What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

what can I do with this?

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
I have several trojans that keep reloading adware/malware. I can't get rid of them. What should I remove from this list?

Thank you for your help!!!







Logfile of HijackThis v1.99.1
Scan saved at 8:41:23 PM, on 10/23/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v5.50 (5.50.4134.0100)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SK9910DM.EXE
C:\PROGRAM FILES\HP\HPCORETECH\HPCMPMGR.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP SOFTWARE UPDATE\HPWUSCHD.EXE
C:\WINDOWS\SYSTEM\HPZTSB09.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOTDD01.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\W130713.STUB.EXE
C:\WINDOWS\SYSTEM\APD123.EXE
C:\WINDOWS\SYSTEM\PXVH\UCMKQUBA.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\EXE82.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\LLLPSG.EXE
C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 4\CREATECD\CREATECD.EXE
C:\PROGRAM FILES\INTERNET OPTIMIZER\OPTIMIZE.EXE
C:\PROGRAM FILES\WEBHANCER\PROGRAMS\WHAGENT.EXE
C:\PROGRAM FILES\WEBHANCER\PROGRAMS\WHSURVEY.EXE
C:\WINDOWS\SYSTEM\MSOEMB.EXE
C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE
C:\WINDOWS\SYSTEM\MSOEMB.EXE
C:\COMPUSERVE 2000\CSTRAY.EXE
C:\PROGRAM FILES\FINEPIXVIEWER\QUICKDCF.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R3 - URLSearchHook: (no name) - _{02EE5B04-F144-47BB-83FB-A60BD91B74A9} - (no file)
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll (file missing)
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\NEM220.DLL
O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\PROGRAM FILES\WEBHANCER\PROGRAMS\WHIEHLPR.DLL
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Hot Key Kbd 9910 Daemon] SK9910DM.EXE
O4 - HKLM\..\Run: [HP Component Manager] "C:\PROGRAM FILES\HP\HPCORETECH\HPCMPMGR.EXE"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb09.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\SYSTEM\wintask.exe
O4 - HKLM\..\Run: [testit.exe] C:\WINDOWS\SYSTEM\testit.exe
O4 - HKLM\..\Run: [inwmg] C:\W130713.STUB.EXE
O4 - HKLM\..\Run: [VVHXJJC] C:\WINDOWS\SYSTEM\TVDFOXW\VVHXJJC.EXE
O4 - HKLM\..\Run: [APD123] C:\WINDOWS\SYSTEM\APD123.exe
O4 - HKLM\..\Run: [UCMKQUBA] C:\WINDOWS\SYSTEM\PXVH\UCMKQUBA.EXE
O4 - HKLM\..\Run: [0.10] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.78] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [1.36] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.81] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.46] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.33] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.84] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.88] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.20] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.49] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.54] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.69] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.24] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [3.50] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.16] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [2.32] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.31] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.35] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.22] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.23] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.58] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [2.02] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.89] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.83] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.56] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.14] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [6.29] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.19] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [7.35] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.87] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.44] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.95] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.76] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [9.11] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.25] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.11] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.72] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.68] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.82] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.38] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.59] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.45] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.41] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.61] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.60] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.47] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.77] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.51] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [6.21] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [1.61] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.18] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [5.75] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.43] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.91] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.74] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.80] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.13] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.50] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [4.25] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.66] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.75] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.79] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.63] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.57] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.39] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [8.36] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.55] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [4.12] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.98] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [6.50] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.32] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [3.08] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.28] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.71] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.12] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.92] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.36] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.06] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [MSConfigReminder] C:\WINDOWS\SYSTEM\msconfig.exe /reminder
O4 - HKLM\..\Run: [0.94] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [3.70] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.67] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.64] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.52] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.27] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.37] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [6.34] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.70] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.34] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.99] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.86] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [5.95] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.62] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\lllpsg.exe reg_run
O4 - HKLM\..\Run: [CreateCD] C:\PROGRA~1\ADAPTEC\EASYCD~1\CREATECD\CREATECD.EXE -r
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [webHancer Agent] "C:\Program Files\webHancer\Programs\whAgent.exe"
O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - HKLM\..\Run: [3.15] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.30] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [8.34] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.93] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [6.08] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.96] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [1.85] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.65] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.85] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [8.08] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.90] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [5.60] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [9.35] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.97] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [3.90] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [9.09] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.03] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [9.96] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.73] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.48] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.15] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [5.89] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.26] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.21] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [5.73] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [1.95] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [1.66] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.29] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [9.06] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.40] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [4.88] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [7.56] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.53] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE"
O4 - HKCU\..\Run: [MSOEMB] C:\WINDOWS\SYSTEM\MSOEMB.exe
O4 - HKCU\..\RunServices: [PopUpStopperFreeEdition] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE"
O4 - HKCU\..\RunServices: [MSOEMB] C:\WINDOWS\SYSTEM\MSOEMB.exe
O4 - HKCU\..\RunOnce: [MSOEMB] C:\WINDOWS\SYSTEM\MSOEMB.exe
O4 - Startup: CompuServe 2000 Tray Icon.lnk = C:\CompuServe 2000\cstray.exe
O4 - Startup: nnna.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.popuppers.com
O18 - Filter: text/html - {8253D547-38DD-4325-B35A-F1817EDFA5F5} - C:\PROGRAM FILES\SYSTEM FILES\PLUGIN.DLL
Post #2
Hello jj_dynamite, welcome to the forum. Sorry about the delay in responding :( If you still need help, Scan again with HijackThis, and copy/paste" a new log file into this thread.
Post #3
I ran adaware, restarted and then ran hijack this again. I keep getting more and more restore files that adaware cannot remove. Thanks for your help.

