Spyware / Malware / Virus Removal

WinAntiVirus (vtstu.dll)

18 min read

Looking for the outcome? Ask AI

LumberJack - The Essence of Man Topic Starter

Post #1July 23, 2006, 9:02 PM UTC

I'm infected with the WinAntiVirus version of that notorius Winfixer trojan and as I'm sure you're aware attempted detection or removal by Adaware, Spybot, Spyware Doctor, and Kaspersky 2006 all fail. I even tried disabling the vtstu.dll from autorun registry entries with "AutoRuns", but when it disables it, I exit and reopen to confirm it has been disabled only to find the entry has regenerated itself. Anyway, could someone please direct me to an appropriate fix, or inform me what action to take if a fix for my specific problem is not already posted. Here is my Hi-Jack This logfile:

Logfile of HijackThis v1.99.1
Scan saved at 4:05:19 PM, on 23/07/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Applications\UofT Software\Altera\Quartus41\bin\JTAGServer.exe
C:\Applications\Norton AntiVirus 2005\navapsvc.exe
C:\Applications\Norton Internet Security\NISUM.EXE
C:\Applications\Spyware Doctor - PC Tools\sdhelp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Applications\Norton Internet Security\SymProxySvc.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Applications\Norton Internet Security\NISSERV.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\Applications\Norton Internet Security\IAMAPP.EXE
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\Applications\SpyBot - Search & Destroy\TeaTimer.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\APPLIC~1\FIREFOX\FIREFOX.EXE
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Applications\Hi-Jack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ca.red.clientapps.yahoo.com/customi…/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ca.red.clientapps.yahoo.com/customi…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Applications\Norton AntiVirus 2005\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll
O4 - HKLM\..\Run: [iamapp] C:\Applications\Norton Internet Security\IAMAPP.EXE
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Applications\SpyBot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Applications\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\APPLIC~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: Rogers Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab28578.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab30149.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…StatsClient.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://antu.popcap.com/games/popcaploader_v5.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Applications\AutoCAD 2000i\AcPreview.ocx
O16 - DPF: {FE5D6722-826F-11D5-A24E-0060B0F1A5AE} (Tukati Launcher) - http://3dgamers.tukati.com/tukati/1.7.20.20/tukati.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: ,,
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Applications\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Altera JTAG Server (JTAGServer) - Unknown owner - C:\Applications\UofT Software\Altera\Quartus41\bin\JTAGServer.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Applications\Norton AntiVirus 2005\navapsvc.exe
O23 - Service: Norton Internet Security Service (NISSERV) - Symantec Corporation - C:\Applications\Norton Internet Security\NISSERV.EXE
O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Applications\Norton Internet Security\NISUM.EXE
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Applications\Norton AntiVirus 2005\IWP\NPFMntor.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\Pacsptisvr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Applications\Norton AntiVirus 2005\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Applications\Spyware Doctor - PC Tools\sdhelp.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Symantec Corporation - C:\Applications\Norton Internet Security\SymProxySvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Any help would be appreciated, thanks for your time.

agrarianmonk

Post #2July 24, 2006, 12:32 AM UTC

Welcome !! Please take note of the following while we are working together:

Your fix may take a couple posts so please be patient even if you don't see immediate results.
I will working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear.
If you don't know or understand something, please don't hesitate to say or ask!! It's definitely better to be sure and safe than sorry.

***************************************

Please download VundoFix.exe to your desktop.* Double-click VundoFix.exe to run it.
* Put a check next to Run VundoFix as a task.
* You will receive a message saying vundofix will close and re-open in a minute or less. Click OK
* When VundoFix re-opens,Click Scan for Vundo button.
* Once the scan is complete, Right Click inside the listbox (white box) and click add more files
* Copy&Paste the 2 entries below into the top 2 boxes

o C:\WINDOWS\system32\vtstu.dll
o C:\WINDOWS\system32\utstv.*

* Click Add Files and Click Close Window
* Click the Remove Vundo button.
* You will receive a prompt asking if you want to remove the files, click YES
* Once you click yes, your desktop will go blank as it starts removing Vundo.
* When completed, it will prompt that it will shutdown your computer, click OK.
* Turn your computer back on.
* Please post the contents of C:\vundofix.txt and a new HiJackThis log.
Note: If Vundofix never re-opens, please try running vundofix again, but without the check next to "Run VundoFix as a task."

LumberJack - The Essence of Man

Post #3July 24, 2006, 4:28 PM UTC

Thanks for your help so far, and for your quick response. I ran the Vundofix and judging by its log file things look good so far. Here is a copy of the log file.
_____________________________________________________________________________

VundoFix V5.1.5

Running as SYSTEM
from c:\windows\system32\VundoFix.exe

Checking Java version…

Scan started at 12:07:17 PM 7/24/2006

Listing files found while scanning….

C:\windows\system32\vtstu.dll
C:\windows\system32\utstv.ini
C:\windows\system32\utstv.bak1
C:\windows\system32\utstv.bak2
C:\windows\system32\utstv.ini2
C:\windows\system32\utstv.tmp
C:\WINDOWS\system32\Drivers\DP.sys

Beginning removal…

The process smss.exe was successfully stopped

The process winlogon.exe was successfully stopped

The process explorer.exe was successfully stopped

The process iexplore.exe was successfully stopped

The process rundll32.exe was successfully stopped

Attempting to delete C:\windows\system32\vtstu.dll
C:\windows\system32\vtstu.dll Has been deleted!

Attempting to delete C:\windows\system32\utstv.ini
C:\windows\system32\utstv.ini Has been deleted!

Attempting to delete C:\windows\system32\utstv.bak1
C:\windows\system32\utstv.bak1 Has been deleted!

Attempting to delete C:\windows\system32\utstv.bak2
C:\windows\system32\utstv.bak2 Has been deleted!

Attempting to delete C:\windows\system32\utstv.ini2
C:\windows\system32\utstv.ini2 Has been deleted!

Attempting to delete C:\windows\system32\utstv.tmp
C:\windows\system32\utstv.tmp Has been deleted!

Attempting to delete C:\WINDOWS\system32\Drivers\DP.sys
C:\WINDOWS\system32\Drivers\DP.sys Has been deleted!

Performing Repairs to the registry.
Done!

______________________________________________________________________________

And now here is the new Hi-Jack This! log file.
______________________________________________________________________________

Logfile of HijackThis v1.99.1
Scan saved at 12:21:39 PM, on 24/07/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Applications\Norton Internet Security\IAMAPP.EXE
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\Applications\SpyBot - Search & Destroy\TeaTimer.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Applications\UofT Software\Altera\Quartus41\bin\JTAGServer.exe
C:\Applications\Norton AntiVirus 2005\navapsvc.exe
C:\Applications\Norton Internet Security\NISUM.EXE
C:\Applications\Spyware Doctor - PC Tools\sdhelp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Applications\Norton Internet Security\SymProxySvc.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Applications\Norton Internet Security\NISSERV.EXE
C:\Applications\Firefox\firefox.exe
C:\Applications\Hi-Jack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ca.red.clientapps.yahoo.com/customi…/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ca.red.clientapps.yahoo.com/customi…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2FF5573C-0EB5-43db-A1B2-C4326813468E} - (no file)
O2 - BHO: (no name) - {3D117109-0505-4A69-9E90-ECD6583F14F1} - C:\WINDOWS\System32\vtstu.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\APPLIC~1\SPYBOT~1\SDHelper.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\APPLIC~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: (no name) - {98DBBF16-CA43-4c33-BE80-99E6694468A4} - (no file)
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\APPLIC~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Applications\Norton AntiVirus 2005\NavShExt.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Applications\Norton AntiVirus 2005\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll
O4 - HKLM\..\Run: [iamapp] C:\Applications\Norton Internet Security\IAMAPP.EXE
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Applications\SpyBot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Applications\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\APPLIC~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: Rogers Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab28578.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab30149.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…StatsClient.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://antu.popcap.com/games/popcaploader_v5.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Applications\AutoCAD 2000i\AcPreview.ocx
O16 - DPF: {FE5D6722-826F-11D5-A24E-0060B0F1A5AE} (Tukati Launcher) - http://3dgamers.tukati.com/tukati/1.7.20.20/tukati.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: ,,
O20 - Winlogon Notify: AutorunsDisabled - C:\WINDOWS\
O20 - Winlogon Notify: vtstu - C:\WINDOWS\
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Applications\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Altera JTAG Server (JTAGServer) - Unknown owner - C:\Applications\UofT Software\Altera\Quartus41\bin\JTAGServer.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Applications\Norton AntiVirus 2005\navapsvc.exe
O23 - Service: Norton Internet Security Service (NISSERV) - Symantec Corporation - C:\Applications\Norton Internet Security\NISSERV.EXE
O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Applications\Norton Internet Security\NISUM.EXE
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Applications\Norton AntiVirus 2005\IWP\NPFMntor.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\Pacsptisvr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Applications\Norton AntiVirus 2005\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Applications\Spyware Doctor - PC Tools\sdhelp.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Symantec Corporation - C:\Applications\Norton Internet Security\SymProxySvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

______________________________________________________________________________

Thanks again for all your help so far. Hope to hear from you soon.

agrarianmonk

Post #4July 24, 2006, 4:38 PM UTC

Some security programs with active monitoring processes are known to interfere with automatic scanners and can actually prevent HJT fixes from taking effect.

Please turn off or disable any of the following programs you may have,

Spybot S&D (Teatimer)

1. Run Spybot-S&D in Advanced Mode.
2. If it is not already set to do this Go to the Mode menu select "Advanced Mode"
3. On the left hand side, Click on Tools
4. Then click on the Resident Icon in the List
5. Uncheck "Resident TeaTimer" and OK any prompts.
6. Restart your computer.

After reboot,

Please re-open HiJackThis and select Scan. Check the boxes next to all the entries listed below (if present).

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ca.red.clientapps.yahoo.com/customi…/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ca.red.clientapps.yahoo.com/customi…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: (no name) - {2FF5573C-0EB5-43db-A1B2-C4326813468E} - (no file)
O2 - BHO: (no name) - {3D117109-0505-4A69-9E90-ECD6583F14F1} - C:\WINDOWS\System32\vtstu.dll (file missing)
O2 - BHO: (no name) - {98DBBF16-CA43-4c33-BE80-99E6694468A4} - (no file)
O20 - AppInit_DLLs: ,,
O20 - Winlogon Notify: AutorunsDisabled - C:\WINDOWS\
O20 - Winlogon Notify: vtstu - C:\WINDOWS\

Now close all windows other than HiJackThis, then click Fix Checked. close HijackThis.

reboot, and post a new hijackthis log.

also let me know how your computer is running and if problems persist.

LumberJack - The Essence of Man

Post #5July 24, 2006, 6:18 PM UTC

Hello again, I did as instructed but when I told Hi-Jack This! to fix the selected checks this error message came up.

______________________________________________________________________________

An unexpected error has occurred at procedure: modBackup_MakeBackup(sItem=O20 - AppInit_DLLs: ,,)
Error #5 - Invalid procedure call or argument

Please email me at [removed], reporting the following:
* What you were trying to fix when the error occurred, if applicable
* How you can reproduce the error
* A complete HijackThis scan log, if possible

Windows version: Windows NT 5.01.2600
MSIE version: 6.0.2800.1106
HijackThis version: 1.99.1

This message has been copied to your clipboard.
Click OK to continue the rest of the scan.
_______________________________________________________________________________

I had it proceede with what it could anyway and rebooted. Here is a copy of the Hi-Jack This! log I got after the reboot.
_______________________________________________________________________________

Logfile of HijackThis v1.99.1
Scan saved at 2:03:12 PM, on 24/07/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Applications\Norton Internet Security\IAMAPP.EXE
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Applications\UofT Software\Altera\Quartus41\bin\JTAGServer.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Applications\Norton Internet Security\NISUM.EXE
C:\WINDOWS\System32\ezSP_Px.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\Applications\Spyware Doctor - PC Tools\sdhelp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Applications\Norton Internet Security\SymProxySvc.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Applications\Norton Internet Security\NISSERV.EXE
C:\Applications\Norton AntiVirus 2005\navapsvc.exe
C:\Applications\Firefox\firefox.exe
C:\Applications\Hi-Jack This\HijackThis.exe

O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\APPLIC~1\SPYBOT~1\SDHelper.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\APPLIC~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\APPLIC~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Applications\Norton AntiVirus 2005\NavShExt.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Applications\Norton AntiVirus 2005\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll
O4 - HKLM\..\Run: [iamapp] C:\Applications\Norton Internet Security\IAMAPP.EXE
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Applications\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\APPLIC~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: Rogers Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab28578.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab30149.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…StatsClient.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://antu.popcap.com/games/popcaploader_v5.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Applications\AutoCAD 2000i\AcPreview.ocx
O16 - DPF: {FE5D6722-826F-11D5-A24E-0060B0F1A5AE} (Tukati Launcher) - http://3dgamers.tukati.com/tukati/1.7.20.20/tukati.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Applications\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Altera JTAG Server (JTAGServer) - Unknown owner - C:\Applications\UofT Software\Altera\Quartus41\bin\JTAGServer.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Applications\Norton AntiVirus 2005\navapsvc.exe
O23 - Service: Norton Internet Security Service (NISSERV) - Symantec Corporation - C:\Applications\Norton Internet Security\NISSERV.EXE
O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Applications\Norton Internet Security\NISUM.EXE
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Applications\Norton AntiVirus 2005\IWP\NPFMntor.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\Pacsptisvr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Applications\Norton AntiVirus 2005\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Applications\Spyware Doctor - PC Tools\sdhelp.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Symantec Corporation - C:\Applications\Norton Internet Security\SymProxySvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
____________________________________________________________________________

On a side note my computer seems to be running alright, except for one thing (I'm not sure if it's related) that had been occuring before I contacted you, and just after I had installed Kaspersky and done some fixes with it and Spyware Doctor. The problem is that whenever I try to open a microsoft program that tries to access a webpage (I think that's the symptom), such as MSN messenger when it tries to open MSN Today, or when I start Windows Media Player, the program will instantly kill itself (suprisingly fast) and there's no way for me to open the program (I fixed the messenger problem by disabling the show MSN Today on startup option, and now MSN works, Windows Media Player however opens and closes way too fast for me to change settings). Any idea if this is a related problem or how to fix it? Once again thanks for all your help.

agrarianmonk

Post #6July 24, 2006, 9:42 PM UTC

I'm not seeing anything in your log that should create that problem, but lets run a scan to make sure there's nothing left on your system:

Please do an online scan with Kaspersky WebScanner

Note: This Scanner is for Internet Explorer Only!

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:
- Scan using the following Anti-Virus database:
Extended (if available otherwise Standard)
- Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan:Select My Computer
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
- Now click on the Save as Text button:
Save the file to your desktop.
Copy and paste that information in your next post.

LumberJack - The Essence of Man

Post #7July 26, 2006, 5:50 AM UTC

I tried to open Internet Explorer to do the scan you suggested, and just the same as when other microsoft programs try to access the internet (I'm guessing though IE, which would be the key ellement in common to these situations) it instantly closes down and disappears. I'm wondering if something key to internet explorer was deleted in the registry, or if something else instantly shuts down any program which tries to access the internet through Internet Explorer? In the meantime, seeing as I have an active trial licence of Kaspersky 2006, I will scan my computer again with it, after updating the deffinitions of course. If it is then possible I will see about posting a log of its scan for you to see. Once again I imensely appreciate all your help.

agrarianmonk

Post #8July 26, 2006, 5:54 AM UTC

hmm…how about a reinstall of Internet Explorer?

Please go to:
start–>run

and type this in:
regedit

Then click on the FILE menu and select export
Save the file as backup. Save the file somewhere you will remember and not delete.
IMPORTANT: make sure to set the export range to ALL

Then, go to start–>run

and type this in:
notepad

Paste this into the box:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\
{89820200-ECBD-11cf-8B85-00AA005B4383}]
"IsInstalled"=dword:00000000

Then click on the FILE menu and select save as
Save the file as regfix.reg. Save the file to the desktop.
IMPORTANT: make sure to save the file as "all types" and NOT as a text file

Now double click on fixreg.reg and insert it into the registry.

Then, go here, and reinstall Internet Explorer:
Internet Explorer Update

and then let me know if you have problems with IE.

LumberJack - The Essence of Man

Post #9July 26, 2006, 3:32 PM UTC

Here are the results of the Kaspersky scan I conducted (as expected, fixing the infections Kaspersky detected had no effect on the IE problem). Now I will attempt your suggested fix for Internet Explorer and get back to you with the results of that when it is completed. Many thanks. Scan My Computer —————- Scanned: 615616 Detected: 19 Untreated: 0 Start time: 26/07/2006 1:51:37 AM Duration: 09:26:22 Finish time: 26/07/2006 11:17:59 AM Detected ——– Status Object —— —— deleted: Trojan program Trojan-Spy.HTML.Paylap.m Mail body: C:\Documents and Settings\David\Application Data\Qualcomm\Eudora\In.mbx.002/[From ella <[removed]>][Date Fri, 20 Aug 2004 09:57:42 -0400]/UNNAMED/[From F!rosh Week 0T4 <[removed]>][Date Tue, 1 Jun 2004 22:35:51 -0400]/text/[From "Marinela Lucic" <[removed]>][Date Sun, 30 May 2004 19:33:54 -0400]/html/[From "Awesome Laptop" <[removed]>][Date Sat, 16 Jul 2005 07:46:45 -0800]/html/[From Brittany <[removed]>][Date Sun, 17 Jul 2005 05:22:50 -0800]/UNNAMED deleted: Trojan program Trojan-Spy.HTML.Fraud.gen (modification) Mail body: C:\Documents and Settings\David\Application Data\Qualcomm\Eudora\Trash.mbx/[From "Free Product Heavan" <[removed]>][Date Mon, 05 Sep 2005 11:02:33 -0800]/html/[From "Brett Winter" <[removed]>][Date Mon, 5 Sep 2005 14:01:10 -0300]/text/[From "Julian Givens" <[removed]>][Date Mon, 05 Sep 2005 10:34:12 -0600]/text/[From "PizzaPizza Gift4You" <[removed]>][Date Mon, 05 Sep 2005 01:13:25 -0800]/html/[From "Spa_Dreams" <[removed]>][Date Mon, 05 Sep 2005 00:24:30 -0800]/text/[From "Consumer Starbucks Promotions" <[removed]>][Date Sun, 04 Sep 2005 23:53:32 -0800]/html/[From "Irma Cote" <[removed]>][Date Mon, 05 Sep 2005 07:49:09 +0000]/text/[From "Ernestine Woodson" <[removed]>][Date Sun, 04 Sep 2005 23:37:54 -0800]/UNNAMED/[From "Kermit Darnell" <[removed]>][Date Sun, 04 Sep 2005 23:37:27 -0700]/text/[From "Tracey Conn" <[removed]>][Date Tue, 06 Sep 2005 17:24:01 +0400]/UNNAMED deleted: Trojan program Trojan.Win32.Agent.ny File: C:\VundoFix Backups\DP.sys deleted: Trojan program Trojan.Win32.Agent.ny File: C:\WINDOWS\system32\adhlkkvs.exe/PE_Patch/UPack deleted: Trojan program Trojan.Win32.Agent.ny File: C:\WINDOWS\system32\alfnfqdh.exe/PE_Patch/UPack deleted: Trojan program Trojan.Win32.Agent.ny File: C:\WINDOWS\system32\axadigfg.exe/PE_Patch/UPack deleted: Trojan program Trojan.Win32.Agent.ny File: C:\WINDOWS\system32\eejbxjop.exe/PE_Patch/UPack deleted: Trojan program Trojan.Win32.Agent.ny File: C:\WINDOWS\system32\igoglygt.exe/PE_Patch/UPack deleted: Trojan program Trojan.Win32.Agent.ny File: C:\WINDOWS\system32\ijdnpuxy.exe/PE_Patch/UPack deleted: Trojan program Trojan.Win32.Agent.ny File: C:\WINDOWS\system32\ixxijhwr.exe/PE_Patch/UPack deleted: Trojan program Trojan.Win32.Agent.ny File: C:\WINDOWS\system32\kvuqosee.exe/PE_Patch/UPack deleted: Trojan program Trojan.Win32.Agent.ny File: C:\WINDOWS\system32\mtbetnhb.exe/PE_Patch/UPack deleted: Trojan program Trojan.Win32.Agent.ny File: C:\WINDOWS\system32\qgyriuft.exe/PE_Patch/UPack deleted: Trojan program Trojan.Win32.Agent.ny File: C:\WINDOWS\system32\qhlvaukq.exe/PE_Patch/UPack deleted: Trojan program Trojan.Win32.Agent.ny File: C:\WINDOWS\system32\rkqxcshr.exe/PE_Patch/UPack deleted: Trojan program Trojan.Win32.Agent.ny File: C:\WINDOWS\system32\sfhxygui.exe/PE_Patch/UPack deleted: Trojan program Trojan.Win32.Agent.ny File: C:\WINDOWS\system32\vlttervd.exe/PE_Patch/UPack deleted: Trojan program Trojan.Win32.Agent.ny File: C:\WINDOWS\system32\ygyeiuxf.exe/PE_Patch/UPack deleted: Trojan program Trojan.Win32.Agent.ny File: C:\WINDOWS\system32\ymwkyjoc.exe/PE_Patch/UPack Events —— Time Name Status Reason —- —- —— —— Statistics ———- Object Scanned Detected Untreated Deleted Moved to Quarantine Archived Compressed Password protected Corrupted —— ——- ——– ——— ——- ——————- ——– ———- —————— ——— Total 615616 19 19 0 0 9805 471 135 25 System Memory 2129 0 0 0 0 1 2 0 0 Startup Objects 1218 0 0 0 0 2 7 0 0 System Restore 2 0 0 0 0 0 0 0 0 Mailboxes 280 0 0 0 0 148 4 0 0 All Hard Drives 611987 19 19 0 0 9654 458 135 25 Settings ——– Name Value —- —– Security Level High Action Prompt for action when the scan is complete File types All Scan new and changed files only No Scan archives All Scan embedded OLE objects All Skip if object is greater than No Skip if scan takes longer than No Parse e-mail formats Yes Scan password-protected archives No Enable iChecker technology Yes Enable iSwift technology Yes Show detected threats on "Detected" tab Yes

agrarianmonk

Post #10July 26, 2006, 8:47 PM UTC

alright, let me know how it goes in your next post

LumberJack - The Essence of Man

Post #11July 27, 2006, 5:44 AM UTC

I edited the registry as you instructed and then did the IE 6 SP1 intall and attempted to use IE to access the internet. Just as before, it's not when it opens or runs, but when it tries to access the internet and gets a response that it instantly terminates. I tries restarting the computer to be sure that wasn't an essential part of the reinstall process, but even after a reboot the situation remains the same. There has to be some program blocking it? or could it still be something missing from the registry? I don't get it…….. what is peculiar is that it seems the "WinAntiVirus" virus could use IE (its popup was an IE window), however, while I was still infected with the virus, and the virus was still clearly able to use IE, I had already noticed that any application I tried to use which required IE wasn't working. As always thanks for all you've done and your continuing help.

agrarianmonk

Post #12July 27, 2006, 5:51 AM UTC last edited July 27, 2006, 5:54 AM UTC

actually, hold off on the antivirus scan.

do this instead:

Please download WinPFind2.

Extract the files to a folder(eg: C:\WinPFind2).
Double click WinPFind2.exe to start the program.
Click the Select All button in the File Options box of the Configuration tab(this is the tab the program opens up to by default).
Click the Run all Scans button.
When its finished scanning you will see Scans Complete! at the bottom left of the program.
Click the Export to Text button.
Notepad will open with the results of the scan and the log will be saved to the folder that you extracted the program to(C:\WinPFind2\WinPFind2.txt)
Post the log in your next reply please. You may need to split the log over a couple posts so that it doesn't get cut off. If so please use the [Start Post #1] and [Start Post #2] deliminators in the log to split the log up.

LumberJack - The Essence of Man

Post #13July 28, 2006, 5:06 AM UTC

Here are the results of the scan. Thanks for all the effort, hopefully this one gives us a lead.
___________________________________________________________________________

Logfile created on: 07/28/2006 00:53
WinPFind2 by OldTimer - Version 1.0.0 Folder = C:\Applications\WinPFind2\
Microsoft Windows XP (Version = Service Pack 1)
Internet Explorer (Version - 6.0.2800.1106)

[Start Post #1]

Processes
Image Name—————ProcessID–Thread Count–Parent ID–Base Priority–Full Path (Version Info)
aluschedulersvc.exe——001280—–0004———-000984—–Normal———c:\program files\symantec\liveupdate\aluschedulersvc.exe (Symantec Corporation [Ver = 3.0.0.160 | Size = 100032 bytes | Date = 02/23/2006 11:41 | Attr = ])
asusprob.exe————-001316—–0002———-000616—–Normal———c:\program files\asus\probe\asusprob.exe ( [Ver = | Size = 617984 bytes | Date = 12/17/2001 22:22 | Attr = ])
ati2evxx.exe————-001168—–0004———-000984—–Normal———c:\windows\system32\ati2evxx.exe (ATI Technologies Inc. [Ver = 6.14.10.4124 | Size = 393216 bytes | Date = 12/11/2005 23:33 | Attr = ])
ati2evxx.exe————-001672—–0004———-000940—–Normal———c:\windows\system32\ati2evxx.exe (ATI Technologies Inc. [Ver = 6.14.10.4124 | Size = 393216 bytes | Date = 12/11/2005 23:33 | Attr = ])
ccapp.exe—————-000172—–0033———-000616—–Normal———c:\program files\common files\symantec shared\ccapp.exe (Symantec Corporation [Ver = 103.0.7.2 | Size = 59040 bytes | Date = 02/17/2006 11:05 | Attr = ])
ccevtmgr.exe————-001888—–0015———-000984—–Normal———c:\program files\common files\symantec shared\ccevtmgr.exe (Symantec Corporation [Ver = 103.0.7.2 | Size = 198304 bytes | Date = 02/17/2006 11:05 | Attr = ])
ccsetmgr.exe————-001828—–0009———-000984—–Normal———c:\program files\common files\symantec shared\ccsetmgr.exe (Symantec Corporation [Ver = 103.0.7.2 | Size = 181920 bytes | Date = 02/17/2006 11:05 | Attr = ])
csrss.exe—————-000868—–0010———-000800—–Normal———\??\c:\windows\system32\csrss.exe (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 4096 bytes | Date = 08/23/2001 08:00 | Attr = ])
ctsvccda.exe————-001308—–0002———-000984—–Normal———c:\windows\system32\ctsvccda.exe (Creative Technology Ltd [Ver = 1.0.1.0 | Size = 44032 bytes | Date = 12/13/1999 02:01 | Attr = ])
explorer.exe————-000616—–0014———-000580—–Normal———c:\windows\explorer.exe (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 1004032 bytes | Date = 08/28/2002 23:41 | Attr = ])
ezsp_px.exe————–001072—–0001———-000616—–Normal———c:\windows\system32\ezsp_px.exe (Easy Systems Japan Ltd. [Ver = 1, 0, 0, 0 | Size = 40960 bytes | Date = 08/20/2002 11:29 | Attr = ])
firefox.exe————–003192—–0011———-000616—–Normal———c:\applications\firefox\firefox.exe (Mozilla [Ver = 1.0.6 | Size = 6636644 bytes | Date = 07/16/2005 05:41 | Attr = ])
hpotdd01.exe————-002128—–0003———-000616—–Normal———c:\program files\hewlett-packard\digital imaging\bin\hpotdd01.exe (Hewlett-Packard [Ver = 1, 0, 0, 1 | Size = 28672 bytes | Date = 04/06/2003 02:06 | Attr = ])
iamapp.exe—————000348—–0005———-000616—–Normal———c:\applications\norton internet security\iamapp.exe (Symantec Corporation [Ver = 4.0.3.104 | Size = 378536 bytes | Date = 02/18/2002 14:03 | Attr = ])
jtagserver.exe———–001348—–0003———-000984—–Normal———c:\applications\uoft software\altera\quartus41\bin\jtagserver.exe ( [Ver = | Size = 143360 bytes | Date = 06/24/2004 00:40 | Attr = ])
lsass.exe—————-000996—–0019———-000940—–Normal———c:\windows\system32\lsass.exe (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 11776 bytes | Date = 08/28/2002 23:41 | Attr = ])
navapsvc.exe————-001436—–0011———-000984—–Normal———c:\applications\norton antivirus 2005\navapsvc.exe (Symantec Corporation [Ver = 11.0.16.2 | Size = 177264 bytes | Date = 10/19/2005 13:54 | Attr = ])
nisserv.exe————–000124—–0010———-000984—–Normal———c:\applications\norton internet security\nisserv.exe (Symantec Corporation [Ver = 4.0.3.104 | Size = 63144 bytes | Date = 02/18/2002 14:03 | Attr = ])
nisum.exe—————-001580—–0005———-000984—–Normal———c:\applications\norton internet security\nisum.exe (Symantec Corporation [Ver = 4.0.3.104 | Size = 87720 bytes | Date = 02/18/2002 14:03 | Attr = ])
point32.exe————–000652—–0004———-000616—–Normal———c:\program files\microsoft intellipoint\point32.exe (Microsoft Corporation [Ver = 5.00.174.0 | Size = 163840 bytes | Date = 05/15/2003 19:41 | Attr = ])
rapimgr.exe————–002220—–0007———-001200—–Normal———c:\progra~1\micros~4\rapimgr.exe (Microsoft Corporation [Ver = 4.1.4841.0 | Size = 180224 bytes | Date = 11/15/2005 19:42 | Attr = ])
sdhelp.exe—————000352—–0006———-000984—–Normal———c:\applications\spyware doctor - pc tools\sdhelp.exe (PC Tools Research Pty Ltd [Ver = 3.6.0.2024 | Size = 894120 bytes | Date = 07/21/2006 19:02 | Attr = ])
services.exe————-000984—–0019———-000940—–Normal———c:\windows\system32\services.exe (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 101376 bytes | Date = 08/23/2001 08:00 | Attr = ])
smss.exe—————–000800—–0003———-000004—–Normal———\systemroot\system32\smss.exe (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 45568 bytes | Date = 08/28/2002 23:41 | Attr = ])
spbbcsvc.exe————-001848—–0008———-000984—–Normal———c:\program files\common files\symantec shared\spbbc\spbbcsvc.exe (Symantec Corporation [Ver = 1,0,1,47 | Size = 173160 bytes | Date = 07/21/2004 12:24 | Attr = ])
spoolsv.exe————–002008—–0010———-000984—–Normal———c:\windows\system32\spoolsv.exe (Microsoft Corporation [Ver = 5.1.2600.0 (XPClient.010817-1148) | Size = 51200 bytes | Date = 08/23/2001 08:00 | Attr = ])
svchost.exe————–000520—–0007———-000984—–Normal———c:\windows\system32\svchost.exe (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
svchost.exe————–001200—–0009———-000984—–Normal———c:\windows\system32\svchost.exe (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
svchost.exe————–001584—–0016———-000984—–Normal———c:\windows\system32\svchost.exe (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
svchost.exe————–001384—–0071———-000984—–Normal———c:\windows\system32\svchost.exe (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
svchost.exe————–001512—–0005———-000984—–Normal———c:\windows\system32\svchost.exe (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
symlcsvc.exe————-000536—–0005———-000984—–Normal———c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe (Symantec Corporation [Ver = 1, 8, 54, 534 | Size = 822424 bytes | Date = 06/14/2005 17:29 | Attr = ])
symproxysvc.exe———-000636—–0015———-000984—–Normal———c:\applications\norton internet security\symproxysvc.exe (Symantec Corporation [Ver = 4.0.3.104 | Size = 54952 bytes | Date = 02/18/2002 14:02 | Attr = ])
teatimer.exe————-001600—–0003———-000616—–Idle———–c:\applications\spybot - search & destroy\teatimer.exe (Safer Networking Limited [Ver = 1, 3, 0, 12 | Size = 1038336 bytes | Date = 05/12/2004 01:03 | Attr = ])
type32.exe—————000228—–0003———-000616—–Normal———c:\program files\microsoft intellitype pro\type32.exe (Microsoft Corporation [Ver = 5.00.174.0 | Size = 114688 bytes | Date = 05/15/2003 19:45 | Attr = ])
wcescomm.exe————-001488—–0005———-000616—–Normal———c:\program files\microsoft activesync\wcescomm.exe (Microsoft Corporation [Ver = 4.1.4841.0 | Size = 1200128 bytes | Date = 11/15/2005 19:44 | Attr = ])
wdfmgr.exe—————000676—–0004———-000984—–Normal———c:\windows\system32\wdfmgr.exe (Microsoft Corporation [Ver = 5.2.3790.1230 built by: DNSRV(bld4act) | Size = 38912 bytes | Date = 09/22/2004 18:46 | Attr = ])
winlogon.exe————-000940—–0024———-000800—–High———–\??\c:\windows\system32\winlogon.exe (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 516608 bytes | Date = 08/28/2002 23:41 | Attr = ])
winpfind2.exe————003896—–0001———-000616—–Normal———c:\applications\winpfind2\winpfind2.exe (OldTimer Tools [Ver = 1.0.0.0 | Size = 381440 bytes | Date = 07/16/2006 09:30 | Attr = ])

Registry Entries
Key——————————————————————————————————————— Value (Version Info)
WinPFind2 by OldTimer - Version 1.0.0———————————————————————————–
Microsoft Windows XP Version = Service Pack 1————————————————————————–
Internet Explorer Version = 6.0.2800.1106——————————————————————————
Internet Explorer Settings———————————————————————————————-
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page————————————————————– http://www.microsoft.com/isapi/redir.dll?p…ER}&ar=home
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Page————————————————————- http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default Page———————————————————— http://www.microsoft.com/isapi/redir.dll?p…&ar=msnhome
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default Search———————————————————- http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Local Page————————————————————– %SystemRoot%\system32\blank.htm
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page————————————————————– http://www.google.ca/
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Page————————————————————-
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Local Page————————————————————– C:\WINDOWS\System32\blank.htm
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable——————————————- 0
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride—————————————–
BHO's——————————————————————————————————————-
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}— Yahoo! Companion BHO = C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll (Yahoo! Inc. [Ver = 2005, 4, 22, 1 | Size = 328275 bytes | Date = 04/22/2005 19:40 | Attr = ])
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}— AcroIEHlprObj Class = C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated [Ver = 7.0.0.2004121400 | Size = 63136 bytes | Date = 12/14/2004 01:56 | Attr = ])
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2FF5573C-0EB5-43db-A1B2-C4326813468E}— = (File not found)
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3D117109-0505-4A69-9E90-ECD6583F14F1}— = (File not found)
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}— = C:\APPLIC~1\SPYBOT~1\SDHelper.dll (Safer Networking Limited [Ver = 1, 3, 0, 12 | Size = 744960 bytes | Date = 05/12/2004 01:03 | Attr = ])
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}— UberButton Class = C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! [Ver = 2005, 5, 26, 1 | Size = 181352 bytes | Date = 05/26/2005 11:39 | Attr = ])
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB}— PCTools Site Guard = C:\APPLIC~1\SPYWAR~1\tools\iesdsg.dll (PC Tools [Ver = 3.6.0.2069 | Size = 803048 bytes | Date = 05/05/2006 13:55 | Attr = ])
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{65D886A2-7CA7-479B-BB95-14D1EFB7946A}— YahooTaggedBM Class = C:\Program Files\Yahoo!\Common\YIeTagBm.dll (Yahoo! Inc. [Ver = 2005, 1, 24, 1 | Size = 115832 bytes | Date = 01/24/2005 09:55 | Attr = ])
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{98DBBF16-CA43-4c33-BE80-99E6694468A4}— = (File not found)
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B56A7D7D-6927-48C8-A975-17DF180C71AC}— PCTools Browser Monitor = C:\APPLIC~1\SPYWAR~1\tools\iesdpb.dll (PC Tools [Ver = 3.6.0.2281 | Size = 839920 bytes | Date = 05/05/2006 13:56 | Attr = ])
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDF3E430-B101-42AD-A544-FADC6B084872}— CNavExtBho Class = C:\Applications\Norton AntiVirus 2005\NavShExt.dll (Symantec Corporation [Ver = 11.0.16.2 | Size = 218736 bytes | Date = 10/19/2005 13:54 | Attr = ])
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D}— SidebarAutoLaunch Class = C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll (Yahoo! Inc. [Ver = 2004, 8, 3, 1 | Size = 124032 bytes | Date = 02/03/2005 17:07 | Attr = ])
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\AutorunsDisabled————————- = (File not found)
Internet Explorer Bars, Toolbars and Extensions————————————————————————-
HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}————————– &Tip of the Day = %SystemRoot%\System32\shdocvw.dll (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 1341440 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{850CD0B8-DA33-4558-A8C8-95D7908E37A7}————————– = (File not found)
HKLM\SOFTWARE\Microsoft\Internet Explorer\ToolBar\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}——————————- Norton AntiVirus = C:\Applications\Norton AntiVirus 2005\NavShExt.dll (Symantec Corporation [Ver = 11.0.16.2 | Size = 218736 bytes | Date = 10/19/2005 13:54 | Attr = ])
HKLM\SOFTWARE\Microsoft\Internet Explorer\ToolBar\\{8E718888-423F-11D2-876E-00A0C9082467}——————————- &Radio = C:\WINDOWS\System32\msdxm.ocx ( [Ver = | Size = 842268 bytes | Date = 08/28/2002 23:40 | Attr = ])
HKLM\SOFTWARE\Microsoft\Internet Explorer\ToolBar\\{EF99BD32-C1FB-11D2-892F-0090271D4F88}——————————- Yahoo! Companion = C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll (Yahoo! Inc. [Ver = 2005, 4, 22, 1 | Size = 328275 bytes | Date = 04/22/2005 19:40 | Attr = ])
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}—————————– MenuText: Sun Java Console = C:\WINDOWS\System32\msjava.dll (Microsoft Corporation [Ver = 5.00.3805 | Size = 945693 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}—————————– MenuText: = (File not found)
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E}—————————– ButtonText: Web Anti-Virus = (File not found)
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2D663D1A-8670-49D9-A1A5-4C56B4E14E84}—————————– ButtonText: Spyware Doctor = (File not found)
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}—————————– ButtonText: Create Mobile Favorite = (File not found)
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}—————————– MenuText: Create Mobile Favorite… = C:\PROGRA~1\MICROS~4\INetRepl.dll (Microsoft Corporation [Ver = 4.1.4841.0 | Size = 135168 bytes | Date = 11/15/2005 19:42 | Attr = ])
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}—————————– MenuText: = (File not found)
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{44226DFF-747E-4edc-B30C-78752E50CD0C}—————————– ButtonText: ATI TV = (File not found)
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}—————————– ButtonText: Rogers Yahoo! Services = (File not found)
HKLM\SOFTWARE\Microsoft\Internet Explorer\Plugins\Extension\.spop——————————————————- = C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll (InterTrust Technologies Corporation, Inc. [Ver = 1.0.30.95 | Size = 225280 bytes | Date = 01/30/2001 14:56 | Attr = ])
HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}————————– Media Band = %SystemRoot%\System32\browseui.dll (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 1021952 bytes | Date = 08/28/2002 23:40 | Attr = ])
HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}————————– File Search Explorer Band = %SystemRoot%\system32\SHELL32.dll (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 8336384 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E}————————– Explorer Band = %SystemRoot%\System32\shdocvw.dll (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 1341440 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{01E04581-4EEE-11D0-BFE9-00AA005B4383}—————— &Address = %SystemRoot%\System32\browseui.dll (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 1021952 bytes | Date = 08/28/2002 23:40 | Attr = ])
HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}—————— Norton AntiVirus = C:\Applications\Norton AntiVirus 2005\NavShExt.dll (Symantec Corporation [Ver = 11.0.16.2 | Size = 218736 bytes | Date = 10/19/2005 13:54 | Attr = ])
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{01E04581-4EEE-11D0-BFE9-00AA005B4383}——————– &Address = %SystemRoot%\System32\browseui.dll (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 1021952 bytes | Date = 08/28/2002 23:40 | Attr = ])
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0E5CBF21-D15F-11D0-8301-00AA005B4383}——————– &Links = %SystemRoot%\system32\SHELL32.dll (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 8336384 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EF99BD32-C1FB-11D2-892F-0090271D4F88}——————– Yahoo! Companion = C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll (Yahoo! Inc. [Ver = 2005, 4, 22, 1 | Size = 328275 bytes | Date = 04/22/2005 19:40 | Attr = ])
HKCU\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel——————————————– res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 (Microsoft Corporation [Ver = 10.0.4302 | Size = 9173576 bytes | Date = 07/03/2002 15:37 | Attr = R ])
Approved Shell Extensions (Non-Microsoft only)————————————————————————–
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{5464D816-CF16-4784-B9F3-75C0DB52B499}——— YMailShellExt Class = C:\Program Files\Yahoo!\Common\ymmapi.dll (Yahoo! Inc. [Ver = 2004, 11, 23, 1 | Size = 175616 bytes | Date = 11/23/2004 10:56 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{5E2121EE-0300-11D4-8D3B-444553540000}——— SimpleShlExt Class = C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll ( [Ver = 1, 0, 0, 1 | Size = 73728 bytes | Date = 10/19/2005 11:17 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{85E0B171-04FA-11D1-B7DA-00A0C90348D6}——— Web Anti-Virus = C:\Applications\Kaspersky Anti-Virus 6.0\scieplugin.dll (Kaspersky Lab [Ver = 6.0.0.299 | Size = 184430 bytes | Date = 03/24/2006 19:07 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{88895560-9AA2-1069-930E-00AA0030EBC8}——— HyperTerminal Icon Ext = C:\WINDOWS\System32\hticons.dll (Hilgraeve, Inc. [Ver = 5.1.2600.0 | Size = 44544 bytes | Date = 08/23/2001 08:00 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{B41DB860-8EE4-11D2-9906-E49FADC173CA}——— WinRAR = C:\Applications\WinRAR\rarext.dll ( [Ver = | Size = 121344 bytes | Date = 11/02/2004 17:57 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}——— Eudora's Shell Extension = C:\APPLIC~1\EUDORA~1.0\EuShlExt.dll (Qualcomm Inc. [Ver = 1, 0, 1, 1 | Size = 86016 bytes | Date = 09/09/2003 14:59 | Attr = R ])
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BDEADF00-C265-11d0-BCED-00A0C90AB50F}——— Web Folders = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL (Microsoft Corporation [Ver = 10.145.3810.0 | Size = 1318912 bytes | Date = 02/14/2001 22:45 | Attr = ])
ContextMenuHandlers (Non-Microsoft only)——————————————————————————–
HKCR\*\shellex\ContextMenuHandlers\Kaspersky Anti-Virus—————————————————————– {dd230880-495a-11d1-b064-008048ec2fc5} = C:\Applications\Kaspersky Anti-Virus 6.0\shellex.dll (Kaspersky Lab [Ver = 6.0.0.299 | Size = 41067 bytes | Date = 03/24/2006 19:08 | Attr = ])
HKCR\*\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu———————————————- {5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} = C:\Applications\Norton AntiVirus 2005\NavShExt.dll (Symantec Corporation [Ver = 11.0.16.2 | Size = 218736 bytes | Date = 10/19/2005 13:54 | Attr = ])
HKCR\*\shellex\ContextMenuHandlers\WinRAR——————————————————————————- {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Applications\WinRAR\rarext.dll ( [Ver = | Size = 121344 bytes | Date = 11/02/2004 17:57 | Attr = ])
HKCR\*\shellex\ContextMenuHandlers\Yahoo! Mail————————————————————————– {5464D816-CF16-4784-B9F3-75C0DB52B499} = C:\Program Files\Yahoo!\Common\ymmapi.dll (Yahoo! Inc. [Ver = 2004, 11, 23, 1 | Size = 175616 bytes | Date = 11/23/2004 10:56 | Attr = ])
HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Kaspersky Anti-Virus——————————————- {dd230880-495a-11d1-b064-008048ec2fc5} = C:\Applications\Kaspersky Anti-Virus 6.0\shellex.dll (Kaspersky Lab [Ver = 6.0.0.299 | Size = 41067 bytes | Date = 03/24/2006 19:08 | Attr = ])
HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Library——————————————————– {54F51408-DD44-4a12-82EF-519AD2A80DE9} = C:\Program Files\ATI Multimedia\mlibrary\MLShell.dll (ATI Technologies Inc. [Ver = 9.06.000 | Size = 61440 bytes | Date = 04/28/2005 12:17 | Attr = ])
HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu———————— {5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} = C:\Applications\Norton AntiVirus 2005\NavShExt.dll (Symantec Corporation [Ver = 11.0.16.2 | Size = 218736 bytes | Date = 10/19/2005 13:54 | Attr = ])
HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR——————————————————— {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Applications\WinRAR\rarext.dll ( [Ver = | Size = 121344 bytes | Date = 11/02/2004 17:57 | Attr = ])
HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR—————————————————— {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Applications\WinRAR\rarext.dll ( [Ver = | Size = 121344 bytes | Date = 11/02/2004 17:57 | Attr = ])
ColumnHandlers (Non-Microsoft only)————————————————————————————-
HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{F9DB5320-233E-11D1-9F84-707F02C10627}—————————— PDF Shell Extension = C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll (Adobe Systems, Inc. [Ver = 7.0.0.0 | Size = 110592 bytes | Date = 12/14/2004 02:20 | Attr = ])
Registry Run Keys——————————————————————————————————-
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\ASUS Probe———————————————————- C:\Program Files\ASUS\Probe\AsusProb.exe ( [Ver = | Size = 617984 bytes | Date = 12/17/2001 22:22 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\ccApp————————————————————— "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" (Symantec Corporation [Ver = 103.0.7.2 | Size = 59040 bytes | Date = 02/17/2006 11:05 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\ezShieldProtector for Px——————————————– C:\WINDOWS\System32\ezSP_Px.exe (Easy Systems Japan Ltd. [Ver = 1, 0, 0, 0 | Size = 40960 bytes | Date = 08/20/2002 11:29 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\iamapp————————————————————– C:\Applications\Norton Internet Security\IAMAPP.EXE (Symantec Corporation [Ver = 4.0.3.104 | Size = 378536 bytes | Date = 02/18/2002 14:03 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\IntelliPoint——————————————————– "C:\Program Files\Microsoft IntelliPoint\point32.exe" (Microsoft Corporation [Ver = 5.00.174.0 | Size = 163840 bytes | Date = 05/15/2003 19:41 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\SiSUSBRG———————————————————— C:\WINDOWS\SiSUSBrg.exe (Silicon Integrated Systems Corp. [Ver = 1, 0, 0, 1 | Size = 106496 bytes | Date = 07/12/2002 06:15 | Attr = R ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\SSC_UserPrompt—————————————————— C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe (Symantec Corporation [Ver = 2005.1.2.20 | Size = 218240 bytes | Date = 11/02/2004 17:59 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Symantec NetDriver Monitor—————————————— C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer (Symantec Corporation [Ver = 5.5.1.6 | Size = 100056 bytes | Date = 06/14/2005 17:41 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\type32————————————————————– "C:\Program Files\Microsoft IntelliType Pro\type32.exe" (Microsoft Corporation [Ver = 5.00.174.0 | Size = 114688 bytes | Date = 05/15/2003 19:45 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL——————————————— Installed = 1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI———————————————- Installed = 1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS———————————————- Installed = 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\——————————————————————– (File not found)
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\H/PC Connection Agent———————————————– "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" (Microsoft Corporation [Ver = 4.1.4841.0 | Size = 1200128 bytes | Date = 11/15/2005 19:44 | Attr = ])
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\SpybotSD TeaTimer————————————————— C:\Applications\SpyBot - Search & Destroy\TeaTimer.exe (Safer Networking Limited [Ver = 1, 3, 0, 12 | Size = 1038336 bytes | Date = 05/12/2004 01:03 | Attr = ])
Startup Lnks————————————————————————————————————
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini——————————————— C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini ( [Ver = | Size = 84 bytes | Date = 12/29/2004 21:09 | Attr = HS])
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk—————————————- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard [Ver = 1, 0, 0, 1 | Size = 28672 bytes | Date = 04/06/2003 02:06 | Attr = ])
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk———————————— C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation [Ver = 10.0.2609 | Size = 83360 bytes | Date = 02/13/2001 02:01 | Attr = ])
C:\Documents and Settings\Michael\Start Menu\Programs\Startup\desktop.ini———————————————– C:\Documents and Settings\Michael\Start Menu\Programs\Startup\desktop.ini ( [Ver = | Size = 84 bytes | Date = 01/23/2003 00:55 | Attr = HS])
Disabled MSConfig Items————————————————————————————————-
User Agent Post Platform————————————————————————————————
AppInit DLLs————————————————————————————————————
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs————————————————- (File not found)
Image File Execution Options——————————————————————————————–
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path- Debugger = ntsd -d
Shell Service Object Delay Load—————————————————————————————–
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\CDBurn————————————– {fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 8336384 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\PostBootReminder—————————- {7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 8336384 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\SysTray————————————- {35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\System32\stobject.dll (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 117760 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck———————————— {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\System32\webcheck.dll (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 258048 bytes | Date = 08/28/2002 23:41 | Attr = ])
Shell Execute Hooks—————————————————————————————————–
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972}——- URL Exec Hook = shell32.dll (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 8336384 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}——- Eudora's Shell Extension = C:\APPLIC~1\EUDORA~1.0\EuShlExt.dll (Qualcomm Inc. [Ver = 1, 0, 1, 1 | Size = 86016 bytes | Date = 09/09/2003 14:59 | Attr = R ])
Shared Task Scheduler—————————————————————————————————
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{438755C2-A8BA-11D1-B96B-00A0C90312E1}—– Browseui preloader = %SystemRoot%\System32\browseui.dll (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 1021952 bytes | Date = 08/28/2002 23:40 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{8C7461EF-2B13-11d2-BE35-3078302C2030}—– Component Categories cache daemon = %SystemRoot%\System32\browseui.dll (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 1021952 bytes | Date = 08/28/2002 23:40 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\furnariidae——————————– = (File not found)
Winlogon—————————————————————————————————————-
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit—————————————————- C:\WINDOWS\system32\userinit.exe, (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 22016 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell——————————————————- Explorer.exe (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 1004032 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\System—————————————————— (File not found)
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent——————————————- Ati2evxx.dll (ATI Technologies Inc. [Ver = 6.14.10.4124 | Size = 47104 bytes | Date = 12/11/2005 23:34 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AutorunsDisabled————————————– (File not found)
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain—————————————— crypt32.dll (Microsoft Corporation [Ver = 5.131.2600.1106 (xpsp1.020828-1920) | Size = 557568 bytes | Date = 08/28/2002 23:40 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet———————————————- cryptnet.dll (Microsoft Corporation [Ver = 5.131.2600.0 (xpclient.010817-1148) | Size = 53248 bytes | Date = 08/23/2001 08:00 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll———————————————— cscdll.dll (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 89600 bytes | Date = 08/23/2001 08:00 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp——————————————– wlnotify.dll (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 86528 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule———————————————- wlnotify.dll (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 86528 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy———————————————- sclgntfy.dll (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 18432 bytes | Date = 08/23/2001 08:00 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn———————————————- WlNotify.dll (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 86528 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv———————————————– wlnotify.dll (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 86528 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\vtstu————————————————- (File not found)
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon——————————————— wlnotify.dll (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 86528 bytes | Date = 08/28/2002 23:41 | Attr = ])
DNS Name Servers——————————————————————————————————–
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{2A2D5489-6FB3-496A-B864-83705DE04E93}————— ()
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{723EB1B1-05B8-4323-91E1-F4C14EA54D5E}————— ()
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{7FB761FE-2610-49C4-936C-E85C1C0A9FE1}————— (1394 Net Adapter)
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{8B90428F-323E-47B9-A5C9-7E1F334B42C7}————— (Windows Mobile-based Device)
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{8CB97E15-A95B-4678-8F42-DB5F554C18CF}————— (1394 Net Adapter)
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BCF42147-A7BA-44BE-A61D-1C18802159F7}————— (SiS 900-Based PCI Fast Ethernet Adapter)
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{C86D22AD-48CA-4F21-B102-1C3F2BCE90B1}————— (Windows Mobile-based Device)
Winsock2 Catalogs (Non-Microsoft only)———————————————————————————-
Protocol Handlers (Non-Microsoft only)———————————————————————————-
HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\ipp—————————————————————————– (File not found)
HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp————————————————————————- (File not found)
HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\vnd.ms.radio——————————————————————– C:\WINDOWS\System32\msdxm.ocx ( [Ver = | Size = 842268 bytes | Date = 08/28/2002 23:40 | Attr = ])
Protocol Filters (Non-Microsoft only)———————————————————————————–

[Start Post #2]

Services
Name——————————————————–Internal Name————Startup Type—State—–Service Type————————————–Path (Version Info)
Alerter—————————————————–Alerter——————Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k LocalService (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Ati HotKey Poller——————————————-Ati HotKey Poller——–Automatic——Running—Win32, running in it's own process—————-C:\WINDOWS\System32\Ati2evxx.exe (ATI Technologies Inc. [Ver = 6.14.10.4124 | Size = 393216 bytes | Date = 12/11/2005 23:33 | Attr = ])
Windows Audio———————————————–AudioSrv—————–Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Automatic LiveUpdate Scheduler——————————Automatic LiveUpdate SchedulerAutomatic——Running—Win32, running in it's own process—————-"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" (Symantec Corporation [Ver = 3.0.0.160 | Size = 100032 bytes | Date = 02/23/2006 11:41 | Attr = ])
Computer Browser——————————————–Browser——————Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Symantec Event Manager————————————–ccEvtMgr—————–Automatic——Running—Win32, running in it's own process—————-"C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe" (Symantec Corporation [Ver = 103.0.7.2 | Size = 198304 bytes | Date = 02/17/2006 11:05 | Attr = ])
Symantec Settings Manager———————————–ccSetMgr—————–Automatic——Running—Win32, running in it's own process—————-"C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe" (Symantec Corporation [Ver = 103.0.7.2 | Size = 181920 bytes | Date = 02/17/2006 11:05 | Attr = ])
Creative Service for CDROM Access—————————Creative Service for CDROM AccessAutomatic——Running—Win32, running in it's own process—————-C:\WINDOWS\System32\CTsvcCDA.EXE (Creative Technology Ltd [Ver = 1.0.1.0 | Size = 44032 bytes | Date = 12/13/1999 02:01 | Attr = ])
Cryptographic Services————————————–CryptSvc—————–Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\system32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
DHCP Client————————————————-Dhcp———————Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Logical Disk Manager—————————————-dmserver—————–Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
DNS Client————————————————–Dnscache—————–Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k NetworkService (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Error Reporting Service————————————-ERSvc——————–Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Event Log—————————————————Eventlog—————–Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\system32\services.exe (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 101376 bytes | Date = 08/23/2001 08:00 | Attr = ])
COM+ Event System——————————————-EventSystem————–On Demand——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Fast User Switching Compatibility—————————FastUserSwitchingCompatibilityOn Demand——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Help and Support——————————————–helpsvc——————Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Human Interface Device Access——————————-HidServ——————Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Altera JTAG Server——————————————JTAGServer—————Automatic——Running—Win32, running in it's own process—————-C:\Applications\UofT Software\Altera\Quartus41\bin\JTAGServer.exe ( [Ver = | Size = 143360 bytes | Date = 06/24/2004 00:40 | Attr = ])
Server——————————————————lanmanserver————-Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Workstation————————————————-lanmanworkstation——–Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
TCP/IP NetBIOS Helper—————————————LmHosts——————Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k LocalService (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Norton AntiVirus Auto-Protect Service———————–navapsvc—————–Automatic——Running—Win32, running in it's own process—————-"C:\Applications\Norton AntiVirus 2005\navapsvc.exe" (Symantec Corporation [Ver = 11.0.16.2 | Size = 177264 bytes | Date = 10/19/2005 13:54 | Attr = ])
Network Connections—————————————–Netman——————-On Demand——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Norton Internet Security Service—————————-NISSERV——————Automatic——Running—Win32, running in it's own process—————-C:\Applications\Norton Internet Security\NISSERV.EXE (Symantec Corporation [Ver = 4.0.3.104 | Size = 63144 bytes | Date = 02/18/2002 14:03 | Attr = ])
Norton Internet Security Accounts Manager——————-NISUM——————–On Demand——Running—Win32, running in it's own process—————-C:\Applications\Norton Internet Security\NISUM.EXE (Symantec Corporation [Ver = 4.0.3.104 | Size = 87720 bytes | Date = 02/18/2002 14:03 | Attr = ])
Network Location Awareness (NLA)—————————-Nla———————-On Demand——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Plug and Play———————————————–PlugPlay—————–Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\system32\services.exe (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 101376 bytes | Date = 08/23/2001 08:00 | Attr = ])
IPSEC Services———————————————-PolicyAgent————–Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\lsass.exe (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 11776 bytes | Date = 08/28/2002 23:41 | Attr = ])
Protected Storage——————————————-ProtectedStorage———Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\system32\lsass.exe (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 11776 bytes | Date = 08/28/2002 23:41 | Attr = ])
Remote Access Connection Manager—————————-RasMan——————-On Demand——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Remote Registry———————————————RemoteRegistry———–Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\system32\svchost.exe -k LocalService (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Remote Procedure Call (RPC)———————————RpcSs——————–Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\system32\svchost -k rpcss (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Security Accounts Manager———————————–SamSs——————–Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\system32\lsass.exe (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 11776 bytes | Date = 08/28/2002 23:41 | Attr = ])
Task Scheduler———————————————-Schedule—————–Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
PC Tools Spyware Doctor————————————-SDhelper—————–Automatic——Running—Win32, running in it's own process—————-C:\Applications\Spyware Doctor - PC Tools\sdhelp.exe (PC Tools Research Pty Ltd [Ver = 3.6.0.2024 | Size = 894120 bytes | Date = 07/21/2006 19:02 | Attr = ])
Secondary Logon———————————————seclogon—————–Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
System Event Notification———————————–SENS———————Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\system32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Shell Hardware Detection————————————ShellHWDetection———Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Symantec SPBBCSvc——————————————-SPBBCSvc—————–Automatic——Running—Win32, running in it's own process—————-C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe (Symantec Corporation [Ver = 1,0,1,47 | Size = 173160 bytes | Date = 07/21/2004 12:24 | Attr = ])
Print Spooler———————————————–Spooler——————Automatic——Running—Win32, running in it's own process—————-C:\WINDOWS\system32\spoolsv.exe (Microsoft Corporation [Ver = 5.1.2600.0 (XPClient.010817-1148) | Size = 51200 bytes | Date = 08/23/2001 08:00 | Attr = ])
SSDP Discovery Service————————————–SSDPSRV——————On Demand——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k LocalService (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Windows Image Acquisition (WIA)—————————–stisvc——————-Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k imgsvc (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Symantec Core LC——————————————–Symantec Core LC———Automatic——Running—Win32, running in it's own process—————-C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (Symantec Corporation [Ver = 1, 8, 54, 534 | Size = 822424 bytes | Date = 06/14/2005 17:29 | Attr = ])
Norton Internet Security Proxy Service———————-SymProxySvc————–Automatic——Running—Win32, running in it's own process—————-C:\Applications\Norton Internet Security\SymProxySvc.exe (Symantec Corporation [Ver = 4.0.3.104 | Size = 54952 bytes | Date = 02/18/2002 14:02 | Attr = ])
Telephony—————————————————TapiSrv——————On Demand——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Terminal Services——————————————-TermService————–On Demand——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Themes——————————————————Themes——————-Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Distributed Link Tracking Client—————————-TrkWks——————-Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\system32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23

agrarianmonk

Post #14July 28, 2006, 5:10 AM UTC

looks like the post got cut off. if you'll notice in the winpfind log, there are [Start Post #1] and [Start Post #2] deliminators in the log to split the log up use those to determine when to start a separate post for the winpfind log. thanks,

LumberJack - The Essence of Man

Post #15July 28, 2006, 5:27 AM UTC

ooppss, sorry about that, I clicked check post length and it seemed to be fine/the preview looked ok, oh well. Here is the 1st of the 2 posts of the log:

Logfile created on: 07/28/2006 00:53
WinPFind2 by OldTimer - Version 1.0.0 Folder = C:\Applications\WinPFind2\
Microsoft Windows XP (Version = Service Pack 1)
Internet Explorer (Version - 6.0.2800.1106)

[Start Post #1]

Processes
Image Name—————ProcessID–Thread Count–Parent ID–Base Priority–Full Path (Version Info)
aluschedulersvc.exe——001280—–0004———-000984—–Normal———c:\program files\symantec\liveupdate\aluschedulersvc.exe (Symantec Corporation [Ver = 3.0.0.160 | Size = 100032 bytes | Date = 02/23/2006 11:41 | Attr = ])
asusprob.exe————-001316—–0002———-000616—–Normal———c:\program files\asus\probe\asusprob.exe ( [Ver = | Size = 617984 bytes | Date = 12/17/2001 22:22 | Attr = ])
ati2evxx.exe————-001168—–0004———-000984—–Normal———c:\windows\system32\ati2evxx.exe (ATI Technologies Inc. [Ver = 6.14.10.4124 | Size = 393216 bytes | Date = 12/11/2005 23:33 | Attr = ])
ati2evxx.exe————-001672—–0004———-000940—–Normal———c:\windows\system32\ati2evxx.exe (ATI Technologies Inc. [Ver = 6.14.10.4124 | Size = 393216 bytes | Date = 12/11/2005 23:33 | Attr = ])
ccapp.exe—————-000172—–0033———-000616—–Normal———c:\program files\common files\symantec shared\ccapp.exe (Symantec Corporation [Ver = 103.0.7.2 | Size = 59040 bytes | Date = 02/17/2006 11:05 | Attr = ])
ccevtmgr.exe————-001888—–0015———-000984—–Normal———c:\program files\common files\symantec shared\ccevtmgr.exe (Symantec Corporation [Ver = 103.0.7.2 | Size = 198304 bytes | Date = 02/17/2006 11:05 | Attr = ])
ccsetmgr.exe————-001828—–0009———-000984—–Normal———c:\program files\common files\symantec shared\ccsetmgr.exe (Symantec Corporation [Ver = 103.0.7.2 | Size = 181920 bytes | Date = 02/17/2006 11:05 | Attr = ])
csrss.exe—————-000868—–0010———-000800—–Normal———\??\c:\windows\system32\csrss.exe (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 4096 bytes | Date = 08/23/2001 08:00 | Attr = ])
ctsvccda.exe————-001308—–0002———-000984—–Normal———c:\windows\system32\ctsvccda.exe (Creative Technology Ltd [Ver = 1.0.1.0 | Size = 44032 bytes | Date = 12/13/1999 02:01 | Attr = ])
explorer.exe————-000616—–0014———-000580—–Normal———c:\windows\explorer.exe (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 1004032 bytes | Date = 08/28/2002 23:41 | Attr = ])
ezsp_px.exe————–001072—–0001———-000616—–Normal———c:\windows\system32\ezsp_px.exe (Easy Systems Japan Ltd. [Ver = 1, 0, 0, 0 | Size = 40960 bytes | Date = 08/20/2002 11:29 | Attr = ])
firefox.exe————–003192—–0011———-000616—–Normal———c:\applications\firefox\firefox.exe (Mozilla [Ver = 1.0.6 | Size = 6636644 bytes | Date = 07/16/2005 05:41 | Attr = ])
hpotdd01.exe————-002128—–0003———-000616—–Normal———c:\program files\hewlett-packard\digital imaging\bin\hpotdd01.exe (Hewlett-Packard [Ver = 1, 0, 0, 1 | Size = 28672 bytes | Date = 04/06/2003 02:06 | Attr = ])
iamapp.exe—————000348—–0005———-000616—–Normal———c:\applications\norton internet security\iamapp.exe (Symantec Corporation [Ver = 4.0.3.104 | Size = 378536 bytes | Date = 02/18/2002 14:03 | Attr = ])
jtagserver.exe———–001348—–0003———-000984—–Normal———c:\applications\uoft software\altera\quartus41\bin\jtagserver.exe ( [Ver = | Size = 143360 bytes | Date = 06/24/2004 00:40 | Attr = ])
lsass.exe—————-000996—–0019———-000940—–Normal———c:\windows\system32\lsass.exe (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 11776 bytes | Date = 08/28/2002 23:41 | Attr = ])
navapsvc.exe————-001436—–0011———-000984—–Normal———c:\applications\norton antivirus 2005\navapsvc.exe (Symantec Corporation [Ver = 11.0.16.2 | Size = 177264 bytes | Date = 10/19/2005 13:54 | Attr = ])
nisserv.exe————–000124—–0010———-000984—–Normal———c:\applications\norton internet security\nisserv.exe (Symantec Corporation [Ver = 4.0.3.104 | Size = 63144 bytes | Date = 02/18/2002 14:03 | Attr = ])
nisum.exe—————-001580—–0005———-000984—–Normal———c:\applications\norton internet security\nisum.exe (Symantec Corporation [Ver = 4.0.3.104 | Size = 87720 bytes | Date = 02/18/2002 14:03 | Attr = ])
point32.exe————–000652—–0004———-000616—–Normal———c:\program files\microsoft intellipoint\point32.exe (Microsoft Corporation [Ver = 5.00.174.0 | Size = 163840 bytes | Date = 05/15/2003 19:41 | Attr = ])
rapimgr.exe————–002220—–0007———-001200—–Normal———c:\progra~1\micros~4\rapimgr.exe (Microsoft Corporation [Ver = 4.1.4841.0 | Size = 180224 bytes | Date = 11/15/2005 19:42 | Attr = ])
sdhelp.exe—————000352—–0006———-000984—–Normal———c:\applications\spyware doctor - pc tools\sdhelp.exe (PC Tools Research Pty Ltd [Ver = 3.6.0.2024 | Size = 894120 bytes | Date = 07/21/2006 19:02 | Attr = ])
services.exe————-000984—–0019———-000940—–Normal———c:\windows\system32\services.exe (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 101376 bytes | Date = 08/23/2001 08:00 | Attr = ])
smss.exe—————–000800—–0003———-000004—–Normal———\systemroot\system32\smss.exe (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 45568 bytes | Date = 08/28/2002 23:41 | Attr = ])
spbbcsvc.exe————-001848—–0008———-000984—–Normal———c:\program files\common files\symantec shared\spbbc\spbbcsvc.exe (Symantec Corporation [Ver = 1,0,1,47 | Size = 173160 bytes | Date = 07/21/2004 12:24 | Attr = ])
spoolsv.exe————–002008—–0010———-000984—–Normal———c:\windows\system32\spoolsv.exe (Microsoft Corporation [Ver = 5.1.2600.0 (XPClient.010817-1148) | Size = 51200 bytes | Date = 08/23/2001 08:00 | Attr = ])
svchost.exe————–000520—–0007———-000984—–Normal———c:\windows\system32\svchost.exe (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
svchost.exe————–001200—–0009———-000984—–Normal———c:\windows\system32\svchost.exe (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
svchost.exe————–001584—–0016———-000984—–Normal———c:\windows\system32\svchost.exe (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
svchost.exe————–001384—–0071———-000984—–Normal———c:\windows\system32\svchost.exe (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
svchost.exe————–001512—–0005———-000984—–Normal———c:\windows\system32\svchost.exe (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
symlcsvc.exe————-000536—–0005———-000984—–Normal———c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe (Symantec Corporation [Ver = 1, 8, 54, 534 | Size = 822424 bytes | Date = 06/14/2005 17:29 | Attr = ])
symproxysvc.exe———-000636—–0015———-000984—–Normal———c:\applications\norton internet security\symproxysvc.exe (Symantec Corporation [Ver = 4.0.3.104 | Size = 54952 bytes | Date = 02/18/2002 14:02 | Attr = ])
teatimer.exe————-001600—–0003———-000616—–Idle———–c:\applications\spybot - search & destroy\teatimer.exe (Safer Networking Limited [Ver = 1, 3, 0, 12 | Size = 1038336 bytes | Date = 05/12/2004 01:03 | Attr = ])
type32.exe—————000228—–0003———-000616—–Normal———c:\program files\microsoft intellitype pro\type32.exe (Microsoft Corporation [Ver = 5.00.174.0 | Size = 114688 bytes | Date = 05/15/2003 19:45 | Attr = ])
wcescomm.exe————-001488—–0005———-000616—–Normal———c:\program files\microsoft activesync\wcescomm.exe (Microsoft Corporation [Ver = 4.1.4841.0 | Size = 1200128 bytes | Date = 11/15/2005 19:44 | Attr = ])
wdfmgr.exe—————000676—–0004———-000984—–Normal———c:\windows\system32\wdfmgr.exe (Microsoft Corporation [Ver = 5.2.3790.1230 built by: DNSRV(bld4act) | Size = 38912 bytes | Date = 09/22/2004 18:46 | Attr = ])
winlogon.exe————-000940—–0024———-000800—–High———–\??\c:\windows\system32\winlogon.exe (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 516608 bytes | Date = 08/28/2002 23:41 | Attr = ])
winpfind2.exe————003896—–0001———-000616—–Normal———c:\applications\winpfind2\winpfind2.exe (OldTimer Tools [Ver = 1.0.0.0 | Size = 381440 bytes | Date = 07/16/2006 09:30 | Attr = ])

