Need help with a "tune-up"

Hello, thanks all for this great forum and for helping out! I just posted logs for my new HP computer in another post but wanted to get my old Dell TOO into shape since I use it more (the HP sucks), just wanted to clarify this is not the same log/problem.

I'm not really having a "problem" with this machine per se, just running out of room and keep getting virtual memory messages.

I wasn't really sure where to start, so thought these might be a good place…they're the extra logs from HJT, happy to provide any more info to keep this thing in shape! My HJT log is posted in that forum as well.

Thanks in advance!!!
Jeanne

*****************UNINSTALL LOG************************************

Actiontec Gateway
Adobe Download Manager 2.0 (Remove Only)
Adobe Photoshop 6.0
Adobe Photoshop 7.0.1
Adobe Reader 7.0.5
Adobe SVG Viewer 3.0
Adobe Type Manager 4.1
CCHelp
CCScore
ClearType Tuning Control Panel Applet
Cyberfetch 1.1.12
Dr Watson for Microsoft Windows OneCare Live v1.0.0971.38
ESSAdpt
ESSANUP
ESSBrwr
ESSCAM
ESSCDBK
ESScore
ESSCT
ESSEMAIL
ESSgui
ESShelp
ESSini
ESSPCD
ESSPDock
ESSSONIC
ESSvpaht
ESSvpot
Extreme Thumbnail Generator 1.6
FTP Commander
HighMAT Extension to Microsoft Windows XP CD Writing Wizard
HijackThis 1.99.1
HLPCCTR
HLPIndex
HLPPDOCK
HLPSFO
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
HP OfficeJet/PSC Scrubber
HP Photo and Imaging 2.0 - All-in-One
Java 2 Runtime Environment, SE v1.4.2_05
KeyMaestro Input Device Driver V2.6.4-73AU
KSU
LiveReg (Symantec Corporation)
Macromedia Dreamweaver MX 2004
Macromedia Extension Manager
Macromedia Fireworks MX 2004
Macromedia Flash MX 2004
Macromedia Flash Player 8
Microsoft .NET Framework 1.1
Microsoft .NET Framework 2.0
Microsoft Bootvis
Microsoft Office Professional Edition 2003
Microsoft Office Standard Edition 2003
Microsoft Web Embedding Fonts Tool (III)
MSN Messenger 7.5
Norton AntiVirus 2003 Professional Edition
Notifier
OfotoXMI
OTtBP
OTtBPSDK
PCDLNCH
QuarkXPress 6.0
Security Update for Microsoft .NET Framework 2.0 (KB917283)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899589)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917537)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
SFR
SFR2
The Font Thing
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB914882)
Update for Windows XP (KB916595)
VCAMCEN
VPRINTOL
Windows Defender Signatures
Windows Installer 3.1 (KB893803)
Windows Installer 3.1 (KB893803)
Windows Media Player 10
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Windows XP Service Pack 2
WinZip
WriteExpress 3,001 Business & Sales Letters

****************STARTUP LIST*************************************

StartupList report, 9/7/2006, 11:45:09 PM
StartupList version: 1.52.2
Started from : C:\Documents and Settings\Jeanne\Desktop\programs\HijackThis1991.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
* Including empty and uninteresting sections
* Showing rarely important sections
==================================================

Running processes:

C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\windows\System32\SCardSvr.exe
C:\windows\system32\netdde.exe
C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
C:\windows\System32\alg.exe
C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\System32\dllhost.exe
C:\windows\System32\svchost.exe
C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\msdtc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\windows\System32\locator.exe
C:\windows\System32\svchost.exe
C:\windows\System32\svchost.exe
C:\WINDOWS\System32\tlntsvr.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\windows\System32\dmadmin.exe
C:\windows\Explorer.EXE
C:\windows\system32\ctfmon.exe
C:\windows\system32\WISPTIS.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Jeanne\Desktop\programs\HijackThis1991.exe
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\helpctr.exe
C:\windows\PCHealth\HelpCtr\Binaries\HelpSvc.exe
C:\windows\PCHealth\HelpCtr\Binaries\HelpHost.exe

————————————————–

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\Jeanne\Start Menu\Programs\Startup]
*No files*

Shell folders AltStartup:
*Folder not found*

User shell folders Startup:
*Folder not found*

User shell folders AltStartup:
*Folder not found*

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

Shell folders Common AltStartup:
*Folder not found*

User shell folders Common Startup:
*Folder not found*

User shell folders Alternate Common Startup:
*Folder not found*

————————————————–

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
*Registry value not found*

[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

QuickTime Task = "C:\program files\quicktime\qttask.exe" -atboottime

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

(Default) =

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

ctfmon.exe = C:\windows\system32\ctfmon.exe
Yahoo! Pager = "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
PhotoShow Deluxe Media Manager = C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

