Spyware / Malware / Virus Removal

logfile

18 min read

Looking for the outcome? Ask AI

OldTimer

Post #16December 23, 2006, 2:47 AM UTC

Hi PatRick B. The log looks pretty good. No active files. Just a few left-over entries to clean out of the registry.

Start WinPFind3U. Copy/Paste the information in the quotebox below into the pane where it says "Paste fix here" and then click the Run Fix button.

[Registry - Non-Microsoft Only]
< Run [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YY -> mlbaeu -> c:\windows\system32\diqtygq.exe
YY -> uwctnew -> c:\windows\system32\uifzwhz.exe
< BHO's > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
YY -> {B9D0C4C5-0B72-05F1-76F6-7045077A7393} [HKLM] -> C:\WINDOWS\system32\trla.dll [Reg Data - Value does not exist]
< Internet Explorer ToolBars [HKCU] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\
YN -> ShellBrowser\\{5CBE2611-C31B-401F-89BC-4CBB25E853D7} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found]
[Files - Created Wihin 30 days]
NY -> MobileSidewalkRON_2.ico -> C:\WINDOWS\System32\MobileSidewalkRON_2.ico
NY -> TitanPokerIconDropTRA108.ico -> C:\WINDOWS\System32\TitanPokerIconDropTRA108.ico
NY -> TrafficSales_Casino_3.ico -> C:\WINDOWS\System32\TrafficSales_Casino_3.ico
[Files - Modified Wihin 30 days]
NY -> 333D2DC9AE.sys -> C:\WINDOWS\System32\333D2DC9AE.sys
NY -> ClickToFindandFixErrors_Intl.ico -> C:\WINDOWS\System32\ClickToFindandFixErrors_Intl.ico
NY -> MobileSidewalkRON_2.ico -> C:\WINDOWS\System32\MobileSidewalkRON_2.ico
NY -> TitanPokerIconDropTRA108.ico -> C:\WINDOWS\System32\TitanPokerIconDropTRA108.ico
NY -> TrafficSales_Casino_3.ico -> C:\WINDOWS\System32\TrafficSales_Casino_3.ico

Click the Run Fix button and let's see what we get.

Post the following back here:

a new WinPFind3U report
the latest .log file from the WinPFind3u folder (it will have a name in the format mmddyyyy_hhmmss.log)

I will review the information when it comes back in.

Also let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.

Cheers.

OT

PatRick B

Post #17December 24, 2006, 8:13 PM UTC

Hello OT,
A happy Holidays to you & yours

Computer seems to be running a bit faster & have not had any popups/unders in a while the installer has stopped also.

WinPFind fix ran with no problems
Had to run the scan 3 or 4 times b4 it would run complete, kept getting stuck ( not responding)

WinPFind3 logfile created on: 12/24/2006 12:35:26 PM
WinPFind3U by OldTimer - Version 1.0.1 Folder = C:\Documents and Settings\Patrick Boyle\Desktop\WinPFind3u\
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600)
Internet Explorer (Version = 6.0.2900.2180)

[Processes - Non-Microsoft Only]
avgamsvr.exe -> C:\Program Files\Grisoft\AVG Free\avgamsvr.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 343552 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
avgas.exe -> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 50 | Size = 6266880 bytes | Modified Date = 10/7/2006 6:20:00 AM | Attr = ]
avgcc.exe -> C:\Program Files\Grisoft\AVG Free\avgcc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.418 | Size = 406016 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
avgemc.exe -> C:\Program Files\Grisoft\AVG Free\avgemc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.432 | Size = 323072 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
avgupsvc.exe -> C:\Program Files\Grisoft\AVG Free\avgupsvc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 49664 bytes | Modified Date = 12/17/2006 8:37:48 AM | Attr = ]
ctsvccda.exe -> C:\WINDOWS\SYSTEM32\CTSVCCDA.EXE -> Creative Technology Ltd [Ver = 1.0.1.0 | Size = 44032 bytes | Modified Date = 12/13/1999 12:01:00 AM | Attr = ]
damon.exe -> C:\Program Files\Dell\Support\Alert\bin\DAMon.exe -> [Ver = 1, 0, 0, 1 | Size = 282624 bytes | Modified Date = 4/3/2002 5:06:18 PM | Attr = ]
devldr32.exe -> C:\WINDOWS\SYSTEM32\devldr32.exe -> Creative Technology Ltd. [Ver = 1, 0, 0, 22 | Size = 25600 bytes | Modified Date = 8/31/2001 12:44:30 PM | Attr = ]
dlcqcoms.exe -> C:\WINDOWS\SYSTEM32\dlcqcoms.exe -> [Ver = 6.3.22.0 | Size = 528384 bytes | Modified Date = 7/13/2006 5:27:16 PM | Attr = ]
dlcqmon.exe -> C:\Program Files\Dell Photo AIO Printer 966\dlcqmon.exe -> [Ver = 0.1.25.0 | Size = 286720 bytes | Modified Date = 6/20/2006 11:37:42 AM | Attr = ]
easyshare.exe -> C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe -> [Ver = 5, 0, 25, 230 | Size = 151552 bytes | Modified Date = 7/22/2005 3:47:22 AM | Attr = ]
evntsvc.exe -> C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -> RealNetworks, Inc. [Ver = 0.1.0.880 | Size = 146432 bytes | Modified Date = 6/22/2002 7:20:54 AM | Attr = ]
ezsp_px.exe -> C:\WINDOWS\SYSTEM32\ezSP_Px.exe -> Easy Systems Japan Ltd. [Ver = 1, 0, 0, 0 | Size = 40960 bytes | Modified Date = 8/20/2002 10:29:26 AM | Attr = ]
firefox.exe -> C:\Program Files\Mozilla Firefox\firefox.exe -> Mozilla [Ver = 1.0.7 | Size = 6637156 bytes | Modified Date = 9/15/2005 6:26:00 PM | Attr = ]
guard.exe -> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 47 | Size = 204800 bytes | Modified Date = 9/28/2006 8:13:20 AM | Attr = ]
ipodservice.exe -> C:\Program Files\iPod\bin\iPodService.exe -> Apple Computer, Inc. [Ver = 7.0.2.16 | Size = 492608 bytes | Modified Date = 10/30/2006 9:36:32 AM | Attr = ]
ituneshelper.exe -> C:\Program Files\iTunes\iTunesHelper.exe -> Apple Computer, Inc. [Ver = 7.0.2.16 | Size = 256576 bytes | Modified Date = 10/30/2006 9:36:36 AM | Attr = ]
jucheck.exe -> C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe -> Sun Microsystems, Inc. [Ver = 5.0.90.3 | Size = 241775 bytes | Modified Date = 10/12/2006 3:10:54 AM | Attr = ]
jusched.exe -> C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe -> Sun Microsystems, Inc. [Ver = 5.0.90.3 | Size = 49263 bytes | Modified Date = 10/12/2006 3:10:54 AM | Attr = ]
kodak software updater.exe -> C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe -> [Ver = | Size = 16423 bytes | Modified Date = 2/13/2004 2:12:08 PM | Attr = ]
mediadetect.exe -> C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe -> Corel, Inc. [Ver = 6.0.0 (20050831.10) | Size = 106496 bytes | Modified Date = 8/31/2005 11:06:18 AM | Attr = ]
memcard.exe -> C:\Program Files\Dell Photo AIO Printer 966\memcard.exe -> [Ver = 1.0.18.1 | Size = 299008 bytes | Modified Date = 6/27/2006 5:34:50 AM | Attr = ]
mm_tray.exe -> C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe -> MUSICMATCH, Inc. [Ver = 7.10.0053 | Size = 90112 bytes | Modified Date = 2/27/2002 12:17:08 PM | Attr = ]
morpheus.exe -> C:\Program Files\Morpheus\Morpheus.exe -> Streamcast Networks, Inc [Ver = 1.0.0.1 | Size = 721408 bytes | Modified Date = 9/12/2006 1:17:26 PM | Attr = ]
nvsvc32.exe -> C:\WINDOWS\SYSTEM32\nvsvc32.exe -> NVIDIA Corporation [Ver = 6.14.10.5216 | Size = 81920 bytes | Modified Date = 10/6/2003 2:16:00 PM | Attr = ]
qttask.exe -> C:\Program Files\QuickTime\qttask.exe -> Apple Computer, Inc. [Ver = 7.1.3 | Size = 282624 bytes | Modified Date = 10/25/2006 6:58:18 PM | Attr = ]
sagent2.exe -> C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe -> SEIKO EPSON CORPORATION [Ver = 2, 2, 0, 0 | Size = 90112 bytes | Modified Date = 10/25/2001 1:02:00 AM | Attr = ]
thunderbird.exe -> C:\Program Files\Mozilla Thunderbird\thunderbird.exe -> Mozilla.org [Ver = 1.0.2 | Size = 7541349 bytes | Modified Date = 3/17/2005 12:20:00 PM | Attr = ]
viewmgr.exe -> C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe -> Viewpoint Corporation [Ver = 2, 0, 0, 42 | Size = 111816 bytes | Modified Date = 11/10/2004 10:15:32 PM | Attr = ]
winpfind3u.exe -> C:\Documents and Settings\Patrick Boyle\Desktop\WinPFind3u\WinPFind3U.exe -> Oldtimer Tools [Ver = 1.0.1.0 | Size = 302592 bytes | Modified Date = 12/21/2006 8:20:08 PM | Attr = ]
wkufind.exe -> C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe -> Microsoft® Corporation [Ver = 6.00.3215.0 | Size = 28738 bytes | Modified Date = 8/16/2001 9:41:58 PM | Attr = ]
ymsgr_tray.exe -> C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe -> Yahoo! Inc. [Ver = 8,1,0,0 | Size = 103928 bytes | Modified Date = 10/24/2006 4:10:18 PM | Attr = ]

[Win32 Services - Non-Microsoft Only]
(AVG Anti-Spyware Guard) AVG Anti-Spyware Guard [Win32_Own | Auto | Running] -> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 47 | Size = 204800 bytes | Modified Date = 9/28/2006 8:13:20 AM | Attr = ]
(Avg7Alrt) AVG7 Alert Manager Server [Win32_Own | Auto | Running] -> C:\Program Files\Grisoft\AVG Free\avgamsvr.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 343552 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
(Avg7UpdSvc) AVG7 Update Service [Win32_Own | Auto | Running] -> C:\Program Files\Grisoft\AVG Free\avgupsvc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 49664 bytes | Modified Date = 12/17/2006 8:37:48 AM | Attr = ]
(AVGEMS) AVG E-mail Scanner [Win32_Own | Auto | Running] -> C:\Program Files\Grisoft\AVG Free\avgemc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.432 | Size = 323072 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
(Creative Service for CDROM Access) Creative Service for CDROM Access [Win32_Own | Auto | Running] -> C:\WINDOWS\SYSTEM32\CTSVCCDA.EXE -> Creative Technology Ltd [Ver = 1.0.1.0 | Size = 44032 bytes | Modified Date = 12/13/1999 12:01:00 AM | Attr = ]
(dlcq_device) dlcq_device [Win32_Own | Auto | Running] -> C:\WINDOWS\SYSTEM32\dlcqcoms.exe -> [Ver = 6.3.22.0 | Size = 528384 bytes | Modified Date = 7/13/2006 5:27:16 PM | Attr = ]
(dmadmin) Logical Disk Manager Administrative Service [Win32_Shared | On_Demand | Stopped] -> C:\WINDOWS\SYSTEM32\dmadmin.exe -> Microsoft Corp., Veritas Software [Ver = 2600.2180.503.0 | Size = 224768 bytes | Modified Date = 8/4/2004 1:56:48 AM | Attr = ]
(EPSONStatusAgent2) EPSON Printer Status Agent2 [Win32_Own | Auto | Running] -> C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe -> SEIKO EPSON CORPORATION [Ver = 2, 2, 0, 0 | Size = 90112 bytes | Modified Date = 10/25/2001 1:02:00 AM | Attr = ]
(iPod Service) iPod Service [Win32_Own | On_Demand | Running] -> C:\Program Files\iPod\bin\iPodService.exe -> Apple Computer, Inc. [Ver = 7.0.2.16 | Size = 492608 bytes | Modified Date = 10/30/2006 9:36:32 AM | Attr = ]
(KodakCCS) Kodak Camera Connection Software [Win32_Own | On_Demand | Stopped] -> C:\WINDOWS\SYSTEM32\DRIVERS\KodakCCS.exe -> Eastman Kodak Company [Ver = 1.1.5100.4 | Size = 411920 bytes | Modified Date = 3/30/2005 4:46:56 PM | Attr = ]
(NVSvc) NVIDIA Display Driver Service [Win32_Own | Auto | Running] -> C:\WINDOWS\SYSTEM32\nvsvc32.exe -> NVIDIA Corporation [Ver = 6.14.10.5216 | Size = 81920 bytes | Modified Date = 10/6/2003 2:16:00 PM | Attr = ]
(PACSPTISVR) PACSPTISVR [Win32_Own | On_Demand | Stopped] -> C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe -> Sony Corporation [Ver = 4.0.00.05270 | Size = 53337 bytes | Modified Date = 5/27/2004 1:14:58 AM | Attr = ]
(SPTISRV) Sony SPTI Service [Win32_Own | On_Demand | Stopped] -> C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe -> Sony Corporation [Ver = 4.0.00.05270 | Size = 69718 bytes | Modified Date = 5/27/2004 1:13:00 AM | Attr = ]

