krazykat
Topic Starter
Attached is my initial HijackThis scan (log).
Note: I was advised to run the HijackThis scan because I have the following "ERROR". I have WIN2K PRO and when I try to boot in SAFE MODE I receive a "STOP ERROR". I can give you the exact text of the stop error if you need it.
Here is my HijackThis scan:
Logfile of HijackThis v1.99.1
Scan saved at 1:02:36 PM, on 10/18/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\STOPzilla!\szntsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
F:\Norton_AntiVirus_CorpEdition_7\defwatch.exe
C:\WINDOWS\System32\svchost.exe
F:\NORTON~1\NORTON~1\GHOSTS~2.EXE
C:\WINDOWS\system32\LxrJD31s.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
F:\Norton_AntiVirus_CorpEdition_7\rtvscan.exe
F:\Norton_System_Works2003\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
F:\NORTON~1\SPEEDD~1\nopdb.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\SYSTEM32\ZONELABS\VSMON.EXE
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\MsgSys.EXE
F:\Omni_Page_Pro_14_Office\WorkFlowTray.exe
F:\NORTON~2\vptray.exe
F:\Omni_Page_Pro_14_Office\PdfPrn\SPrnAgent.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\StartupMonitor.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
F:\Omni_Page_Pro_14_Office\OpScheduler.exe
C:\windows\system32\spool\drivers\w32x86\2\hpoopm07.exe
F:\Norton_System_Works2003\Norton Ghost\GhostStartTrayApp.exe
E:\Warez_Office11\Daemon_Tools\daemon.exe
C:\Program Files\Citi Virtual Account Numbers\CitiVAN.exe
C:\WINDOWS\Mixer.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
D:\UTILITES\Acronis_True_Image_9_B3677\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
D:\ZoneAlarmPro_61_737update(032606)\ZoneAlarm\zlclient.exe
D:\UTILITES\Acronis_True_Image_9_B3677\TimounterMonitor.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
E:\Rose_City_Software\Registry_First_Aid_5_0\RFA_5.0\RFA\rfagent.exe
F:\Ashampoo_2002_2003\UIWatcher.exe
D:\Sea_Monkey_1_0_2(060206)\SeaMonkey.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Nikon_View_4\NkVwMon.exe
C:\HP_G85_drivers\AiO\hp officejet g series\Bin\hpoavn07.exe
D:\ZoneAlarm_2_6\AdSubtract\AdSubtract CE\AdSubtract\adsub.exe
F:\Explorer_Plus_1_0\Nxdlghlp.exe
D:\UTILITES\Desktop_Search\Yahoo\YahooDesktopSearch.exe
D:\UTILITES\Desktop_Search\Yahoo\YDSsystray.exe
C:\HP_G85~1\AiO\Shared\Bin\hpoevm07.exe
C:\WINDOWS\system32\hpoipm07.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
F:\Explorer_Plus_1_0\NxExplo.exe
F:\Explorer_Plus_1_0\NxExplo.exe
D:\UTILITES\HIjack_this\Hijack_This_Program_V199_1(101806)\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.comcast.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:4444
F3 - REG:win.ini: run=
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: ClickCatcher MSIE handler - {16664845-0E00-11D2-8059-000000000000} - C:\Program Files\Common Files\ReGet Shared\Catcher.dll
O2 - BHO: CitiUSBrowserHelper Class - {387EDF53-1CF2-4523-BC2F-13462651BE8C} - C:\WINDOWS\system32\BhoCitUS.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\SPYBOT~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: ReGet Bar - {17939A30-18E2-471E-9D3A-56DD725F1215} - D:\UTILITES\ReGetDx\iebar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [TaskScheduler] D:\TURBOTAX\PRO_2003\32bit\TaskSch.exe
O4 - HKLM\..\Run: [ProTaskScheduler] D:\TURBOTAX\PRO_2005\32bit\TaskSch.exe
O4 - HKLM\..\Run: [WorkFlowTray] "F:\Omni_Page_Pro_14_Office\WorkFlowTray.exe"
O4 - HKLM\..\Run: [vptray] F:\NORTON~2\vptray.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [SSPrnAgent] F:\Omni_Page_Pro_14_Office\PdfPrn\SPrnAgent.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe"
O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PDF Converter Registry Controller] "F:\Omni_Page_Pro_14_Office\PdfCnv\RegistryController.exe"
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [Opware14] "F:\Omni_Page_Pro_14_Office\Opware14.exe"
O4 - HKLM\..\Run: [OpScheduler] "F:\Omni_Page_Pro_14_Office\OpScheduler.exe"
O4 - HKLM\..\Run: [Omnipage] "C:\Program Files\ScanSoft\OmniPagePro11.0\opware32.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] c:\windows\system32\spool\drivers\w32x86\2\hpoopm07.exe
O4 - HKLM\..\Run: [GhostStartTrayApp] "F:\Norton_System_Works2003\Norton Ghost\GhostStartTrayApp.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\Warez_Office11\Daemon_Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [CitiVAN] "C:\Program Files\Citi Virtual Account Numbers\CitiVAN.exe" /dontopenmycards
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [TrueImageMonitor.exe] D:\UTILITES\Acronis_True_Image_9_B3677\TrueImageMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Zone Labs Client] D:\ZoneAlarmPro_61_737update(032606)\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] D:\UTILITES\Acronis_True_Image_9_B3677\TimounterMonitor.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [rfagent] "E:\Rose_City_Software\Registry_First_Aid_5_0\RFA_5.0\RFA\rfagent.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Tweak UI] "RUNDLL32.EXE" TWEAKUI.CPL,TweakMeUp
O4 - HKCU\..\Run: [UIWatcher] F:\Ashampoo_2002_2003\UIWatcher.exe
O4 - HKCU\..\Run: [SeaMonkey Quick Launch] "d:\Sea_Monkey_1_0_2(060206)\SeaMonkey.exe" -turbo
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Startup: Dialog Tracker.lnk = F:\Explorer_Plus_1_0\Nxdlghlp.exe
O4 - Startup: Yahoo! Desktop Search.lnk = D:\UTILITES\Desktop_Search\Yahoo\YahooDesktopSearch.exe
O4 - Startup: Yahoo! Desktop Search System Tray.lnk = D:\UTILITES\Desktop_Search\Yahoo\YDSsystray.exe
O4 - Global Startup: NkVwMon.exe.lnk = E:\Nikon_View_4\NkVwMon.exe
O4 - Global Startup: HPAiODevice(hp officejet g series) - 1.lnk = C:\HP_G85_drivers\AiO\hp officejet g series\Bin\hpoavn07.exe
O4 - Global Startup: AdSubtract.lnk = D:\ZoneAlarm_2_6\AdSubtract\AdSubtract CE\AdSubtract\adsub.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &WordWeb… - res://C:\WINDOWS\wweb32.dll/lookup.html
O8 - Extra context menu item: Do&wnload by ReGet Deluxe - C:\Program Files\Common Files\ReGet Shared\CC_Link.htm
O8 - Extra context menu item: Download A&ll by ReGet Deluxe - C:\Program Files\Common Files\ReGet Shared\CC_All.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\OFFICE~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open PDF in Word - res://F:\Omni_Page_Pro_14_Office\PdfCnv\IEShellExt.dll /100
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Citi - {4C730913-3961-439b-83D5-F4E445520422} - C:\Program Files\Citi Virtual Account Numbers\CitiVAN.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\OFFICE~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: @Home - {0A01ED80-F4C9-11D5-8FBB-0050BAE7F34C} - http://home.excite.com (file missing) (HKCU)
O12 - Plugin for .asx: D:\Netscape\COMMUN~3\Program\PLUGINS\npdsplay.dll
O12 - Plugin for .bcf: C:\PROGRA~1\INTERN~1\Plugins\NPBelv32.dll
O12 - Plugin for .wm: D:\Netscape\COMMUN~3\Program\PLUGINS\npdsplay.dll
O12 - Plugin for .wmv: D:\Netscape\COMMUN~3\Program\PLUGINS\npdsplay.dll
O15 - Trusted Zone: *.accruradio.com
O16 - DPF: {156BF4B7-AE3A-4365-BD88-95A75AF8F09D} (HPSDDX Class) - http://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab
O16 - DPF: {1FA643B0-F90E-11D3-BA0B-00C04F384A92} (HomeTsrCtrl Class) - http://image.excite.com/sputnik/dynacat_up…ationchange.dll
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} (NCSView Class) - http://isvprod1.landonline.com.au/ecwplugins/ncs.cab
O16 - DPF: {97BB6657-DC7F-4489-9067-51FAB9D8857E} (CWebLaunchCtl Object) - http://support.gateway.com/eSupport/static…/weblaunch2.cab
O16 - DPF: {9B17FE0E-51F2-4692-8B32-8EFB805FC0E7} (HPObjectInstaller Class) - http://h30155.www3.hp.com/ediags/gs/instal…edsolutions.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://dgl.microsoft.com/downloads/outc.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: DefWatch - Symantec Corporation - F:\Norton_AntiVirus_CorpEdition_7\defwatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: GhostStartService - Symantec Corporation - F:\NORTON~1\NORTON~1\GHOSTS~2.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Intuit Fuse Service - Intuit - C:\Program Files\Common Files\Intuit\Fuse\Service\Intuit Fuse Service.exe
O23 - Service: Lexar JD31 (LxrJD31s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrJD31s.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - F:\Norton_AntiVirus_CorpEdition_7\rtvscan.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - F:\Norton_System_Works2003\Norton Utilities\NPROTECT.EXE
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - F:\Sandra_Lite\SiSoftware Sandra Lite 2005.SR3\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - F:\Sandra_Lite\SiSoftware Sandra Lite 2005.SR3\RpcSandraSrv.exe
O23 - Service: Speed Disk service - Symantec Corporation - F:\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: STOPzilla Local Service - International Software Systems Solutions - C:\Program Files\STOPzilla!\szntsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\VSMON.EXE
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
Note: I was advised to run the HijackThis scan because I have the following "ERROR". I have WIN2K PRO and when I try to boot in SAFE MODE I receive a "STOP ERROR". I can give you the exact text of the stop error if you need it.
Here is my HijackThis scan:
Logfile of HijackThis v1.99.1
Scan saved at 1:02:36 PM, on 10/18/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\STOPzilla!\szntsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
F:\Norton_AntiVirus_CorpEdition_7\defwatch.exe
C:\WINDOWS\System32\svchost.exe
F:\NORTON~1\NORTON~1\GHOSTS~2.EXE
C:\WINDOWS\system32\LxrJD31s.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
F:\Norton_AntiVirus_CorpEdition_7\rtvscan.exe
F:\Norton_System_Works2003\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
F:\NORTON~1\SPEEDD~1\nopdb.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\SYSTEM32\ZONELABS\VSMON.EXE
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\MsgSys.EXE
F:\Omni_Page_Pro_14_Office\WorkFlowTray.exe
F:\NORTON~2\vptray.exe
F:\Omni_Page_Pro_14_Office\PdfPrn\SPrnAgent.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\StartupMonitor.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
F:\Omni_Page_Pro_14_Office\OpScheduler.exe
C:\windows\system32\spool\drivers\w32x86\2\hpoopm07.exe
F:\Norton_System_Works2003\Norton Ghost\GhostStartTrayApp.exe
E:\Warez_Office11\Daemon_Tools\daemon.exe
C:\Program Files\Citi Virtual Account Numbers\CitiVAN.exe
C:\WINDOWS\Mixer.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
D:\UTILITES\Acronis_True_Image_9_B3677\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
D:\ZoneAlarmPro_61_737update(032606)\ZoneAlarm\zlclient.exe
D:\UTILITES\Acronis_True_Image_9_B3677\TimounterMonitor.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