Logfile of HijackThis v1.99.1
Scan saved at 9:18:15 PM, on 11/2/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v5.50 (5.50.4134.0100)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SK9910DM.EXE
C:\PROGRAM FILES\HP\HPCORETECH\HPCMPMGR.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP SOFTWARE UPDATE\HPWUSCHD.EXE
C:\WINDOWS\SYSTEM\HPZTSB09.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOTDD01.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\W130713.STUB.EXE
C:\WINDOWS\SYSTEM\APD123.EXE
C:\WINDOWS\SYSTEM\PXVH\UCMKQUBA.EXE
C:\WINDOWS\EXE82.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\LLLPSG.EXE
C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 4\CREATECD\CREATECD.EXE
C:\WINDOWS\SYSTEM\MSOEMB.EXE
C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE
C:\COMPUSERVE 2000\CSTRAY.EXE
C:\PROGRAM FILES\FINEPIXVIEWER\QUICKDCF.EXE
C:\WINDOWS\SYSTEM\MSOEMB.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R3 - URLSearchHook: (no name) - _{02EE5B04-F144-47BB-83FB-A60BD91B74A9} - (no file)
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll (file missing)
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Hot Key Kbd 9910 Daemon] SK9910DM.EXE
O4 - HKLM\..\Run: [HP Component Manager] "C:\PROGRAM FILES\HP\HPCORETECH\HPCMPMGR.EXE"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb09.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\SYSTEM\wintask.exe
O4 - HKLM\..\Run: [testit.exe] C:\WINDOWS\SYSTEM\testit.exe
O4 - HKLM\..\Run: [inwmg] C:\W130713.STUB.EXE
O4 - HKLM\..\Run: [VVHXJJC] C:\WINDOWS\SYSTEM\TVDFOXW\VVHXJJC.EXE
O4 - HKLM\..\Run: [APD123] C:\WINDOWS\SYSTEM\APD123.exe
O4 - HKLM\..\Run: [UCMKQUBA] C:\WINDOWS\SYSTEM\PXVH\UCMKQUBA.EXE
O4 - HKLM\..\Run: [0.10] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.78] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [1.36] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.81] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.46] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.33] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.84] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.88] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.20] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.49] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.54] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.69] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.24] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [3.50] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.16] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [2.32] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.31] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.35] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.22] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.23] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.58] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [2.02] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.89] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.83] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.56] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.14] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [6.29] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.19] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [7.35] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.87] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.44] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.95] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.76] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [9.11] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.25] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.11] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.72] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.68] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.82] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.38] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.59] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.45] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.41] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.61] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.60] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.47] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.77] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.51] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [6.21] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [1.61] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.18] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [5.75] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.43] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.91] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.74] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.80] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.13] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.50] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [4.25] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.66] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.75] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.79] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.63] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.57] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.39] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [8.36] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.55] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [4.12] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.98] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [6.50] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.32] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [3.08] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.28] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.71] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.12] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.92] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.36] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.06] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [MSConfigReminder] C:\WINDOWS\SYSTEM\msconfig.exe /reminder
O4 - HKLM\..\Run: [0.94] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [3.70] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.67] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.64] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.52] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.27] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.37] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [6.34] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.70] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.34] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.99] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.86] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [5.95] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.62] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\lllpsg.exe reg_run
O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - HKLM\..\Run: [3.15] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.30] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [8.34] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.93] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [6.08] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.96] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [1.85] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.65] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.85] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [8.08] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.90] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [5.60] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [9.35] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.97] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [3.90] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [9.09] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.03] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [9.96] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.73] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.48] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.15] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [5.89] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.26] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.21] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [5.73] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [1.95] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [1.66] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.29] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [9.06] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.40] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [4.88] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [7.56] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.53] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.09] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.17] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [6.91] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.42] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [2.73] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.07] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [7.62] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [9.84] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [3.19] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [5.41] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [5.12] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [9.41] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.05] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [6.12] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [8.05] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [1.06] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [7.74] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [2.99] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [3.87] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [9.08] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [8.62] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [9.50] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [4.61] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [6.83] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [4.15] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [7.99] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [1.76] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [1.17] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [6.49] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [5.90] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [5.22] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [6.10] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [7.47] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [9.23] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [9.15] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [3.29] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [1.96] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [3.71] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [3.55] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [6.35] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [1.75] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [2.66] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [5.30] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [3.21] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [4.97] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [8.52] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [5.68] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [7.60] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [1.83] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [2.37] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [1.87] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [6.77] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [6.14] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [7.54] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [6.59] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [5.84] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [8.06] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [9.82] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [1.79] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [9.65] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [2.23] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [5.32] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [4.87] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [7.08] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [3.12] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [9.07] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [2.53] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [1.03] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [4.48] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [1.50] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [5.92] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [5.33] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [5.24] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.01] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [7.29] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [3.44] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [2.06] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [9.34] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [7.83] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [7.25] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [2.36] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [4.11] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [9.47] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [2.71] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [5.45] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [1.04] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [4.41] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [5.29] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [4.24] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [6.40] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [6.11] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [5.36] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [6.24] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [1.34] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [1.05] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.02] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [7.78] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [8.66] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [1.09] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [3.31] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [5.15] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [5.53] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [8.50] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [9.37] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [4.02] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [7.27] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [4.34] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [8.29] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [4.28] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [4.06] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [7.03] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [6.73] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [3.01] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [5.98] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [6.86] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [1.67] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [2.55] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [CreateCD] C:\PROGRA~1\ADAPTEC\EASYCD~1\CREATECD\CREATECD.EXE -r
O4 - HKLM\..\Run: [7.84] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [7.55] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [0.08] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [1.22] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [4.77] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [4.91] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [7.58] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [8.46] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [3.10] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [4.45] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [2.52] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [3.40] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [8.59] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [8.30] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\Run: [3.24] C:\WINDOWS\EXE82.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE"
O4 - HKCU\..\Run: [MSOEMB] C:\WINDOWS\SYSTEM\MSOEMB.exe
O4 - HKCU\..\RunServices: [PopUpStopperFreeEdition] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE"
O4 - HKCU\..\RunServices: [MSOEMB] C:\WINDOWS\SYSTEM\MSOEMB.exe
O4 - HKCU\..\RunOnce: [MSOEMB] C:\WINDOWS\SYSTEM\MSOEMB.exe
O4 - Startup: CompuServe 2000 Tray Icon.lnk = C:\CompuServe 2000\cstray.exe
O4 - Startup: nnna.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.popuppers.com
Post #5
Here is the new log file. I still feel like not everything was taken out by the avg free program that I ran. I didn't see anything in the recycle bin to empty other than three desktop links that were downloaded when I downloaded the avg free program (online dating, free vacations and something else I can't remember).

