikybhqal.1" refers to invalid object "{9FABF03A-4478-46B8-A2AC-CF334233DE83}". Action Taken: No Action Taken.
Entry "HKCR\Kvpqakbg.Lusxffcgsc.5" refers to invalid object "{8BA5C287-CA41-4D6F-B545-7E838CC5AD62}". Action Taken: No Action Taken.
Entry "HKCR\msbackupfile\shell\open\command" refers to invalid object "%SystemRoot%\system32\ntbackup.exe". Action Taken: No Action Taken.
Entry "HKCR\Netscape.Help.1" refers to invalid object "{60403D81-872B-11CF-ACC8-0080C82BE3B6}". Action Taken: No Action Taken.
Entry "HKCR\NN_Bar_Dummy.NN_BarDummy" refers to invalid object "{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}". Action Taken: No Action Taken.
Entry "HKCR\NN_Bar_Dummy.NN_BarDummy.1" refers to invalid object "{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}". Action Taken: No Action Taken.
Entry "HKCR\Omgconv2.OmgAt3ToOmgf" refers to invalid object "{5F9F8BEA-39A4-4EB7-85E4-8B5733FD3034}". Action Taken: No Action Taken.
Entry "HKCR\Omgconv2.OmgAt3ToOmgf.1" refers to invalid object "{5F9F8BEA-39A4-4EB7-85E4-8B5733FD3034}". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic.1" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\ppifile\shell\open\command" refers to invalid object "%SystemRoot%\System32\msppcnfg.exe /Config %1". Action Taken: No Action Taken.
Entry "HKCR\RTCCore.RTCClient" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken.
Entry "HKCR\RTCCore.RTCClient.1" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken.
Entry "HKCR\SAFRCFileDlg.FileOpen" refers to invalid object "{5F889CE8-3B09-4CFF-B70A-83730CC00627}". Action Taken: No Action Taken.
Entry "HKCR\SAFRCFileDlg.FileOpen.1" refers to invalid object "{5F889CE8-3B09-4CFF-B70A-83730CC00627}". Action Taken: No Action Taken.
Entry "HKCR\SAPI.SpMemoryStream" refers to invalid object "{5FB7EF7D-DFF4-468a-B6B7-2FCBD188F994}". Action Taken: No Action Taken.
Entry "HKCR\SAPI.SpMemoryStream.1" refers to invalid object "{5FB7EF7D-DFF4-468a-B6B7-2FCBD188F994}". Action Taken: No Action Taken.
Entry "HKCR\Tbidkuwayyum.Peglva.3" refers to invalid object "{D39AC12B-0CC9-4421-988B-651AC845E04F}". Action Taken: No Action Taken.
Entry "HKCR\Tthmbv.Pwfdohhjhtim.5" refers to invalid object "{4D7D8169-E751-4A04-A52C-24CB45BD5CE3}". Action Taken: No Action Taken.
Entry "HKCR\ViewBarBHO.BHO" refers to invalid object "{A7327C09-B521-4EDB-8509-7D2660C9EC98}". Action Taken: No Action Taken.
Entry "HKCR\ViewBarBHO.BHO.1" refers to invalid object "{A7327C09-B521-4EDB-8509-7D2660C9EC98}". Action Taken: No Action Taken.
Entry "HKCR\Wiaacmgr.EventPrompt" refers to invalid object "{5f4baad0-4d59-4fcd-b213-783ce7a92f22}". Action Taken: No Action Taken.
Entry "HKCR\Wiaacmgr.EventPrompt.1" refers to invalid object "{5f4baad0-4d59-4fcd-b213-783ce7a92f22}". Action Taken: No Action Taken.
Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.
Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr.1" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.
Entry "HKCR\YIeTagBm.YahooTaggedBM" refers to invalid object "{65D886A2-7CA7-479B-BB95-14D1EFB7946A}". Action Taken: No Action Taken.
Entry "HKCR\YIeTagBm.YahooTaggedBM.1" refers to invalid object "{65D886A2-7CA7-479B-BB95-14D1EFB7946A}". Action Taken: No Action Taken.
Entry "HKCR\Yiried.Dhjymefwnuhh.7" refers to invalid object "{A53479CE-BCA0-480B-B000-5494EB3EC202}". Action Taken: No Action Taken.
File C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\KM9V2KTL\AppWrap[1].exe infected by "Trojan-Downloader.Win32.Small.ru" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\U52ZI1SZ\AppWrap[2].exe infected by "Trojan-Downloader.Win32.Small.ru" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ISearchTechISTsvc.zip infected by "Password-protected-EXE" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ISearchTechISTsvc1.zip infected by "Password-protected-EXE" Virus! Action Taken: No Action Taken.
File C:\Documents and
Post #22
Double-click on Killbox.exe to start the program.
In the killbox program, select the Delete on Reboot option.
In the field labeled Full Path of File to Delete enter the file paths listed below ONE AT A TIME (EXACTLY as it appears, please double check to make sure!):

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\KM9V2KTL\AppWrap[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\U52ZI1SZ\AppWrap[2].exe
C:\WINNT\Temp\~os2B.tmp\ossproxy.exe
C:\WINNT\Temp\~os2B.tmp\rk.bin

Press the button that looks like a red circle with a white X in it after each one. When it asks if you would like to delete on reboot, press the YES button, when it asks if you want to reboot now, press the NO button. Do this after each one until you have entered the LAST file path I have listed above. After that LAST file path has been entered, press the YES button at both prompts so that your computer restarts.
If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just restart manually.



Delete the following folders:

[c:\program files\180search assistant programs
c:\program files\maxspeed
c:\program files\delfin


Cleanup the items quarantined by Norton
  • Open Norton Antivirus and click "reports".
  • In quarantined items click "view report" and in the window that opens click Quarantined Items.
  • Highlight each line in the left column and click Delete Item from the toolbar above.
  • Repeat this procedure for the Backup Items.
Clean Spybot S&D's Recovery
  • Open Spybot S&D and click Recovery
  • Check everything and click Purge Selected Items.
  • OK any promts.
Reboot the computer and scan with Hijackthis. Post the new log as a reply to this thread.
Let me know how the computer is behaving now.
Post #23
The computer is still responding very well.
It acts like a normal happy machine, although I imagine it is anxious to be defragged.
Will be curious to see what happens when we connect it to the internet.


The following items might not mean anything, but here is what I have noticed:

During shutdown I sometimes still get an alert that says something like this:
SKMBATT.exe initialization failed……..something about a missing .dll I think
The alert closes quickly and then Windows shuts down.
This has been happening off and on ever since the troubles began, but it used to not close quickly.
I searched the machine for a file by that name, and it seems to be a .pf file in the C:\winnt\prefetch.
Probably no big deal, but it's funny it was created about the same date as the onset of problems.




Also, I see another suspicious folder in c:\program files.
c:\program files\bjballroom
This one is 9.56Meg and does contain an executable called CasinoGame.exe and several .dll's
as well as an UNWISE.exe …….. it also has a subdirectory called bjballroom
I think that's BlackJack Ballroom.



And the following file exists:
c:\adlog.txt
This one reads like a dialogue between Ezula and a remote server.



Here is the fresh HJT log after following your latest instructions:

Logfile of HijackThis v1.99.1
Scan saved at 8:02:57 PM, on 10/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINNT\System32\NMSSvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\wanmpsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINNT\SM1BG.EXE
C:\Program Files\QuickTime\qttask.exe
C:\WINNT\system32\PROMon.exe
C:\Program Files\Saitek\Software\Profiler.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINNT\System32\igfxtray.exe
C:\WINNT\System32\hkcmd.exe
C:\WINNT\system32\SK9910DM.EXE
C:\WINNT\GWMDMMSG.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\WINNT\system32\wuauclt.exe
C:\Documents and Settings\Owner\Desktop\hjt\HijackThis.exe

N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/bookmark/7_0/home.html"); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\x6vbj4wt.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\x6vbj4wt.slt\prefs.js)
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [SM1BG] C:\WINNT\SM1BG.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe
O4 - HKLM\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Keyboard Preload Check] C:\OEMDRVRS\KEYB\Preload.exe /DEVID: /CLASS:Keyboard /RunValue:"Keyboard Preload Check"
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [Hot Key Kbd 9910 Daemon] SK9910DM.EXE
O4 - HKLM\..\Run: [GWMDMpi] C:\WINNT\GWMDMpi.exe
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [eMusicClient Systray] C:\Program Files\eMusic\eMusicClient.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\Netscape\Netscape\Netscp.exe" -turbo
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .avi: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npavi32.dll
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .wmv: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npdsplay.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://www.songtouch.com/Install.exe
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.yahoo.com/…ebio5_0_2_7.cab
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Pacsptisvr.exe
O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe
Post #24
Navigate to the following folder and delete everything inside of it but not the folder itself:

C:\winnt\prefetch

This may make the computer boot-up slower for the first few reboots as it rebuilds the items in the prefetch folder.


This one appears to be associated with this website (made unclickable for protection): hxxp://www.kcsod.com/
Not sure how old your nephew is or if he is allowed to play at gambling sites. I would check to see if this program was purposely installed. Remove if he knows nothing about it.

c:\program files\bjballroom


Delete this file:

c:\adlog.txt


Your new log appears clean. :)

Reset and Re-enable your System Restore to remove bad files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected.)

1. Right-click My Computer, and then click Properties.
2. On the System Restore tab, put a check mark in the 'Turn Off System Restore' check box.
3. Click OK, and then click Yes.
4. Restart the computer.
5. Repeat steps 1 - 2, this time clearing the box beside 'Turn Off System Restore', click 'OK'.


I suggest that you download these programs to help keep the computer clean:

Spyware Blaster - Blocks bad ActiveX items from installing on your computer. Spyware Blaster runs silently in the background.
ie-spyad - Puts over 12,000 bad URLs into your restricted sites for Internet Explorer.
Google Toolbar - Blocks many unwanted pop-ups in Internet Explorer.
Firefox - 'Safer' alternative to the Internet Explorer web browser.
ZoneAlarm - Free firewall program if you currently are not using one.

Update these regularly.

You may also want to read the following posts to learn how to better secure your computer.
"So how did I get infected in the first place"
"Securing Your PC After An Attack"

Be sure to keep Windows and your Anti-virus updated.
Post #25
Thank you very much! You are a real inspiration. I will take the machine back to my nephew tomorrow and load the suggested defences, and connect it to the internet. If something goes wrong when we connect it, would it be alright if I contact you? If so, do I use email or this post again? Thanks again. God bless you.
Post #26
Your welcome. Glad I was able to help out. I'll leave this thread open for a few days longer just in case any problems arise. Just let me know if you need any more help. :thumbup:
Post #27
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI