HJT Log ... I cant take it anymore!

Hi brianmontes
welcome to TomCoyote Forums
My name is dan12 and I will be looking over your log today.
These logs take a little time to research and all I ask is for you to be patient.
Dont start another thread and follow the Instruction I give to you, post your replies back to this thread
Anything that you are not sure about just ask and I'm sure we will be able to help you with your current malware problems.

As I am an Undergraduate, everything that I post to you must be checked by an Admin or Moderator. Thus, there may be a small delay between posts, but it shouldn't be too long. I will post back shortly with a potential fix.
Thanks for your patience!

Hi Brianmontes,

We need to temporarily disable the Real-time Protection on Windows Defender as it may interfere with the HijackThis fixes we make.

• Open Windows Defender
• Click Tools => General Settings
• Scroll down and uncheck Turn on real-time protection (recommended).
• Click Save
• Close Windows Defender

After all of the fixes are complete it is very important that you enable Real-time Protection again.
We shall reenable after the fix.


Remove These HijackThis entries

• Run HijackThis
• Click on the Scan button
• Put a check beside all of the items listed below (if present)
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
• Close all open windows and browsers/email, etc…
• Click on the Fix Checked button
• When completed, close the application.
  
  
  Update Java
  
  • Download the latest version of Java Runtime Environment (JRE) 5.0 Update 8.
  • Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • Check the box that says: "Accept License Agreement".
  • The page will refresh.
  • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-1_5_0_08-windows-i586-p to install the newest version.
  please do an online scan with Kaspersky Online Scanner
  
  Click on Kaspersky Online Scanner
  
  You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then start to download the latest definition files.
  • Once the scanner is installed and the definitions downloaded, click Next.
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  • Extended (If available otherwise Standard)
  • Scan Options:
  • Scan Archives
  • Scan Mail Bases
  • Click OK
  • Now under select a target to scan select My Computer
  • The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button:
  • Save the file to your desktop.
  • Copy and paste that information in your next post.
  Next post Include kaspersky log and New HJT log
  Thanks

Hi Brianmotes
your kaspersky log came back clean.

can you explain what we are doing so I understand the process

On the whole we have a few minor malware issues to deal with, which have been known to slow things down. also keeping you upto date with security issues.
It seems they are being a little stubborn. I will also deal with the AOL entries for you.


Next we need to stop a couple of processes that are running on your computer

To do this…
Startup HJT and select the 4th button entitled
Open the misc tools section

Under where it says system tools click on
Open process manager

Now look for the following processes one by one in the list below, once you find them highlight them then click on the
killl process
button
acsd.exe
wanmpsvc.exe

Please copy (Ctrl+C) and paste (Ctrl+V) the following text in the quote to Notepad.
Save it as "All Files" and name it FixServices.bat. Please save it on your desktop.
I will tell you when to use it.

@echo off
sc stop AOL ACS
sc delete AOL ACS
sc stop WANMiniportService 
sc delete WANMiniportService 
exit

• Close all programs so that you are at your desktop.
• Double-click on the My Computer icon.
• Select the Tools menu and click Folder Options
• After the new window appears select the View tab.
• Place a checkmark in the checkbox labeled Display the contents of system folders
• Under the Hidden files and folders section select the radio button labeled Show hidden files and folders
• Remove the checkmark from the checkbox labeled Hide file extensions for known file types
• Remove the checkmark from the checkbox labeled Hide protected operating system files
• Press the Apply and then the ok button and shut down my computer
• Now your computer is configured to show all hidden files.
• For you and the tools to be able to see appropriate files we need to Show Hidden Files

• Next, please reboot your computer in Safe Mode by doing the following:
  
• Restart your computer
  
• After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
  
• Instead of Windows loading as normal, a menu should appear use arrow up to highlight
  
• Select the first option, to run Windows in Safe Mode hit enter.
  
• For additional help in booting into Safe Mode, see the following site: HERE

Find the fixservice.bat you made earlier. Double click FixServices.bat. A window will open and close. This is normal.

• Run HijackThis
• Click on the Scan button
• Put a check beside all of the items listed below (if present)
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
• Close all open windows and browsers/email, etc…
• Click on the Fix Checked button
• When completed, close the application.

In Windows Explorer (My Computer) , select View, Details. Then navigate to each of these files or folders and Delete, if present:I have have shown the files\folders for deletion in Red
C:\PROGRA~1\COMMON~1\AOL <====This folder
C:\WINDOWS\wanmpsvc.exe <====This file

Re-boot into normal mode
in your next post please include new HJT log
Thanks

Hi Brianmotes
All were doing at the moment is trying to rule out malware on your system, which you are having problems with.
sometimes with malware your first pass doesn't deal with it, and you have to try a different method.
There are a couple of entries I still want to tidy up for you.

I need to look a little deeper because your still having problems
Please download WinPFind2.

• Extract the files to a folder(eg: C:\WinPFind2).
• Double click WinPFind2.exe to start the program.
• Click the Select All button in the File Options box of the Configuration tab(this is the tab the program opens up to by default).
• Click the Run all Scans button.
• When its finished scanning you will see Scans Complete! at the bottom left of the program.
• Click the Export to Text button.
• Notepad will open with the results of the scan and the log will be saved to the folder that you extracted the program to(C:\WinPFind2\WinPFind2.txt)
• Post the log in your next reply please. You may need to split the log over a couple posts so that it doesn't get cut off. If so please use the [Start Post #1] and [Start Post #2] deliminators in the log to split the log up.

Make the following batch file as you did before.

@echo off
sc stop AOL ACS
sc delete AOL ACS

Dont use yet.

1. Open HijackThis and click Scan
2. Checkmark the following items:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http:///???
O16 - DPF: {CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1) -

3. Important: Close all windows, except the HijackThis-window, and click Fix Checked

• Next, please reboot your computer in Safe Mode by doing the following:
  
• Restart your computer
  
• After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
  
• Instead of Windows loading as normal, a menu should appear use arrow up to highlight
  
• Select the first option, to run Windows in Safe Mode hit enter.
  
• For additional help in booting into Safe Mode, see the following site: HERE

Find the batch file you made and double click it.

Search and delete files
We need to do a search now. Go to

• Start
• Search
• For Files and Folders
• Expand Search Options, check Advanced Options, check Search system folders, Search hidden files and folders, and Search Subfolders.
• Paste this into the Search for files and folders named box:
• AOL <===This folder

If any of these files/folders are found please delete them.
If you dont find this dont worry.