Registry Entries
Key——————————————————————————————————————— Value (Version Info)
WinPFind2 by OldTimer - Version 1.0.0———————————————————————————–
Microsoft Windows XP Version = Service Pack 1————————————————————————–
Internet Explorer Version = 6.0.2800.1106——————————————————————————
Internet Explorer Settings———————————————————————————————-
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page————————————————————– http://www.microsoft.com/isapi/redir.dll?p…ER}&ar=home
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Page————————————————————- http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default Page———————————————————— http://www.microsoft.com/isapi/redir.dll?p…&ar=msnhome
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default Search———————————————————- http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Local Page————————————————————– %SystemRoot%\system32\blank.htm
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page————————————————————– http://www.google.ca/
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Page————————————————————-
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Local Page————————————————————– C:\WINDOWS\System32\blank.htm
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable——————————————- 0
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride—————————————–
BHO's——————————————————————————————————————-
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}— Yahoo! Companion BHO = C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll (Yahoo! Inc. [Ver = 2005, 4, 22, 1 | Size = 328275 bytes | Date = 04/22/2005 19:40 | Attr = ])
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}— AcroIEHlprObj Class = C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated [Ver = 7.0.0.2004121400 | Size = 63136 bytes | Date = 12/14/2004 01:56 | Attr = ])
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2FF5573C-0EB5-43db-A1B2-C4326813468E}— = (File not found)
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3D117109-0505-4A69-9E90-ECD6583F14F1}— = (File not found)
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}— = C:\APPLIC~1\SPYBOT~1\SDHelper.dll (Safer Networking Limited [Ver = 1, 3, 0, 12 | Size = 744960 bytes | Date = 05/12/2004 01:03 | Attr = ])
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}— UberButton Class = C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! [Ver = 2005, 5, 26, 1 | Size = 181352 bytes | Date = 05/26/2005 11:39 | Attr = ])
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB}— PCTools Site Guard = C:\APPLIC~1\SPYWAR~1\tools\iesdsg.dll (PC Tools [Ver = 3.6.0.2069 | Size = 803048 bytes | Date = 05/05/2006 13:55 | Attr = ])
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{65D886A2-7CA7-479B-BB95-14D1EFB7946A}— YahooTaggedBM Class = C:\Program Files\Yahoo!\Common\YIeTagBm.dll (Yahoo! Inc. [Ver = 2005, 1, 24, 1 | Size = 115832 bytes | Date = 01/24/2005 09:55 | Attr = ])
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{98DBBF16-CA43-4c33-BE80-99E6694468A4}— = (File not found)
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B56A7D7D-6927-48C8-A975-17DF180C71AC}— PCTools Browser Monitor = C:\APPLIC~1\SPYWAR~1\tools\iesdpb.dll (PC Tools [Ver = 3.6.0.2281 | Size = 839920 bytes | Date = 05/05/2006 13:56 | Attr = ])
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDF3E430-B101-42AD-A544-FADC6B084872}— CNavExtBho Class = C:\Applications\Norton AntiVirus 2005\NavShExt.dll (Symantec Corporation [Ver = 11.0.16.2 | Size = 218736 bytes | Date = 10/19/2005 13:54 | Attr = ])
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D}— SidebarAutoLaunch Class = C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll (Yahoo! Inc. [Ver = 2004, 8, 3, 1 | Size = 124032 bytes | Date = 02/03/2005 17:07 | Attr = ])
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\AutorunsDisabled————————- = (File not found)
Internet Explorer Bars, Toolbars and Extensions————————————————————————-
HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}————————– &Tip of the Day = %SystemRoot%\System32\shdocvw.dll (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 1341440 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{850CD0B8-DA33-4558-A8C8-95D7908E37A7}————————– = (File not found)
HKLM\SOFTWARE\Microsoft\Internet Explorer\ToolBar\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}——————————- Norton AntiVirus = C:\Applications\Norton AntiVirus 2005\NavShExt.dll (Symantec Corporation [Ver = 11.0.16.2 | Size = 218736 bytes | Date = 10/19/2005 13:54 | Attr = ])
HKLM\SOFTWARE\Microsoft\Internet Explorer\ToolBar\\{8E718888-423F-11D2-876E-00A0C9082467}——————————- &Radio = C:\WINDOWS\System32\msdxm.ocx ( [Ver = | Size = 842268 bytes | Date = 08/28/2002 23:40 | Attr = ])
HKLM\SOFTWARE\Microsoft\Internet Explorer\ToolBar\\{EF99BD32-C1FB-11D2-892F-0090271D4F88}——————————- Yahoo! Companion = C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll (Yahoo! Inc. [Ver = 2005, 4, 22, 1 | Size = 328275 bytes | Date = 04/22/2005 19:40 | Attr = ])
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}—————————– MenuText: Sun Java Console = C:\WINDOWS\System32\msjava.dll (Microsoft Corporation [Ver = 5.00.3805 | Size = 945693 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}—————————– MenuText: = (File not found)
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E}—————————– ButtonText: Web Anti-Virus = (File not found)
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2D663D1A-8670-49D9-A1A5-4C56B4E14E84}—————————– ButtonText: Spyware Doctor = (File not found)
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}—————————– ButtonText: Create Mobile Favorite = (File not found)
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}—————————– MenuText: Create Mobile Favorite… = C:\PROGRA~1\MICROS~4\INetRepl.dll (Microsoft Corporation [Ver = 4.1.4841.0 | Size = 135168 bytes | Date = 11/15/2005 19:42 | Attr = ])
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}—————————– MenuText: = (File not found)
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{44226DFF-747E-4edc-B30C-78752E50CD0C}—————————– ButtonText: ATI TV = (File not found)
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}—————————– ButtonText: Rogers Yahoo! Services = (File not found)
HKLM\SOFTWARE\Microsoft\Internet Explorer\Plugins\Extension\.spop——————————————————- = C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll (InterTrust Technologies Corporation, Inc. [Ver = 1.0.30.95 | Size = 225280 bytes | Date = 01/30/2001 14:56 | Attr = ])
HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}————————– Media Band = %SystemRoot%\System32\browseui.dll (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 1021952 bytes | Date = 08/28/2002 23:40 | Attr = ])
HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}————————– File Search Explorer Band = %SystemRoot%\system32\SHELL32.dll (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 8336384 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E}————————– Explorer Band = %SystemRoot%\System32\shdocvw.dll (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 1341440 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{01E04581-4EEE-11D0-BFE9-00AA005B4383}—————— &Address = %SystemRoot%\System32\browseui.dll (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 1021952 bytes | Date = 08/28/2002 23:40 | Attr = ])
HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}—————— Norton AntiVirus = C:\Applications\Norton AntiVirus 2005\NavShExt.dll (Symantec Corporation [Ver = 11.0.16.2 | Size = 218736 bytes | Date = 10/19/2005 13:54 | Attr = ])
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{01E04581-4EEE-11D0-BFE9-00AA005B4383}——————– &Address = %SystemRoot%\System32\browseui.dll (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 1021952 bytes | Date = 08/28/2002 23:40 | Attr = ])
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0E5CBF21-D15F-11D0-8301-00AA005B4383}——————– &Links = %SystemRoot%\system32\SHELL32.dll (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 8336384 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EF99BD32-C1FB-11D2-892F-0090271D4F88}——————– Yahoo! Companion = C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll (Yahoo! Inc. [Ver = 2005, 4, 22, 1 | Size = 328275 bytes | Date = 04/22/2005 19:40 | Attr = ])
HKCU\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel——————————————– res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 (Microsoft Corporation [Ver = 10.0.4302 | Size = 9173576 bytes | Date = 07/03/2002 15:37 | Attr = R ])
Approved Shell Extensions (Non-Microsoft only)————————————————————————–
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{5464D816-CF16-4784-B9F3-75C0DB52B499}——— YMailShellExt Class = C:\Program Files\Yahoo!\Common\ymmapi.dll (Yahoo! Inc. [Ver = 2004, 11, 23, 1 | Size = 175616 bytes | Date = 11/23/2004 10:56 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{5E2121EE-0300-11D4-8D3B-444553540000}——— SimpleShlExt Class = C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll ( [Ver = 1, 0, 0, 1 | Size = 73728 bytes | Date = 10/19/2005 11:17 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{85E0B171-04FA-11D1-B7DA-00A0C90348D6}——— Web Anti-Virus = C:\Applications\Kaspersky Anti-Virus 6.0\scieplugin.dll (Kaspersky Lab [Ver = 6.0.0.299 | Size = 184430 bytes | Date = 03/24/2006 19:07 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{88895560-9AA2-1069-930E-00AA0030EBC8}——— HyperTerminal Icon Ext = C:\WINDOWS\System32\hticons.dll (Hilgraeve, Inc. [Ver = 5.1.2600.0 | Size = 44544 bytes | Date = 08/23/2001 08:00 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{B41DB860-8EE4-11D2-9906-E49FADC173CA}——— WinRAR = C:\Applications\WinRAR\rarext.dll ( [Ver = | Size = 121344 bytes | Date = 11/02/2004 17:57 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}——— Eudora's Shell Extension = C:\APPLIC~1\EUDORA~1.0\EuShlExt.dll (Qualcomm Inc. [Ver = 1, 0, 1, 1 | Size = 86016 bytes | Date = 09/09/2003 14:59 | Attr = R ])
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BDEADF00-C265-11d0-BCED-00A0C90AB50F}——— Web Folders = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL (Microsoft Corporation [Ver = 10.145.3810.0 | Size = 1318912 bytes | Date = 02/14/2001 22:45 | Attr = ])
ContextMenuHandlers (Non-Microsoft only)——————————————————————————–
HKCR\*\shellex\ContextMenuHandlers\Kaspersky Anti-Virus—————————————————————– {dd230880-495a-11d1-b064-008048ec2fc5} = C:\Applications\Kaspersky Anti-Virus 6.0\shellex.dll (Kaspersky Lab [Ver = 6.0.0.299 | Size = 41067 bytes | Date = 03/24/2006 19:08 | Attr = ])
HKCR\*\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu———————————————- {5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} = C:\Applications\Norton AntiVirus 2005\NavShExt.dll (Symantec Corporation [Ver = 11.0.16.2 | Size = 218736 bytes | Date = 10/19/2005 13:54 | Attr = ])
HKCR\*\shellex\ContextMenuHandlers\WinRAR——————————————————————————- {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Applications\WinRAR\rarext.dll ( [Ver = | Size = 121344 bytes | Date = 11/02/2004 17:57 | Attr = ])
HKCR\*\shellex\ContextMenuHandlers\Yahoo! Mail————————————————————————– {5464D816-CF16-4784-B9F3-75C0DB52B499} = C:\Program Files\Yahoo!\Common\ymmapi.dll (Yahoo! Inc. [Ver = 2004, 11, 23, 1 | Size = 175616 bytes | Date = 11/23/2004 10:56 | Attr = ])
HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Kaspersky Anti-Virus——————————————- {dd230880-495a-11d1-b064-008048ec2fc5} = C:\Applications\Kaspersky Anti-Virus 6.0\shellex.dll (Kaspersky Lab [Ver = 6.0.0.299 | Size = 41067 bytes | Date = 03/24/2006 19:08 | Attr = ])
HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Library——————————————————– {54F51408-DD44-4a12-82EF-519AD2A80DE9} = C:\Program Files\ATI Multimedia\mlibrary\MLShell.dll (ATI Technologies Inc. [Ver = 9.06.000 | Size = 61440 bytes | Date = 04/28/2005 12:17 | Attr = ])
HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu———————— {5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} = C:\Applications\Norton AntiVirus 2005\NavShExt.dll (Symantec Corporation [Ver = 11.0.16.2 | Size = 218736 bytes | Date = 10/19/2005 13:54 | Attr = ])
HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR——————————————————— {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Applications\WinRAR\rarext.dll ( [Ver = | Size = 121344 bytes | Date = 11/02/2004 17:57 | Attr = ])
HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR—————————————————— {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Applications\WinRAR\rarext.dll ( [Ver = | Size = 121344 bytes | Date = 11/02/2004 17:57 | Attr = ])
ColumnHandlers (Non-Microsoft only)————————————————————————————-
HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{F9DB5320-233E-11D1-9F84-707F02C10627}—————————— PDF Shell Extension = C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll (Adobe Systems, Inc. [Ver = 7.0.0.0 | Size = 110592 bytes | Date = 12/14/2004 02:20 | Attr = ])
Registry Run Keys——————————————————————————————————-
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\ASUS Probe———————————————————- C:\Program Files\ASUS\Probe\AsusProb.exe ( [Ver = | Size = 617984 bytes | Date = 12/17/2001 22:22 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\ccApp————————————————————— "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" (Symantec Corporation [Ver = 103.0.7.2 | Size = 59040 bytes | Date = 02/17/2006 11:05 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\ezShieldProtector for Px——————————————– C:\WINDOWS\System32\ezSP_Px.exe (Easy Systems Japan Ltd. [Ver = 1, 0, 0, 0 | Size = 40960 bytes | Date = 08/20/2002 11:29 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\iamapp————————————————————– C:\Applications\Norton Internet Security\IAMAPP.EXE (Symantec Corporation [Ver = 4.0.3.104 | Size = 378536 bytes | Date = 02/18/2002 14:03 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\IntelliPoint——————————————————– "C:\Program Files\Microsoft IntelliPoint\point32.exe" (Microsoft Corporation [Ver = 5.00.174.0 | Size = 163840 bytes | Date = 05/15/2003 19:41 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\SiSUSBRG———————————————————— C:\WINDOWS\SiSUSBrg.exe (Silicon Integrated Systems Corp. [Ver = 1, 0, 0, 1 | Size = 106496 bytes | Date = 07/12/2002 06:15 | Attr = R ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\SSC_UserPrompt—————————————————— C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe (Symantec Corporation [Ver = 2005.1.2.20 | Size = 218240 bytes | Date = 11/02/2004 17:59 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Symantec NetDriver Monitor—————————————— C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer (Symantec Corporation [Ver = 5.5.1.6 | Size = 100056 bytes | Date = 06/14/2005 17:41 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\type32————————————————————– "C:\Program Files\Microsoft IntelliType Pro\type32.exe" (Microsoft Corporation [Ver = 5.00.174.0 | Size = 114688 bytes | Date = 05/15/2003 19:45 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL——————————————— Installed = 1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI———————————————- Installed = 1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS———————————————- Installed = 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\——————————————————————– (File not found)
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\H/PC Connection Agent———————————————– "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" (Microsoft Corporation [Ver = 4.1.4841.0 | Size = 1200128 bytes | Date = 11/15/2005 19:44 | Attr = ])
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\SpybotSD TeaTimer————————————————— C:\Applications\SpyBot - Search & Destroy\TeaTimer.exe (Safer Networking Limited [Ver = 1, 3, 0, 12 | Size = 1038336 bytes | Date = 05/12/2004 01:03 | Attr = ])
Startup Lnks————————————————————————————————————
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini——————————————— C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini ( [Ver = | Size = 84 bytes | Date = 12/29/2004 21:09 | Attr = HS])
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk—————————————- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard [Ver = 1, 0, 0, 1 | Size = 28672 bytes | Date = 04/06/2003 02:06 | Attr = ])
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk———————————— C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation [Ver = 10.0.2609 | Size = 83360 bytes | Date = 02/13/2001 02:01 | Attr = ])
C:\Documents and Settings\Michael\Start Menu\Programs\Startup\desktop.ini———————————————– C:\Documents and Settings\Michael\Start Menu\Programs\Startup\desktop.ini ( [Ver = | Size = 84 bytes | Date = 01/23/2003 00:55 | Attr = HS])
Disabled MSConfig Items————————————————————————————————-
User Agent Post Platform————————————————————————————————
AppInit DLLs————————————————————————————————————
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs————————————————- (File not found)
Image File Execution Options——————————————————————————————–
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path- Debugger = ntsd -d
Shell Service Object Delay Load—————————————————————————————–
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\CDBurn————————————– {fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 8336384 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\PostBootReminder—————————- {7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 8336384 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\SysTray————————————- {35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\System32\stobject.dll (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 117760 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck———————————— {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\System32\webcheck.dll (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 258048 bytes | Date = 08/28/2002 23:41 | Attr = ])
Shell Execute Hooks—————————————————————————————————–
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972}——- URL Exec Hook = shell32.dll (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 8336384 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}——- Eudora's Shell Extension = C:\APPLIC~1\EUDORA~1.0\EuShlExt.dll (Qualcomm Inc. [Ver = 1, 0, 1, 1 | Size = 86016 bytes | Date = 09/09/2003 14:59 | Attr = R ])
Shared Task Scheduler—————————————————————————————————
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{438755C2-A8BA-11D1-B96B-00A0C90312E1}—– Browseui preloader = %SystemRoot%\System32\browseui.dll (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 1021952 bytes | Date = 08/28/2002 23:40 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{8C7461EF-2B13-11d2-BE35-3078302C2030}—– Component Categories cache daemon = %SystemRoot%\System32\browseui.dll (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 1021952 bytes | Date = 08/28/2002 23:40 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\furnariidae——————————– = (File not found)
Winlogon—————————————————————————————————————-
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit—————————————————- C:\WINDOWS\system32\userinit.exe, (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 22016 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell——————————————————- Explorer.exe (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 1004032 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\System—————————————————— (File not found)
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent——————————————- Ati2evxx.dll (ATI Technologies Inc. [Ver = 6.14.10.4124 | Size = 47104 bytes | Date = 12/11/2005 23:34 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AutorunsDisabled————————————– (File not found)
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain—————————————— crypt32.dll (Microsoft Corporation [Ver = 5.131.2600.1106 (xpsp1.020828-1920) | Size = 557568 bytes | Date = 08/28/2002 23:40 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet———————————————- cryptnet.dll (Microsoft Corporation [Ver = 5.131.2600.0 (xpclient.010817-1148) | Size = 53248 bytes | Date = 08/23/2001 08:00 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll———————————————— cscdll.dll (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 89600 bytes | Date = 08/23/2001 08:00 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp——————————————– wlnotify.dll (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 86528 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule———————————————- wlnotify.dll (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 86528 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy———————————————- sclgntfy.dll (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 18432 bytes | Date = 08/23/2001 08:00 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn———————————————- WlNotify.dll (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 86528 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv———————————————– wlnotify.dll (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 86528 bytes | Date = 08/28/2002 23:41 | Attr = ])
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\vtstu————————————————- (File not found)
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon——————————————— wlnotify.dll (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 86528 bytes | Date = 08/28/2002 23:41 | Attr = ])
DNS Name Servers——————————————————————————————————–
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{2A2D5489-6FB3-496A-B864-83705DE04E93}————— ()
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{723EB1B1-05B8-4323-91E1-F4C14EA54D5E}————— ()
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{7FB761FE-2610-49C4-936C-E85C1C0A9FE1}————— (1394 Net Adapter)
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{8B90428F-323E-47B9-A5C9-7E1F334B42C7}————— (Windows Mobile-based Device)
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{8CB97E15-A95B-4678-8F42-DB5F554C18CF}————— (1394 Net Adapter)
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BCF42147-A7BA-44BE-A61D-1C18802159F7}————— (SiS 900-Based PCI Fast Ethernet Adapter)
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{C86D22AD-48CA-4F21-B102-1C3F2BCE90B1}————— (Windows Mobile-based Device)
Winsock2 Catalogs (Non-Microsoft only)———————————————————————————-
Protocol Handlers (Non-Microsoft only)———————————————————————————-
HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\ipp—————————————————————————– (File not found)
HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp————————————————————————- (File not found)
HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\vnd.ms.radio——————————————————————– C:\WINDOWS\System32\msdxm.ocx ( [Ver = | Size = 842268 bytes | Date = 08/28/2002 23:40 | Attr = ])
Protocol Filters (Non-Microsoft only)———————————————————————————–

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

WinAntiVirus (vtstu.dll)

✨ Ask AI

Ask AI