Thanks again,

J

Logfile of HijackThis v1.99.1
Scan saved at 12:38:46 AM, on 11/3/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v5.50 (5.50.4134.0100)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SK9910DM.EXE
C:\PROGRAM FILES\HP\HPCORETECH\HPCMPMGR.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP SOFTWARE UPDATE\HPWUSCHD.EXE
C:\WINDOWS\SYSTEM\HPZTSB09.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOTDD01.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 4\CREATECD\CREATECD.EXE
C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE
C:\PROGRAM FILES\TCSR\BETT.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\COMPUSERVE 2000\CSTRAY.EXE
C:\PROGRAM FILES\FINEPIXVIEWER\QUICKDCF.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R3 - URLSearchHook: (no name) - {F69FE7B5-6BEF-C13E-0268-57B021081F50} - C:\WINDOWS\Izmxwkww.dll
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll (file missing)
O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\BXXS5.DLL
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Hot Key Kbd 9910 Daemon] SK9910DM.EXE
O4 - HKLM\..\Run: [HP Component Manager] "C:\PROGRAM FILES\HP\HPCORETECH\HPCMPMGR.EXE"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb09.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [testit.exe] C:\WINDOWS\SYSTEM\testit.exe
O4 - HKLM\..\Run: [MSConfigReminder] C:\WINDOWS\SYSTEM\msconfig.exe /reminder
O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - HKLM\..\Run: [bxxs5] RunDLL32.EXE C:\WINDOWS\BXXS5.DLL,DllRun
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [CreateCD] C:\PROGRA~1\ADAPTEC\EASYCD~1\CREATECD\CREATECD.EXE -r
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE"
O4 - HKCU\..\Run: [Noha] "C:\Program Files\tcsr\bett.exe" -vt yazr
O4 - Startup: CompuServe 2000 Tray Icon.lnk = C:\CompuServe 2000\cstray.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.popuppers.com
Post #6
I suggest you do this:

Download this file from the link to your desktop.
http://www.mvps.org/winhelp2002/DelDomains.inf

Right-click on the deldomains.inf file and select 'Install'

Once it is finished your Zones should be reset.

Note, if you use SpywareBlaster and/or IE/Spyads, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the program and re-protect all items. For IE/Spyads, run the batch file and reinstall the protection


Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com

R3 - URLSearchHook: (no name) - {F69FE7B5-6BEF-C13E-0268-57B021081F50} - C:\WINDOWS\Izmxwkww.dll

O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll (file missing)

O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\BXXS5.DLL

O4 - HKLM\..\Run: [testit.exe] C:\WINDOWS\SYSTEM\testit.exe

O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"

O4 - HKLM\..\Run: [bxxs5] RunDLL32.EXE C:\WINDOWS\BXXS5.DLL,DllRun

O4 - HKCU\..\Run: [Noha] "C:\Program Files\tcsr\bett.exe" -vt yazr

O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O15 - Trusted Zone: *.media-motor.net

O15 - Trusted Zone: *.popuppers.com

Close ALL windows and browsers except HijackThis and click "Fix checked"


Use Add/Remove Programs and remove: If listed
ISTbar
XXXToolbar
webHancer


Restart in Safe Mode:
Restart your computer.