[Registry - Non-Microsoft Only]
< Run [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
!AVG Anti-Spyware -> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 50 | Size = 6266880 bytes | Modified Date = 10/7/2006 6:20:00 AM | Attr = ]
AVG7_CC -> C:\Program Files\Grisoft\AVG Free\avgcc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.418 | Size = 406016 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
Corel Photo Downloader -> C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe -> Corel, Inc. [Ver = 6.0.0 (20050831.10) | Size = 106496 bytes | Modified Date = 8/31/2005 11:06:18 AM | Attr = ]
Dell|Alert -> C:\Program Files\Dell\Support\Alert\bin\DAMon.exe -> [Ver = 1, 0, 0, 1 | Size = 282624 bytes | Modified Date = 4/3/2002 5:06:18 PM | Attr = ]
DLCQCATS -> C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\dlcqtime.dll [rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCQtime.dll,_RunDLLEntry@16] -> [Ver = 1.20.0.0 | Size = 106496 bytes | Modified Date = 6/7/2006 12:17:18 PM | Attr = ]
dlcqmon.exe -> C:\Program Files\Dell Photo AIO Printer 966\dlcqmon.exe -> [Ver = 0.1.25.0 | Size = 286720 bytes | Modified Date = 6/20/2006 11:37:42 AM | Attr = ]
ezShieldProtector for Px -> C:\WINDOWS\SYSTEM32\ezSP_Px.exe -> Easy Systems Japan Ltd. [Ver = 1, 0, 0, 0 | Size = 40960 bytes | Modified Date = 8/20/2002 10:29:26 AM | Attr = ]
FaxCenterServer -> C:\Program Files\Dell PC Fax\fm3032.exe -> [Ver = 0.1.35.8 | Size = 307200 bytes | Modified Date = 6/15/2006 4:03:30 AM | Attr = ]
ISUSPM Startup -> C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe -> InstallShield Software Corporation [Ver = 4, 50, 100, 33433 | Size = 249856 bytes | Modified Date = 6/10/2005 10:44:02 AM | Attr = ]
ISUSScheduler -> C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe -> InstallShield Software Corporation [Ver = 4, 50, 100, 33433 | Size = 81920 bytes | Modified Date = 6/10/2005 10:44:02 AM | Attr = ]
iTunesHelper -> C:\Program Files\iTunes\iTunesHelper.exe -> Apple Computer, Inc. [Ver = 7.0.2.16 | Size = 256576 bytes | Modified Date = 10/30/2006 9:36:36 AM | Attr = ]
MemoryCardManager -> C:\Program Files\Dell Photo AIO Printer 966\memcard.exe -> [Ver = 1.0.18.1 | Size = 299008 bytes | Modified Date = 6/27/2006 5:34:50 AM | Attr = ]
Microsoft Works Update Detection -> C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe -> Microsoft® Corporation [Ver = 6.00.3215.0 | Size = 28738 bytes | Modified Date = 8/16/2001 9:41:58 PM | Attr = ]
MMTray -> C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe -> MUSICMATCH, Inc. [Ver = 7.10.0053 | Size = 90112 bytes | Modified Date = 2/27/2002 12:17:08 PM | Attr = ]
NvCplDaemon -> C:\WINDOWS\SYSTEM32\nvcpl.dll [RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup] -> NVIDIA Corporation [Ver = 6.14.10.5216 | Size = 5058560 bytes | Modified Date = 10/6/2003 2:16:00 PM | Attr = ]
QuickTime Task -> C:\Program Files\QuickTime\qttask.exe -> Apple Computer, Inc. [Ver = 7.1.3 | Size = 282624 bytes | Modified Date = 10/25/2006 6:58:18 PM | Attr = ]
SunJavaUpdateSched -> C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe -> Sun Microsystems, Inc. [Ver = 5.0.90.3 | Size = 49263 bytes | Modified Date = 10/12/2006 3:10:54 AM | Attr = ]
TkBellExe -> C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -> RealNetworks, Inc. [Ver = 0.1.0.880 | Size = 146432 bytes | Modified Date = 6/22/2002 7:20:54 AM | Attr = ]
ViewMgr -> C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe -> Viewpoint Corporation [Ver = 2, 0, 0, 42 | Size = 111816 bytes | Modified Date = 11/10/2004 10:15:32 PM | Attr = ]
< RunOnceEx [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
-> -> File not found
< OptionalComponents [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\
IMAIL -> Installed = 1 ->
MAPI -> Installed = 1 ->
MSFS -> Installed = 1 ->
< Run [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Works Update Detection -> C:\Program Files\Microsoft Works\WkDetect.exe -> File not found
MoneyAgent -> C:\Program Files\Microsoft Money\System\Money Express.exe -> File not found
swg -> C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe -> File not found
Yahoo! Pager -> C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe -> Yahoo! Inc. [Ver = 8,1,0,195 | Size = 4662776 bytes | Modified Date = 10/24/2006 4:10:18 PM | Attr = ]
< ShellExecuteHooks [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{57B86673-276A-48B2-BAE7-C6DBB3020EB8} [HKLM] -> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll [AVG Anti-Spyware 7.5] -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 47 | Size = 73728 bytes | Modified Date = 9/28/2006 8:13:28 AM | Attr = ]
< SecurityProviders [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders
< Winlogon settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
*VMApplet* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet ->
Control_RunDLL -> -> File not found
< Policy Settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{BDEADF00-C265-11D0-BCED-00A0C90AB50F} -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} -> 1073741857 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{0DF44EAA-FF21-4412-828E-260A8728E7F1} -> 32 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\dontdisplaylastusername -> 0 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\legalnoticecaption -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\legalnoticetext -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\shutdownwithoutlogon -> 1 ->
< Policy Settings [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 95 ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools -> 0 ->
< HOSTS File > -> C:\WINDOWS\System32\drivers\etc\Hosts
< Internet Explorer Settings > ->
HKLM: Default_Page_URL -> http://www.microsoft.com/isapi/redir.dll?p…&ar=msnhome ->
HKLM: Main\\Default_Search_URL -> http://www.google.com/ie ->
HKLM: Local Page -> %SystemRoot%\system32\blank.htm ->
HKLM: Start Page -> http://www.dellnet.com ->
HKLM: CustomizeSearch -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm ->
HKLM: Search\\Default_Search_URL -> http://www.google.com/ie ->
HKLM: SearchAssistant -> http://www.google.com/ie ->
HKCU: Local Page -> C:\WINDOWS\system32\blank.htm ->
HKCU: Search Bar -> http://www.google.com/ie ->
HKCU: Search Page -> http://www.google.com ->
HKCU: Start Page -> http://www.npr.org/ ->
HKCU: SearchAssistant -> http://www.google.com/ie ->
HKCU: ProxyEnable -> 0 ->
< Trusted Sites > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
msn.com [ - ] -> ->
< Trusted Sites > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
aol.com [ - ] -> ->
free_aol.com [ - ] -> ->
free_aol.com [http] -> ->
< BHO's > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [HKLM] -> C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [AcroIEHlprObj Class] -> [Ver = 1, 0, 0, 1 | Size = 37808 bytes | Modified Date = 4/16/2001 3:39:02 PM | Attr = ]
{53707962-6F74-2D53-2644-206D7942484F} [HKLM] -> C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [] -> Safer Networking Limited [Ver = 1, 4, 0, 0 | Size = 853672 bytes | Modified Date = 5/31/2005 1:04:00 AM | Attr = ]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [HKLM] -> C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll [SSVHelper Class] -> Sun Microsystems, Inc. [Ver = 5.0.90.3 | Size = 434279 bytes | Modified Date = 10/12/2006 3:25:44 AM | Attr = ]
{AA58ED58-01DD-4d91-8333-CF10577473F7} [HKLM] -> c:\program files\Google\googletoolbar3.dll [Google Toolbar Helper] -> Google Inc. [Ver = 4, 0, 1020, 3054 | Size = 2120768 bytes | Modified Date = 10/17/2006 2:04:08 PM | Attr = R ]
{BA849497-5825-54F6-74F6-70450779229C} [HKLM] -> C:\WINDOWS\SYSTEM32\bbtqp.dll [Reg Data - Value does not exist] -> [Ver = | Size = 58880 bytes | Modified Date = 12/11/2006 7:44:28 AM | Attr = ]
< Internet Explorer Bars [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\
{32683183-48a0-441b-a342-7c2a440a9478} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found] -> File not found
< Internet Explorer ToolBars [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar
{2318C2B1-4965-11d4-9B18-009027A5CD4F} [HKLM] -> c:\program files\Google\googletoolbar3.dll [&Google] -> Google Inc. [Ver = 4, 0, 1020, 3054 | Size = 2120768 bytes | Modified Date = 10/17/2006 2:04:08 PM | Attr = R ]
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} [HKLM] -> C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll [MSN] -> File not found
< Internet Explorer ToolBars [HKCU] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\
ShellBrowser\\{5CBE2611-C31B-401F-89BC-4CBB25E853D7} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found] -> File not found
WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} [HKLM] -> c:\program files\Google\googletoolbar3.dll [&Google] -> Google Inc. [Ver = 4, 0, 1020, 3054 | Size = 2120768 bytes | Modified Date = 10/17/2006 2:04:08 PM | Attr = R ]
WebBrowser\\{3F3714A9-89A4-46BE-8AF3-D0C9D1FB03F9} [HKLM] -> C:\Program Files\MorpheusBar\bar\2.bin\MORPHBAR.DLL [Morpheus Toolbar] -> File not found
WebBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found] -> File not found
< Internet Explorer CmdMapping [HKCU] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping
{000007C6-17DF-4438-92A4-DE5537471BA3} -> 8195 - Reg Data - Key not found ->
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} -> 8198 - Sun Java Console ->
{6685509E-B47B-4f47-8E16-9A5F3A62F683} -> 8199 - Reg Data - Key not found ->
{AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} -> 8196 - Reg Data - Key not found ->
{AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} -> 8197 - Reg Data - Key not found ->
{E023F504-0C5A-4750-A1E7-A9046DEA8A21} -> 8193 - Reg Data - Key not found ->
{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} -> 8200 - Yahoo! Messenger ->
{FB5F1910-F110-11d2-BB9E-00C04F795683} -> 8194 - Windows Messenger ->
NextId -> 8201 ->
< Internet Explorer Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKLM] -> C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll [MenuText: Sun Java Console] ->
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKCU] -> C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll [MenuText: Sun Java Console] -> Sun Microsystems, Inc. [Ver = 5.0.90.3 | Size = 434279 bytes | Modified Date = 10/12/2006 3:25:44 AM | Attr = ]
{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} -> C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [ButtonText: Yahoo! Messenger] -> Yahoo! Inc. [Ver = 8,1,0,195 | Size = 4662776 bytes | Modified Date = 10/24/2006 4:10:18 PM | Attr = ]
< Internet Explorer Plugins [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\Extension\
.spop -> C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll [Reg Data - Value does not exist] -> Intertrust Technologies, Inc. [Ver = 1.0.0.32 | Size = 270336 bytes | Modified Date = 8/1/2001 4:05:42 PM | Attr = ]
< Approved Shell Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
{0DF44EAA-FF21-4412-828E-260A8728E7F1} [HKLM] -> Reg Data - Key not found [Taskbar and Start Menu] -> File not found
{1CDB2949-8F65-4355-8456-263E7C208A5D} [HKLM] -> C:\WINDOWS\SYSTEM32\nvshell.dll [Desktop Explorer] -> NVIDIA Corporation [Ver = 6.14.10.5216 | Size = 430152 bytes | Modified Date = 10/6/2003 2:16:00 PM | Attr = ]
{1E2CDF40-419B-11D2-A5A1-002018648BA7} [HKLM] -> Reg Data - Key not found [AVG Shell Extension] -> File not found
{1E9B04FB-F9E5-4718-997B-B8DA88302A47} [HKLM] -> C:\WINDOWS\SYSTEM32\nvshell.dll [Desktop Explorer Menu] -> NVIDIA Corporation [Ver = 6.14.10.5216 | Size = 430152 bytes | Modified Date = 10/6/2003 2:16:00 PM | Attr = ]
{32683183-48a0-441b-a342-7c2a440a9478} [HKLM] -> Reg Data - Key not found [Media Band] -> File not found
{42071714-76d4-11d1-8b24-00a0c9068ff3} [HKLM] -> deskpan.dll [Display Panning CPL Extension] -> File not found
{5E44E225-A408-11CF-B581-008029601108} [HKLM] -> C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\Shellex.dll [Adaptec DirectCD Shell Extension] -> Roxio [Ver = 5.2.0.91 | Size = 180224 bytes | Modified Date = 4/10/2002 3:41:50 PM | Attr = ]
{764BF0E1-F219-11ce-972D-00AA00A14F56} [HKLM] -> Reg Data - Key not found [Shell extensions for file compression] -> File not found
{7A9D77BD-5403-11d2-8785-2E0420524153} [HKLM] -> Reg Data - Key not found [User Accounts] -> File not found
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} [HKLM] -> Reg Data - Key not found [Encryption Context Menu] -> File not found
{88895560-9AA2-1069-930E-00AA0030EBC8} [HKLM] -> C:\WINDOWS\SYSTEM32\HTICONS.DLL [HyperTerminal Icon Ext] -> Hilgraeve, Inc. [Ver = 5.1.2600.0 | Size = 44544 bytes | Modified Date = 8/18/2001 5:00:00 AM | Attr = ]
{8FF88D21-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [WinAce Archiver 2.6b4 (beta test) Context Menu Shell Extension] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
{8FF88D23-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [WinAce Archiver 2.6b4 (beta test) Property Sheet Shell Extension] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
{8FF88D25-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [WinAce Archiver 2.6b4 (beta test) DragDrop Shell Extension] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
{8FF88D27-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [WinAce Archiver 2.6b4 (beta test) Context Menu Shell Extension] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} [HKLM] -> C:\Program Files\Grisoft\AVG Free\avgse.dll [AVG7 Shell Extension] -> GRISOFT, s.r.o. [Ver = 7.5.0.409 | Size = 50688 bytes | Modified Date = 12/17/2006 8:37:44 AM | Attr = ]
{9F97547E-460A-42C5-AE0C-81C61FFAEBC3} [HKLM] -> C:\Program Files\Grisoft\AVG Free\avgse.dll [AVG7 Find Extension] -> GRISOFT, s.r.o. [Ver = 7.5.0.409 | Size = 50688 bytes | Modified Date = 12/17/2006 8:37:44 AM | Attr = ]
{acb4a560-3606-11d3-aef4-00104bd0f92d} [HKLM] -> C:\Program Files\Common Files\Kodak\ifscore\KodakShX.dll [KodakShellExtension] -> Eastman Kodak Company [Ver = 2.0.2300.3 | Size = 183296 bytes | Modified Date = 3/31/2005 7:53:42 AM | Attr = ]
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} [HKLM] -> C:\Program Files\iTunes\iTunesMiniPlayer.dll [iTunes] -> Apple Computer, Inc. [Ver = 7.0.2.16 | Size = 132672 bytes | Modified Date = 10/30/2006 9:36:36 AM | Attr = ]
{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} [HKLM] -> C:\Program Files\Real\RealOne Player\rpplugins\ierpplug.dll [Shell Extensions for RealOne Player] -> RealNetworks [Ver = 1.0.0.301 | Size = 180736 bytes | Modified Date = 6/22/2002 7:20:56 AM | Attr = ]
< ContextMenuHandlers - * [HKLM] > -> HKEY_LOCAL_MACHINE\Software\Classes\*\shellex\ContextMenuHandlers\
{8934FCEF-F5B8-468f-951F-78A921CD3920} [HKLM] -> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll [AVG Anti-Spyware] -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 49 | Size = 98304 bytes | Modified Date = 10/6/2006 5:40:48 AM | Attr = ]
{1E2CDF40-419B-11D2-A5A1-002018648BA7} [HKLM] -> Reg Data - Key not found [AVG Shell Extension] -> File not found
{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} [HKLM] -> C:\Program Files\Grisoft\AVG Free\avgse.dll [AVG7 Shell Extension] -> GRISOFT, s.r.o. [Ver = 7.5.0.409 | Size = 50688 bytes | Modified Date = 12/17/2006 8:37:44 AM | Attr = ]
{7DBF2913-1F89-4104-B1F4-932A29945C13} [HKLM] -> C:\Program Files\Morpheus\MorphShellExt.dll [MorpheusShellExt] -> TODO: [Ver = 1.0.0.1 | Size = 53248 bytes | Modified Date = 9/11/2006 4:21:40 PM | Attr = ]
{8FF88D27-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [ZFAdd] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
< ContextMenuHandlers - Directory [HKLM] > -> HKEY_LOCAL_MACHINE\Software\Classes\Directory\shellex\ContextMenuHandlers\
{8934FCEF-F5B8-468f-951F-78A921CD3920} [HKLM] -> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll [AVG Anti-Spyware] -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 49 | Size = 98304 bytes | Modified Date = 10/6/2006 5:40:48 AM | Attr = ]
{8FF88D27-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [ZFAdd] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
< ContextMenuHandlers - Folder [HKLM] > -> HKEY_LOCAL_MACHINE\Software\Classes\Folder\shellex\ContextMenuHandlers\
{1E2CDF40-419B-11D2-A5A1-002018648BA7} [HKLM] -> Reg Data - Key not found [AVG Shell Extension] -> File not found
{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} [HKLM] -> C:\Program Files\Grisoft\AVG Free\avgse.dll [AVG7 Shell Extension] -> GRISOFT, s.r.o. [Ver = 7.5.0.409 | Size = 50688 bytes | Modified Date = 12/17/2006 8:37:44 AM | Attr = ]
{7DBF2913-1F89-4104-B1F4-932A29945C13} [HKLM] -> C:\Program Files\Morpheus\MorphShellExt.dll [MorpheusShellExt] -> TODO: [Ver = 1.0.0.1 | Size = 53248 bytes | Modified Date = 9/11/2006 4:21:40 PM | Attr = ]
< User Agent Post Platform [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform
SV1 -> ->
< DNS Name Servers [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\
{F22F6660-02CA-4B75-AAC4-260C7BD2EBEA} -> (GVC-REALTEK Ethernet 10/100 PCI Adapter) ->
< Protocol Handlers [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\
ipp -> Reg Data - Key not found -> File not found
msdaipp -> Reg Data - Key not found -> File not found

[Files - Created Wihin 30 days]
dlcq.log -> C:\dlcq.log -> [Ver = | Size = 78 bytes | Created Date = 12/24/2006 10:54:48 AM | Attr = ]
dlcqscan.log -> C:\dlcqscan.log -> [Ver = | Size = 83 bytes | Created Date = 12/24/2006 10:54:50 AM | Attr = ]
hiberfil.sys -> C:\hiberfil.sys -> [Ver = | Size = 267468800 bytes | Created Date = 1/1/1601 6:00:00 AM | Attr = HS]
setupfax.log -> C:\setupfax.log -> [Ver = | Size = 172 bytes | Created Date = 12/4/2006 10:23:08 PM | Attr = ]
ie7_main.log -> C:\WINDOWS\ie7_main.log -> [Ver = | Size = 1151 bytes | Created Date = 12/20/2006 12:04:33 PM | Attr = ]
iexplore.exe-up.txt -> C:\WINDOWS\iexplore.exe-up.txt -> [Ver = | Size = 1855 bytes | Created Date = 12/5/2006 3:21:44 PM | Attr = ]
KB923689.log -> C:\WINDOWS\KB923689.log -> [Ver = | Size = 10942 bytes | Created Date = 12/17/2006 3:04:47 AM | Attr = ]
KB923694.log -> C:\WINDOWS\KB923694.log -> [Ver = | Size = 11904 bytes | Created Date = 12/16/2006 3:48:04 PM | Attr = ]
KB925398.log -> C:\WINDOWS\KB925398.log -> [Ver = | Size = 9413 bytes | Created Date = 12/17/2006 3:06:21 AM | Attr = ]
KB925454.log -> C:\WINDOWS\KB925454.log -> [Ver = | Size = 21129 bytes | Created Date = 12/16/2006 3:52:29 PM | Attr = ]
KB926255.log -> C:\WINDOWS\KB926255.log -> [Ver = | Size = 11927 bytes | Created Date = 12/16/2006 3:48:17 PM | Attr = ]
ntbtlog.txt -> C:\WINDOWS\ntbtlog.txt -> [Ver = | Size = 124486 bytes | Created Date = 12/19/2006 8:42:35 PM | Attr = ]
QTFont.for -> C:\WINDOWS\QTFont.for -> [Ver = | Size = 1409 bytes | Created Date = 12/17/2006 4:58:08 PM | Attr = ]
QTFont.qfn -> C:\WINDOWS\QTFont.qfn -> [Ver = | Size = 54156 bytes | Created Date = 12/17/2006 4:58:08 PM | Attr = H ]
bbtqp.dll -> C:\WINDOWS\System32\bbtqp.dll -> [Ver = | Size = 58880 bytes | Created Date = 12/24/2006 10:53:57 AM | Attr = ]
d3d8caps.dat -> C:\WINDOWS\System32\d3d8caps.dat -> [Ver = | Size = 552 bytes | Created Date = 12/20/2006 10:07:09 AM | Attr = ]
DLCQinst.dll -> C:\WINDOWS\System32\DLCQinst.dll -> [Ver = | Size = 274432 bytes | Created Date = 12/4/2006 10:20:18 PM | Attr = ]
DLPMONUI.DLL -> C:\WINDOWS\System32\DLPMONUI.DLL -> [Ver = 0.1.35.8 | Size = 32768 bytes | Created Date = 12/4/2006 10:21:54 PM | Attr = ]
DLPRMON.DLL -> C:\WINDOWS\System32\DLPRMON.DLL -> [Ver = 0.1.35.8 | Size = 40960 bytes | Created Date = 12/4/2006 10:21:54 PM | Attr = ]
IM31IMG.DIL -> C:\WINDOWS\System32\IM31IMG.DIL -> Data Techniques, Inc. [Ver = 7.20 | Size = 49152 bytes | Created Date = 12/4/2006 10:21:34 PM | Attr = ]
IM31XPNG.DEL -> C:\WINDOWS\System32\IM31XPNG.DEL -> Data Techniques, Inc. [Ver = 7.20 | Size = 98304 bytes | Created Date = 12/4/2006 10:21:34 PM | Attr = ]
IM31XTIF.DEL -> C:\WINDOWS\System32\IM31XTIF.DEL -> Data Techniques, Inc. [Ver = 7.20 | Size = 69632 bytes | Created Date = 12/4/2006 10:21:34 PM | Attr = ]
IMGMAN32.DLL -> C:\WINDOWS\System32\IMGMAN32.DLL -> Data Techniques, Inc. [Ver = 7.20 | Size = 339968 bytes | Created Date = 12/4/2006 10:21:34 PM | Attr = ]
IMHOST32.DLL -> C:\WINDOWS\System32\IMHOST32.DLL -> Data Techniques, Inc. [Ver = 7.20 | Size = 98345 bytes | Created Date = 12/4/2006 10:21:34 PM | Attr = ]
KGyGaAvL.sys -> C:\WINDOWS\System32\KGyGaAvL.sys -> [Ver = | Size = 3350 bytes | Created Date = 12/5/2006 1:37:28 PM | Attr = HS]
LexFiles.ulf -> C:\WINDOWS\System32\LexFiles.ulf -> [Ver = | Size = 26211 bytes | Created Date = 12/4/2006 10:19:02 PM | Attr = ]
wnscpsv.exe -> C:\WINDOWS\System32\wnscpsv.exe -> [Ver = | Size = 2 bytes | Created Date = 12/24/2006 10:54:13 AM | Attr = ]
AvgAsCln.sys -> C:\WINDOWS\System32\drivers\AvgAsCln.sys -> GRISOFT, s.r.o. [Ver = 1.0.0.14 | Size = 3968 bytes | Created Date = 12/18/2006 7:10:04 PM | Attr = ]
avgclean.sys -> C:\WINDOWS\System32\drivers\avgclean.sys -> GRISOFT, s.r.o. [Ver = 1.0.0.14 | Size = 3968 bytes | Created Date = 12/17/2006 8:37:49 AM | Attr = ]
avgmfx86.sys -> C:\WINDOWS\System32\drivers\avgmfx86.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.416 | Size = 18240 bytes | Created Date = 12/17/2006 8:37:48 AM | Attr = ]