[AutorunsDisabled]
QuickTime Task = c:\program files\quicktime\qttask.exe

[OptionalComponents]
*No values found*

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

————————————————–

File association entry for .EXE:
HKEY_CLASSES_ROOT\exefile\shell\open\command

(Default) = "%1" %*

————————————————–

File association entry for .COM:
HKEY_CLASSES_ROOT\comfile\shell\open\command

(Default) = "%1" %*

————————————————–

File association entry for .BAT:
HKEY_CLASSES_ROOT\batfile\shell\open\command

(Default) = "%1" %*

————————————————–

File association entry for .PIF:
HKEY_CLASSES_ROOT\piffile\shell\open\command

(Default) = "%1" %*

————————————————–

File association entry for .SCR:
HKEY_CLASSES_ROOT\scrfile\shell\open\command

(Default) = "%1" /S

————————————————–

File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = C:\WINDOWS\System32\mshta.exe "%1" %*

————————————————–

File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command

(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1

————————————————–

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP

[>{26923b43-4d38-484f-9b9e-de460746276c}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *
StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

[{4b218e3e-bc98-4770-93d3-2731b9329278}] *
StubPath = %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection MarketplaceLinkInstall 896 %systemroot%\inf\ie.inf

[{5945c046-1e7d-11d1-bc44-00c04fd912be}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection %SystemRoot%\INF\msmsgs.inf,BLC.Install.PerUser

[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = %SystemRoot%\system32\ie4uinit.exe

[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *
StubPath = C:\windows\system32\Rundll32.exe C:\windows\system32\mscories.dll,Install

————————————————–

Enumerating ICQ Agent Autostart apps:
HKCU\Software\Mirabilis\ICQ\Agent\Apps

*Registry key not found*

————————————————–

Load/Run keys from C:\windows\WIN.INI:

load=*INI section not found*
run=*INI section not found*

Load/Run keys from Registry:

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=

————————————————–

Shell & screensaver key from C:\windows\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\windows\System32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

————————————————–

Checking for EXPLORER.EXE instances:

C:\windows\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\windows\Explorer\Explorer.exe: not present
C:\windows\System\Explorer.exe: not present
C:\windows\System32\Explorer.exe: not present
C:\windows\Command\Explorer.exe: not present
C:\windows\Fonts\Explorer.exe: not present

————————————————–

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

————————————————–

Verifying REGEDIT.EXE integrity:

- Regedit.exe found in C:\windows
- .reg open command is normal (regedit.exe %1)
- Company name OK: 'Microsoft Corporation'
- Original filename OK: 'REGEDIT.EXE'
- File description: 'Registry Editor'

Registry check passed

————————————————–

Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\Program Files\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}

————————————————–

Enumerating Task Scheduler jobs:

*No jobs found*

————————————————–

Enumerating Download Program Files:

[QuickTime Object]
InProcServer32 = c:\program files\quicktime\QTPlugin.ocx
CODEBASE = http://www.apple.com/qtactivex/qtplugin.cab

[DjVuCtl Class]
InProcServer32 = C:\Program Files\LizardTech\DjVuControl\DjVuCntl.dll
CODEBASE = http://downloadcenter.samsung.com/content/…trolLite_EN.cab

[Windows Genuine Advantage Validation Tool]
InProcServer32 = C:\windows\system32\legitcheckcontrol.dll
CODEBASE = http://go.microsoft.com/fwlink/?linkid=39204

[Office Update Installation Engine]
InProcServer32 = C:\windows\opuc.dll
CODEBASE = http://office.microsoft.com/officeupdate/content/opuc3.cab

[MUWebControl Class]
InProcServer32 = C:\windows\system32\muweb.dll
CODEBASE = http://update.microsoft.com/microsoftupdat…b?1131318434786

[MMSPlayerX Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\SMILInetCtrl.dll
CODEBASE = http://otp.mycricket.com/mmawap/jsp/compos…r/mmsPlayer.cab

[Shockwave Flash Object]
InProcServer32 = C:\windows\system32\Macromed\Flash\Flash8.ocx
CODEBASE = http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab

[CTAdjust Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\clearadjust.dll
CODEBASE = http://download.microsoft.com/download/7/E…04/clearadj.cab

————————————————–

Enumerating Winsock LSP files:

