Hijack This Log 2

crisp Hello and Welcome to Tom Coyote forums. Sorry for the delay. I am currently looking at your log and will have a reply soon. However since things change, could you post a fresh Hijackthis log thanks bamajim

Crisp

Thanks for the new log

You may want to print out these instructions for reference as part of the fix will be in Safe mode and the information may not be easily available

First Disable Spybot S&D "resident tea timer" so it does not interfere with our fix.1) Run Spybot-S&D
2) Go to the Mode menu, select "Advanced Mode"
3) In the left pane, click Tools ->> Resident
4)Uncheck "Resident TeaTimer" and OK any prompts
5) Reboot your PC
Next Please download hosterAnd Save it to your Desktop
Rt Click Hoster.zip->>Extract all->>Extract it to your Desktop
Open The Hoster folder->>Double Click Hoster.exe (It will look like a yeild sign with a stop light in the center)
When the program Opens Click The "Restore Original Hosts" Button
Close the Hoster program when complete
Next Go here and Download Ewido Antimalware 4.0
(30 day free trial version) Save it to Your Desktop

Double Click Ewido-setup
(It will create its own folder)
Once the program starts You will be at the Status menuUnder "Your computers Security"
Click change status on Resident shield to inactive
Click Update now (next to last update)
After the update loads
Under Automatic updates Uncheck download and install updates automatically(recommended)
(you can always select maual updates the next day)
At the top toolbar Click Scanner Then the settings tabUnder How to act? Set default action for detected malwareTo Quarantine
Under how to scan All boxes should be checked
Under Possibly unwanted software All boxes should be checked
Under reports Select Automatically generate report after every scan
Uncheck Only if threats were found
Under what to scan Scan every file should be highlited
Exit Ewido(do not run it yet)

Next Reboot into Safe Mode
This can be done byRestart your PC, and after it starts, but before you see the Windows Splash screen
Begin tapping the F8 key twice a second untill you reach another menu screen (black background with white menu choices)
Use your arrow keys and select Safe Mode and then Enter
Run EwidoClick scanner
Select Complete system scan
Once the scan finishesSelect Apply all actions (The items found will be quarantined)
Click save report as (Another window will open)
Save it to your desktop
(By default It will be saved in the Ewido folder as)
C:\Program Files\ewido anti-spyware 4.0\Reports
Exit Ewido

Reboot your PC in Normal Mode
Double click the report-scan txt. you saved to your desktop
It will open in Notepad
Copy and paste that report as a reply to this thread
Do not run any other options untill instructed to do so


Next Run an online virus scan called Kaspersky from HERE.1. Click on "Kaspersky Online Scanner"
2. A new smaller window will pop up. Press on "Accept". After reading the contents.
3. Now Kaspersky will update the anti-virus database. Let it run.
4. Click on "Next"->>"Scan Settings", and make sure the database is set to "extended". And check both the scan options. Then click OK.
5. Then click on "My Computer". And the scan will start.
6. Once finished, save a log as ".txt" to the desktop.
Copy and post the results of the Kaspersky Online scan

Finally Re run Hijackthis and post a fresh log

Your reply should includeyour report_scan.txt from Ewido
your results from Kaspersky
a fresh Hijackthis log
thanks bamajim

Crisp

Thanks for the logs, good job

First Download MVPS HOSTS

And run it, if you need help the instructions are here

Next
Open Outlook Express and emptyYour Outbox folder
Your Inbox folder
Your deleted items folder
Sent Items folder
Next Update Your Java

• Download the latest version of Java Runtime Environment (JRE) 5.0 Update 8.
• Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
• Click the "Download" button to the right.
• Check the box that says: "Accept License Agreement".
• The page will refresh.
• Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java versions.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-1_5_0_08-windows-i586-p to install the newest version.

Next Re Run Hijackthis and place checks beside the following entryR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm

Close all other open windows except Hijackthis and Select "Fix checked"
Reboot your PC->>Re run Hijackthis and post a fresh Hijackthis log

thanks bamajim

thanks bamajim just 2 things before i continue 1: is it possible to delete just those messages in my inbox and sentbox without deleting every message in my outlook (i have a lot of very important emails saved in my inbox, i hope these will not be affected) 2: is it ok if we can remove the more sensitive information from our previous posts as im not too into having them on the internet! (dont worry i have saved all of them as a .html file in needed) cheers fella crisp

Crisp Yes you can delete the effected messages. And yes it will be edited bamajim

ok cool, however i cannot find either of these 2 messages in my inbox:

C

not sure why..