[Files - Modified Wihin 30 days]
dlcq.log -> C:\dlcq.log -> [Ver = | Size = 78 bytes | Modified Date = 12/24/2006 10:54:50 AM | Attr = ]
dlcqscan.log -> C:\dlcqscan.log -> [Ver = | Size = 83 bytes | Modified Date = 12/24/2006 10:54:52 AM | Attr = ]
hiberfil.sys -> C:\hiberfil.sys -> [Ver = | Size = 267468800 bytes | Modified Date = 12/20/2006 11:43:12 AM | Attr = HS]
setupfax.log -> C:\setupfax.log -> [Ver = | Size = 172 bytes | Modified Date = 12/4/2006 10:28:40 PM | Attr = ]
0.LOG -> C:\WINDOWS\0.LOG -> [Ver = | Size = 0 bytes | Modified Date = 12/20/2006 11:44:26 AM | Attr = ]
BOOTSTAT.DAT -> C:\WINDOWS\BOOTSTAT.DAT -> [Ver = | Size = 2048 bytes | Modified Date = 12/20/2006 11:43:14 AM | Attr = S]
comsetup.log -> C:\WINDOWS\comsetup.log -> [Ver = | Size = 56926 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
FaxSetup.log -> C:\WINDOWS\FaxSetup.log -> [Ver = | Size = 1105807 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
ie7_main.log -> C:\WINDOWS\ie7_main.log -> [Ver = | Size = 1151 bytes | Modified Date = 12/20/2006 12:06:28 PM | Attr = ]
iexplore.exe-up.txt -> C:\WINDOWS\iexplore.exe-up.txt -> [Ver = | Size = 1855 bytes | Modified Date = 12/5/2006 3:21:46 PM | Attr = ]
IIS6.LOG -> C:\WINDOWS\IIS6.LOG -> [Ver = | Size = 174573 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
imsins.BAK -> C:\WINDOWS\imsins.BAK -> [Ver = | Size = 1393 bytes | Modified Date = 12/17/2006 3:07:04 AM | Attr = ]
imsins.log -> C:\WINDOWS\imsins.log -> [Ver = | Size = 1393 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
KB923689.log -> C:\WINDOWS\KB923689.log -> [Ver = | Size = 10942 bytes | Modified Date = 12/17/2006 3:06:20 AM | Attr = ]
KB923694.log -> C:\WINDOWS\KB923694.log -> [Ver = | Size = 11904 bytes | Modified Date = 12/17/2006 3:04:36 AM | Attr = ]
KB925398.log -> C:\WINDOWS\KB925398.log -> [Ver = | Size = 9413 bytes | Modified Date = 12/17/2006 3:07:04 AM | Attr = ]
KB925454.log -> C:\WINDOWS\KB925454.log -> [Ver = | Size = 21129 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
KB926255.log -> C:\WINDOWS\KB926255.log -> [Ver = | Size = 11927 bytes | Modified Date = 12/17/2006 3:04:48 AM | Attr = ]
mozver.dat -> C:\WINDOWS\mozver.dat -> [Ver = | Size = 8622 bytes | Modified Date = 11/29/2006 7:11:34 PM | Attr = ]
MSGSOCM.LOG -> C:\WINDOWS\MSGSOCM.LOG -> [Ver = | Size = 55680 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
ntbtlog.txt -> C:\WINDOWS\ntbtlog.txt -> [Ver = | Size = 124486 bytes | Modified Date = 12/19/2006 8:58:46 PM | Attr = ]
ntdtcsetup.log -> C:\WINDOWS\ntdtcsetup.log -> [Ver = | Size = 228847 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
ocgen.log -> C:\WINDOWS\ocgen.log -> [Ver = | Size = 84417 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
OCMSN.LOG -> C:\WINDOWS\OCMSN.LOG -> [Ver = | Size = 52304 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
QTFont.for -> C:\WINDOWS\QTFont.for -> [Ver = | Size = 1409 bytes | Modified Date = 12/17/2006 4:58:10 PM | Attr = ]
QTFont.qfn -> C:\WINDOWS\QTFont.qfn -> [Ver = | Size = 54156 bytes | Modified Date = 12/23/2006 9:13:36 PM | Attr = H ]
SchedLgU.Txt -> C:\WINDOWS\SchedLgU.Txt -> [Ver = | Size = 32388 bytes | Modified Date = 12/19/2006 8:56:50 PM | Attr = ]
setupapi.log -> C:\WINDOWS\setupapi.log -> [Ver = | Size = 288093 bytes | Modified Date = 12/21/2006 6:29:42 PM | Attr = ]
SIERRA.INI -> C:\WINDOWS\SIERRA.INI -> [Ver = | Size = 512 bytes | Modified Date = 11/29/2006 5:32:34 PM | Attr = ]
TSOC.LOG -> C:\WINDOWS\TSOC.LOG -> [Ver = | Size = 431506 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
UninstallFirefox.exe -> C:\WINDOWS\UninstallFirefox.exe -> [Ver = | Size = 99965 bytes | Modified Date = 11/29/2006 7:11:42 PM | Attr = ]
updspapi.log -> C:\WINDOWS\updspapi.log -> [Ver = | Size = 48276 bytes | Modified Date = 12/17/2006 3:07:30 AM | Attr = ]
WIADEBUG.LOG -> C:\WINDOWS\WIADEBUG.LOG -> [Ver = | Size = 159 bytes | Modified Date = 12/20/2006 11:43:52 AM | Attr = ]
WIASERVC.LOG -> C:\WINDOWS\WIASERVC.LOG -> [Ver = | Size = 50 bytes | Modified Date = 12/20/2006 11:43:40 AM | Attr = ]
WindowsUpdate.log -> C:\WINDOWS\WindowsUpdate.log -> [Ver = | Size = 1207926 bytes | Modified Date = 12/24/2006 11:40:56 AM | Attr = ]
wmsetup.log -> C:\WINDOWS\wmsetup.log -> [Ver = | Size = 24364 bytes | Modified Date = 12/18/2006 3:49:22 PM | Attr = ]
yacs.log -> C:\WINDOWS\yacs.log -> [Ver = | Size = 28457 bytes | Modified Date = 11/28/2006 8:48:02 PM | Attr = ]
bbtqp.dll -> C:\WINDOWS\System32\bbtqp.dll -> [Ver = | Size = 58880 bytes | Modified Date = 12/11/2006 7:44:28 AM | Attr = ]
d3d8caps.dat -> C:\WINDOWS\System32\d3d8caps.dat -> [Ver = | Size = 552 bytes | Modified Date = 12/20/2006 10:07:10 AM | Attr = ]
KGyGaAvL.sys -> C:\WINDOWS\System32\KGyGaAvL.sys -> [Ver = | Size = 3350 bytes | Modified Date = 12/22/2006 11:49:54 AM | Attr = HS]
LexFiles.ulf -> C:\WINDOWS\System32\LexFiles.ulf -> [Ver = | Size = 26211 bytes | Modified Date = 12/4/2006 10:32:50 PM | Attr = ]
wnscpsv.exe -> C:\WINDOWS\System32\wnscpsv.exe -> [Ver = | Size = 2 bytes | Modified Date = 12/24/2006 10:54:14 AM | Attr = ]
WPA.DBL -> C:\WINDOWS\System32\WPA.DBL -> [Ver = | Size = 1170 bytes | Modified Date = 12/24/2006 12:18:56 PM | Attr = ]
avg7core.sys -> C:\WINDOWS\System32\drivers\avg7core.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.429 | Size = 816672 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
avg7rsw.sys -> C:\WINDOWS\System32\drivers\avg7rsw.sys -> GRISOFT, s.r.o. [Ver = 7,0,0,340 | Size = 4224 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
avg7rsxp.sys -> C:\WINDOWS\System32\drivers\avg7rsxp.sys -> GRISOFT, s.r.o. [Ver = 7,1,0,398 | Size = 28416 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
avgclean.sys -> C:\WINDOWS\System32\drivers\avgclean.sys -> GRISOFT, s.r.o. [Ver = 1.0.0.14 | Size = 3968 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
avgmfx86.sys -> C:\WINDOWS\System32\drivers\avgmfx86.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.416 | Size = 18240 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
avgtdi.sys -> C:\WINDOWS\System32\drivers\avgtdi.sys -> GRISOFT, s.r.o. [Ver = 7,0,0,346 | Size = 4960 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]

[File String Scan - Non-Microsoft Only]
UPX0 , -> C:\ar505enu.exe -> InstallShield Software Corporation [Ver = 2.02.001 | Size = 8981440 bytes | Modified Date = 7/9/2002 6:18:42 PM | Attr = ]
UPX0 , -> C:\avg6386fu_free.exe -> [Ver = | Size = 5433344 bytes | Modified Date = 9/17/2002 9:28:30 PM | Attr = ]
Thawte Consulting , -> C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\core3.zip -> [Ver = | Size = 3290841 bytes | Modified Date = 12/6/2004 10:57:36 PM | Attr = ]
USERTRUST , -> C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\patch-jre1.5.0_09.b03\patchjre.exe -> Sun Microsystems, Inc. [Ver = 1, 0, 0, 1 | Size = 4490872 bytes | Modified Date = 10/12/2006 3:41:58 AM | Attr = ]
FSG! , -> C:\Program Files\Common Files\Microsoft Shared\Shoebox\STANDARD.SBT -> [Ver = | Size = 19954310 bytes | Modified Date = 6/21/2000 3:59:14 AM | Attr = ]
PEC2 , -> C:\Program Files\Common Files\Sony Shared\AVLib\Metallic.dll -> Sony Corporation [Ver = 2.7.00.14160 | Size = 229376 bytes | Modified Date = 2/17/2004 8:16:12 AM | Attr = ]
UPX! , UPX0 , -> C:\WINDOWS\Zambelli Fireworks Screensaver.scr -> [Ver = | Size = 671744 bytes | Modified Date = 9/27/2001 2:04:28 PM | Attr = ]
PEC2 , PECompact2 , -> C:\WINDOWS\System32\bbtqp.dll -> [Ver = | Size = 58880 bytes | Modified Date = 12/11/2006 7:44:28 AM | Attr = ]
PEC2 , -> C:\WINDOWS\System32\DFRG.MSC -> [Ver = | Size = 41397 bytes | Modified Date = 8/18/2001 5:00:00 AM | Attr = ]
winsync , -> C:\WINDOWS\System32\WBDBASE.DEU -> [Ver = | Size = 1309184 bytes | Modified Date = 8/18/2001 5:00:00 AM | Attr = ]
Thawte Consulting , -> C:\WINDOWS\System32\XceedFtp.dll -> Xceed Software Inc [removed] [removed] www.xceedsoft.com [Ver = 1.1.129.0 | Size = 279392 bytes | Modified Date = 8/31/2005 10:35:40 AM | Attr = ]
UPX! , FSG! , PEC2 , aspack , -> C:\WINDOWS\System32\drivers\avg7core.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.429 | Size = 816672 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
PTech , -> C:\WINDOWS\System32\drivers\mtlstrm.sys -> Smart Link [Ver = 3.80.01MC15 | Size = 1309184 bytes | Modified Date = 8/3/2004 11:41:38 PM | Attr = ]

< End of report >

[Registry - Non-Microsoft Only]
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\mlbaeu deleted successfully.
File c:\windows\system32\diqtygq.exe not found!
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\uwctnew deleted successfully.
File c:\windows\system32\uifzwhz.exe not found!
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B9D0C4C5-0B72-05F1-76F6-7045077A7393} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B9D0C4C5-0B72-05F1-76F6-7045077A7393} deleted successfully.
File C:\WINDOWS\system32\trla.dll not found!
[Files - Created Wihin 30 days]
C:\WINDOWS\System32\MobileSidewalkRON_2.ico moved successfully.
C:\WINDOWS\System32\TitanPokerIconDropTRA108.ico moved successfully.
C:\WINDOWS\System32\TrafficSales_Casino_3.ico moved successfully.
[Files - Modified Wihin 30 days]
C:\WINDOWS\System32\333D2DC9AE.sys moved successfully.
C:\WINDOWS\System32\ClickToFindandFixErrors_Intl.ico moved successfully.
File C:\WINDOWS\System32\MobileSidewalkRON_2.ico not found!
File C:\WINDOWS\System32\TitanPokerIconDropTRA108.ico not found!
File C:\WINDOWS\System32\TrafficSales_Casino_3.ico not found!
< End of log >
Created on 12/24/2006 12:24:54

Thanks,
Patrick

OldTimer

Post #18December 24, 2006, 8:30 PM UTC

Hi PatRick B. I see 1 new file here that looks kind of interesting. I'd like to have it checked out to see what we can find out.

Go to the Jotti's malware scan page and use the buttons at the top of the page to browse to this file(s) on your hard drive to submit for a scan:
C:\WINDOWS\System32\bbtqp.dll
Several scanning engines will be used to check the file for any threats. Please post the results of the scans back here.

Cheers.

OT

PatRick B

Post #19December 25, 2006, 4:31 PM UTC

OT, Here are results Patrick Service load: 0% 100% File: bbtqp.dll Status: INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) MD5 0792be1fd970fbba9cfe4554e4d42154 Packers detected: Analyzing… AntiVir Found ADSPY/PurityScan.AK.145 adware ArcaVir Found Adware.Purityscan.Ak Avast Found nothing AVG Antivirus Found Generic.SJI BitDefender Found nothing ClamAV Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found not-a-virus:AdWare.Win32.PurityScan.ak (4, 1, 400) Fortinet Found Adware/PurityScan Kaspersky Anti-Virus Found not-a-virus:AdWare.Win32.PurityScan.ak NOD32 Found a variant of Win32/Adware.PurityScan application Norman Virus Control Found W32/PurityScan.dam VirusBuster Found nothing VBA32 Found AdWare.Win32.PurityScan.ak

OldTimer

Post #20December 25, 2006, 7:09 PM UTC

Hi PatRick B. PurityScan is fun

Let's clean it out. Please follow the steps below in order.

Step #1

Download ATF Cleaner

Double-click ATF-Cleaner.exe to run the program.
Click Select All found at the bottom of the list.
Click the Empty Selected button.

If you use Firefox browser, do this also:

Click Firefox at the top and choose Select All from the list.
Click the Empty Selected button.
NOTE : If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser, do this also:

Click Opera at the top and choose Select All from the list.
Click the Empty Selected button.
NOTE : If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

Step #2

1. Download ComboFix to your desktop.

2. Double click on combofix.exe & follow the prompts to allow the tool to run.

3. When it has finished, it will produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall.

Step #3

First download AVG Anti-Spyware from HERE and save that file to your desktop.
This is a 30 day trial of the program

Once you have downloaded AVG Anti-Spyware, locate the icon on the desktop and double-click it to launch the set up program.
Once the setup is complete you will need run AVG Anti-Spyware and update the definition files.
On the main screen select the icon "Update" then select the "Update now" link.
- Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.
Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
Under "Reports"
- Select "Automatically generate report after every scan"
- Un-Select "Only if threats were found"

Close AVG Anti-Spyware, Do Not run a scan just yet, we will shortly.

Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter.
IMPORTANT: Do not open any other windows or programs while AVG Anti-Spyware is scanning, it may interfere with the scanning proccess:
Lauch AVG Anti-Spyware by double-clicking the icon on your desktop.
Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".
AVG Anti-Spyware will now begin the scanning process, be patient this may take a little time.
Once the scan is complete do the following:
If you have any infections you will prompted, then select "Apply all actions"
Next select the "Reports" icon at the top.
Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).
Close AVG Anti-Spyware and reboot your system back into Normal Mode and post the results of the AVG Anti-Spyware report scan.

Step #4

I found why WinPFind3u seemed to be hanging. It was scanning the hibernation file (your is about 267mb). The system would report that WinPFind3u was not respond when really it was just busy.

I fixed this in a new release so it will skip over any hibernation files. Please delete the current WinPFind3u files and folders from your desktop and download the latest.

Download WinPFind3U.exe to your Desktop and double-click on it to extract the files. It will create a folder named WinPFind3u on your desktop.

Open the WinPFind3u folder and double-click on WinPFind3U.exe to start the program.
- In the Files Created Within group click 30 days
- In the Files Modified Within group select 30 days
- In the File String Search group select Non-Microsoft
Now click the Run Scan button on the toolbar.
When the scan is complete Notepad will open with the report file loaded in it.
Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

Step #5

Post the following back here (these will not all fit into a single post so use separate posts for each):

the new ComboFix report
the AVG Anti-Spyware report
the new WinPFind3U report
the latest .log file from the WinPFind3u folder (it will have a name in the format mmddyyyy_hhmmss.log)

PatRick B

Post #21December 26, 2006, 5:31 AM UTC

OT, Here are the reports you asked for No problems running them Patrick Patrick - 06-12-25 14:08:46.90 Service Pack 2 ComboFix 06.11.27 - Running from: "C:\Documents and Settings\Patrick Boyle\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\QooBox\Purity\Program Files\MCROSO~1.NET C:\QooBox\Purity\Program Files\Common Files\PPATCH~1 C:\QooBox\Purity\Program Files\MCROSO~1.NET\n?lookup.exe C:\QooBox\Purity\WINDOWS\SYSTEM32\APPATC~1 C:\QooBox\Purity\WINDOWS\SYSTEM32\STEM32~1 C:\QooBox\Purity\WINDOWS\SYSTEM32\APPATC~1\A?pPatch C:\QooBox\Purity\WINDOWS\SYSTEM32\APPATC~1\nslookup.exe ((((((((((((((((((((((((((((((( Files Created from 2006-11-25 to 2006-12-25 )))))))))))))))))))))))))))))))))) 2006-12-25 08:06 d——– C:\WINDOWS\WBEM 2006-12-25 08:06 d——– C:\WINDOWS\SYSTEM32\en-US 2006-12-25 08:04 d–h-c— C:\WINDOWS\ie7 2006-12-25 08:00 121,856 ——— C:\WINDOWS\SYSTEM32\xmllite.dll 2006-12-25 07:57 d——– C:\WINDOWS\network diagnostic 2006-12-24 10:54 2 –a—— C:\WINDOWS\SYSTEM32\wnscpsv.exe 2006-12-24 10:53 58,880 –a—— C:\WINDOWS\SYSTEM32\bbtqp.dll 2006-12-18 19:10 3,968 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\AvgAsCln.sys 2006-12-17 08:37 3,968 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\avgclean.sys 2006-12-17 08:37 18,240 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\avgmfx86.sys 2006-12-11 22:25 d——– C:\Documents and Settings\Patrick Boyle\Application Data\Apple Computer 2006-12-08 10:26 d——– C:\WINDOWS\SYSTEM32\àdobe 2006-12-07 21:58 d——– C:\Documents and Settings\Patrick Boyle\Application Data\Lavasoft 2006-12-05 19:36 d——– C:\Documents and Settings\Patrick Boyle\Application Data\DellFaxCtr 2006-12-05 13:37 3,350 –ahs—- C:\WINDOWS\SYSTEM32\KGyGaAvL.sys 2006-12-05 13:06 d——– C:\Program Files\rdso 2006-12-04 22:33 d——– C:\Program Files\dl_cats 2006-12-04 22:31 d——– C:\Documents and Settings\Patrick Boyle\Application Data\Corel 2006-12-04 22:30 d——– C:\Documents and Settings\All Users\Application Data\InstallShield 2006-12-04 22:29 d——– C:\Program Files\Corel 2006-12-04 22:29 d——– C:\Program Files\Common Files\Corel 2006-12-04 22:23 d——– C:\Documents and Settings\All Users\Application Data\BVRP Software 2006-12-04 22:21 98,345 –a—— C:\WINDOWS\SYSTEM32\IMHOST32.DLL 2006-12-04 22:21 40,960 –a—— C:\WINDOWS\SYSTEM32\DLPRMON.DLL 2006-12-04 22:21 339,968 –a—— C:\WINDOWS\SYSTEM32\IMGMAN32.DLL 2006-12-04 22:21 32,768 –a—— C:\WINDOWS\SYSTEM32\DLPMONUI.DLL 2006-12-04 22:21 d——– C:\Documents and Settings\All Users\Application Data\DellFaxCtr 2006-12-04 22:20 274,432 –a—— C:\WINDOWS\SYSTEM32\DLCQinst.dll 2006-12-04 22:20 d——– C:\Program Files\Abbyy FineReader 6.0 Sprint 2006-12-04 22:19 d——– C:\Program Files\Dell Photo AIO Printer 966 2006-12-04 22:19 d——– C:\Program Files\Dell PC Fax 2006-12-04 21:43 9,600 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\hidusb.sys 2006-12-04 21:42 87,040 –a—— C:\WINDOWS\SYSTEM32\wiafbdrv.dll 2006-12-04 21:37 31,616 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\usbccgp.sys 2006-11-29 19:12 d——– C:\Documents and Settings\Patrick Boyle\Application Data\Talkback (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-12-25 14:16 ——– d-a—— C:\Program Files\Common Files 2006-12-25 09:56 ——– d——– C:\Program Files\Java 2006-12-25 08:52 ——– d——– C:\Program Files\Morpheus 2006-12-25 08:46 ——– d——– C:\Program Files\Internet Explorer 2006-12-22 19:57 ——– d——– C:\Program Files\Mozilla Firefox 2006-12-21 08:28 ——– d——– C:\Documents and Settings\Patrick Boyle\Application Data\MSN6 2006-12-20 18:54 ——– d——– C:\Program Files\Support Software 2006-12-18 19:09 ——– d——– C:\Program Files\Grisoft 2006-12-18 19:05 ——– d—s—- C:\Documents and Settings\Patrick Boyle\Application Data\Microsoft 2006-12-17 08:37 816672 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\avg7core.sys 2006-12-17 08:37 4960 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\avgtdi.sys 2006-12-17 08:37 4224 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\avg7rsw.sys 2006-12-17 08:37 28416 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\avg7rsxp.sys 2006-12-17 03:04 ——– d——– C:\Program Files\Outlook Express 2006-12-17 03:04 ——– d——– C:\Program Files\Common Files\System 2006-12-08 06:50 ——– d-a—— C:\Program Files\Lycos 2006-12-07 21:57 ——– d——– C:\Program Files\Lavasoft 2006-12-06 23:29 2374472 –a—— C:\WINDOWS\SYSTEM32\wmvcore.dll 2006-12-04 22:29 ——– d——– C:\Program Files\Common Files\InstallShield 2006-12-04 22:28 ——– d——– C:\Program Files\Dell 2006-12-04 22:23 ——– d–h—– C:\Program Files\InstallShield Installation Information 2006-11-29 19:11 99965 –a—— C:\WINDOWS\UninstallFirefox.exe 2006-11-29 17:32 ——– d——– C:\Program Files\Common Files\Sierra On-Line 2006-11-22 20:57 ——– d——– C:\Program Files\Yahoo! 2006-11-16 03:02 ——– d——– C:\Program Files\MSXML 4.0 2006-11-07 23:06 679424 –a—— C:\WINDOWS\SYSTEM32\inetcomm.dll 2006-11-07 21:03 6049280 ——— C:\WINDOWS\SYSTEM32\ieframe.dll 2006-11-07 21:03 50688 ——— C:\WINDOWS\SYSTEM32\msfeedsbs.dll 2006-11-07 21:03 458752 ——— C:\WINDOWS\SYSTEM32\msfeeds.dll 2006-11-07 21:03 413696 –a—— C:\WINDOWS\SYSTEM32\vbscript.dll 2006-11-07 21:03 231424 –a—— C:\WINDOWS\SYSTEM32\webcheck.dll 2006-11-07 21:03 180736 ——— C:\WINDOWS\SYSTEM32\ieui.dll 2006-11-07 21:03 156160 –a—— C:\WINDOWS\SYSTEM32\msls31.dll 2006-11-07 20:09 ——– d——– C:\Program Files\ValuSoft 2006-11-07 20:02 ——– d——– C:\Program Files\Common Files\Microsoft Shared 2006-11-07 19:59 ——– d——– C:\Program Files\ArcSoft 2006-11-07 03:27 382976 –a—— C:\WINDOWS\SYSTEM32\iedkcs32.dll 2006-11-07 03:27 229376 –a—— C:\WINDOWS\SYSTEM32\ieaksie.dll 2006-11-07 03:26 71680 –a—— C:\WINDOWS\SYSTEM32\admparse.dll 2006-11-07 03:26 55296 –a—— C:\WINDOWS\SYSTEM32\iesetup.dll 2006-11-07 03:26 54784 –a—— C:\WINDOWS\SYSTEM32\ie4uinit.exe 2006-11-07 03:26 43008 –a—— C:\WINDOWS\SYSTEM32\iernonce.dll 2006-11-07 03:26 152064 –a—— C:\WINDOWS\SYSTEM32\ieakeng.dll 2006-11-07 03:26 13312 –a—— C:\WINDOWS\SYSTEM32\ieudinit.exe 2006-11-07 03:26 123904 –a—— C:\WINDOWS\SYSTEM32\advpack.dll 2006-11-07 03:25 161792 –a—— C:\WINDOWS\SYSTEM32\ieakui.dll 2006-11-05 20:43 ——– d——– C:\Program Files\iTunes 2006-11-05 20:42 ——– d——– C:\Program Files\iPod 2006-11-05 20:41 ——– d——– C:\Program Files\QuickTime 2006-11-05 20:38 ——– d——– C:\Program Files\Apple Software Update 2006-11-04 14:14 1245696 –a—— C:\WINDOWS\SYSTEM32\msxml4.dll 2006-10-27 21:41 ——– d——– C:\Program Files\Google 2006-10-19 07:56 713216 –a—— C:\WINDOWS\SYSTEM32\sxs.dll 2006-10-17 12:06 78336 –a—— C:\WINDOWS\SYSTEM32\ieencode.dll 2006-10-17 12:05 40960 –a—— C:\WINDOWS\SYSTEM32\licmgr10.dll 2006-10-17 12:05 206336 ——— C:\WINDOWS\SYSTEM32\WinFXDocObj.exe 2006-10-17 12:05 105984 –a—— C:\WINDOWS\SYSTEM32\url.dll 2006-10-17 12:04 101376 –a—— C:\WINDOWS\SYSTEM32\occache.dll 2006-10-17 12:03 17408 –a—— C:\WINDOWS\SYSTEM32\corpol.dll 2006-10-17 11:58 61952 ——— C:\WINDOWS\SYSTEM32\icardie.dll 2006-10-17 11:58 12288 ——— C:\WINDOWS\SYSTEM32\msfeedssync.exe 2006-10-17 11:57 36352 –a—— C:\WINDOWS\SYSTEM32\imgutil.dll 2006-10-17 11:57 266752 ——— C:\WINDOWS\SYSTEM32\iertutil.dll 2006-10-17 11:56 45568 –a—— C:\WINDOWS\SYSTEM32\mshta.exe 2006-10-17 11:28 48128 –a—— C:\WINDOWS\SYSTEM32\mshtmler.dll 2006-10-17 11:27 380928 ——— C:\WINDOWS\SYSTEM32\ieapfltr.dll 2006-10-13 06:35 142336 –a—— C:\WINDOWS\SYSTEM32\nwprovau.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "MoneyAgent"="\"C:\\Program Files\\Microsoft Money\\System\\Money Express.exe\"" "Microsoft Works Update Detection"="C:\\Program Files\\Microsoft Works\\WkDetect.exe" "swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.0.720.3640\\GoogleToolbarNotifier.exe" "Yahoo! Pager"="\"C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\YAHOOM~1.EXE\" -quiet" "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "TkBellExe"="C:\\Program Files\\Common Files\\Real\\Update_OB\\evntsvc.exe -osboot" "Dell|Alert"="C:\\Program Files\\Dell\\Support\\Alert\\bin\\DAMon.exe" "AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\"" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "MMTray"="C:\\Program Files\\MUSICMATCH\\MUSICMATCH Jukebox\\mm_tray.exe" "ezShieldProtector for Px"="C:\\WINDOWS\\system32\\ezSP_Px.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "ViewMgr"="C:\\Program Files\\Viewpoint\\Viewpoint Manager\\ViewMgr.exe" "Microsoft Works Update Detection"="C:\\Program Files\\Common Files\\Microsoft Shared\\Works Shared\\WkUFind.exe" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "dlcqmon.exe"="\"C:\\Program Files\\Dell Photo AIO Printer 966\\dlcqmon.exe\"" "MemoryCardManager"="\"C:\\Program Files\\Dell Photo AIO Printer 966\\memcard.exe\"" "FaxCenterServer"="\"C:\\Program Files\\Dell PC Fax\\fm3032.exe\" /s" "ISUSPM Startup"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\isuspm.exe\" -startup" "ISUSScheduler"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start" "DLCQCATS"="rundll32 C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\DLCQtime.dll,_RunDLLEntry@16" "Corel Photo Downloader"="C:\\Program Files\\Corel\\Corel Photo Album 6\\MediaDetect.exe" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex] @="" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000000 "GeneralFlags"=dword:00000000 [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:0000005f @="" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled] "NvCplDaemon"="RUNDLL32.EXE NvQTwk,NvCplDaemon initialize" "LTWinModem1"="ltmsg.exe 9" "UpdReg"="C:\\WINDOWS\\Updreg.exe" "AHQInit"="C:\\Program Files\\Creative\\SBLive\\Program\\AHQInit.exe" "MMTray"="C:\\Program Files\\MUSICMATCH\\MUSICMATCH Jukebox\\mm_tray.exe" "AdaptecDirectCD"="\"C:\\Program Files\\Roxio\\Easy CD Creator 5\\DirectCD\\DirectCD.exe\"" "TkBellExe"="C:\\Program Files\\Common Files\\Real\\Update_OB\\evntsvc.exe -osboot" "AVG_CC"="C:\\PROGRA~1\\Grisoft\\AVG6\\avgcc32.exe /STARTUP" "MessengerPlus2"="\"C:\\Program Files\\Messenger Plus! 2\\MsgPlus.exe\"" "ANX"="C:\\WINDOWS\\ANX.exe" "YFQ"="C:\\WINDOWS\\YFQ.exe" "RMXEPKU"="C:\\WINDOWS\\RMXEPKU.exe" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" ~ ~ ~ ~ ~ ~ ~ ~ Hijackthis entries set to ignore ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O2 - BH O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html O4 - HKLM\..\Run: [AVG7_CC] C:\PR O4 - HKLM\..\Run: [AVG7_EMC] C:\PR Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\Ad-aware 6.job C:\WINDOWS\tasks\AppleSoftwareUpdate.job C:\WINDOWS\tasks\{1CC58C7E-7F8C-4290-98A2-D7FFCDBAC786}_DH871L11_Patrick Boyle.job C:\WINDOWS\tasks\{F2C84142-816A-4B2B-87F5-FF638034D120}_DH871L11_Chelsey Boyle.job Completion time: 06-12-25 14:18:18.21 C:\ComboFix.txt … 06-12-25 14:18

PatRick B

Post #22December 26, 2006, 5:33 AM UTC

——————————————————— AVG Anti-Spyware - Scan Report ——————————————————— + Created at: 10:26:05 PM 12/25/2006 + Scan result: C:\WINDOWS\SYSTEM32\bbtqp.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Documents and Settings\The Sims\Cookies\the sims@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned. C:\Documents and Settings\The Sims\Cookies\the sims@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned. C:\Documents and Settings\The Sims\Cookies\the sims@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned. C:\Documents and Settings\Patrick Boyle\Cookies\patrick boyle@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned. C:\WINDOWS\SYSTEM32\wnscpsv.exe -> Trojan.Small : Cleaned with backup (quarantined). ::Report end

PatRick B

Post #23December 26, 2006, 5:35 AM UTC

WinPFind3 logfile created on: 12/25/2006 10:39:02 PM
WinPFind3U by OldTimer - Version 1.0.3 Folder = C:\Documents and Settings\Patrick Boyle\Desktop\WinPFind3u\
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600)
Internet Explorer (Version = 7.0.5730.11)