NameSpace #1: C:\windows\System32\mswsock.dll
NameSpace #2: C:\windows\System32\winrnr.dll
NameSpace #3: C:\windows\System32\mswsock.dll
NameSpace #4: C:\windows\System32\nwprovau.dll
Protocol #1: C:\windows\system32\mswsock.dll
Protocol #2: C:\windows\system32\mswsock.dll
Protocol #3: C:\windows\system32\mswsock.dll
Protocol #4: C:\windows\system32\mswsock.dll
Protocol #5: C:\windows\system32\mswsock.dll
Protocol #6: C:\windows\system32\mswsock.dll
Protocol #7: C:\windows\system32\mswsock.dll
Protocol #8: C:\windows\system32\mswsock.dll
Protocol #9: C:\windows\system32\mswsock.dll
Protocol #10: C:\windows\system32\mswsock.dll
Protocol #11: C:\windows\system32\mswsock.dll
Protocol #12: C:\windows\system32\mswsock.dll
Protocol #13: C:\windows\system32\mswsock.dll
Protocol #14: C:\windows\system32\mswsock.dll
Protocol #15: C:\windows\system32\mswsock.dll
Protocol #16: C:\windows\system32\mswsock.dll
Protocol #17: C:\windows\system32\mswsock.dll
Protocol #18: C:\windows\system32\mswsock.dll
Protocol #19: C:\windows\system32\mswsock.dll
Protocol #20: C:\windows\system32\mswsock.dll
Protocol #21: C:\windows\system32\mswsock.dll
Protocol #22: C:\windows\system32\mswsock.dll
Protocol #23: C:\windows\system32\mswsock.dll
Protocol #24: C:\windows\system32\mswsock.dll
Protocol #25: C:\windows\system32\mswsock.dll
Protocol #26: C:\windows\system32\mswsock.dll
Protocol #27: C:\windows\system32\mswsock.dll
Protocol #28: C:\windows\system32\mswsock.dll
Protocol #29: C:\windows\system32\mswsock.dll
Protocol #30: C:\windows\system32\mswsock.dll
Protocol #31: C:\windows\system32\mswsock.dll
Protocol #32: C:\windows\system32\mswsock.dll
Protocol #33: C:\windows\system32\mswsock.dll
Protocol #34: C:\windows\system32\mswsock.dll
Protocol #35: C:\windows\system32\mswsock.dll
Protocol #36: C:\windows\system32\mswsock.dll
Protocol #37: C:\windows\system32\mswsock.dll
Protocol #38: C:\windows\system32\mswsock.dll
Protocol #39: C:\windows\system32\mswsock.dll
Protocol #40: C:\windows\system32\mswsock.dll
Protocol #41: C:\windows\system32\mswsock.dll
Protocol #42: C:\windows\system32\mswsock.dll
Protocol #43: C:\windows\system32\mswsock.dll
Protocol #44: C:\windows\system32\mswsock.dll
Protocol #45: C:\windows\system32\mswsock.dll
Protocol #46: C:\windows\system32\mswsock.dll
Protocol #47: C:\windows\system32\mswsock.dll
Protocol #48: C:\windows\system32\rsvpsp.dll
Protocol #49: C:\windows\system32\rsvpsp.dll