Press the F8 key until the startup menu appears.

Choose the Safe Mode option then press Enter.


Delete these folders if listed.
C:\Program Files\webHancer
C:\Program Files\tcsr


delete these files if listed:
C:\WINDOWS\BXXS5.DLL
C:\WINDOWS\SYSTEM\testit.exe

To configure Windows to show all files

Do the following:
In Windows, on the Windows desktop, double-click the My Computer icon.

On the Tools menu, click Folder Options.
On the View tab, uncheck Hide file extensions for known file types.

Uncheck Hide protected operating system files. Then, under the "Hidden files" folder, click Show hidden files and folders.
If you see a warning message, click Yes.
Click Apply.
Click OK.




Do this also if these Temp Folders are part of your OS.

Also in safe mode navigate to the C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.


Next navigate to the C:\Documents and Settings\(EVERY LISTED USER)\Local Settings\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

Finally go to Control Panel > Internet Options. On the General tab under "Temporary Internet Files" Click "Delete Files". Put a check by "Delete Offline Content" and click OK. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK.


Empty the Recycle Bin

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #7
I tried to do everything that you listed. these weren't listed in my hijack this when I went to fix them: 015 - Trusted Zone: *.media-motor.net 015 - Trusted Zone: *.popuppers.com Add/Remove didn't show: ISTbar XXXToolbar webHancer Couldn't find C:\Program Files\webHancer C:\Program Files\tcsr C:\Windows\BXXS5.DLL (I did find BSX32 but, did not delete it) Couldn't find C:\Documents and Settings I did everything else. When I started up, everything seemed normal again. I didn't get any error reports when window was starting up. I hope it worked. If you think I need to do anything else, please let me know. I will let you know if I start seeing anything happening again. Thanks, J Logfile of HijackThis v1.99.1 Scan saved at 8:50:51 AM, on 11/5/2005 Platform: Windows ME (Win9x 4.90.3000) MSIE: Internet Explorer v5.50 (5.50.4134.0100) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\SSDPSRV.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SK9910DM.EXE C:\PROGRAM FILES\HP\HPCORETECH\HPCMPMGR.EXE C:\PROGRAM FILES\HEWLETT-PACKARD\HP SOFTWARE UPDATE\HPWUSCHD.EXE C:\WINDOWS\SYSTEM\HPZTSB09.EXE C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOTDD01.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 4\CREATECD\CREATECD.EXE C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\COMPUSERVE 2000\CSTRAY.EXE C:\PROGRAM FILES\FINEPIXVIEWER\QUICKDCF.EXE C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [Hot Key Kbd 9910 Daemon] SK9910DM.EXE O4 - HKLM\..\Run: [HP Component Manager] "C:\PROGRAM FILES\HP\HPCORETECH\HPCMPMGR.EXE" O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb09.exe O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [MSConfigReminder] C:\WINDOWS\SYSTEM\msconfig.exe /reminder O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE O4 - HKLM\..\Run: [CreateCD] C:\PROGRA~1\ADAPTEC\EASYCD~1\CREATECD\CREATECD.EXE -r O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE" O4 - Startup: CompuServe 2000 Tray Icon.lnk = C:\CompuServe 2000\cstray.exe O4 - Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
Post #8

C:\Windows\BXXS5.DLL (I did find BSX32 but, did not delete it)


Open C:\Windows\ BSX32 <–Delete file

I see you disabled some startup entries via msconfig. Let's take a look if there are still programs/files present that needs to go.

Open Notepad, (Start button, click on Run, type in Notepad, and click OK) copy & pastes the following block of text into Notepad:

regedit /e startup.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg"
start notepad startup.txt

Click on 'File', then 'Save as'
Select 'Save as type:' as All Files,
Save the file to the desktop as look.bat. Close Notepad.

Double click on look.bat and a notepad file should open. Copy the contents of that file to your next post.
=====
Post #9
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI