nhsbaseball16
Topic Starter
Okay well im new to this. I am not very knowledgable with computers. I was at another site/forum and I asked them about removing outerinfo popups. They gave me this link.
http://forums.tomcoyote.org/index.php?act=…mp;t=72305&
I did the Combo Fix and here is the log for that:
C:\WINDOWS\system32\msconfig.dll
C:\WINDOWS\system32\wtscc.exe
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Folders Quarantined:
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\ASEMBL~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\ECURIT~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\FNTS~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\MANTEC~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\MBOLS~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\PPATCH~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\RACLE~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\RACLE~2
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\SCURIT~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\SEMBLY~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\SSEMBL~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\TSKS~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\WNSXS~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\YMBOLS~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\YSTEM3~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\My Documents\APPATC~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\My Documents\CROSOF~1.NET
C:\QooBox\Purity\Documents and Settings\Scott Richison\My Documents\DOBE~2
C:\QooBox\Purity\Documents and Settings\Scott Richison\My Documents\FNTS~2
C:\QooBox\Purity\Documents and Settings\Scott Richison\My Documents\ICROSO~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\My Documents\ICROSO~2
C:\QooBox\Purity\Documents and Settings\Scott Richison\My Documents\MBOLS~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\My Documents\PPATCH~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\My Documents\PPPATC~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\My Documents\RACLE~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\My Documents\SCURIT~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\My Documents\SMANTE~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\My Documents\SMBOLS~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\My Documents\TSKS~1
C:\QooBox\Purity\Program Files\ASEMBL~1
C:\QooBox\Purity\Program Files\CROSOF~1.NET
C:\QooBox\Purity\Program Files\CURITY~1
C:\QooBox\Purity\Program Files\DOBE~1
C:\QooBox\Purity\Program Files\ICROSO~1.NET
C:\QooBox\Purity\Program Files\ICROSO~2.NET
C:\QooBox\Purity\Program Files\PPATCH~1
C:\QooBox\Purity\Program Files\PPPATC~1
C:\QooBox\Purity\Program Files\RACLE~1
C:\QooBox\Purity\Program Files\RACLE~2
C:\QooBox\Purity\Program Files\SKS~1
C:\QooBox\Purity\Program Files\SKS~2
C:\QooBox\Purity\Program Files\SSEMBL~1
C:\QooBox\Purity\Program Files\SSTEM3~1
C:\QooBox\Purity\Program Files\STEM32~1
C:\QooBox\Purity\Program Files\TSKS~1
C:\QooBox\Purity\Program Files\WNSXS~1
C:\QooBox\Purity\Program Files\YMBOLS~1
C:\QooBox\Purity\Program Files\YSTEM3~1
C:\QooBox\Purity\Program Files\YSTEM~1
C:\QooBox\Purity\Program Files\Common Files\CROSOF~1
C:\QooBox\Purity\Program Files\Common Files\CURITY~1
C:\QooBox\Purity\Program Files\Common Files\DOBE~1
C:\QooBox\Purity\Program Files\Common Files\ECURIT~1
C:\QooBox\Purity\Program Files\Common Files\FNTS~1
C:\QooBox\Purity\Program Files\Common Files\ICROSO~1
C:\QooBox\Purity\Program Files\Common Files\ICROSO~1.NET
C:\QooBox\Purity\Program Files\Common Files\PPPATC~1
C:\QooBox\Purity\Program Files\Common Files\RACLE~1
C:\QooBox\Purity\Program Files\Common Files\SSTEM3~1
C:\QooBox\Purity\Program Files\Common Files\WNSXS~1
C:\QooBox\Purity\Program Files\RACLE~1\arpa.exe
C:\QooBox\Purity\Program Files\RACLE~1\RACLE~1
C:\QooBox\Purity\Program Files\YSTEM3~1\w?nspool.exe
C:\QooBox\Purity\WINDOWS\APPATC~1
C:\QooBox\Purity\WINDOWS\ASKS~1
C:\QooBox\Purity\WINDOWS\CROSOF~1
C:\QooBox\Purity\WINDOWS\ICROSO~1
C:\QooBox\Purity\WINDOWS\MANTEC~1
C:\QooBox\Purity\WINDOWS\MBOLS~1
C:\QooBox\Purity\WINDOWS\MCROSO~1.NET
C:\QooBox\Purity\WINDOWS\RACLE~1
C:\QooBox\Purity\WINDOWS\SCURIT~1
C:\QooBox\Purity\WINDOWS\SEMBLY~1
C:\QooBox\Purity\WINDOWS\SMBOLS~1
C:\QooBox\Purity\WINDOWS\WNSXS~1
C:\QooBox\Purity\WINDOWS\YMBOLS~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\CROSOF~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\DOBE~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\ECURIT~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\FNTS~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\MCROSO~1.NET