————————————————–

Enumerating Windows NT/2000/XP services

IPv6 Helper Service: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
Microsoft ACPI Driver: System32\DRIVERS\ACPI.sys (system)
Aureal Game Port Enumerator: System32\DRIVERS\admjoy.sys (manual start)
Adobe LM Service: "C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe" (autostart)
Microsoft Kernel Acoustic Echo Canceller: system32\drivers\aec.sys (manual start)
AFD Networking Support Environment: \SystemRoot\System32\drivers\afd.sys (system)
Intel AGP Bus Filter: System32\DRIVERS\agp440.sys (system)
Alerter: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
Application Layer Gateway Service: %SystemRoot%\System32\alg.exe (autostart)
Application Management: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
ASP.NET State Service: %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (autostart)
RAS Asynchronous Media Driver: System32\DRIVERS\asyncmac.sys (manual start)
Standard IDE/ESDI Hard Disk Controller: System32\DRIVERS\atapi.sys (system)
ATM ARP Client Protocol: System32\DRIVERS\atmarpc.sys (manual start)
ATM Service: %SystemRoot%\System32\ATMsrvc.exe (manual start)
Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Audio Stub Driver: System32\DRIVERS\audstub.sys (manual start)
Background Intelligent Transfer Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
MAC Bridge: system32\DRIVERS\bridge.sys (manual start)
MAC Bridge Miniport: system32\DRIVERS\bridge.sys (manual start)
Computer Browser: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
ccEvtMgr: "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe" (manual start)
Symantec Password Validation Service: "C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe" (autostart)
CD-ROM Driver: System32\DRIVERS\cdrom.sys (system)
Indexing Service: C:\WINDOWS\System32\cisvc.exe (autostart)
ClipBook: %SystemRoot%\system32\clipsrv.exe (manual start)
.NET Runtime Optimization Service v2.0.50727_X86: C:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (manual start)
COM+ System Application: C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (autostart)
Cryptographic Services: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Kodak Camera Proxy: system32\DRIVERS\DcCam.sys (system)
DcFpoint: system32\DRIVERS\DcFpoint.sys (manual start)
Kodak DCFS2K Driver: system32\drivers\dcfs2k.sys (autostart)
Legacy Polling Service: system32\DRIVERS\DcLps.sys (manual start)
DCOM Server Process Launcher: %SystemRoot%\system32\svchost -k DcomLaunch (autostart)
dcptp: system32\DRIVERS\DcPTP.sys (manual start)
DHCP Client: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Disk Driver: System32\DRIVERS\disk.sys (system)
Logical Disk Manager Administrative Service: %SystemRoot%\System32\dmadmin.exe /com (autostart)
dmboot: System32\drivers\dmboot.sys (disabled)
Logical Disk Manager Driver: System32\drivers\dmio.sys (system)
dmload: System32\drivers\dmload.sys (system)
Logical Disk Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Microsoft Kernel DLS Syntheiszer: system32\drivers\DMusic.sys (manual start)
DNS Client: %SystemRoot%\System32\svchost.exe -k NetworkService (autostart)
Microsoft Kernel DRM Audio Descrambler: system32\drivers\drmkaud.sys (manual start)
3Com EtherLink XL 90X Adapter Driver: System32\DRIVERS\el90xnd5.sys (manual start)
ERSvc: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Event Log: %SystemRoot%\system32\services.exe (manual start)
COM+ Event System: C:\WINDOWS\System32\svchost.exe -k netsvcs (autostart)
Exportit: system32\DRIVERS\exportit.sys (system)
Fast User Switching Compatibility: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Floppy Disk Controller Driver: System32\DRIVERS\fdc.sys (manual start)
Floppy Disk Driver: System32\DRIVERS\flpydisk.sys (manual start)
FltMgr: system32\drivers\fltmgr.sys (system)
Volume Manager Driver: System32\DRIVERS\ftdisk.sys (system)
Generic Packet Classifier: System32\DRIVERS\msgpc.sys (manual start)
Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
HID Input Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Microsoft HID Class Driver: system32\DRIVERS\hidusb.sys (manual start)
IEEE-1284.4 Driver HPZid412: system32\DRIVERS\HPZid412.sys (manual start)
Print Class Driver for IEEE-1284.4 HPZipr12: system32\DRIVERS\HPZipr12.sys (manual start)
USB to IEEE-1284.4 Translation Driver HPZius12: system32\DRIVERS\HPZius12.sys (manual start)
HTTP: System32\Drivers\HTTP.sys (manual start)
HTTP SSL: %SystemRoot%\System32\svchost.exe -k HTTPFilter (autostart)
i8042 Keyboard and PS/2 Mouse Port Driver: System32\DRIVERS\i8042prt.sys (system)
InstallDriver Table Manager: "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe" (autostart)
CD-Burning Filter Driver: system32\DRIVERS\imapi.sys (system)
IMAPI CD-Burning COM Service: C:\WINDOWS\System32\imapi.exe (autostart)
IntelIde: System32\DRIVERS\intelide.sys (system)
IPv6 Windows Firewall Driver: system32\drivers\ip6fw.sys (manual start)
IP Traffic Filter Driver: System32\DRIVERS\ipfltdrv.sys (autostart)
IP in IP Tunnel Driver: System32\DRIVERS\ipinip.sys (manual start)
IP Network Address Translator: System32\DRIVERS\ipnat.sys (manual start)
IPSEC driver: System32\DRIVERS\ipsec.sys (system)
IR Enumerator Service: System32\DRIVERS\irenum.sys (manual start)
PnP ISA/EISA Bus Driver: System32\DRIVERS\isapnp.sys (system)
Keyboard Class Driver: System32\DRIVERS\kbdclass.sys (system)