Edit personal email information at user request.

crisp Look in your Deleted Inbox, or deleted items box bamajim

hmm i empty my deleted items box every couple of hours, so they arent in there.. and i dont have (or cant find?!) a Deleted Inbox.. sorry

Crisp I want to check on a couple of things, and I'll be back soon thanks bamajim

Crisp

Glad to hear things are better

1) Download WinPFind.zip from here and save it to your Desktop.
You will need to extract the file(s):
Right click on the zipped folder and from the menu that appears, click on Extract All…
In the 'Extraction Wizard' window that opens, click on Next> and in the next window that appears, click on Next> again.
In the final window, click on Finish

You should now see a window with the WinPFind folder in it - close it, you will use it a little later.

2) You will need to know how to boot into Safe Mode.
Instructions can be found here.

3) Boot into Safe Mode.

4) Open the WinPFind folder and locate and double click winpfind.exe.
Click on 'Start Scan'.

When the scan has completed, you will find a copy of the results in the WinPFind folder called WinPFind.txt - copy and paste this file into your next reply.

thanks bamajim

hey bamajim heres my winPfind scan results WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding. If you see a message in the titlebar saying "Not responding…" you can ignore it. Windows somethimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly. »»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Product Name: Microsoft Windows 2000 Current Build: Service Pack 4 Current Build Number: 2195 Internet Explorer Version: 6.0.2800.1106 »»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»» Checking %SystemDrive% folder… Checking %ProgramFilesDir% folder… Checking %WinDir% folder… Checking %System% folder… UPX! 01/12/2005 23:08:34 28672 C:\WINNT\SYSTEM32\jesterrun.dll PECompact2 09/08/2006 20:03:04 8325544 C:\WINNT\SYSTEM32\MRT.exe aspack 09/08/2006 20:03:04 8325544 C:\WINNT\SYSTEM32\MRT.exe Umonitor 12/01/2005 20:39:46 531216 C:\WINNT\SYSTEM32\RASDLG.DLL UPX! 27/04/2006 17:49:30 288417 C:\WINNT\SYSTEM32\SrchSTS.exe UPX! 09/01/2006 10:36:04 42496 C:\WINNT\SYSTEM32\swreg.exe UPX! 09/01/2006 10:36:06 40960 C:\WINNT\SYSTEM32\swsc.exe winsync 07/12/1999 13:00:00 1309184 C:\WINNT\SYSTEM32\wbdbase.deu Checking %System%\Drivers folder and sub-folders… Items found in C:\WINNT\SYSTEM32\drivers\etc\HOSTS 127.0.0.1 download1.shopathomeselect.com #[ADW_SAHAGENT.A] 127.0.0.1 www.shopathomeselect.com #[Adware.SAHAgent] 127.0.0.1 web-nexus.net #[Adw.Web-Nexus.WebNexusAdServer] 127.0.0.1 ax.web-nexus.net #[TROJ_QOOLAID.R] 127.0.0.1 dl.web-nexus.net #[eTrust.Win32.Qoologic] 127.0.0.1 dl.web-nexus.net #[eTrust.Win32.Qoologic] 127.0.0.1 stech.web-nexus.net #[Trojan-Downloader.Win32.Qoologic.p] 127.0.0.1 stech.web-nexus.net #[Trojan-Downloader.Win32.Qoologic.p] 127.0.0.1 www.web-nexus.net 127.0.0.1 agentq.vpptechnologies.com 127.0.0.1 js.vpptechnologies.com 127.0.0.1 media-0.vpptechnologies.com 127.0.0.1 media-1.vpptechnologies.com 127.0.0.1 media-2.vpptechnologies.com #[SiteAdvisor.fish-screensaver.com] 127.0.0.1 media-4.vpptechnologies.com 127.0.0.1 media-5.vpptechnologies.com 127.0.0.1 media-6.vpptechnologies.com 127.0.0.1 media-8.vpptechnologies.com #[SiteAdvisor.fish-screensaver.com] 127.0.0.1 media-a.vpptechnologies.com #[a599.x.akamai.net] 127.0.0.1 media-b.vpptechnologies.com 127.0.0.1 media-c.vpptechnologies.com #[a1332.x.akamai.net] 127.0.0.1 media-d.vpptechnologies.com 127.0.0.1 media-e.vpptechnologies.com 127.0.0.1 media-f.vpptechnologies.com 127.0.0.1 msxml.vpptechnologies.com 127.0.0.1 static.vpptechnologies.com #[hotsearchbar.com] 127.0.0.1 xml.vpptechnologies.com #[BlazeFind] 127.0.0.1 ad-w-a-r-e.com #[Win32.Canbede][Troj/Dloader-IG] 127.0.0.1 www.ad-w-a-r-e.com #[AdWare.Win32.Look2Me.ab] 127.0.0.1 abetterinternet.com #[Downloader.Stubby.A][Adware.Aurora] 127.0.0.1 download.abetterinternet.com #[Adware.StopPopupAdsNow] 127.0.0.1 st.abetterinternet.com 127.0.0.1 static.abetterinternet.com 127.0.0.1 thinstall.abetterinternet.com 127.0.0.1 www.abetterinternet.com #[Trojan-Downloader.Win32.Stubby.d] Checking the Windows folder and sub-folders for system and hidden files within the last 60 days… 28/08/2006 20:37:28 H 54156 C:\WINNT\QTFont.qfn 29/08/2006 09:57:10 H 1053358 C:\WINNT\ShellIconCache 29/08/2006 09:57:14 S 64 C:\WINNT\CSC\00000001 29/08/2006 09:09:58 S 64 C:\WINNT\CSC\00000002 03/07/2006 10:29:48 S 64 C:\WINNT\CSC\csc1.tmp 29/08/2006 09:26:52 H 0 C:\WINNT\repair\ntuser.dat.LOG 11/08/2006 09:25:10 H 0 C:\WINNT\SoftwareDistribution\Download\S-1-5-18\fa6a8b6ef758224c8bfe859aa426f0c7\BIT6.tmp 29/08/2006 09:36:40 H 1024 C:\WINNT\system32\config\default.LOG 29/08/2006 10:00:26 H 1024 C:\WINNT\system32\config\SAM.LOG 29/08/2006 09:58:34 H 1024 C:\WINNT\system32\config\SECURITY.LOG 29/08/2006 10:02:52 H 1024 C:\WINNT\system32\config\software.LOG 28/08/2006 19:06:30 HS 336 C:\WINNT\system32\Microsoft\Protect\S-1-5-18\be907647-2526-4619-91ba-032c709c9c89 28/08/2006 19:06:30 HS 24 C:\WINNT\system32\Microsoft\Protect\S-1-5-18\Preferred 29/08/2006 09:30:10 H 6 C:\WINNT\Tasks\SA.DAT Checking for CPL files… Microsoft Corporation 07/12/1999 13:00:00 67344 C:\WINNT\SYSTEM32\access.cpl Realtek Semiconductor Corp. 26/10/2005 15:32:00 18776064 C:\WINNT\SYSTEM32\ALSNDMGR.CPL Microsoft Corporation 19/06/2003 13:05:04 301328 C:\WINNT\SYSTEM32\appwiz.cpl Microsoft Corporation 19/06/2003 13:05:04 237328 C:\WINNT\SYSTEM32\DESK.CPL Microsoft Corporation 07/12/1999 13:00:00 31504 C:\WINNT\SYSTEM32\fax.cpl Microsoft Corporation 07/12/1999 13:00:00 128272 C:\WINNT\SYSTEM32\hdwwiz.cpl Microsoft Corporation 29/08/2002 08:14:40 292352 C:\WINNT\SYSTEM32\inetcpl.cpl Microsoft Corporation 07/12/1999 13:00:00 118032 C:\WINNT\SYSTEM32\intl.cpl Microsoft Corporation 07/12/1999 13:00:00 36112 C:\WINNT\SYSTEM32\irprops.cpl Microsoft Corporation 30/10/2001 09:10:00 326144 C:\WINNT\SYSTEM32\joy.cpl Sun Microsystems, Inc. 26/07/2006 03:03:14 49265 C:\WINNT\SYSTEM32\jpicpl32.cpl Microsoft Corporation 07/12/1999 13:00:00 122128 C:\WINNT\SYSTEM32\main.cpl Microsoft Corporation 07/12/1999 13:00:00 303888 C:\WINNT\SYSTEM32\mmsys.cpl Microsoft Corporation 07/12/1999 13:00:00 17168 C:\WINNT\SYSTEM32\ncpa.cpl NVIDIA Corporation 15/06/2005 10:20:00 73728 C:\WINNT\SYSTEM32\nvtuicpl.cpl Microsoft Corporation 07/12/1999 13:00:00 41232 C:\WINNT\SYSTEM32\nwc.cpl Microsoft Corporation 20/02/2003 18:39:50 32768 C:\WINNT\SYSTEM32\odbccp32.cpl Microsoft Corporation 19/06/2003 13:05:04 90896 C:\WINNT\SYSTEM32\powercfg.cpl Microsoft Corporation 19/06/2003 13:05:04 83216 C:\WINNT\SYSTEM32\sticpl.cpl Microsoft Corporation 19/06/2003 13:05:04 125712 C:\WINNT\SYSTEM32\SYSDM.CPL Microsoft Corporation 07/12/1999 13:00:00 5904 C:\WINNT\SYSTEM32\telephon.cpl Microsoft Corporation 07/12/1999 13:00:00 61200 C:\WINNT\SYSTEM32\timedate.cpl Microsoft Corporation 26/05/2005 05:16:30 174360 C:\WINNT\SYSTEM32\wuaucpl.cpl Microsoft Corporation 29/08/2002 08:14:40 292352 C:\WINNT\SYSTEM32\dllcache\inetcpl.cpl Microsoft Corporation 12/01/2005 20:40:00 64784 C:\WINNT\SYSTEM32\dllcache\msmq.cpl IBM Corporation 23/09/1999 19:44:36 94208 C:\WINNT\SYSTEM32\dllcache\mwcpa32.cpl Microsoft Corporation 07/12/1999 13:00:00 41232 C:\WINNT\SYSTEM32\dllcache\nwc.cpl Microsoft Corporation 20/02/2003 18:39:50 32768 C:\WINNT\SYSTEM32\dllcache\odbccp32.cpl Microsoft Corporation 26/05/2005 05:16:30 174360 C:\WINNT\SYSTEM32\dllcache\wuaucpl.cpl »»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»» Checking files in %ALLUSERSPROFILE%\Startup folder… 18/11/2005 20:12:32 799 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk 18/11/2005 17:26:16 1575 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk 17/11/2005 18:30:14 1568 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk 24/11/2005 12:57:52 662 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NaturalColorLoad.lnk 17/11/2005 20:14:34 1478 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\OneCare.lnk Checking files in %ALLUSERSPROFILE%\Application Data folder… 01/08/2006 10:29:00 2123 C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache Checking files in %USERPROFILE%\Startup folder… 07/06/2006 14:38:44 1745 C:\Documents and Settings\Chris Noble\Start Menu\Programs\Startup\Cyber-shot Viewer Media Check Tool.lnk 05/08/2006 17:02:00 533 C:\Documents and Settings\Chris Noble\Start Menu\Programs\Startup\SpywareGuard.lnk Checking files in %USERPROFILE%\Application Data folder… »»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»» [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers] HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\7-Zip {23170F69-40C1-278A-1000-000100020000} = C:\Program Files\7-Zip\7-zipn.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\ewido anti-spyware {8934FCEF-F5B8-468f-951F-78A921CD3920} = C:\Program Files\ewido anti-spyware 4.0\context.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files {750fdf0e-2a26-11d1-a3ea-080036587f03} = cscui.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With {09799AFB-AD67-11d1-ABCD-00C04FC30936} = %SystemRoot%\system32\shell32.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu {A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\shell32.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WinRAR {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WinZip {E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{CFC7205E-2792-4378-9591-3879CC6C9022} = c:\progra~1\mcafee.com\vso\mcvsshl.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers] HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip {23170F69-40C1-278A-1000-000100020000} = C:\Program Files\7-Zip\7-zipn.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinZip {E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\{CFC7205E-2792-4378-9591-3879CC6C9022} = c:\progra~1\mcafee.com\vso\mcvsshl.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers] HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip {23170F69-40C1-278A-1000-000100020000} = C:\Program Files\7-Zip\7-zipn.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ewido anti-spyware {8934FCEF-F5B8-468f-951F-78A921CD3920} = C:\Program Files\ewido anti-spyware 4.0\context.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Offline Files {750fdf0e-2a26-11d1-a3ea-080036587f03} = cscui.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Open With EncryptionMenu {A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\shell32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Sharing {f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = ntshrui.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinZip {E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers] HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871} = %SystemRoot%\system32\shell32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF} = %SystemRoot%\system32\shell32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF} = %SystemRoot%\system32\shell32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE} = C:\WINNT\System32\docprop2.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{7f9609be-af9a-11d1-83e0-00c04fb6e984} = %SystemRoot%\system32\faxshell.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{884EA37B-37C0-11d2-BE3F-00A0C9A83DA1} = C:\WINNT\System32\docprop2.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{F9DB5320-233E-11D1-9F84-707F02C10627} = C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} AcroIEHlprObj Class = C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41D68ED8-4CFF-4115-88A6-6EBB8AF19000} = HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4A368E80-174F-4872-96B5-0B27DDD11DB2} SpywareGuardDLBLOCK.CBrowserHelper = C:\Program Files\SpywareGuard\dlprotect.dll HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F} = C:\PROGRA~1\SPYBOT~1\SDHelper.dll HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} SSVHelper Class = C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376} &Tip of the Day = %SystemRoot%\system32\shdocvw.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar] {8E718888-423F-11D2-876E-00A0C9082467} = &Radio : C:\WINNT\system32\msdxm.ocx {BA52B914-B692-46c4-B683-905236F6F655} = McAfee VirusScan : c:\progra~1\mcafee.com\vso\mcvsshl.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} MenuText = Sun Java Console : C:\Program Files\Java\jre1.5.0_08\bin\npjpi150_08.dll [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478} Media Band = %SystemRoot%\system32\browseui.dll HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1} File and Folders Search ActiveX Control = C:\WINNT\system32\shell32.dll HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E} Explorer Band = %SystemRoot%\system32\shdocvw.dll [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser {01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address : %SystemRoot%\system32\browseui.dll {0E5CBF21-D15F-11D0-8301-00AA005B4383} = &Links : %SystemRoot%\system32\browseui.dll HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser {01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address : %SystemRoot%\system32\browseui.dll {0E5CBF21-D15F-11D0-8301-00AA005B4383} = &Links : %SystemRoot%\system32\browseui.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] Synchronization Manager mobsync.exe /logon NvCplDaemon RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup nwiz nwiz.exe /install SW20 C:\WINNT\System32\sw20.exe SW24 C:\WINNT\System32\sw24.exe NvMediaCenter RunDLL32.exe NvMCTray.dll,NvTaskbarInit nTrayFw C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe Motive SmartBridge C:\PROGRA~1\OneCare\SMARTB~1\MotiveSB.exe NeroFilterCheck C:\WINNT\system32\NeroCheck.exe TkBellExe "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime RemoteControl "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" OpwareSE2 "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" EssSpkPhone essspk.exe SoundMan SOUNDMAN.EXE MSKDetectorExe C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall McafWelcome C:\Program Files\McAfee.com\Agent\mcwelcom.exe VSOCheckTask "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask VirusScan Online C:\Program Files\McAfee.com\VSO\mcvsshld.exe OASClnt C:\Program Files\McAfee.com\VSO\oasclnt.exe MCAgentExe c:\PROGRA~1\mcafee.com\agent\mcagent.exe MCUpdateExe C:\PROGRA~1\mcafee.com\agent\mcupdate.exe MPFExe C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe WinampAgent C:\Program Files\Winamp\winampa.exe WinPatrol C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe !ewido "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized SunJavaUpdateSched "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe" SpeedTouch USB Diagnostics "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] IMAIL Installed = 1 MAPI Installed = 1 MSFS Installed = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] internat.exe internat.exe Creative Detector C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R McAfee QuickClean Imonitor C:\Program Files\McAfee\McAfee QuickClean\Plguni.exe /START SpybotSD TeaTimer C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop\AdminComponent HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum {BDEADF00-C265-11D0-BCED-00A0C90AB50F} = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system dontdisplaylastusername 0 legalnoticecaption legalnoticetext shutdownwithoutlogon 1 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies] HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer NoDriveTypeAutoRun 149 CDRAutoRun 0 HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System DisableRegistryTools 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] Network.ConnectionTray {7007ACCF-3202-11D1-AAD2-00805FC1270E} = C:\WINNT\system32\NETSHELL.dll WebCheck {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\system32\webcheck.dll SysTray {35CEC8A3-2BE6-11D2-8773-92E220524153} = stobject.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] UserInit = C:\WINNT\system32\userinit.exe, Shell = Explorer.exe System = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain = crypt32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet = cryptnet.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll = cscdll.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy = sclgntfy.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn = WlNotify.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif = wzcdlg.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path Debugger = ntsd -d [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] AppInit_DLLs »»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» WinPFind v1.4.1 - Log file written to "WinPFind.Txt" in the WinPFind folder. Scan completed on 29/08/2006 10:04:05