E:\Rose_City_Software\Registry_First_Aid_5_0\RFA_5.0\RFA\rfagent.exe
F:\Ashampoo_2002_2003\UIWatcher.exe
D:\Sea_Monkey_1_0_2(060206)\SeaMonkey.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Nikon_View_4\NkVwMon.exe
C:\HP_G85_drivers\AiO\hp officejet g series\Bin\hpoavn07.exe
D:\ZoneAlarm_2_6\AdSubtract\AdSubtract CE\AdSubtract\adsub.exe
F:\Explorer_Plus_1_0\Nxdlghlp.exe
D:\UTILITES\Desktop_Search\Yahoo\YahooDesktopSearch.exe
D:\UTILITES\Desktop_Search\Yahoo\YDSsystray.exe
C:\HP_G85~1\AiO\Shared\Bin\hpoevm07.exe
C:\WINDOWS\system32\hpoipm07.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
F:\Explorer_Plus_1_0\NxExplo.exe
F:\Explorer_Plus_1_0\NxExplo.exe
D:\UTILITES\HIjack_this\Hijack_This_Program_V199_1(101806)\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.comcast.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:4444
F3 - REG:win.ini: run=
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: ClickCatcher MSIE handler - {16664845-0E00-11D2-8059-000000000000} - C:\Program Files\Common Files\ReGet Shared\Catcher.dll
O2 - BHO: CitiUSBrowserHelper Class - {387EDF53-1CF2-4523-BC2F-13462651BE8C} - C:\WINDOWS\system32\BhoCitUS.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\SPYBOT~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: ReGet Bar - {17939A30-18E2-471E-9D3A-56DD725F1215} - D:\UTILITES\ReGetDx\iebar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [TaskScheduler] D:\TURBOTAX\PRO_2003\32bit\TaskSch.exe
O4 - HKLM\..\Run: [ProTaskScheduler] D:\TURBOTAX\PRO_2005\32bit\TaskSch.exe
O4 - HKLM\..\Run: [WorkFlowTray] "F:\Omni_Page_Pro_14_Office\WorkFlowTray.exe"
O4 - HKLM\..\Run: [vptray] F:\NORTON~2\vptray.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [SSPrnAgent] F:\Omni_Page_Pro_14_Office\PdfPrn\SPrnAgent.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe"
O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PDF Converter Registry Controller] "F:\Omni_Page_Pro_14_Office\PdfCnv\RegistryController.exe"
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [Opware14] "F:\Omni_Page_Pro_14_Office\Opware14.exe"
O4 - HKLM\..\Run: [OpScheduler] "F:\Omni_Page_Pro_14_Office\OpScheduler.exe"
O4 - HKLM\..\Run: [Omnipage] "C:\Program Files\ScanSoft\OmniPagePro11.0\opware32.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] c:\windows\system32\spool\drivers\w32x86\2\hpoopm07.exe
O4 - HKLM\..\Run: [GhostStartTrayApp] "F:\Norton_System_Works2003\Norton Ghost\GhostStartTrayApp.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\Warez_Office11\Daemon_Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [CitiVAN] "C:\Program Files\Citi Virtual Account Numbers\CitiVAN.exe" /dontopenmycards
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [TrueImageMonitor.exe] D:\UTILITES\Acronis_True_Image_9_B3677\TrueImageMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Zone Labs Client] D:\ZoneAlarmPro_61_737update(032606)\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] D:\UTILITES\Acronis_True_Image_9_B3677\TimounterMonitor.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [rfagent] "E:\Rose_City_Software\Registry_First_Aid_5_0\RFA_5.0\RFA\rfagent.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Tweak UI] "RUNDLL32.EXE" TWEAKUI.CPL,TweakMeUp
O4 - HKCU\..\Run: [UIWatcher] F:\Ashampoo_2002_2003\UIWatcher.exe
O4 - HKCU\..\Run: [SeaMonkey Quick Launch] "d:\Sea_Monkey_1_0_2(060206)\SeaMonkey.exe" -turbo
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Startup: Dialog Tracker.lnk = F:\Explorer_Plus_1_0\Nxdlghlp.exe
O4 - Startup: Yahoo! Desktop Search.lnk = D:\UTILITES\Desktop_Search\Yahoo\YahooDesktopSearch.exe
O4 - Startup: Yahoo! Desktop Search System Tray.lnk = D:\UTILITES\Desktop_Search\Yahoo\YDSsystray.exe
O4 - Global Startup: NkVwMon.exe.lnk = E:\Nikon_View_4\NkVwMon.exe
O4 - Global Startup: HPAiODevice(hp officejet g series) - 1.lnk = C:\HP_G85_drivers\AiO\hp officejet g series\Bin\hpoavn07.exe
O4 - Global Startup: AdSubtract.lnk = D:\ZoneAlarm_2_6\AdSubtract\AdSubtract CE\AdSubtract\adsub.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &WordWeb… - res://C:\WINDOWS\wweb32.dll/lookup.html
O8 - Extra context menu item: Do&wnload by ReGet Deluxe - C:\Program Files\Common Files\ReGet Shared\CC_Link.htm
O8 - Extra context menu item: Download A&ll by ReGet Deluxe - C:\Program Files\Common Files\ReGet Shared\CC_All.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\OFFICE~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open PDF in Word - res://F:\Omni_Page_Pro_14_Office\PdfCnv\IEShellExt.dll /100
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Citi - {4C730913-3961-439b-83D5-F4E445520422} - C:\Program Files\Citi Virtual Account Numbers\CitiVAN.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\OFFICE~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: @Home - {0A01ED80-F4C9-11D5-8FBB-0050BAE7F34C} - http://home.excite.com (file missing) (HKCU)
O12 - Plugin for .asx: D:\Netscape\COMMUN~3\Program\PLUGINS\npdsplay.dll
O12 - Plugin for .bcf: C:\PROGRA~1\INTERN~1\Plugins\NPBelv32.dll
O12 - Plugin for .wm: D:\Netscape\COMMUN~3\Program\PLUGINS\npdsplay.dll
O12 - Plugin for .wmv: D:\Netscape\COMMUN~3\Program\PLUGINS\npdsplay.dll
O15 - Trusted Zone: *.accruradio.com
O16 - DPF: {156BF4B7-AE3A-4365-BD88-95A75AF8F09D} (HPSDDX Class) - http://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab
O16 - DPF: {1FA643B0-F90E-11D3-BA0B-00C04F384A92} (HomeTsrCtrl Class) - http://image.excite.com/sputnik/dynacat_up…ationchange.dll
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} (NCSView Class) - http://isvprod1.landonline.com.au/ecwplugins/ncs.cab
O16 - DPF: {97BB6657-DC7F-4489-9067-51FAB9D8857E} (CWebLaunchCtl Object) - http://support.gateway.com/eSupport/static…/weblaunch2.cab
O16 - DPF: {9B17FE0E-51F2-4692-8B32-8EFB805FC0E7} (HPObjectInstaller Class) - http://h30155.www3.hp.com/ediags/gs/instal…edsolutions.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://dgl.microsoft.com/downloads/outc.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: DefWatch - Symantec Corporation - F:\Norton_AntiVirus_CorpEdition_7\defwatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: GhostStartService - Symantec Corporation - F:\NORTON~1\NORTON~1\GHOSTS~2.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Intuit Fuse Service - Intuit - C:\Program Files\Common Files\Intuit\Fuse\Service\Intuit Fuse Service.exe
O23 - Service: Lexar JD31 (LxrJD31s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrJD31s.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - F:\Norton_AntiVirus_CorpEdition_7\rtvscan.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - F:\Norton_System_Works2003\Norton Utilities\NPROTECT.EXE
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - F:\Sandra_Lite\SiSoftware Sandra Lite 2005.SR3\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - F:\Sandra_Lite\SiSoftware Sandra Lite 2005.SR3\RpcSandraSrv.exe
O23 - Service: Speed Disk service - Symantec Corporation - F:\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: STOPzilla Local Service - International Software Systems Solutions - C:\Program Files\STOPzilla!\szntsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\VSMON.EXE
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