[Processes - Non-Microsoft Only]
avgamsvr.exe -> C:\Program Files\Grisoft\AVG Free\avgamsvr.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 343552 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
avgas.exe -> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 50 | Size = 6266880 bytes | Modified Date = 10/7/2006 6:20:00 AM | Attr = ]
avgcc.exe -> C:\Program Files\Grisoft\AVG Free\avgcc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.418 | Size = 406016 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
avgemc.exe -> C:\Program Files\Grisoft\AVG Free\avgemc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.432 | Size = 323072 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
avgupsvc.exe -> C:\Program Files\Grisoft\AVG Free\avgupsvc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 49664 bytes | Modified Date = 12/17/2006 8:37:48 AM | Attr = ]
ctsvccda.exe -> C:\WINDOWS\SYSTEM32\CTSVCCDA.EXE -> Creative Technology Ltd [Ver = 1.0.1.0 | Size = 44032 bytes | Modified Date = 12/13/1999 12:01:00 AM | Attr = ]
damon.exe -> C:\Program Files\Dell\Support\Alert\bin\DAMon.exe -> [Ver = 1, 0, 0, 1 | Size = 282624 bytes | Modified Date = 4/3/2002 5:06:18 PM | Attr = ]
devldr32.exe -> C:\WINDOWS\SYSTEM32\devldr32.exe -> Creative Technology Ltd. [Ver = 1, 0, 0, 22 | Size = 25600 bytes | Modified Date = 8/31/2001 12:44:30 PM | Attr = ]
dlcqcoms.exe -> C:\WINDOWS\SYSTEM32\dlcqcoms.exe -> [Ver = 6.3.22.0 | Size = 528384 bytes | Modified Date = 7/13/2006 5:27:16 PM | Attr = ]
dlcqmon.exe -> C:\Program Files\Dell Photo AIO Printer 966\dlcqmon.exe -> [Ver = 0.1.25.0 | Size = 286720 bytes | Modified Date = 6/20/2006 11:37:42 AM | Attr = ]
easyshare.exe -> C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe -> [Ver = 5, 0, 25, 230 | Size = 151552 bytes | Modified Date = 7/22/2005 3:47:22 AM | Attr = ]
evntsvc.exe -> C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -> RealNetworks, Inc. [Ver = 0.1.0.880 | Size = 146432 bytes | Modified Date = 6/22/2002 7:20:54 AM | Attr = ]
ezsp_px.exe -> C:\WINDOWS\SYSTEM32\ezSP_Px.exe -> Easy Systems Japan Ltd. [Ver = 1, 0, 0, 0 | Size = 40960 bytes | Modified Date = 8/20/2002 10:29:26 AM | Attr = ]
firefox.exe -> C:\Program Files\Mozilla Firefox\firefox.exe -> Mozilla [Ver = 1.0.7 | Size = 6637156 bytes | Modified Date = 9/15/2005 6:26:00 PM | Attr = ]
guard.exe -> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 47 | Size = 204800 bytes | Modified Date = 9/28/2006 8:13:20 AM | Attr = ]
ipodservice.exe -> C:\Program Files\iPod\bin\iPodService.exe -> Apple Computer, Inc. [Ver = 7.0.2.16 | Size = 492608 bytes | Modified Date = 10/30/2006 9:36:32 AM | Attr = ]
ituneshelper.exe -> C:\Program Files\iTunes\iTunesHelper.exe -> Apple Computer, Inc. [Ver = 7.0.2.16 | Size = 256576 bytes | Modified Date = 10/30/2006 9:36:36 AM | Attr = ]
jusched.exe -> C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe -> Sun Microsystems, Inc. [Ver = 5.0.100.3 | Size = 49263 bytes | Modified Date = 11/9/2006 3:07:30 PM | Attr = ]
kodak software updater.exe -> C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe -> [Ver = | Size = 16423 bytes | Modified Date = 2/13/2004 2:12:08 PM | Attr = ]
mediadetect.exe -> C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe -> Corel, Inc. [Ver = 6.0.0 (20050831.10) | Size = 106496 bytes | Modified Date = 8/31/2005 11:06:18 AM | Attr = ]
memcard.exe -> C:\Program Files\Dell Photo AIO Printer 966\memcard.exe -> [Ver = 1.0.18.1 | Size = 299008 bytes | Modified Date = 6/27/2006 5:34:50 AM | Attr = ]
mm_tray.exe -> C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe -> MUSICMATCH, Inc. [Ver = 7.10.0053 | Size = 90112 bytes | Modified Date = 2/27/2002 12:17:08 PM | Attr = ]
morpheus.exe -> C:\Program Files\Morpheus\Morpheus.exe -> Streamcast Networks, Inc [Ver = 1.0.0.1 | Size = 721408 bytes | Modified Date = 9/12/2006 1:17:26 PM | Attr = ]
nvsvc32.exe -> C:\WINDOWS\SYSTEM32\nvsvc32.exe -> NVIDIA Corporation [Ver = 6.14.10.5216 | Size = 81920 bytes | Modified Date = 10/6/2003 2:16:00 PM | Attr = ]
qttask.exe -> C:\Program Files\QuickTime\qttask.exe -> Apple Computer, Inc. [Ver = 7.1.3 | Size = 282624 bytes | Modified Date = 10/25/2006 6:58:18 PM | Attr = ]
sagent2.exe -> C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe -> SEIKO EPSON CORPORATION [Ver = 2, 2, 0, 0 | Size = 90112 bytes | Modified Date = 10/25/2001 1:02:00 AM | Attr = ]
viewmgr.exe -> C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe -> Viewpoint Corporation [Ver = 2, 0, 0, 42 | Size = 111816 bytes | Modified Date = 11/10/2004 10:15:32 PM | Attr = ]
winpfind3u.exe -> C:\Documents and Settings\Patrick Boyle\Desktop\WinPFind3u\WinPFind3U.exe -> Oldtimer Tools [Ver = 1.0.3.0 | Size = 303104 bytes | Modified Date = 12/25/2006 11:19:46 PM | Attr = ]
wkufind.exe -> C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe -> Microsoft® Corporation [Ver = 6.00.3215.0 | Size = 28738 bytes | Modified Date = 8/16/2001 9:41:58 PM | Attr = ]
ymsgr_tray.exe -> C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe -> Yahoo! Inc. [Ver = 8,1,0,0 | Size = 103928 bytes | Modified Date = 10/24/2006 4:10:18 PM | Attr = ]

[Win32 Services - Non-Microsoft Only]
(AVG Anti-Spyware Guard) AVG Anti-Spyware Guard [Win32_Own | Auto | Running] -> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 47 | Size = 204800 bytes | Modified Date = 9/28/2006 8:13:20 AM | Attr = ]
(Avg7Alrt) AVG7 Alert Manager Server [Win32_Own | Auto | Running] -> C:\Program Files\Grisoft\AVG Free\avgamsvr.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 343552 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
(Avg7UpdSvc) AVG7 Update Service [Win32_Own | Auto | Running] -> C:\Program Files\Grisoft\AVG Free\avgupsvc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 49664 bytes | Modified Date = 12/17/2006 8:37:48 AM | Attr = ]
(AVGEMS) AVG E-mail Scanner [Win32_Own | Auto | Running] -> C:\Program Files\Grisoft\AVG Free\avgemc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.432 | Size = 323072 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
(Creative Service for CDROM Access) Creative Service for CDROM Access [Win32_Own | Auto | Running] -> C:\WINDOWS\SYSTEM32\CTSVCCDA.EXE -> Creative Technology Ltd [Ver = 1.0.1.0 | Size = 44032 bytes | Modified Date = 12/13/1999 12:01:00 AM | Attr = ]
(dlcq_device) dlcq_device [Win32_Own | Auto | Running] -> C:\WINDOWS\SYSTEM32\dlcqcoms.exe -> [Ver = 6.3.22.0 | Size = 528384 bytes | Modified Date = 7/13/2006 5:27:16 PM | Attr = ]
(dmadmin) Logical Disk Manager Administrative Service [Win32_Shared | On_Demand | Stopped] -> C:\WINDOWS\SYSTEM32\dmadmin.exe -> Microsoft Corp., Veritas Software [Ver = 2600.2180.503.0 | Size = 224768 bytes | Modified Date = 8/4/2004 1:56:48 AM | Attr = ]
(EPSONStatusAgent2) EPSON Printer Status Agent2 [Win32_Own | Auto | Running] -> C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe -> SEIKO EPSON CORPORATION [Ver = 2, 2, 0, 0 | Size = 90112 bytes | Modified Date = 10/25/2001 1:02:00 AM | Attr = ]
(iPod Service) iPod Service [Win32_Own | On_Demand | Running] -> C:\Program Files\iPod\bin\iPodService.exe -> Apple Computer, Inc. [Ver = 7.0.2.16 | Size = 492608 bytes | Modified Date = 10/30/2006 9:36:32 AM | Attr = ]
(KodakCCS) Kodak Camera Connection Software [Win32_Own | On_Demand | Stopped] -> C:\WINDOWS\SYSTEM32\DRIVERS\KodakCCS.exe -> Eastman Kodak Company [Ver = 1.1.5100.4 | Size = 411920 bytes | Modified Date = 3/30/2005 4:46:56 PM | Attr = ]
(NVSvc) NVIDIA Display Driver Service [Win32_Own | Auto | Running] -> C:\WINDOWS\SYSTEM32\nvsvc32.exe -> NVIDIA Corporation [Ver = 6.14.10.5216 | Size = 81920 bytes | Modified Date = 10/6/2003 2:16:00 PM | Attr = ]
(PACSPTISVR) PACSPTISVR [Win32_Own | On_Demand | Stopped] -> C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe -> Sony Corporation [Ver = 4.0.00.05270 | Size = 53337 bytes | Modified Date = 5/27/2004 1:14:58 AM | Attr = ]
(SPTISRV) Sony SPTI Service [Win32_Own | On_Demand | Stopped] -> C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe -> Sony Corporation [Ver = 4.0.00.05270 | Size = 69718 bytes | Modified Date = 5/27/2004 1:13:00 AM | Attr = ]