C:\QooBox\Purity\WINDOWS\SYSTEM32\PPATCH~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\RACLE~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\SCURIT~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\SEMBLY~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\SKS~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\SMBOLS~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\SSTEM3~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\SSTEM~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\STEM~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\WNSXS~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\YMBOLS~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\YSTEM3~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\YSTEM~1
((((((((((((((((((((((((((((((( Files Created from 2006-11-06 to 2006-12-06 ))))))))))))))))))))))))))))))))))
2006-12-06 19:51 56,832 –a—— C:\WINDOWS\SYSTEM32\mcv.dll
2006-12-04 22:01 51,072 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\ikhlayer.sys
2006-12-04 22:01 30,592 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\ikhfile.sys
2006-12-04 22:01 d——– C:\Program Files\Spyware Doctor
2006-12-04 22:01 d——– C:\Documents and Settings\Scott Richison\Application Data\PC Tools
2006-11-23 03:01 d——– C:\43eff0333ecb2633edba58d9
2006-11-22 02:03 d——– C:\Program Files\MSXML 4.0
2006-11-17 03:02 d——– C:\cb9222d242bf48bac425c2f5
2006-11-16 07:27 d–h-c— C:\WINDOWS\ie7
2006-11-15 21:04 d——– C:\Documents and Settings\Scott Richison\Application Data\ICAClient
2006-11-15 21:03 d——– C:\Program Files\Citrix
2006-11-08 20:13 d——– C:\Documents and Settings\Scott Richison\Application Data\çasks
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2006-12-06 21:51 ——– d-a—— C:\Program Files\Common Files
2006-12-06 20:29 ——– d——– C:\Program Files\Plaxo
2006-11-30 18:12 ——– d——– C:\Program Files\NoAds
2006-11-16 07:32 ——– d——– C:\Program Files\Internet Explorer
2006-11-15 22:36 ——– d——– C:\Program Files\iTunes
2006-11-15 22:35 ——– d——– C:\Program Files\iPod
2006-11-15 22:31 ——– d——– C:\Program Files\QuickTime
2006-11-07 19:31 ——– d——– C:\Program Files\Apple Software Update
2006-11-04 20:25 1321744 –a—— C:\WINDOWS\SYSTEM32\msxml6.dll
2006-11-04 14:14 1245696 –a—— C:\WINDOWS\SYSTEM32\msxml4.dll
2006-10-29 19:40 ——– d——– C:\Program Files\MsnMusic
2006-10-29 19:38 ——– d——– C:\Program Files\MTV Networks
2006-10-29 19:36 ——– d——– C:\Program Files\Windows Media Player
2006-10-29 19:36 ——– d——– C:\Program Files\Windows Media Connect 2
2006-10-27 15:09 6049280 ——— C:\WINDOWS\SYSTEM32\ieframe.dll
2006-10-27 15:09 50688 ——— C:\WINDOWS\SYSTEM32\msfeedsbs.dll
2006-10-27 15:09 458752 ——— C:\WINDOWS\SYSTEM32\msfeeds.dll
2006-10-27 15:09 413696 –a—— C:\WINDOWS\SYSTEM32\vbscript.dll
2006-10-27 15:09 231424 –a—— C:\WINDOWS\SYSTEM32\webcheck.dll
2006-10-27 15:09 180736 ——— C:\WINDOWS\SYSTEM32\ieui.dll
2006-10-27 15:09 156160 –a—— C:\WINDOWS\SYSTEM32\msls31.dll
2006-10-27 02:44 71680 –a—— C:\WINDOWS\SYSTEM32\admparse.dll
2006-10-27 02:44 55296 –a—— C:\WINDOWS\SYSTEM32\iesetup.dll
2006-10-27 02:44 54784 –a—— C:\WINDOWS\SYSTEM32\ie4uinit.exe
2006-10-27 02:44 43008 –a—— C:\WINDOWS\SYSTEM32\iernonce.dll
2006-10-27 02:44 382976 –a—— C:\WINDOWS\SYSTEM32\iedkcs32.dll
2006-10-27 02:44 229376 –a—— C:\WINDOWS\SYSTEM32\ieaksie.dll
2006-10-27 02:44 152064 –a—— C:\WINDOWS\SYSTEM32\ieakeng.dll
2006-10-27 02:44 13312 –a—— C:\WINDOWS\SYSTEM32\ieudinit.exe
2006-10-27 02:44 123904 –a—— C:\WINDOWS\SYSTEM32\advpack.dll
2006-10-27 02:42 161792 –a—— C:\WINDOWS\SYSTEM32\ieakui.dll
2006-10-17 13:06 78336 –a—— C:\WINDOWS\SYSTEM32\ieencode.dll
2006-10-17 13:05 40960 –a—— C:\WINDOWS\SYSTEM32\licmgr10.dll
2006-10-17 13:05 206336 ——— C:\WINDOWS\SYSTEM32\WinFXDocObj.exe
2006-10-17 13:05 105984 –a—— C:\WINDOWS\SYSTEM32\url.dll
2006-10-17 13:04 101376 –a—— C:\WINDOWS\SYSTEM32\occache.dll
2006-10-17 13:03 17408 –a—— C:\WINDOWS\SYSTEM32\corpol.dll
2006-10-17 12:58 61952 ——— C:\WINDOWS\SYSTEM32\icardie.dll
2006-10-17 12:58 12288 ——— C:\WINDOWS\SYSTEM32\msfeedssync.exe
2006-10-17 12:57 36352 –a—— C:\WINDOWS\SYSTEM32\imgutil.dll
2006-10-17 12:57 266752 ——— C:\WINDOWS\SYSTEM32\iertutil.dll
2006-10-17 12:56 45568 –a—— C:\WINDOWS\SYSTEM32\mshta.exe
2006-10-17 12:28 48128 –a—— C:\WINDOWS\SYSTEM32\mshtmler.dll
2006-10-17 12:27 380928 ——— C:\WINDOWS\SYSTEM32\ieapfltr.dll
2006-10-13 06:35 65536 –a—— C:\WINDOWS\SYSTEM32\nwwks.dll
2006-10-13 06:35 64000 –a—— C:\WINDOWS\SYSTEM32\nwapi32.dll
2006-10-13 06:35 142336 –a—— C:\WINDOWS\SYSTEM32\nwprovau.dll
2006-10-13 04:23 163584 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\nwrdr.sys
2006-10-08 18:57 ——– d—s—- C:\Documents and Settings\Scott Richison\Application Data\Microsoft
2006-09-19 15:43 109360 –a—— C:\WINDOWS\SYSTEM32\GEARAspi.dll
2006-09-12 23:01 1084416 –a—— C:\WINDOWS\SYSTEM32\msxml3.dll
2006-09-06 17:43 22752 –a—— C:\WINDOWS\SYSTEM32\spupdsvc.exe
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries are not shown
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"NoAds"="\"C:\\Program Files\\NoAds\\NoAds.exe\""
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"Yahoo! Pager"="\"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe\" -quiet"
"PlaxoUpdate"="C:\\Program Files\\Plaxo\\2.11.1.5\\PlaxoHelper.exe -a"
"Microsoft Works Update Detection"="C:\\Program Files\\Microsoft Works\\WkDetect.exe"
"Ncao"="\"C:\\PROGRA~1\\RACLE~1\\arpa.exe\" -vt cs_o"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"
"Ujsorye"="C:\\Program Files\\?ystem32\\w?nspool.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"DVDSentry"="C:\\WINDOWS\\System32\\DSentry.exe"
"AdaptecDirectCD"="\"C:\\Program Files\\Roxio\\Easy CD Creator 5\\DirectCD\\DirectCD.exe\""
"ViewMgr"="C:\\Program Files\\Viewpoint\\Viewpoint Manager\\ViewMgr.exe"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"AVG7_EMC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgemc.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"HostManager"="C:\\Program Files\\Common Files\\AOL\\1125889202\\ee\\AOLSoftware.exe"
"P17Helper"="Rundll32 P17.dll,P17Helper"
"CTSysVol"="C:\\Program Files\\Creative\\SBAudigy\\Surround Mixer\\CTSysVol.exe /r"
"UpdReg"="C:\\WINDOWS\\UpdReg.EXE"
"CTRegRun"="C:\\WINDOWS\\CTRegRun.EXE"
"IntelliPoint"="\"C:\\Program Files\\Microsoft IntelliPoint\\point32.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000005
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="http://hp.msn.com/2C/47O@XPGR3K2H,J~7-WNSB{.jpg"
"SubscribedURL"="http://hp.msn.com/2C/47O@XPGR3K2H,J~7-WNSB{.jpg"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,00,00,00,00,00,00,00,00,00,04,00,00,de,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:02,00,00,00
"OriginalStateInfo"=hex:18,00,00,00,6c,02,00,00,e5,00,00,00,25,01,00,00,9a,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:18,00,00,00,6c,02,00,00,e5,00,00,00,25,01,00,00,9a,00,\
00,00,01,00,00,00
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
"Source"="http://espn-att.starwave.com/media/pga/2004/0717/photo/g_woods_frt.jpg"
"SubscribedURL"="http://espn-att.starwave.com/media/pga/2004/0717/photo/g_woods_frt.jpg"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,a4,01,00,00,27,00,00,00,74,01,00,00,e0,00,00,00,ea,\
03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,00
"OriginalStateInfo"=hex:18,00,00,00,a4,01,00,00,27,00,00,00,74,01,00,00,e0,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:dc,ff,7d,0e,09,48,e9,77,88,32,e8,77,ff,ff,ff,ff,de,60,\
e7,77,90,e0,f5,0b
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\2]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,a0,00,00,00,01,00,00,00,80,02,00,00,39,02,00,00,ec,\
03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,00
"OriginalStateInfo"=hex:18,00,00,00,a0,00,00,00,00,00,00,00,80,02,00,00,3a,02,\
00,00,04,00,00,40
"RestoredStateInfo"=hex:18,00,00,00,a0,00,00,00,00,00,00,00,80,02,00,00,3a,02,\
00,00,01,00,00,00
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"
"Hfal"="C:\\WINDOWS\\system32\\n?lookup.exe"
"Yahoo! Pager"="\"C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\ypager.exe\" -quiet"
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"
"Hfal"="C:\\WINDOWS\\system32\\n?lookup.exe"
"Yahoo! Pager"="\"C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\ypager.exe\" -quiet"
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Scott Richison^Start Menu^Programs^Startup^Download Plus.lnk]
"path"="C:\\Documents and Settings\\Scott Richison\\Start Menu\\Programs\\Startup\\Download Plus.lnk"
"backup"="C:\\WINDOWS\\pss\\Download Plus.lnkStartup"
"location"="Startup"
"command"="C:\\DOCUME~1\\SCOTTR~1\\APPLIC~1\\DOWNLO~1.EXE "
"item"="Download Plus"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Scott Richison^Start Menu^Programs^Startup^Virtual Bouncer.lnk]
"path"="C:\\Documents and Settings\\Scott Richison\\Start Menu\\Programs\\Startup\\Virtual Bouncer.lnk"
"backup"="C:\\WINDOWS\\pss\\Virtual Bouncer.lnkStartup"
"location"="Startup"
"command"="C:\\Program Files\\VBouncer\\VirtualBouncer.exe "
"item"="Virtual Bouncer"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKLM"
"command"="c:\\WINDOWS\\System32\\"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG_CC]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="avgcc32"
"hkey"="HKLM"
"command"="C:\\Program Files\\Grisoft\\AVG6\\avgcc32.exe /startup"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bakra]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="IEHost34"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\System32\\IEHost34.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bargains]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="bargains"
"hkey"="HKLM"
"command"="C:\\Program Files\\Bargain Buddy\\bin2\\bargains.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KAZAA]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Kazaa"
"hkey"="HKLM"
"command"="C:\\Program Files\\Kazaa\\Kazaa.exe /SYSTRAY"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="WkDetect"
"hkey"="HKCU"
"command"="C:\\Program Files\\Microsoft Works\\WkDetect.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="RUNDLL32"
"hkey"="HKLM"
"command"="RUNDLL32.EXE NvQTwk,NvCplDaemon initialize"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="nwiz"
"hkey"="HKLM"
"command"="nwiz.exe /install"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P2P Networking]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="P2P Networking"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\System32\\P2P Networking\\P2P Networking.exe /AUTOSTART"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\qVgWT]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qVgWT"
"hkey"="HKLM"
"command"="C:\\documents and settings\\scott richison\\local settings\\temp\\qVgWT.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shareaza]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Shareaza"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Shareaza\\Shareaza.exe\" -tray"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\spkrsj]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="spkrsj"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\spkrsj.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SQConfigChecker]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="cc"
"hkey"="HKLM"
"command"="C:\\Program Files\\Sqwire\\cc.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SQUpdatesChecker]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="uc"
"hkey"="HKLM"
"command"="C:\\Program Files\\Sqwire\\uc.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Srng]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Srng"
"hkey"="HKLM"
"command"="\\Program Files\\Srng\\Srng.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\thdetrf]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKLM"
"command"=""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TimeSyncApp]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="TimeSynchronize"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\TimeSynchronize.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ufyfuhbs]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="rudacgji"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\System32\\rudacgji.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wbjxuoxw]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="rycchnsb"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\rycchnsb.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSave]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Save"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\Save\\Save.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearch]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Search"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\WHENUS~1\\Search.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\Symantec NetDetect.job
Completion time: 06-12-06 21:53:31.85
C:\ComboFix.txt … 06-12-06 21:53
Also, i did the log for hijack this. here is that one:
Logfile of HijackThis v1.99.1
Scan saved at 10:36:19 PM, on 12/7/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Common Files\AOL\1125889202\ee\AOLSoftware.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\NoAds\NoAds.exe
C:\Program Files\Plaxo\2.11.1.5\PlaxoHelper.exe
C:\PROGRA~1\RACLE~1\arpa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\D-Link AirPlus\AIRPLUS.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\?ystem32\w?nspool.exe
C:\WINDOWS\System32\cidaemon.exe
C:\Program Files\AIM95\aim.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\iTunes\iTunes.exe
C:\DOCUME~1\SCOTTR~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Outlook Express\msimn.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://smbusiness.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R3 - URLSearchHook: (no name) - {BBB18C35-1684-4372-D05F-1A73643D5898} - C:\WINDOWS\system32\mcv.dll
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: (no name) - {BBB18C35-1684-4372-D05F-1A73643D5898} - C:\WINDOWS\system32\mcv.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1125889202\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [CTRegRun] C:\WINDOWS\CTRegRun.EXE
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [NoAds] "C:\Program Files\NoAds\NoAds.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.11.1.5\PlaxoHelper.exe -a
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [Ncao] "C:\PROGRA~1\RACLE~1\arpa.exe" -vt cs_o
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [Ujsorye] C:\Program Files\?ystem32\w?nspool.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: D-Link AirPlus Utility.lnk = ?
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 3.0\resources\en-US\local\search.html
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: Toki Toki Boom - http://download.games.yahoo.com/games/clients/y/vtm_x.cab
O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/clients/y/jt0_x.cab
O16 - DPF: Yahoo! Canasta - http://download.games.yahoo.com/games/clients/y/yt1_x.cab
O16 - DPF: Yahoo! Fleet - http://download.games.yahoo.com/games/clients/y/fltt2_x.cab
O16 - DPF: Yahoo! Tic-Tac-Toe - http://download.games.yahoo.com/games/clients/y/ft3_x.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai.net/f/516/25175/7d/ru…cat-no-eula.cab
O16 - DPF: {2871FC9B-5E34-4AAE-9E9C-EBD1652D5C92} (Rhapsody Player Engine) - http://forms.real.com/real/player/download…ne_Inst_Win.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_…aploader_v6.cab
O20 - AppInit_DLLs: ,
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: .NET Framework Service (.NET Connection Service) - Unknown owner - C:\WINDOWS\svchost.exe (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
What do i need to do next? Are there any problems i need to fix? Do i need to go ahead and delete the folder named Qoobox? Please help me and tell me everything i need to know. Thanks
http://forums.tomcoyote.org/index.php?act=…mp;t=72305&
I did the Combo Fix and here is the log for that:
C:\WINDOWS\system32\msconfig.dll
C:\WINDOWS\system32\wtscc.exe
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Folders Quarantined:
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\ASEMBL~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\ECURIT~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\FNTS~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\MANTEC~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\MBOLS~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\PPATCH~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\RACLE~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\RACLE~2
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\SCURIT~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\SEMBLY~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\SSEMBL~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\TSKS~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\WNSXS~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\YMBOLS~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\Application Data\YSTEM3~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\My Documents\APPATC~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\My Documents\CROSOF~1.NET
C:\QooBox\Purity\Documents and Settings\Scott Richison\My Documents\DOBE~2
C:\QooBox\Purity\Documents and Settings\Scott Richison\My Documents\FNTS~2
C:\QooBox\Purity\Documents and Settings\Scott Richison\My Documents\ICROSO~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\My Documents\ICROSO~2
C:\QooBox\Purity\Documents and Settings\Scott Richison\My Documents\MBOLS~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\My Documents\PPATCH~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\My Documents\PPPATC~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\My Documents\RACLE~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\My Documents\SCURIT~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\My Documents\SMANTE~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\My Documents\SMBOLS~1
C:\QooBox\Purity\Documents and Settings\Scott Richison\My Documents\TSKS~1
C:\QooBox\Purity\Program Files\ASEMBL~1
C:\QooBox\Purity\Program Files\CROSOF~1.NET
C:\QooBox\Purity\Program Files\CURITY~1
C:\QooBox\Purity\Program Files\DOBE~1
C:\QooBox\Purity\Program Files\ICROSO~1.NET
C:\QooBox\Purity\Program Files\ICROSO~2.NET
C:\QooBox\Purity\Program Files\PPATCH~1
C:\QooBox\Purity\Program Files\PPPATC~1
C:\QooBox\Purity\Program Files\RACLE~1
C:\QooBox\Purity\Program Files\RACLE~2
C:\QooBox\Purity\Program Files\SKS~1
C:\QooBox\Purity\Program Files\SKS~2
C:\QooBox\Purity\Program Files\SSEMBL~1
C:\QooBox\Purity\Program Files\SSTEM3~1
C:\QooBox\Purity\Program Files\STEM32~1
C:\QooBox\Purity\Program Files\TSKS~1
C:\QooBox\Purity\Program Files\WNSXS~1
C:\QooBox\Purity\Program Files\YMBOLS~1
C:\QooBox\Purity\Program Files\YSTEM3~1
C:\QooBox\Purity\Program Files\YSTEM~1
C:\QooBox\Purity\Program Files\Common Files\CROSOF~1
C:\QooBox\Purity\Program Files\Common Files\CURITY~1
C:\QooBox\Purity\Program Files\Common Files\DOBE~1
C:\QooBox\Purity\Program Files\Common Files\ECURIT~1
C:\QooBox\Purity\Program Files\Common Files\FNTS~1
C:\QooBox\Purity\Program Files\Common Files\ICROSO~1
C:\QooBox\Purity\Program Files\Common Files\ICROSO~1.NET
C:\QooBox\Purity\Program Files\Common Files\PPPATC~1
C:\QooBox\Purity\Program Files\Common Files\RACLE~1
C:\QooBox\Purity\Program Files\Common Files\SSTEM3~1
C:\QooBox\Purity\Program Files\Common Files\WNSXS~1
C:\QooBox\Purity\Program Files\RACLE~1\arpa.exe
C:\QooBox\Purity\Program Files\RACLE~1\RACLE~1
C:\QooBox\Purity\Program Files\YSTEM3~1\w?nspool.exe
C:\QooBox\Purity\WINDOWS\APPATC~1
C:\QooBox\Purity\WINDOWS\ASKS~1
C:\QooBox\Purity\WINDOWS\CROSOF~1
C:\QooBox\Purity\WINDOWS\ICROSO~1
C:\QooBox\Purity\WINDOWS\MANTEC~1
C:\QooBox\Purity\WINDOWS\MBOLS~1
C:\QooBox\Purity\WINDOWS\MCROSO~1.NET
C:\QooBox\Purity\WINDOWS\RACLE~1
C:\QooBox\Purity\WINDOWS\SCURIT~1
C:\QooBox\Purity\WINDOWS\SEMBLY~1
C:\QooBox\Purity\WINDOWS\SMBOLS~1
C:\QooBox\Purity\WINDOWS\WNSXS~1
C:\QooBox\Purity\WINDOWS\YMBOLS~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\CROSOF~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\DOBE~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\ECURIT~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\FNTS~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\MCROSO~1.NET
C:\QooBox\Purity\WINDOWS\SYSTEM32\PPATCH~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\RACLE~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\SCURIT~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\SEMBLY~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\SKS~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\SMBOLS~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\SSTEM3~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\SSTEM~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\STEM~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\WNSXS~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\YMBOLS~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\YSTEM3~1
C:\QooBox\Purity\WINDOWS\SYSTEM32\YSTEM~1
((((((((((((((((((((((((((((((( Files Created from 2006-11-06 to 2006-12-06 ))))))))))))))))))))))))))))))))))
2006-12-06 19:51 56,832 –a—— C:\WINDOWS\SYSTEM32\mcv.dll
2006-12-04 22:01 51,072 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\ikhlayer.sys
2006-12-04 22:01 30,592 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\ikhfile.sys
2006-12-04 22:01 d——– C:\Program Files\Spyware Doctor
2006-12-04 22:01 d——– C:\Documents and Settings\Scott Richison\Application Data\PC Tools
2006-11-23 03:01 d——– C:\43eff0333ecb2633edba58d9
2006-11-22 02:03 d——– C:\Program Files\MSXML 4.0
2006-11-17 03:02 d——– C:\cb9222d242bf48bac425c2f5
2006-11-16 07:27 d–h-c— C:\WINDOWS\ie7
2006-11-15 21:04 d——– C:\Documents and Settings\Scott Richison\Application Data\ICAClient
2006-11-15 21:03 d——– C:\Program Files\Citrix
2006-11-08 20:13 d——– C:\Documents and Settings\Scott Richison\Application Data\çasks
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2006-12-06 21:51 ——– d-a—— C:\Program Files\Common Files
2006-12-06 20:29 ——– d——– C:\Program Files\Plaxo
2006-11-30 18:12 ——– d——– C:\Program Files\NoAds
2006-11-16 07:32 ——– d——– C:\Program Files\Internet Explorer
2006-11-15 22:36 ——– d——– C:\Program Files\iTunes
2006-11-15 22:35 ——– d——– C:\Program Files\iPod
2006-11-15 22:31 ——– d——– C:\Program Files\QuickTime
2006-11-07 19:31 ——– d——– C:\Program Files\Apple Software Update
2006-11-04 20:25 1321744 –a—— C:\WINDOWS\SYSTEM32\msxml6.dll
2006-11-04 14:14 1245696 –a—— C:\WINDOWS\SYSTEM32\msxml4.dll
2006-10-29 19:40 ——– d——– C:\Program Files\MsnMusic
2006-10-29 19:38 ——– d——– C:\Program Files\MTV Networks
2006-10-29 19:36 ——– d——– C:\Program Files\Windows Media Player
2006-10-29 19:36 ——– d——– C:\Program Files\Windows Media Connect 2
2006-10-27 15:09 6049280 ——— C:\WINDOWS\SYSTEM32\ieframe.dll
2006-10-27 15:09 50688 ——— C:\WINDOWS\SYSTEM32\msfeedsbs.dll
2006-10-27 15:09 458752 ——— C:\WINDOWS\SYSTEM32\msfeeds.dll
2006-10-27 15:09 413696 –a—— C:\WINDOWS\SYSTEM32\vbscript.dll
2006-10-27 15:09 231424 –a—— C:\WINDOWS\SYSTEM32\webcheck.dll
2006-10-27 15:09 180736 ——— C:\WINDOWS\SYSTEM32\ieui.dll
2006-10-27 15:09 156160 –a—— C:\WINDOWS\SYSTEM32\msls31.dll
2006-10-27 02:44 71680 –a—— C:\WINDOWS\SYSTEM32\admparse.dll
2006-10-27 02:44 55296 –a—— C:\WINDOWS\SYSTEM32\iesetup.dll
2006-10-27 02:44 54784 –a—— C:\WINDOWS\SYSTEM32\ie4uinit.exe
2006-10-27 02:44 43008 –a—— C:\WINDOWS\SYSTEM32\iernonce.dll
2006-10-27 02:44 382976 –a—— C:\WINDOWS\SYSTEM32\iedkcs32.dll
2006-10-27 02:44 229376 –a—— C:\WINDOWS\SYSTEM32\ieaksie.dll
2006-10-27 02:44 152064 –a—— C:\WINDOWS\SYSTEM32\ieakeng.dll
2006-10-27 02:44 13312 –a—— C:\WINDOWS\SYSTEM32\ieudinit.exe
2006-10-27 02:44 123904 –a—— C:\WINDOWS\SYSTEM32\advpack.dll
2006-10-27 02:42 161792 –a—— C:\WINDOWS\SYSTEM32\ieakui.dll
2006-10-17 13:06 78336 –a—— C:\WINDOWS\SYSTEM32\ieencode.dll
2006-10-17 13:05 40960 –a—— C:\WINDOWS\SYSTEM32\licmgr10.dll
2006-10-17 13:05 206336 ——— C:\WINDOWS\SYSTEM32\WinFXDocObj.exe
2006-10-17 13:05 105984 –a—— C:\WINDOWS\SYSTEM32\url.dll
2006-10-17 13:04 101376 –a—— C:\WINDOWS\SYSTEM32\occache.dll
2006-10-17 13:03 17408 –a—— C:\WINDOWS\SYSTEM32\corpol.dll
2006-10-17 12:58 61952 ——— C:\WINDOWS\SYSTEM32\icardie.dll
2006-10-17 12:58 12288 ——— C:\WINDOWS\SYSTEM32\msfeedssync.exe
2006-10-17 12:57 36352 –a—— C:\WINDOWS\SYSTEM32\imgutil.dll
2006-10-17 12:57 266752 ——— C:\WINDOWS\SYSTEM32\iertutil.dll
2006-10-17 12:56 45568 –a—— C:\WINDOWS\SYSTEM32\mshta.exe
2006-10-17 12:28 48128 –a—— C:\WINDOWS\SYSTEM32\mshtmler.dll
2006-10-17 12:27 380928 ——— C:\WINDOWS\SYSTEM32\ieapfltr.dll
2006-10-13 06:35 65536 –a—— C:\WINDOWS\SYSTEM32\nwwks.dll
2006-10-13 06:35 64000 –a—— C:\WINDOWS\SYSTEM32\nwapi32.dll
2006-10-13 06:35 142336 –a—— C:\WINDOWS\SYSTEM32\nwprovau.dll
2006-10-13 04:23 163584 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\nwrdr.sys
2006-10-08 18:57 ——– d—s—- C:\Documents and Settings\Scott Richison\Application Data\Microsoft
2006-09-19 15:43 109360 –a—— C:\WINDOWS\SYSTEM32\GEARAspi.dll
2006-09-12 23:01 1084416 –a—— C:\WINDOWS\SYSTEM32\msxml3.dll
2006-09-06 17:43 22752 –a—— C:\WINDOWS\SYSTEM32\spupdsvc.exe
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries are not shown
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"NoAds"="\"C:\\Program Files\\NoAds\\NoAds.exe\""
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"Yahoo! Pager"="\"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe\" -quiet"
"PlaxoUpdate"="C:\\Program Files\\Plaxo\\2.11.1.5\\PlaxoHelper.exe -a"
"Microsoft Works Update Detection"="C:\\Program Files\\Microsoft Works\\WkDetect.exe"
"Ncao"="\"C:\\PROGRA~1\\RACLE~1\\arpa.exe\" -vt cs_o"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"
"Ujsorye"="C:\\Program Files\\?ystem32\\w?nspool.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"DVDSentry"="C:\\WINDOWS\\System32\\DSentry.exe"
"AdaptecDirectCD"="\"C:\\Program Files\\Roxio\\Easy CD Creator 5\\DirectCD\\DirectCD.exe\""
"ViewMgr"="C:\\Program Files\\Viewpoint\\Viewpoint Manager\\ViewMgr.exe"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"AVG7_EMC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgemc.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"HostManager"="C:\\Program Files\\Common Files\\AOL\\1125889202\\ee\\AOLSoftware.exe"
"P17Helper"="Rundll32 P17.dll,P17Helper"
"CTSysVol"="C:\\Program Files\\Creative\\SBAudigy\\Surround Mixer\\CTSysVol.exe /r"
"UpdReg"="C:\\WINDOWS\\UpdReg.EXE"
"CTRegRun"="C:\\WINDOWS\\CTRegRun.EXE"
"IntelliPoint"="\"C:\\Program Files\\Microsoft IntelliPoint\\point32.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000005
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="http://hp.msn.com/2C/47O@XPGR3K2H,J~7-WNSB{.jpg"
"SubscribedURL"="http://hp.msn.com/2C/47O@XPGR3K2H,J~7-WNSB{.jpg"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,00,00,00,00,00,00,00,00,00,04,00,00,de,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:02,00,00,00
"OriginalStateInfo"=hex:18,00,00,00,6c,02,00,00,e5,00,00,00,25,01,00,00,9a,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:18,00,00,00,6c,02,00,00,e5,00,00,00,25,01,00,00,9a,00,\
00,00,01,00,00,00
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
"Source"="http://espn-att.starwave.com/media/pga/2004/0717/photo/g_woods_frt.jpg"
"SubscribedURL"="http://espn-att.starwave.com/media/pga/2004/0717/photo/g_woods_frt.jpg"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,a4,01,00,00,27,00,00,00,74,01,00,00,e0,00,00,00,ea,\
03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,00
"OriginalStateInfo"=hex:18,00,00,00,a4,01,00,00,27,00,00,00,74,01,00,00,e0,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:dc,ff,7d,0e,09,48,e9,77,88,32,e8,77,ff,ff,ff,ff,de,60,\
e7,77,90,e0,f5,0b
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\2]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,a0,00,00,00,01,00,00,00,80,02,00,00,39,02,00,00,ec,\
03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,00
"OriginalStateInfo"=hex:18,00,00,00,a0,00,00,00,00,00,00,00,80,02,00,00,3a,02,\
00,00,04,00,00,40
"RestoredStateInfo"=hex:18,00,00,00,a0,00,00,00,00,00,00,00,80,02,00,00,3a,02,\
00,00,01,00,00,00
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"
"Hfal"="C:\\WINDOWS\\system32\\n?lookup.exe"
"Yahoo! Pager"="\"C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\ypager.exe\" -quiet"
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"
"Hfal"="C:\\WINDOWS\\system32\\n?lookup.exe"
"Yahoo! Pager"="\"C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\ypager.exe\" -quiet"
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Scott Richison^Start Menu^Programs^Startup^Download Plus.lnk]
"path"="C:\\Documents and Settings\\Scott Richison\\Start Menu\\Programs\\Startup\\Download Plus.lnk"
"backup"="C:\\WINDOWS\\pss\\Download Plus.lnkStartup"
"location"="Startup"
"command"="C:\\DOCUME~1\\SCOTTR~1\\APPLIC~1\\DOWNLO~1.EXE "
"item"="Download Plus"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Scott Richison^Start Menu^Programs^Startup^Virtual Bouncer.lnk]
"path"="C:\\Documents and Settings\\Scott Richison\\Start Menu\\Programs\\Startup\\Virtual Bouncer.lnk"
"backup"="C:\\WINDOWS\\pss\\Virtual Bouncer.lnkStartup"
"location"="Startup"
"command"="C:\\Program Files\\VBouncer\\VirtualBouncer.exe "
"item"="Virtual Bouncer"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKLM"
"command"="c:\\WINDOWS\\System32\\"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG_CC]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="avgcc32"
"hkey"="HKLM"
"command"="C:\\Program Files\\Grisoft\\AVG6\\avgcc32.exe /startup"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bakra]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="IEHost34"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\System32\\IEHost34.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bargains]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="bargains"
"hkey"="HKLM"
"command"="C:\\Program Files\\Bargain Buddy\\bin2\\bargains.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KAZAA]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Kazaa"
"hkey"="HKLM"
"command"="C:\\Program Files\\Kazaa\\Kazaa.exe /SYSTRAY"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="WkDetect"
"hkey"="HKCU"
"command"="C:\\Program Files\\Microsoft Works\\WkDetect.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="RUNDLL32"
"hkey"="HKLM"
"command"="RUNDLL32.EXE NvQTwk,NvCplDaemon initialize"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="nwiz"
"hkey"="HKLM"
"command"="nwiz.exe /install"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P2P Networking]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="P2P Networking"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\System32\\P2P Networking\\P2P Networking.exe /AUTOSTART"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\qVgWT]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qVgWT"
"hkey"="HKLM"
"command"="C:\\documents and settings\\scott richison\\local settings\\temp\\qVgWT.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shareaza]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Shareaza"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Shareaza\\Shareaza.exe\" -tray"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\spkrsj]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="spkrsj"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\spkrsj.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SQConfigChecker]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="cc"
"hkey"="HKLM"
"command"="C:\\Program Files\\Sqwire\\cc.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SQUpdatesChecker]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="uc"
"hkey"="HKLM"
"command"="C:\\Program Files\\Sqwire\\uc.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Srng]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Srng"
"hkey"="HKLM"
"command"="\\Program Files\\Srng\\Srng.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\thdetrf]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKLM"
"command"=""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TimeSyncApp]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="TimeSynchronize"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\TimeSynchronize.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ufyfuhbs]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="rudacgji"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\System32\\rudacgji.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wbjxuoxw]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="rycchnsb"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\rycchnsb.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSave]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Save"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\Save\\Save.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearch]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Search"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\WHENUS~1\\Search.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\Symantec NetDetect.job
Completion time: 06-12-06 21:53:31.85
C:\ComboFix.txt … 06-12-06 21:53
Also, i did the log for hijack this. here is that one:
Logfile of HijackThis v1.99.1
Scan saved at 10:36:19 PM, on 12/7/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Common Files\AOL\1125889202\ee\AOLSoftware.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\NoAds\NoAds.exe
C:\Program Files\Plaxo\2.11.1.5\PlaxoHelper.exe
C:\PROGRA~1\RACLE~1\arpa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\D-Link AirPlus\AIRPLUS.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\?ystem32\w?nspool.exe
C:\WINDOWS\System32\cidaemon.exe
C:\Program Files\AIM95\aim.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\iTunes\iTunes.exe
C:\DOCUME~1\SCOTTR~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Outlook Express\msimn.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://smbusiness.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R3 - URLSearchHook: (no name) - {BBB18C35-1684-4372-D05F-1A73643D5898} - C:\WINDOWS\system32\mcv.dll
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: (no name) - {BBB18C35-1684-4372-D05F-1A73643D5898} - C:\WINDOWS\system32\mcv.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1125889202\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [CTRegRun] C:\WINDOWS\CTRegRun.EXE
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [NoAds] "C:\Program Files\NoAds\NoAds.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.11.1.5\PlaxoHelper.exe -a
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [Ncao] "C:\PROGRA~1\RACLE~1\arpa.exe" -vt cs_o
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [Ujsorye] C:\Program Files\?ystem32\w?nspool.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: D-Link AirPlus Utility.lnk = ?
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 3.0\resources\en-US\local\search.html
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: Toki Toki Boom - http://download.games.yahoo.com/games/clients/y/vtm_x.cab
O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/clients/y/jt0_x.cab
O16 - DPF: Yahoo! Canasta - http://download.games.yahoo.com/games/clients/y/yt1_x.cab
O16 - DPF: Yahoo! Fleet - http://download.games.yahoo.com/games/clients/y/fltt2_x.cab
O16 - DPF: Yahoo! Tic-Tac-Toe - http://download.games.yahoo.com/games/clients/y/ft3_x.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai.net/f/516/25175/7d/ru…cat-no-eula.cab
O16 - DPF: {2871FC9B-5E34-4AAE-9E9C-EBD1652D5C92} (Rhapsody Player Engine) - http://forms.real.com/real/player/download…ne_Inst_Win.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_…aploader_v6.cab
O20 - AppInit_DLLs: ,
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: .NET Framework Service (.NET Connection Service) - Unknown owner - C:\WINDOWS\svchost.exe (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
What do i need to do next? Are there any problems i need to fix? Do i need to go ahead and delete the folder named Qoobox? Please help me and tell me everything i need to know. Thanks