Keyboard HID Driver: system32\DRIVERS\kbdhid.sys (system)
KeyMaestro: \??\C:\WINDOWS\system32\drivers\Maestro1.sys (manual start)
Microsoft Kernel Wave Audio Mixer: system32\drivers\kmixer.sys (manual start)
KodakCCS: %SystemRoot%\system32\drivers\KodakCCS.exe (disabled)
Server: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Workstation: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
TCP/IP NetBIOS Helper: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
Macromedia Licensing Service: "C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe" (autostart)
Machine Debug Manager: "C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" (autostart)
Messenger: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
mf: System32\DRIVERS\mf.sys (manual start)
NetMeeting Remote Desktop Sharing: C:\WINDOWS\System32\mnmsrvc.exe (manual start)
Unimodem Streaming Filter Device: system32\drivers\MODEMCSA.sys (manual start)
Mouse Class Driver: System32\DRIVERS\mouclass.sys (system)
Mouse HID Driver: System32\DRIVERS\mouhid.sys (manual start)
WebDav Client Redirector: System32\DRIVERS\mrxdav.sys (manual start)
MRXSMB: System32\DRIVERS\mrxsmb.sys (system)
Distributed Transaction Coordinator: C:\WINDOWS\System32\msdtc.exe (autostart)
Windows Installer: C:\WINDOWS\system32\msiexec.exe /V (autostart)
Microsoft Streaming Service Proxy: system32\drivers\MSKSSRV.sys (manual start)
Microsoft Loopback Adapter Driver: system32\DRIVERS\loop.sys (manual start)
Microsoft Streaming Clock Proxy: system32\drivers\MSPCLOCK.sys (manual start)
Microsoft Streaming Quality Manager Proxy: system32\drivers\MSPQM.sys (manual start)
Microsoft System Management BIOS Driver: System32\DRIVERS\mssmbios.sys (manual start)
Norton AntiVirus Auto Protect Service: "C:\Program Files\Norton AntiVirus\navapsvc.exe" (autostart)
NAVENG: \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20050826.018\NAVENG.Sys (manual start)
NAVEX15: \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20050826.018\NavEx15.Sys (manual start)
Remote Access NDIS TAPI Driver: System32\DRIVERS\ndistapi.sys (manual start)
NDIS Usermode I/O Protocol: System32\DRIVERS\ndisuio.sys (manual start)
Remote Access NDIS WAN Driver: System32\DRIVERS\ndiswan.sys (manual start)
NetBIOS Interface: System32\DRIVERS\netbios.sys (system)
NetBT: System32\DRIVERS\netbt.sys (system)
Network DDE: %SystemRoot%\system32\netdde.exe (autostart)
Network DDE DSDM: %SystemRoot%\system32\netdde.exe (autostart)
Net Logon: %SystemRoot%\System32\lsass.exe (manual start)
Network Connections: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Network Location Awareness (NLA): %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Network Monitor Driver: system32\DRIVERS\NMnt.sys (manual start)
Norton Unerase Protection Driver: \??\C:\WINDOWS\system32\Drivers\NPDRIVER.SYS (manual start)
Norton Unerase Protection: "C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE" (manual start)
NT LM Security Support Provider: %SystemRoot%\System32\lsass.exe (autostart)
Removable Storage: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
nv: System32\DRIVERS\nv4_mini.sys (manual start)
nv4: System32\DRIVERS\nv4.sys (manual start)
Client Service for NetWare: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
IPX Traffic Filter Driver: System32\DRIVERS\nwlnkflt.sys (manual start)
IPX Traffic Forwarder Driver: System32\DRIVERS\nwlnkfwd.sys (manual start)
NWLink IPX/SPX/NetBIOS Compatible Transport Protocol: system32\DRIVERS\nwlnkipx.sys (autostart)
NWLink NetBIOS: system32\DRIVERS\nwlnknb.sys (autostart)
NWLink SPX/SPXII Protocol: system32\DRIVERS\nwlnkspx.sys (autostart)
NetWare Rdr: system32\DRIVERS\nwrdr.sys (manual start)
SAP Agent: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
ose: "C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE" (autostart)
Parallel port driver: System32\DRIVERS\parport.sys (manual start)
PCI Bus Driver: System32\DRIVERS\pci.sys (system)
Plug and Play: %SystemRoot%\system32\services.exe (autostart)
IPSEC Services: %SystemRoot%\System32\lsass.exe (autostart)
WAN Miniport (PPTP): System32\DRIVERS\raspptp.sys (manual start)
Processor Driver: System32\DRIVERS\processr.sys (system)
Protected Storage: %SystemRoot%\system32\lsass.exe (autostart)
QoS Packet Scheduler: System32\DRIVERS\psched.sys (manual start)
Direct Parallel Link Driver: System32\DRIVERS\ptilink.sys (manual start)
PxHelp20: system32\DRIVERS\PxHelp20.sys (system)
Remote Access Auto Connection Driver: System32\DRIVERS\rasacd.sys (system)
Remote Access Auto Connection Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
WAN Miniport (L2TP): System32\DRIVERS\rasl2tp.sys (manual start)
Remote Access Connection Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Remote Access PPPOE Driver: System32\DRIVERS\raspppoe.sys (manual start)
Direct Parallel: System32\DRIVERS\raspti.sys (manual start)
Rdbss: System32\DRIVERS\rdbss.sys (system)
RDPCDD: System32\DRIVERS\RDPCDD.sys (system)
Terminal Server Device Redirector Driver: System32\DRIVERS\rdpdr.sys (manual start)
Remote Desktop Help Session Manager: C:\WINDOWS\system32\sessmgr.exe (autostart)
Digital CD Audio Playback Filter Driver: System32\DRIVERS\redbook.sys (system)
RemoteAccess: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Remote Registry: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
Microsoft Legacy Modem Driver: System32\Drivers\RootMdm.sys (manual start)
Remote Procedure Call (RPC) Locator: %SystemRoot%\System32\locator.exe (autostart)
Remote Procedure Call (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)
QoS RSVP: %SystemRoot%\System32\rsvp.exe (autostart)
Belkin USB Network Adapter: system32\DRIVERS\rt73.sys (manual start)
Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)
SAVRT: \??\C:\WINDOWS\system32\Drivers\SAVRT.SYS (manual start)
SAVRTPEL: \??\C:\WINDOWS\system32\Drivers\SAVRTPEL.SYS (autostart)
ScriptBlocking Service: C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe (autostart)
Smart Card: %SystemRoot%\System32\SCardSvr.exe (autostart)
Task Scheduler: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Secdrv: System32\DRIVERS\secdrv.sys (manual start)
Secondary Logon: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Serenum Filter Driver: System32\DRIVERS\serenum.sys (manual start)
Serial port driver: System32\DRIVERS\serial.sys (system)
Windows Firewall/Internet Connection Sharing (ICS): %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Shell Hardware Detection: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Microsoft Kernel Audio Splitter: system32\drivers\splitter.sys (manual start)
Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)
System Restore Filter Driver: System32\DRIVERS\sr.sys (system)
System Restore Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Srv: System32\DRIVERS\srv.sys (manual start)
SSDP Discovery Service: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
Still Serial Digital Camera Driver: system32\DRIVERS\serscan.sys (manual start)
Windows Image Acquisition (WIA): %SystemRoot%\System32\svchost.exe -k imgsvc (autostart)
Software Bus Driver: System32\DRIVERS\swenum.sys (manual start)
Microsoft Kernel GS Wavetable Synthesizer: system32\drivers\swmidi.sys (manual start)
MS Software Shadow Copy Provider: C:\WINDOWS\System32\dllhost.exe /Processid:{97A5D6B1-A7F6-4E2B-97E8-7BD61E0CE20F} (manual start)
SymEvent: \??\C:\Program Files\Symantec\SYMEVENT.SYS (manual start)
SYMREDRV: \??\C:\WINDOWS\system32\Drivers\SYMREDRV.SYS (manual start)
SYMTDI: \??\C:\WINDOWS\system32\Drivers\SYMTDI.SYS (autostart)
Microsoft Kernel System Audio Device: system32\drivers\sysaudio.sys (manual start)
Performance Logs and Alerts: %SystemRoot%\system32\smlogsvc.exe (autostart)
TapiSrv: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
TCP/IP Protocol Driver: System32\DRIVERS\tcpip.sys (system)
Microsoft IPv6 Protocol Driver: system32\DRIVERS\tcpip6.sys (system)
Terminal Device Driver: System32\DRIVERS\termdd.sys (system)
Terminal Services: %SystemRoot%\System32\svchost -k DComLaunch (autostart)
Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
TlntSvr: C:\WINDOWS\System32\tlntsvr.exe (autostart)
Distributed Link Tracking Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Microsoft Tun Miniport Adapter Driver: system32\DRIVERS\tunmp.sys (manual start)
Windows User Mode Driver Framework: C:\WINDOWS\system32\wdfmgr.exe (autostart)
Microcode Update Driver: System32\DRIVERS\update.sys (manual start)
Universal Plug and Play Device Host: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
Uninterruptible Power Supply: %SystemRoot%\System32\ups.exe (autostart)
Microsoft USB Generic Parent Driver: system32\DRIVERS\usbccgp.sys (manual start)
Microsoft USB Standard Hub Driver: System32\DRIVERS\usbhub.sys (manual start)
Microsoft USB PRINTER Class: system32\DRIVERS\usbprint.sys (manual start)
USB Scanner Driver: system32\DRIVERS\usbscan.sys (manual start)
USB Mass Storage Driver: system32\DRIVERS\USBSTOR.SYS (manual start)
Microsoft USB Universal Host Controller Miniport Driver: System32\DRIVERS\usbuhci.sys (manual start)
USB Remote NDIS Network Device Driver: system32\DRIVERS\usb8023.sys (manual start)
U.S. Robotics Voice Modem Driver 1806: System32\DRIVERS\USR1806V.SYS (manual start)
VGA Display Controller.: \SystemRoot\System32\drivers\vga.sys (system)
Virtual Serial Bus Enumerator: system32\DRIVERS\vsb.sys (manual start)
vsdatant: \??\C:\windows\system32\vsdatant.sys (manual start)
ELTIMA Virtual Serial Ports Driver: System32\DRIVERS\vserial.sys (manual start)
Volume Shadow Copy: %SystemRoot%\System32\vssvc.exe (manual start)
Windows Time: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Remote Access IP ARP Driver: System32\DRIVERS\wanarp.sys (manual start)
Microsoft WINMM WDM Audio Compatibility Driver: system32\drivers\wdmaud.sys (manual start)
Aureal Vortex 8820 Audio Driver (WDM): system32\drivers\adm8820.sys (manual start)
WebClient: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
Windows Management Instrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Portable Media Serial Number Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Windows Management Instrumentation Driver Extensions: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
WMI Performance Adapter: C:\WINDOWS\System32\wbem\wmiapsrv.exe (autostart)
Windows Socket 2.0 Non-IFS Service Provider Support Environment: \SystemRoot\System32\drivers\ws2ifsl.sys (disabled)
Security Center: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Automatic Updates: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Wireless Zero Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Network Provisioning Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

————————————————–

Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*

Windows NT checkdisk command:
BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':
PendingFileRenameOperations: *Registry value not found*

————————————————–

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\windows\system32\SHELL32.dll
CDBurn: C:\windows\system32\SHELL32.dll
WebCheck: C:\windows\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll
UPnPMonitor: C:\windows\system32\upnpui.dll

————————————————–
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*Registry key not found*

————————————————–

End of report, 37,543 bytes
Report generated in 0.470 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

**********************************PROCESS LIST*********************

Process list saved on 12:53:29 AM, on 9/8/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)

[pid] [full path to filename] [file version] [company name]
552 C:\windows\System32\smss.exe 5.1.2600.2180 Microsoft Corporation
640 C:\windows\system32\winlogon.exe 5.1.2600.2180 Microsoft Corporation
684 C:\windows\system32\services.exe 5.1.2600.2180 Microsoft Corporation
696 C:\windows\system32\lsass.exe 5.1.2600.2180 Microsoft Corporation
856 C:\windows\system32\svchost.exe 5.1.2600.2180 Microsoft Corporation
928 C:\windows\system32\svchost.exe 5.1.2600.2180 Microsoft Corporation
996 C:\windows\System32\svchost.exe 5.1.2600.2180 Microsoft Corporation
1032 C:\windows\System32\svchost.exe 5.1.2600.2180 Microsoft Corporation
1060 C:\windows\System32\svchost.exe 5.1.2600.2180 Microsoft Corporation
1200 C:\windows\system32\spoolsv.exe 5.1.2600.2696 Microsoft Corporation
1236 C:\windows\System32\SCardSvr.exe 5.1.2600.2180 Microsoft Corporation
1416 C:\windows\system32\netdde.exe 5.1.2600.2180 Microsoft Corporation
1456 C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe 2.65.10.2 Adobe Systems
1492 C:\windows\System32\alg.exe 5.1.2600.2180 Microsoft Corporation
1544 C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe 1.0.10.6 Symantec Corporation
1592 C:\WINDOWS\System32\cisvc.exe 5.1.2600.2180 Microsoft Corporation
1612 C:\WINDOWS\System32\dllhost.exe 5.1.2600.2180 Microsoft Corporation
1684 C:\windows\System32\svchost.exe 5.1.2600.2180 Microsoft Corporation
1700 C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe 11.0.0.28844 Macrovision Corporation
1780 C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe 2.65.0.1 Macromedia
1820 C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE 7.0.9466.0 Microsoft Corporation
1852 C:\WINDOWS\System32\msdtc.exe 2001.12.4414.258 Microsoft Corporation
1972 C:\Program Files\Norton AntiVirus\navapsvc.exe 9.0.5.1015 Symantec Corporation
276 C:\windows\System32\locator.exe 5.1.2600.2180 Microsoft Corporation
492 C:\windows\System32\svchost.exe 5.1.2600.2180 Microsoft Corporation
812 C:\windows\System32\svchost.exe 5.1.2600.2180 Microsoft Corporation
972 C:\WINDOWS\System32\tlntsvr.exe 5.1.2600.2180 Microsoft Corporation
1100 C:\WINDOWS\system32\wdfmgr.exe 5.2.3790.1230 Microsoft Corporation
1292 C:\WINDOWS\System32\wbem\wmiapsrv.exe 5.1.2600.2180 Microsoft Corporation
1804 C:\windows\System32\dmadmin.exe 2600.2180.503.0 Microsoft Corp., Veritas Software
3144 C:\windows\Explorer.EXE 6.0.2900.2180 Microsoft Corporation
3272 C:\windows\system32\ctfmon.exe 5.1.2600.2180 Microsoft Corporation
3420 C:\windows\system32\WISPTIS.EXE 1.0.2201.0 Microsoft Corporation
3904 C:\WINDOWS\explorer.exe 6.0.2900.2180 Microsoft Corporation
1648 C:\Program Files\Internet Explorer\iexplore.exe 6.0.2900.2180 Microsoft Corporation
240 C:\Documents and Settings\Jeanne\Desktop\programs\HijackThis1991.exe 1.99.0.1 Soeperman Enterprises Ltd.
2868 C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\helpctr.exe 5.1.2600.2180 Microsoft Corporation
1992 C:\windows\PCHealth\HelpCtr\Binaries\HelpSvc.exe 5.1.2600.2180 Microsoft Corporation
3300 C:\windows\PCHealth\HelpCtr\Binaries\HelpHost.exe 5.1.2600.0 Microsoft Corporation

DLLs loaded by process C:\windows\System32\smss.exe:

[full path to filename] [file version] [company name]
C:\windows\system32\ntdll.dll 5.1.2600.2180 Microsoft Corporation

*********************************AD SPY**************************************************

C:\Documents and Settings\All Users\Favorites\Thumbs.db : encryptable (0 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Documents and Settings\Jeanne\Application Data\Microsoft\Installer\{0F9196C6-58B4-445B-B56E-B1200FECC151}\_18be6784.exe : SummaryInformation (88 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Documents and Settings\Jeanne\Application Data\Microsoft\Installer\{0F9196C6-58B4-445B-B56E-B1200FECC151}\_18be6784.exe : {4c8cc155-6c1e-11d1-8e41-00c04fb9386d} (0 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Documents and Settings\Jeanne\Application Data\Microsoft\Proof\CUSTOM.DIC : {4c8cc155-6c1e-11d1-8e41-00c04fb9386d} (0 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Documents and Settings\Jeanne\CUSTOM.DIC : {4c8cc155-6c1e-11d1-8e41-00c04fb9386d} (0 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Documents and Settings\Jeanne\Desktop\programs\HijackThis1991.exe : Zone.Identifier (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Documents and Settings\Jeanne\Desktop\programs\startuplist1521.zip : Zone.Identifier (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Documents and Settings\Jeanne\Desktop\Thumbs.db : encryptable (0 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Documents and Settings\Jeanne\Favorites\Thumbs.db : encryptable (0 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Documents and Settings\Jeanne\Local Settings\Temporary Internet Files\Content.IE5\7XWSHBN9\family%20nexus%20medications[1].pdf : Zone.Identifier (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Documents and Settings\Jeanne\Local Settings\Temporary Internet Files\Content.IE5\KT4BS3K3\family%20nexus%20module%2010[1].pdf : Zone.Identifier (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Documents and Settings\Jeanne\My Documents\ada.pdf : Zone.Identifier (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Documents and Settings\Jeanne\My Documents\awp_application_form.doc : Zone.Identifier (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Documents and Settings\Jeanne\My Documents\Bankruptcy_Brochure.pdf : Zone.Identifier (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Documents and Settings\Jeanne\My Documents\BK\bk_form_b1instr.pdf : Zone.Identifier (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Documents and Settings\Jeanne\My Documents\BK\ch7volpp.pdf : Zone.Identifier (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Documents and Settings\Jeanne\My Documents\My Music\le2.mp3 : Zone.Identifier (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Documents and Settings\Jeanne\My Documents\My Pictures\from my lover\Thumbs.db : encryptable (0 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Documents and Settings\Jeanne\My Documents\My Pictures\halloweenie\Thumbs.db : encryptable (0 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Documents and Settings\Jeanne\My Documents\My Pictures\Thumbs.db : encryptable (0 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Documents and Settings\Jeanne\My Documents\Thumbs.db : encryptable (0 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Documents and Settings\Jeanne\Start Menu\Programs\KeyMaestro\Thumbs.db : encryptable (0 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\MSOCache\All Users\90000409-6000-11D3-8CFE-0150048383C9\FILES\SETUP\OSE.EXE : SummaryInformation (88 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\MSOCache\All Users\90000409-6000-11D3-8CFE-0150048383C9\FILES\SETUP\OSE.EXE : {4c8cc155-6c1e-11d1-8e41-00c04fb9386d} (0 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\Thumbs.db : encryptable (0 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files\Common Files\Microsoft Shared\Stationery\Thumbs.db : encryptable (0 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files\Java\j2re1.4.2_05\Thumbs.db : encryptable (0 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files\KMaestro\Thumbs.db : encryptable (0 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\Thumbs.db : encryptable (0 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\Thumbs.db : encryptable (0 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE : SummaryInformation (88 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE : {4c8cc155-6c1e-11d1-8e41-00c04fb9386d} (0 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files\Movie Maker\Thumbs.db : encryptable (0 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\WINDOWS\Fonts\13oclock.ttf : Zone.Identifier (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\WINDOWS\Fonts\AAJAX.TTF : Zone.Identifier (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\WINDOWS\Fonts\ARTIM___.TTF : Zone.Identifier (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\WINDOWS\Fonts\ARTISTAM.TXT : Zone.Identifier (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\WINDOWS\Fonts\BILLO___.TTF : Zone.Identifier (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\WINDOWS\Fonts\Boingo.ttf : Zone.Identifier (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\WINDOWS\Fonts\BOOGNN__.TTF : Zone.Identifier (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\WINDOWS\Fonts\COOLVETI.TTF : Zone.Identifier (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\WINDOWS\Fonts\COVENTRY.TTF : Zone.Identifier (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\WINDOWS\Fonts\C_BOX.TTF : Zone.Identifier (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\WINDOWS\Fonts\C_BOX_D.TTF : Zone.Identifier (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\WINDOWS\Fonts\degrassi.ttf : Zone.Identifier (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\WINDOWS\Fonts\dephun2.ttf : Zone.Identifier (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\WINDOWS\Fonts\dephunked.txt : Zone.Identifier (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\WINDOWS\Fonts\DOLPHIAN.TTF : Zone.Identifier

Attachments:

📎start.zip

✨ Ask AI

Ask AI