Re-boot into normal mode
please send a further HJT log and the winpfind log
Thanks

I have finally done both and it took forever, my computer is running slower. It took over 10 minutes to load this page alone and if the computer goes to screan saver, any application I am using will go to not responding. I think that just formatting the hard drive and starting over will be easier, or are we cose to fixing the problem? Here are the logs Logfile created on: 08/18/2006 10:25 WinPFind2 by OldTimer - Version 1.0.3 Folder = C:\Documents and Settings\Brian Montes.BRIAN\My Documents\Unzipped\winpfind2\WinPFind2\ Microsoft Windows XP (Version = Service Pack 2) Internet Explorer (Version - 6.0.2900.2180) [Start Post #1] Processes Image Name—————ProcessID–Thread Count–Parent ID–Base Priority– #Full Path ##(Version Info) alg.exe——————002132—–0008———-000472—–Normal——— #c:\windows\system32\alg.exe ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 44544 bytes | Date = 08/04/2004 03:56 | Attr = ]) csrss.exe—————-000404—–0011———-000352—–Normal——— #\??\c:\windows\system32\csrss.exe ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 6144 bytes | Date = 08/04/2004 03:56 | Attr = ]) explorer.exe————-001144—–0016———-001124—–Normal——— #c:\windows\explorer.exe ##(Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 1032192 bytes | Date = 08/04/2004 03:56 | Attr = ]) jusched.exe————–001964—–0001———-001144—–Normal——— #c:\program files\java\jre1.5.0_08\bin\jusched.exe ##(Sun Microsystems, Inc. [Ver = 5.0.80.3 | Size = 49263 bytes | Date = 07/26/2006 03:03 | Attr = ]) lsass.exe—————-000484—–0018———-000428—–Normal——— #c:\windows\system32\lsass.exe ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 13312 bytes | Date = 08/04/2004 03:56 | Attr = ]) mcagent.exe————–001632—–0002———-001564—–Normal——— #c:\program files\mcafee.com\agent\mcagent.exe ##(McAfee, Inc [Ver = 6, 0, 0, 16 | Size = 303104 bytes | Date = 09/22/2005 19:29 | Attr = ]) mcdetect.exe————-001416—–0007———-000472—–Normal——— #c:\program files\mcafee.com\agent\mcdetect.exe ##(McAfee, Inc [Ver = 6, 0, 0, 19 | Size = 126976 bytes | Date = 10/13/2005 20:56 | Attr = ]) mcshield.exe————-001452—–0018———-000472—–High———– #c:\progra~1\mcafee.com\vso\mcshield.exe ##(McAfee Inc. [Ver = 11.0.0.151 | Size = 221184 bytes | Date = 08/10/2005 11:22 | Attr = ]) mctskshd.exe————-001476—–0002———-000472—–Normal——— #c:\progra~1\mcafee.com\agent\mctskshd.exe ##(McAfee, Inc [Ver = 6, 0, 0, 13 | Size = 122368 bytes | Date = 08/24/2005 16:01 | Attr = ]) mcvsescn.exe————-001660—–0002———-001564—–Normal——— #c:\progra~1\mcafee.com\vso\mcvsescn.exe ##(McAfee, Inc. [Ver = 10, 0, 0, 20 | Size = 483328 bytes | Date = 07/08/2005 18:16 | Attr = ]) mcvsshld.exe————-001564—–0002———-000652—–Normal——— #c:\program files\mcafee.com\vso\mcvsshld.exe ##(McAfee, Inc. [Ver = 10, 0, 0, 22 | Size = 163840 bytes | Date = 08/10/2005 12:49 | Attr = ]) mpfservice.exe———–001596—–0009———-000472—–Normal——— #c:\progra~1\mcafee.com\person~1\mpfservice.exe ##(McAfee Corporation [Ver = 7.1.0.113 | Size = 548864 bytes | Date = 11/11/2005 17:43 | Attr = ]) msmpeng.exe————–000796—–0018———-000472—–Normal——— #c:\program files\windows defender\msmpeng.exe ##(Microsoft Corporation [Ver = 1.1.1347.0 | Size = 14032 bytes | Date = 04/03/2006 18:12 | Attr = ]) oasclnt.exe————–001520—–0002———-001452—–Normal——— #c:\progra~1\mcafee.com\vso\oasclnt.exe ##(McAfee, Inc. [Ver = 10, 0, 0, 24 | Size = 53248 bytes | Date = 08/11/2005 22:02 | Attr = ]) services.exe————-000472—–0016———-000428—–Normal——— #c:\windows\system32\services.exe ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 108032 bytes | Date = 08/04/2004 03:56 | Attr = ]) smss.exe—————–000352—–0003———-000004—–Normal——— #\systemroot\system32\smss.exe ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 50688 bytes | Date = 08/04/2004 03:56 | Attr = ]) spoolsv.exe————–001216—–0013———-000472—–Normal——— #c:\windows\system32\spoolsv.exe ##(Microsoft Corporation [Ver = 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519) | Size = 57856 bytes | Date = 06/10/2005 19:53 | Attr = ]) svchost.exe————–000960—–0017———-000472—–Normal——— #c:\windows\system32\svchost.exe ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) svchost.exe————–000904—–0007———-000472—–Normal——— #c:\windows\system32\svchost.exe ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) svchost.exe————–000732—–0014———-000472—–Normal——— #c:\windows\system32\svchost.exe ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) svchost.exe————–000836—–0072———-000472—–Normal——— #c:\windows\system32\svchost.exe ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) svchost.exe————–001720—–0007———-000472—–Normal——— #c:\windows\system32\svchost.exe ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) svchost.exe————–000184—–0009———-000472—–Normal——— #c:\windows\system32\svchost.exe ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) svchost.exe————–000652—–0017———-000472—–Normal——— #c:\windows\system32\svchost.exe ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) wdfmgr.exe—————001788—–0004———-000472—–Normal——— #c:\windows\system32\wdfmgr.exe ##(Microsoft Corporation [Ver = 5.2.3790.1230 built by: DNSRV(bld4act) | Size = 38912 bytes | Date = 08/11/2004 01:45 | Attr = ]) winlogon.exe————-000428—–0016———-000352—–High———– #\??\c:\windows\system32\winlogon.exe ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 502272 bytes | Date = 08/04/2004 03:56 | Attr = ]) winpfind2.exe————003872—–0001———-001144—–Normal——— #c:\documents and settings\brian montes.brian\my documents\unzipped\winpfind2\winpfind2\winpfind2.exe ##(OldTimer Tools [Ver = 1.0.3.0 | Size = 386048 bytes | Date = 08/12/2006 16:23 | Attr = ]) Registry Entries #Value ##(Version Info) <<< Version Info >>> WinPFind2 by OldTimer - Version 1.0.3 # ## Microsoft Windows XP Version = Service Pack 2 # ## Internet Explorer Version = 6.0.2900.2180 # ## <<< Internet Explorer Settings >>> HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page #about:blank ## HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Page #http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch ## HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default Page # ## HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default Search #http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch ## HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Local Page #%SystemRoot%\system32\blank.htm ## HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page #http:///??? ## HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Page # ## HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Local Page #C:\WINDOWS\system32\blank.htm ## HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable #0 ## HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride # ## <<< BHO's >>> HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} #SSVHelper Class = C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll ##(Sun Microsystems, Inc. [Ver = 5.0.80.3 | Size = 434279 bytes | Date = 07/26/2006 03:17 | Attr = ]) <<< Internet Explorer Bars, Toolbars and Extensions >>> HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{30D02401-6A81-11D0-8274-00C04FD5AE38} #Search Band = %SystemRoot%\System32\browseui.dll ##(Microsoft Corporation [Ver = 6.00.2900.2937 (xpsp_sp2_gdr.060623-0002) | Size = 1022976 bytes | Date = 06/23/2006 07:02 | Attr = ]) HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478} #Reg Data missing or invalid = Reg Data missing or invalid ##(File not found) HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{EFA24E61-B078-11D0-89E4-00C04FC9E26E} #Favorites Band = %SystemRoot%\System32\shdocvw.dll ##(Microsoft Corporation [Ver = 6.00.2900.2937 (xpsp_sp2_gdr.060623-0002) | Size = 1494016 bytes | Date = 06/23/2006 07:02 | Attr = ]) HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{EFA24E62-B078-11D0-89E4-00C04FC9E26E} #History Band = %SystemRoot%\System32\shdocvw.dll ##(Microsoft Corporation [Ver = 6.00.2900.2937 (xpsp_sp2_gdr.060623-0002) | Size = 1494016 bytes | Date = 06/23/2006 07:02 | Attr = ]) HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E} #Explorer Band = %SystemRoot%\System32\shdocvw.dll ##(Microsoft Corporation [Ver = 6.00.2900.2937 (xpsp_sp2_gdr.060623-0002) | Size = 1494016 bytes | Date = 06/23/2006 07:02 | Attr = ]) HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376} #&Tip of the Day = %SystemRoot%\System32\shdocvw.dll ##(Microsoft Corporation [Ver = 6.00.2900.2937 (xpsp_sp2_gdr.060623-0002) | Size = 1494016 bytes | Date = 06/23/2006 07:02 | Attr = ]) HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{FE54FA40-D68C-11d2-98FA-00C0F0318AFE} #Real.com = C:\WINDOWS\System32\Shdocvw.dll ##(Microsoft Corporation [Ver = 6.00.2900.2937 (xpsp_sp2_gdr.060623-0002) | Size = 1494016 bytes | Date = 06/23/2006 07:02 | Attr = ]) HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{01E04581-4EEE-11D0-BFE9-00AA005B4383} #&Address = %SystemRoot%\System32\browseui.dll ##(Microsoft Corporation [Ver = 6.00.2900.2937 (xpsp_sp2_gdr.060623-0002) | Size = 1022976 bytes | Date = 06/23/2006 07:02 | Attr = ]) HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0E5CBF21-D15F-11D0-8301-00AA005B4383} #&Links = %SystemRoot%\system32\SHELL32.dll ##(Microsoft Corporation [Ver = 6.00.2900.2951 (xpsp_sp2_gdr.060713-0009) | Size = 8453632 bytes | Date = 07/13/2006 09:33 | Attr = ]) HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} #Reg Data missing or invalid = Reg Data missing or invalid ##(File not found) HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} #Yahoo! Toolbar = C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll ##(Yahoo! Inc. [Ver = 2005, 9, 20, 1 | Size = 393208 bytes | Date = 09/20/2005 18:00 | Attr = ]) HKCU\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} #8192 - Sun Java Console ## HKCU\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{CD67F990-D8E9-11d2-98FE-00C0F0318AFE} #8194 - Reg Data missing or invalid ## HKCU\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{FB5F1910-F110-11d2-BB9E-00C04F795683} #8195 - Reg Data missing or invalid ## HKCU\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\NextId #8196 ## HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} #MenuText: Sun Java Console = C:\Program Files\Java\jre1.5.0_08\bin\npjpi150_08.dll ##(Sun Microsystems, Inc. [Ver = 5.0.80.3 | Size = 69746 bytes | Date = 07/26/2006 03:17 | Attr = ]) HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} #MenuText: Sun Java Console = C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll ##(Sun Microsystems, Inc. [Ver = 5.0.80.3 | Size = 434279 bytes | Date = 07/26/2006 03:17 | Attr = ]) <<< Approved Shell Extensions (Non-Microsoft only) >>> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{0DF44EAA-FF21-4412-828E-260A8728E7F1} #Taskbar and Start Menu = Reg Data missing or invalid ##(File not found) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{32683183-48a0-441b-a342-7c2a440a9478} #Media Band = Reg Data missing or invalid ##(File not found) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{42071714-76d4-11d1-8b24-00a0c9068ff3} #Display Panning CPL Extension = deskpan.dll ##(File not found) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{51550900-DCAC-11d4-AA0F-0080C87C465B} #WayTech MultiMouse = C:\Program Files\Labtec\Wireless Mouse\CPDll.dll ##( [Ver = | Size = 327680 bytes | Date = 02/21/2003 14:31 | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{5CA3D70E-1895-11CF-8E15-001234567890} #DriveLetterAccess = Reg Data missing or invalid ##(File not found) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{764BF0E1-F219-11ce-972D-00AA00A14F56} #Shell extensions for file compression = Reg Data missing or invalid ##(File not found) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{7A9D77BD-5403-11d2-8785-2E0420524153} #User Accounts = Reg Data missing or invalid ##(File not found) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} #Encryption Context Menu = Reg Data missing or invalid ##(File not found) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{88895560-9AA2-1069-930E-00AA0030EBC8} #HyperTerminal Icon Ext = C:\WINDOWS\System32\hticons.dll ##(Hilgraeve, Inc. [Ver = 5.1.2600.0 | Size = 44544 bytes | Date = 08/29/2002 06:00 | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{955B7B84-5308-419c-8ED8-0B9CA3C56985} #6 Months of AOL Included = C:\PROGRA~1\COMMON~1\aolshare\shell\us\shellext.dll ##(America Online, Inc. [Ver = 2, 0, 0, 1 | Size = 111824 bytes | Date = 08/09/2003 18:36 | Attr = H ]) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DEE12703-6333-4D4E-8F34-738C4DCC2E04} #RecordNow! SendToExt = C:\Program Files\Sonic\RecordNow!\shlext.dll ##( [Ver = 7.0.0.0 | Size = 73728 bytes | Date = 03/25/2004 08:01 | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{E0D79304-84BE-11CE-9641-444553540000} #WinZip = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL ##(WinZip Computing, Inc. [Ver = 4.1 (32-bit) | Size = 5120 bytes | Date = 08/16/2004 09:00 | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{E0D79305-84BE-11CE-9641-444553540000} #WinZip = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL ##(WinZip Computing, Inc. [Ver = 4.1 (32-bit) | Size = 5120 bytes | Date = 08/16/2004 09:00 | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{E0D79306-84BE-11CE-9641-444553540000} #WinZip = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL ##(WinZip Computing, Inc. [Ver = 4.1 (32-bit) | Size = 5120 bytes | Date = 08/16/2004 09:00 | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{E0D79307-84BE-11CE-9641-444553540000} #WinZip = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL ##(WinZip Computing, Inc. [Ver = 4.1 (32-bit) | Size = 5120 bytes | Date = 08/16/2004 09:00 | Attr = ]) HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BDEADF00-C265-11d0-BCED-00A0C90AB50F} #Web Folders = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL ##( [Ver = | Size = 561209 bytes | Date = 05/19/2001 09:57 | Attr = ]) <<< ContextMenuHandlers (Non-Microsoft only) >>> HKLM\Software\Classes\*\shellex\ContextMenuHandlers\{CFC7205E-2792-4378-9591-3879CC6C9022} # = c:\progra~1\mcafee.com\vso\mcvsshl.dll ##(McAfee, Inc. [Ver = 10, 0, 0, 19 | Size = 114688 bytes | Date = 07/01/2005 20:44 | Attr = ]) HKLM\Software\Classes\*\shellex\ContextMenuHandlers\WinZip #{E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL ##(WinZip Computing, Inc. [Ver = 4.1 (32-bit) | Size = 5120 bytes | Date = 08/16/2004 09:00 | Attr = ]) HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinZip #{E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL ##(WinZip Computing, Inc. [Ver = 4.1 (32-bit) | Size = 5120 bytes | Date = 08/16/2004 09:00 | Attr = ]) HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\{CFC7205E-2792-4378-9591-3879CC6C9022} # = c:\progra~1\mcafee.com\vso\mcvsshl.dll ##(McAfee, Inc. [Ver = 10, 0, 0, 19 | Size = 114688 bytes | Date = 07/01/2005 20:44 | Attr = ]) HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinZip #{E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL ##(WinZip Computing, Inc. [Ver = 4.1 (32-bit) | Size = 5120 bytes | Date = 08/16/2004 09:00 | Attr = ]) <<< ColumnHandlers (Non-Microsoft only) >>> HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{F9DB5320-233E-11D1-9F84-707F02C10627} #PDF Shell Extension = C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll ##(Adobe Systems, Inc. [Ver = 7.0.0.0 | Size = 110592 bytes | Date = 12/14/2004 03:20 | Attr = ]) <<< Registry Run Keys >>> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\MCAgentExe #c:\PROGRA~1\mcafee.com\agent\McAgent.exe ##(McAfee, Inc [Ver = 6, 0, 0, 16 | Size = 303104 bytes | Date = 09/22/2005 19:29 | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\MCUpdateExe #c:\PROGRA~1\mcafee.com\agent\mcupdate.exe ##(McAfee, Inc [Ver = 6, 0, 0, 21 | Size = 212992 bytes | Date = 01/11/2006 13:05 | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched #"C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe" ##(Sun Microsystems, Inc. [Ver = 5.0.80.3 | Size = 49263 bytes | Date = 07/26/2006 03:03 | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL #Installed = 1 ## HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI #Installed = 1 ## HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS #Installed = 1 ## # ## C:\Documents and Settings\All Users\Start Menu\Programs\Startup\DESKTOP.INI #C:\Documents and Settings\All Users\Start Menu\Programs\Startup\DESKTOP.INI ##( [Ver = | Size = 84 bytes | Date = 09/03/2002 10:00 | Attr = HS]) C:\Documents and Settings\Brian Montes.BRIAN\Start Menu\Programs\Startup\DESKTOP.INI #C:\Documents and Settings\Brian Montes.BRIAN\Start Menu\Programs\Startup\DESKTOP.INI ##( [Ver = | Size = 84 bytes | Date = 09/03/2002 10:00 | Attr = HS]) <<< Disabled MSConfig Items >>> HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpFolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ Labtec Mouse Software 2.0.lnk # Labtec Mouse Software 2.0 = C:\PROGRA~1\Labtec\WIRELE~1\MulMouse.exe ##( [Ver = | Size = 253952 bytes | Date = 02/19/2003 16:03 | Attr = ]) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpFolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk #Adobe Reader Speed Launch = C:\PROGRA~1\Adobe\ACROBA~2.0\Reader\READER~1.EXE ##(Adobe Systems Incorporated [Ver = 7.0.5.2005092300 | Size = 29696 bytes | Date = 09/24/2005 02:05 | Attr = ]) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpFolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk #America Online 9.0 Tray Icon = ##(File not found) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpFolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^LimeWire 4.2.6.lnk #LimeWire 4.2.6 = ##(File not found) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpFolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk #Microsoft Office = C:\PROGRA~1\MICROS~3\Office\OSA9.EXE -b -l ##(Microsoft Corporation [Ver = 9.0.2617 | Size = 65588 bytes | Date = 02/17/1999 16:05 | Attr = ]) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpFolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk #WinZip Quick Pick = C:\PROGRA~1\WinZip\WZQKPICK.EXE ##(WinZip Computing, Inc. [Ver = 1.0 (32-bit) | Size = 118784 bytes | Date = 08/16/2004 09:00 | Attr = ]) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpFolder\C:^Documents and Settings^Brian Montes.BRIAN^Start Menu^Programs^Startup^LimeWire On Startup.lnk #LimeWire On Startup = ##(File not found) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpFolder\C:^Documents and Settings^Brian Montes.BRIAN^Start Menu^Programs^Startup^Yahoo! Widget Engine.lnk #Yahoo! Widget Engine = ##(File not found) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\AGRSMMSG #AGRSMMSG = AGRSMMSG.exe ##(Agere Systems [Ver = 2.1.36 2.1.36 11/19/2003 15:41:01 | Size = 88363 bytes | Date = 11/19/2003 16:41 | Attr = ]) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\Apoint #Apoint = C:\Program Files\Apoint\Apoint.exe ##(Alps Electric Co., Ltd. [Ver = 5.5.101.123 | Size = 155648 bytes | Date = 02/02/2004 16:32 | Attr = ]) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\BuildBU #bldbubg = c:\dell\bldbubg.exe ##( [Ver = | Size = 61440 bytes | Date = 02/19/2004 09:23 | Attr = ]) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\DVDLauncher #DVDLauncher = "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" ##(CyberLink Corp. [Ver = 3.00.0000 | Size = 53248 bytes | Date = 04/11/2004 12:43 | Attr = ]) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\HD #Hd = ##(File not found) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\MCUpdateExe #McUpdate = c:\PROGRA~1\mcafee.com\agent\McUpdate.exe ##(McAfee, Inc [Ver = 6, 0, 0, 21 | Size = 212992 bytes | Date = 01/11/2006 13:05 | Attr = ]) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\mmtask #mmtask = C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe ##(Musicmatch Inc. [Ver = 9.0.0.1 | Size = 53248 bytes | Date = 10/08/2004 09:49 | Attr = ]) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\MMTray #mm_tray = C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe ##(Musicmatch, Inc. [Ver = 9.00.2063 | Size = 131072 bytes | Date = 10/08/2004 09:49 | Attr = ]) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\MoneyAgent #mnyexpr = "C:\Program Files\Microsoft Money\System\mnyexpr.exe" ##(Microsoft Corp. [Ver = 12.00.0613 | Size = 200704 bytes | Date = 06/18/2003 13:00 | Attr = ]) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\MSMSGS #msmsgs = "C:\Program Files\Messenger\msmsgs.exe" /background ##(Microsoft Corporation [Ver = 4.7.3001 | Size = 1694208 bytes | Date = 10/13/2004 12:24 | Attr = HS]) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\PCMService #PCMService = "C:\Program Files\Dell\Media Experience\PCMService.exe" ##(CyberLink Corp. [Ver = 1.0.1611 | Size = 290816 bytes | Date = 04/11/2004 21:15 | Attr = ]) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\PCTAVApp #PCTAV = "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN ##(File not found) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\QMusic #QMAgent = ##(File not found) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\QuickTime Task #qttask = "C:\Program Files\QuickTime\qttask.exe" -atboottime ##(Apple Computer, Inc. [Ver = 6.5.1 | Size = 98304 bytes | Date = 05/18/2006 11:34 | Attr = ]) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\RealTray #RealPlay = C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER ##(RealNetworks, Inc. [Ver = 6.0.9.584 | Size = 26112 bytes | Date = 07/14/2004 11:19 | Attr = ]) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\RegistryMechanic #RegMech = C:\Program Files\Registry Mechanic\RegMech.exe /S ##(PC Tools Research Pty Ltd [Ver = 5.00.0144 | Size = 2076440 bytes | Date = 08/25/2005 13:14 | Attr = ]) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\SpywareBot #SpywareBot = ##(File not found) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\StatusClient #StatusClient = C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto ##(Hewlett-Packard [Ver = 00.00.13 | Size = 36864 bytes | Date = 12/16/2002 17:51 | Attr = ]) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\SunJavaUpdateSched #jusched = C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe ##(File not found) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\TomcatStartup #hpbpsttp = C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe ##(Hewlett-Packard [Ver = 2, 0, 0, 3 | Size = 155648 bytes | Date = 03/31/2003 20:28 | Attr = ]) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\UpdateManager #sgtray = "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r ##(Sonic Solutions [Ver = 1.01.32a | Size = 110592 bytes | Date = 08/19/2003 02:01 | Attr = ]) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\updateMgr #AdobeUpdateManager = "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1 ##(Adobe Systems Incorporated [Ver = 3.1.0.9 | Size = 307200 bytes | Date = 10/24/2005 15:53 | Attr = ]) HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\Windows Defender #MSASCui = "C:\Program Files\Windows Defender\MSASCui.exe" -hide ##(Microsoft Corporation [Ver = 1.1.1347.0 | Size = 777424 bytes | Date = 04/03/2006 18:12 | Attr = ]) <<< User Agent Post Platform >>> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\\SV1 # ## <<< AppInit DLLs >>> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs # ##(File not found) <<< Image File Execution Options >>> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path #Debugger = ntsd -d ## <<< Shell Service Object Delay Load >>> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\CDBurn #{fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll ##(Microsoft Corporation [Ver = 6.00.2900.2951 (xpsp_sp2_gdr.060713-0009) | Size = 8453632 bytes | Date = 07/13/2006 09:33 | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\PostBootReminder #{7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll ##(Microsoft Corporation [Ver = 6.00.2900.2951 (xpsp_sp2_gdr.060713-0009) | Size = 8453632 bytes | Date = 07/13/2006 09:33 | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\SysTray #{35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\System32\stobject.dll ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 121856 bytes | Date = 08/04/2004 03:56 | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck #{E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\System32\webcheck.dll ##(Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 276480 bytes | Date = 08/04/2004 03:56 | Attr = ]) <<< Shell Execute Hooks >>> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} #Microsoft AntiMalware ShellExecuteHook = C:\PROGRA~1\WINDOW~4\MpShHook.dll ##(Microsoft Corporation [Ver = 1.1.1347.0 | Size = 81616 bytes | Date = 04/03/2006 18:12 | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} #URL Exec Hook = shell32.dll ##(Microsoft Corporation [Ver = 6.00.2900.2951 (xpsp_sp2_gdr.060713-0009) | Size = 8453632 bytes | Date = 07/13/2006 09:33 | Attr = ]) <<< Shared Task Scheduler >>> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{438755C2-A8BA-11D1-B96B-00A0C90312E1} #Browseui preloader = %SystemRoot%\System32\browseui.dll ##(Microsoft Corporation [Ver = 6.00.2900.2937 (xpsp_sp2_gdr.060623-0002) | Size = 1022976 bytes | Date = 06/23/2006 07:02 | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{8C7461EF-2B13-11d2-BE35-3078302C2030} #Component Categories cache daemon = %SystemRoot%\System32\browseui.dll ##(Microsoft Corporation [Ver = 6.00.2900.2937 (xpsp_sp2_gdr.060623-0002) | Size = 1022976 bytes | Date = 06/23/2006 07:02 | Attr = ]) <<< Winlogon >>> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit #C:\WINDOWS\system32\userinit.exe, ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 24576 bytes | Date = 08/04/2004 03:56 | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell #Explorer.exe ##(Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 1032192 bytes | Date = 08/04/2004 03:56 | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\System # ##(File not found) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain #crypt32.dll ##(Microsoft Corporation [Ver = 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 597504 bytes | Date = 08/04/2004 03:56 | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet #cryptnet.dll ##(Microsoft Corporation [Ver = 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 63488 bytes | Date = 08/04/2004 03:56 | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll #cscdll.dll ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 101888 bytes | Date = 08/04/2004 03:56 | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp #wlnotify.dll ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 92672 bytes | Date = 08/04/2004 03:56 | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule #wlnotify.dll ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 92672 bytes | Date = 08/04/2004 03:56 | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy #sclgntfy.dll ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 20992 bytes | Date = 08/04/2004 03:56 | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn #WlNotify.dll ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 92672 bytes | Date = 08/04/2004 03:56 | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv #wlnotify.dll ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 92672 bytes | Date = 08/04/2004 03:56 | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon # ##(File not found) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon #wlnotify.dll ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 92672 bytes | Date = 08/04/2004 03:56 | Attr = ]) <<< DNS Name Servers >>> HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{3673E877-4721-4146-933E-3F2BE2472655} # (SiS 900-Based PCI Fast Ethernet Adapter) ## HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{50757A74-8D14-4DF4-808C-195BF84A8E85} # (Motorola SURFboard SB5120 USB Cable Modem) ## HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{78A84C20-BAF1-482A-934B-4A1ED4F87373} # (Motorola SURFboard SB5120 USB Cable Modem) ## HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{9DF156C8-3CA2-492B-B3CA-3372E8C7FBEE} # (Motorola SURFboard SB5120 USB Cable Modem) ## HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{B39B3C91-BFC8-4834-B51A-6D50CE58B607} # (Dell TrueMobile 1300 WLAN PC Card) ## HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{F373ACED-9CA6-481E-AB2D-BD80E185AB4B} # (Motorola SURFboard SB5120 USB Cable Modem) ## <<< Winsock2 Catalogs (Non-Microsoft only) >>> <<< Protocol Handlers (Non-Microsoft only) >>> HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\ipp # ##(File not found) HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp # ##(File not found) <<< Protocol Filters (Non-Microsoft only) >>> [Start Post #2] Services Name–Internal Name–Startup Type–State–Service Type– #Path ##(Version Info) Application Layer Gateway Service–ALG–On Demand–Running–Win32, running in it's own process– #C:\WINDOWS\System32\alg.exe ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 44544 bytes | Date = 08/04/2004 03:56 | Attr = ]) Windows Audio–AudioSrv–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\System32\svchost.exe -k netsvcs ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) Cryptographic Services–CryptSvc–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\system32\svchost.exe -k netsvcs ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) DCOM Server Process Launcher–DcomLaunch–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\system32\svchost -k DcomLaunch ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) DHCP Client–Dhcp–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\System32\svchost.exe -k netsvcs ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) DNS Client–Dnscache–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\System32\svchost.exe -k NetworkService ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) Error Reporting Service–ERSvc–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\System32\svchost.exe -k netsvcs ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) Event Log–Eventlog–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\system32\services.exe ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 108032 bytes | Date = 08/04/2004 03:56 | Attr = ]) COM+ Event System–EventSystem–On Demand–Running–Win32, running in a shared process– #C:\WINDOWS\System32\svchost.exe -k netsvcs ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) Fast User Switching Compatibility–FastUserSwitchingCompatibility–On Demand–Running–Win32, running in a shared process– #C:\WINDOWS\System32\svchost.exe -k netsvcs ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) Help and Support–helpsvc–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\System32\svchost.exe -k netsvcs ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) Server–lanmanserver–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\System32\svchost.exe -k netsvcs ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) Workstation–lanmanworkstation–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\System32\svchost.exe -k netsvcs ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) TCP/IP NetBIOS Helper–LmHosts–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\System32\svchost.exe -k LocalService ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) McAfee WSC Integration–McDetect.exe–Automatic–Running–Win32, running in it's own process– #c:\program files\mcafee.com\agent\mcdetect.exe ##(McAfee, Inc [Ver = 6, 0, 0, 19 | Size = 126976 bytes | Date = 10/13/2005 20:56 | Attr = ]) McAfee.com McShield–McShield–Automatic–Running–Win32, running in it's own process– #c:\PROGRA~1\mcafee.com\vso\mcshield.exe ##(McAfee Inc. [Ver = 11.0.0.151 | Size = 221184 bytes | Date = 08/10/2005 11:22 | Attr = ]) McAfee Task Scheduler–McTskshd.exe–Automatic–Running–Win32, running in it's own process– #c:\PROGRA~1\mcafee.com\agent\mctskshd.exe ##(McAfee, Inc [Ver = 6, 0, 0, 13 | Size = 122368 bytes | Date = 08/24/2005 16:01 | Attr = ]) Messenger–Messenger–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\System32\svchost.exe -k netsvcs ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) McAfee Personal Firewall Service–MpfService–Automatic–Running–Win32, running in it's own process– #C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe ##(McAfee Corporation [Ver = 7.1.0.113 | Size = 548864 bytes | Date = 11/11/2005 17:43 | Attr = ]) Network Connections–Netman–On Demand–Running–Win32, running in a shared process– #C:\WINDOWS\System32\svchost.exe -k netsvcs ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) Network Location Awareness (NLA)–Nla–On Demand–Running–Win32, running in a shared process– #C:\WINDOWS\System32\svchost.exe -k netsvcs ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) Plug and Play–PlugPlay–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\system32\services.exe ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 108032 bytes | Date = 08/04/2004 03:56 | Attr = ]) Protected Storage–ProtectedStorage–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\system32\lsass.exe ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 13312 bytes | Date = 08/04/2004 03:56 | Attr = ]) Remote Access Connection Manager–RasMan–On Demand–Running–Win32, running in a shared process– #C:\WINDOWS\System32\svchost.exe -k netsvcs ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) Remote Procedure Call (RPC)–RpcSs–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\system32\svchost -k rpcss ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) Security Accounts Manager–SamSs–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\system32\lsass.exe ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 13312 bytes | Date = 08/04/2004 03:56 | Attr = ]) Task Scheduler–Schedule–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\System32\svchost.exe -k netsvcs ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) Secondary Logon–seclogon–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\System32\svchost.exe -k netsvcs ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) System Event Notification–SENS–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\system32\svchost.exe -k netsvcs ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) Windows Firewall/Internet Connection Sharing (ICS)–SharedAccess–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\System32\svchost.exe -k netsvcs ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) Shell Hardware Detection–ShellHWDetection–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\System32\svchost.exe -k netsvcs ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) Print Spooler–Spooler–Automatic–Running–Win32, running in it's own process– #C:\WINDOWS\system32\spoolsv.exe ##(Microsoft Corporation [Ver = 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519) | Size = 57856 bytes | Date = 06/10/2005 19:53 | Attr = ]) System Restore Service–srservice–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\System32\svchost.exe -k netsvcs ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) SSDP Discovery Service–SSDPSRV–On Demand–Running–Win32, running in a shared process– #C:\WINDOWS\System32\svchost.exe -k LocalService ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) Windows Image Acquisition (WIA)–stisvc–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\System32\svchost.exe -k imgsvc ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) Telephony–TapiSrv–On Demand–Running–Win32, running in a shared process– #C:\WINDOWS\System32\svchost.exe -k netsvcs ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) Terminal Services–TermService–On Demand–Running–Win32, running in a shared process– #C:\WINDOWS\System32\svchost -k DComLaunch ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) Themes–Themes–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\System32\svchost.exe -k netsvcs ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) Distributed Link Tracking Client–TrkWks–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\system32\svchost.exe -k netsvcs ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) Windows User Mode Driver Framework–UMWdf–Automatic–Running–Win32, running in it's own process– #C:\WINDOWS\system32\wdfmgr.exe ##(Microsoft Corporation [Ver = 5.2.3790.1230 built by: DNSRV(bld4act) | Size = 38912 bytes | Date = 08/11/2004 01:45 | Attr = ]) Windows Time–w32time–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\system32\svchost.exe -k netsvcs ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) WebClient–WebClient–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\System32\svchost.exe -k LocalService ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) Windows Defender Service–WinDefend–Automatic–Running–Win32, running in it's own process– #"C:\Program Files\Windows Defender\MsMpEng.exe" ##(Microsoft Corporation [Ver = 1.1.1347.0 | Size = 14032 bytes | Date = 04/03/2006 18:12 | Attr = ]) Windows Management Instrumentation–winmgmt–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\system32\svchost.exe -k netsvcs ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) Security Center–wscsvc–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\System32\svchost.exe -k netsvcs ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) Automatic Updates–wuauserv–Automatic–Running–Win32, running in it's own process– #C:\WINDOWS\system32\svchost.exe -k netsvcs ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) Wireless Zero Configuration–WZCSVC–Automatic–Running–Win32, running in a shared process– #C:\WINDOWS\System32\svchost.exe -k netsvcs ##(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Date = 08/04/2004 03:56 | Attr = ]) Files Full Path #Details %SystemDrive% # C:\stng260.exe #UPX! (McAfee Inc. [Ver = 2.6.0. | Size = 1144839 bytes | Date = 08/10/2006 22:18 | Attr = ]) %ProgramFilesDir% # %WinDir% # C:\WINDOWS\IFinst27.exe #UPX! ( [Ver = | Size = 65536 bytes | Date = 04/17/2005 14:24 | Attr = ]) %System% # C:\WINDOWS\SYSTEM32\DFRG.MSC #AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAwGpEc213( [Ver = | Size = 41397 bytes | Date = 08/29/2002 06:00 | Attr = ]) C:\WINDOWS\SYSTEM32\MRT.exe #(PeCompact2) (Microsoft Corporation [Ver = 1.19.1565.0 | Size = 8255912 bytes | Date = 08/02/2006 21:22 | Attr = ]) C:\WINDOWS\SYSTEM32\MRT.exe #(ASPack) (Microsoft Corporation [Ver = 1.19.1565.0 | Size = 8255912 bytes | Date = 08/02/2006 21:22 | Attr = ]) C:\WINDOWS\SYSTEM32\ntdll.dll #.aspack (Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 708096 bytes | Date = 08/04/2004 03:56 | Attr = ]) C:\WINDOWS\SYSTEM32\nusrmgr.cpl #Pln``pmlidb_[ZYWSUdxa\^`^Tsfbeffhjol(Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 257024 bytes | Date = 08/04/2004 03:56 | Attr = ]) C:\WINDOWS\SYSTEM32\rasdlg.dll #\DuMonitor SendMessage(WM_RASEVENT) done(Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 657920 bytes | Date = 08/04/2004 03:56 | Attr = ]) C:\WINDOWS\SYSTEM32\WBDBASE.DEU #msubjsuchsullsupeswinsyncszens( [Ver = | Size = 1309184 bytes | Date = 08/29/2002 06:00 | Attr = ]) C:\WINDOWS\SYSTEM32\WgaTray.exe #RIMAPPTECHNOLOGIES (Microsoft Corporation [Ver = 1.5.0540.0 | Size = 304944 bytes | Date = 06/19/2006 16:19 | Attr = ]) %System%\Drivers folder and sub-folders # C:\WINDOWS\SYSTEM32\drivers\mtlstrm.sys #V90NEC, ——–ERROR——— occured in adaptecho(Smart Link [Ver = 3.80.01MC15 | Size = 1309184 bytes | Date = 08/04/2004 01:41 | Attr = ]) %windir% + sub-dirs for System or Hidden files less than 60 days old # C:\WINDOWS\BOOTSTAT.DAT # ( [Ver = | Size = 2048 bytes | Date = 08/18/2006 01:11 | Attr = S]) C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB917422.cat # ( [Ver = | Size = 10925 bytes | Date = 07/05/2006 08:21 | Attr = S]) C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB918899.cat # ( [Ver = | Size = 23751 bytes | Date = 07/28/2006 08:16 | Attr = S]) C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB920214.cat # ( [Ver = | Size = 10337 bytes | Date = 07/27/2006 10:00 | Attr = S]) C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB920670.cat # ( [Ver = | Size = 10925 bytes | Date = 07/21/2006 05:03 | Attr = S]) C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB920683.cat # ( [Ver = | Size = 11929 bytes | Date = 06/26/2006 15:47 | Attr = S]) C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB921398.cat # ( [Ver = | Size = 13050 bytes | Date = 07/13/2006 10:24 | Attr = S]) C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB921883.cat # ( [Ver = | Size = 10925 bytes | Date = 07/14/2006 12:13 | Attr = S]) C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB922616.cat # ( [Ver = | Size = 10925 bytes | Date = 07/14/2006 11:53 | Attr = S]) C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem20.CAT # ( [Ver = | Size = 10925 bytes | Date = 07/05/2006 08:21 | Attr = S]) C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WgaNotify.cat # ( [Ver = | Size = 7160 bytes | Date = 06/19/2006 16:20 | Attr = S]) C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG # ( [Ver = | Size = 1024 bytes | Date = 08/18/2006 01:18 | Attr = H ]) C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.rrr.LOG # ( [Ver = | Size = 0 bytes | Date = 08/13/2006 18:49 | Attr = H ]) C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG # ( [Ver = | Size = 1024 bytes | Date = 08/18/2006 01:12 | Attr = H ]) C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG # ( [Ver = | Size = 1024 bytes | Date = 08/18/2006 01:22 | Attr = H ]) C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG # ( [Ver = | Size = 1024 bytes | Date = 08/18/2006 01:46 | Attr = H ]) C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG # ( [Ver = | Size = 1024 bytes | Date = 08/18/2006 01:46 | Attr = H ]) C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\NTUSER.DAT.LOG # ( [Ver = | Size = 1024 bytes | Date = 08/09/2006 10:41 | Attr = H ]) C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG # ( [Ver = | Size = 1024 bytes | Date = 08/16/2006 06:28 | Attr = H ]) C:\WINDOWS\SYSTEM32\Microsoft\Protect\S-1-5-18\c75d90e5-3e1f-4d65-82dc-2df8de828d28 # ( [Ver = | Size = 388 bytes | Date = 07/11/2006 11:14 | Attr = HS]) C:\WINDOWS\SYSTEM32\Microsoft\Protect\S-1-5-18\Preferred # ( [Ver = | Size = 24 bytes | Date = 07/11/2006 11:14 | Attr = HS]) C:\WINDOWS\SYSTEM32\Microsoft\Protect\S-1-5-18\User\19902ba6-2123-4251-becc-282f6cf52b89 # ( [Ver = | Size = 388 bytes | Date = 07/15/2006 01:02 | Attr = HS]) C:\WINDOWS\SYSTEM32\Microsoft\Protect\S-1-5-18\User\Preferred # ( [Ver = | Size = 24 bytes | Date = 07/15/2006 01:02 | Attr = HS]) C:\WINDOWS\Tasks\MP Scheduled Scan.job # ( [Ver = | Size = 330 bytes | Date = 08/18/2006 01:15 | Attr = H ]) C:\WINDOWS\Tasks\SA.DAT # ( [Ver = | Size = 6 bytes | Date = 08/18/2006 01:12 | Attr = H ]) CPL files # C:\WINDOWS\SYSTEM32\access.cpl # (Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 68608 bytes | Date = 08/04/2004 03:56 | Attr = ]) C:\WINDOWS\SYSTEM32\appwiz.cpl # (Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 549888 bytes | Date = 08/04/2004 03:56 | Attr = ]) C:\WINDOWS\SYSTEM32\BCMWLCPL.CPL # (Dell Computer Corporation [Ver = 3.40.66.0 | Size = 958464 bytes | Date = 02/20/2004 17:13 | Attr = ]) C:\WINDOWS\SYSTEM32\bdeadmin.cpl # (Borland Software Corporation [Ver = 5.2.0.2 | Size = 184320 bytes | Date = 10/07/2003 14:39 | Attr = ]) C:\WINDOWS\SYSTEM32\bthprops.cpl

I dont know why that r0 came up again because I deleted it and it doesnt come up when I start ie. By the way can you inform me on what these processes are doing to my computer?

Hi Brianmontes, Thanks for your logs as you can appreciate the log is a bit more involved and will take me a little time to research then my work is checked. I will post back as soon as I can. thanks for your patience dan

Hi Brianmontes
Sorry for delay but have been working this weekend.

I can understand your frustrations when all you want is to get your pc up and running but sometimes it's not that straight forward.
A lot of common infections will show up to us in the HJT logs but your initial log, we didn't have much to go on so we had to dig deeper to rule out any hiding malware and this takes time.
Your winpfind logs showed up quite a few orphaned entries which were going to deal with.

It may be once i have consulted with my expert tutor that after seeing your final log we may not be able to help you further with this issue and you may want to post to a forum to check out hardware and software issues.
Thankyou for your patience.

Can you check for me if you have "viewpoint manager" in your add and remove programs you will find this in control panel.

Download and install it RegCleaner
we will use it in a while.Also available Here and AlsoHere

Go to Start, Run OR Start, Programs, Accessories, Command Prompt and type Services.msc and click OK.Under the Extended Tab, Scroll down and find the service.AOL Connectivity ServiceClick once on the service to highlight it.
Click StopRight-Click on the service. Choose PropertiesSelect the General tab. Click the Arrow-down tab on the right-hand side at the Start-up Type box.From the drop-down menu, click on DisabledClick the Apply tab, then click OK

How to Boot into Safe Mode

• Reboot the machine and wait for the beep.
• Rapidly press the F8 key until a menu of boot options appears
• Select Safe Mode

Open HJT

click on Config, then Misc Tools, and then press the Delete an NT service.. button. When it opens you should then enter AOL ACS and press OK.

Do a scan only and put a check mark against these entries

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http:///???
O16 - DPF: {CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1) -

• Click on the RegCleanr.exe
• Tools (at the top) > Registry Cleanup > Do Them All
• Then 'Select' (at top left) > choose ALL'Remove Selected" (at bottom right)
• A backup of all that was removed will be made, just choose 'Backups' (top right) to view them, you can delete them when you're confident they're no longer needed.

Re-boot into normal mode
post a new HJT log
thanks dan

Thanks but I gave my computer to my father and he did a manual reg cleaning and cleaned up my computer, it runsr great but the fan stays on still. Thanks anyways

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php