[Registry - Non-Microsoft Only]
< Run [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
!AVG Anti-Spyware -> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 50 | Size = 6266880 bytes | Modified Date = 10/7/2006 6:20:00 AM | Attr = ]
AVG7_CC -> C:\Program Files\Grisoft\AVG Free\avgcc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.418 | Size = 406016 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
Corel Photo Downloader -> C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe -> Corel, Inc. [Ver = 6.0.0 (20050831.10) | Size = 106496 bytes | Modified Date = 8/31/2005 11:06:18 AM | Attr = ]
Dell|Alert -> C:\Program Files\Dell\Support\Alert\bin\DAMon.exe -> [Ver = 1, 0, 0, 1 | Size = 282624 bytes | Modified Date = 4/3/2002 5:06:18 PM | Attr = ]
DLCQCATS -> C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\dlcqtime.dll [rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCQtime.dll,_RunDLLEntry@16] -> [Ver = 1.20.0.0 | Size = 106496 bytes | Modified Date = 6/7/2006 12:17:18 PM | Attr = ]
dlcqmon.exe -> C:\Program Files\Dell Photo AIO Printer 966\dlcqmon.exe -> [Ver = 0.1.25.0 | Size = 286720 bytes | Modified Date = 6/20/2006 11:37:42 AM | Attr = ]
ezShieldProtector for Px -> C:\WINDOWS\SYSTEM32\ezSP_Px.exe -> Easy Systems Japan Ltd. [Ver = 1, 0, 0, 0 | Size = 40960 bytes | Modified Date = 8/20/2002 10:29:26 AM | Attr = ]
FaxCenterServer -> C:\Program Files\Dell PC Fax\fm3032.exe -> [Ver = 0.1.35.8 | Size = 307200 bytes | Modified Date = 6/15/2006 4:03:30 AM | Attr = ]
ISUSPM Startup -> C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe -> InstallShield Software Corporation [Ver = 4, 50, 100, 33433 | Size = 249856 bytes | Modified Date = 6/10/2005 10:44:02 AM | Attr = ]
ISUSScheduler -> C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe -> InstallShield Software Corporation [Ver = 4, 50, 100, 33433 | Size = 81920 bytes | Modified Date = 6/10/2005 10:44:02 AM | Attr = ]
iTunesHelper -> C:\Program Files\iTunes\iTunesHelper.exe -> Apple Computer, Inc. [Ver = 7.0.2.16 | Size = 256576 bytes | Modified Date = 10/30/2006 9:36:36 AM | Attr = ]
MemoryCardManager -> C:\Program Files\Dell Photo AIO Printer 966\memcard.exe -> [Ver = 1.0.18.1 | Size = 299008 bytes | Modified Date = 6/27/2006 5:34:50 AM | Attr = ]
Microsoft Works Update Detection -> C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe -> Microsoft® Corporation [Ver = 6.00.3215.0 | Size = 28738 bytes | Modified Date = 8/16/2001 9:41:58 PM | Attr = ]
MMTray -> C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe -> MUSICMATCH, Inc. [Ver = 7.10.0053 | Size = 90112 bytes | Modified Date = 2/27/2002 12:17:08 PM | Attr = ]
NvCplDaemon -> C:\WINDOWS\SYSTEM32\nvcpl.dll [RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup] -> NVIDIA Corporation [Ver = 6.14.10.5216 | Size = 5058560 bytes | Modified Date = 10/6/2003 2:16:00 PM | Attr = ]
QuickTime Task -> C:\Program Files\QuickTime\qttask.exe -> Apple Computer, Inc. [Ver = 7.1.3 | Size = 282624 bytes | Modified Date = 10/25/2006 6:58:18 PM | Attr = ]
SunJavaUpdateSched -> C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe -> Sun Microsystems, Inc. [Ver = 5.0.100.3 | Size = 49263 bytes | Modified Date = 11/9/2006 3:07:30 PM | Attr = ]
TkBellExe -> C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -> RealNetworks, Inc. [Ver = 0.1.0.880 | Size = 146432 bytes | Modified Date = 6/22/2002 7:20:54 AM | Attr = ]
ViewMgr -> C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe -> Viewpoint Corporation [Ver = 2, 0, 0, 42 | Size = 111816 bytes | Modified Date = 11/10/2004 10:15:32 PM | Attr = ]
< RunOnceEx [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
-> -> File not found
< OptionalComponents [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\
IMAIL -> Installed = 1 ->
MAPI -> Installed = 1 ->
MSFS -> Installed = 1 ->
< Run [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Works Update Detection -> C:\Program Files\Microsoft Works\WkDetect.exe -> File not found
MoneyAgent -> C:\Program Files\Microsoft Money\System\Money Express.exe -> File not found
swg -> C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe -> File not found
Yahoo! Pager -> C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe -> Yahoo! Inc. [Ver = 8,1,0,195 | Size = 4662776 bytes | Modified Date = 10/24/2006 4:10:18 PM | Attr = ]
< Common Startup > -> C:\Documents and Settings\All Users\Start Menu\Programs\Startup
-> C:\Documents and Settings\All Users\Start Menu\Programs\Startup\EPSON Status Monitor 3 Environment Check 2.lnk -> File not found
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk -> C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe -> [Ver = 5, 0, 25, 230 | Size = 151552 bytes | Modified Date = 7/22/2005 3:47:22 AM | Attr = ]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\KODAK Software Updater.lnk -> C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe -> [Ver = | Size = 16423 bytes | Modified Date = 2/13/2004 2:12:08 PM | Attr = ]
-> C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk -> File not found
< User Startup > -> C:\Documents and Settings\Patrick Boyle\Start Menu\Programs\Startup
C:\Documents and Settings\Patrick Boyle\Start Menu\Programs\Startup\Morpheus.lnk -> C:\Program Files\Morpheus\Morpheus.exe -> Streamcast Networks, Inc [Ver = 1.0.0.1 | Size = 721408 bytes | Modified Date = 9/12/2006 1:17:26 PM | Attr = ]
< ShellExecuteHooks [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{57B86673-276A-48B2-BAE7-C6DBB3020EB8} [HKLM] -> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll [AVG Anti-Spyware 7.5] -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 47 | Size = 73728 bytes | Modified Date = 9/28/2006 8:13:28 AM | Attr = ]
< SecurityProviders [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders
< Winlogon settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
*VMApplet* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet ->
Control_RunDLL -> -> File not found
< Policy Settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{BDEADF00-C265-11D0-BCED-00A0C90AB50F} -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} -> 1073741857 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{0DF44EAA-FF21-4412-828E-260A8728E7F1} -> 32 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\dontdisplaylastusername -> 0 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\legalnoticecaption -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\legalnoticetext -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\shutdownwithoutlogon -> 1 ->
< Policy Settings [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Associations\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 95 ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools -> 0 ->
< HOSTS File > -> C:\WINDOWS\System32\drivers\etc\Hosts
< Internet Explorer Settings > ->
HKLM: Default_Page_URL -> http://go.microsoft.com/fwlink/?LinkId=69157 ->
HKLM: Main\\Default_Search_URL -> http://go.microsoft.com/fwlink/?LinkId=54896 ->
HKLM: Local Page -> %SystemRoot%\system32\blank.htm ->
HKLM: Search Page -> http://go.microsoft.com/fwlink/?LinkId=54896 ->
HKLM: Start Page -> http://go.microsoft.com/fwlink/?LinkId=69157 ->
HKLM: CustomizeSearch -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm ->
HKLM: Search\\Default_Search_URL -> http://www.google.com/ie ->
HKLM: SearchAssistant -> http://www.google.com/ie ->
HKCU: Local Page -> C:\WINDOWS\system32\blank.htm ->
HKCU: Search Bar -> http://www.google.com/ie ->
HKCU: Search Page -> http://www.google.com ->
HKCU: Start Page -> http://www.npr.org/ ->
HKCU: SearchAssistant -> http://www.google.com/ie ->
HKCU: ProxyEnable -> 0 ->
< Trusted Sites > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
msn.com [ - ] -> ->
< Trusted Sites > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
aol.com [ - ] -> ->
free_aol.com [ - ] -> ->
free_aol.com [http] -> ->
< BHO's > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [HKLM] -> C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [AcroIEHlprObj Class] -> [Ver = 1, 0, 0, 1 | Size = 37808 bytes | Modified Date = 4/16/2001 3:39:02 PM | Attr = ]
{53707962-6F74-2D53-2644-206D7942484F} [HKLM] -> C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [] -> Safer Networking Limited [Ver = 1, 4, 0, 0 | Size = 853672 bytes | Modified Date = 5/31/2005 1:04:00 AM | Attr = ]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [HKLM] -> C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll [SSVHelper Class] -> Sun Microsystems, Inc. [Ver = 5.0.100.3 | Size = 440056 bytes | Modified Date = 11/9/2006 3:21:52 PM | Attr = ]
{AA58ED58-01DD-4d91-8333-CF10577473F7} [HKLM] -> c:\program files\Google\googletoolbar3.dll [Google Toolbar Helper] -> Google Inc. [Ver = 4, 0, 1020, 3054 | Size = 2120768 bytes | Modified Date = 10/17/2006 2:04:08 PM | Attr = R ]
{BA849497-5825-54F6-74F6-70450779229C} [HKLM] -> C:\WINDOWS\system32\bbtqp.dll [Reg Data - Value does not exist] -> File not found
< Internet Explorer Bars [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\
{32683183-48a0-441b-a342-7c2a440a9478} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found] -> File not found
< Internet Explorer ToolBars [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar
{2318C2B1-4965-11d4-9B18-009027A5CD4F} [HKLM] -> c:\program files\Google\googletoolbar3.dll [&Google] -> Google Inc. [Ver = 4, 0, 1020, 3054 | Size = 2120768 bytes | Modified Date = 10/17/2006 2:04:08 PM | Attr = R ]
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} [HKLM] -> C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll [MSN] -> File not found
< Internet Explorer ToolBars [HKCU] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\
ShellBrowser\\{5CBE2611-C31B-401F-89BC-4CBB25E853D7} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found] -> File not found
WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} [HKLM] -> c:\program files\Google\googletoolbar3.dll [&Google] -> Google Inc. [Ver = 4, 0, 1020, 3054 | Size = 2120768 bytes | Modified Date = 10/17/2006 2:04:08 PM | Attr = R ]
WebBrowser\\{3F3714A9-89A4-46BE-8AF3-D0C9D1FB03F9} [HKLM] -> C:\Program Files\MorpheusBar\bar\2.bin\MORPHBAR.DLL [Morpheus Toolbar] -> File not found
WebBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found] -> File not found
< Internet Explorer CmdMapping [HKCU] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping
{000007C6-17DF-4438-92A4-DE5537471BA3} -> 8195 - Reg Data - Key not found ->
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} -> 8198 - Sun Java Console ->
{6685509E-B47B-4f47-8E16-9A5F3A62F683} -> 8199 - Reg Data - Key not found ->
{AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} -> 8196 - Reg Data - Key not found ->
{AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} -> 8197 - Reg Data - Key not found ->
{E023F504-0C5A-4750-A1E7-A9046DEA8A21} -> 8193 - Reg Data - Key not found ->
{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} -> 8200 - Yahoo! Messenger ->
{FB5F1910-F110-11d2-BB9E-00C04F795683} -> 8194 - Windows Messenger ->
NextId -> 8201 ->
< Internet Explorer Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKLM] -> C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll [MenuText: Sun Java Console] -> Sun Microsystems, Inc. [Ver = 5.0.100.3 | Size = 75528 bytes | Modified Date = 11/9/2006 3:21:54 PM | Attr = ]
{e2e2dd38-d088-4134-82b7-f2ba38496583} [HKLM] -> Reg Data - Key not found [MenuText: @xpsp3res.dll,-20001] -> File not found
{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} -> C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [ButtonText: Yahoo! Messenger] -> Yahoo! Inc. [Ver = 8,1,0,195 | Size = 4662776 bytes | Modified Date = 10/24/2006 4:10:18 PM | Attr = ]
< Internet Explorer Plugins [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\Extension\
.spop -> C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll [Reg Data - Value does not exist] -> Intertrust Technologies, Inc. [Ver = 1.0.0.32 | Size = 270336 bytes | Modified Date = 8/1/2001 4:05:42 PM | Attr = ]
< Approved Shell Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
{0DF44EAA-FF21-4412-828E-260A8728E7F1} [HKLM] -> Reg Data - Key not found [Taskbar and Start Menu] -> File not found
{1CDB2949-8F65-4355-8456-263E7C208A5D} [HKLM] -> C:\WINDOWS\SYSTEM32\nvshell.dll [Desktop Explorer] -> NVIDIA Corporation [Ver = 6.14.10.5216 | Size = 430152 bytes | Modified Date = 10/6/2003 2:16:00 PM | Attr = ]
{1E2CDF40-419B-11D2-A5A1-002018648BA7} [HKLM] -> Reg Data - Key not found [AVG Shell Extension] -> File not found
{1E9B04FB-F9E5-4718-997B-B8DA88302A47} [HKLM] -> C:\WINDOWS\SYSTEM32\nvshell.dll [Desktop Explorer Menu] -> NVIDIA Corporation [Ver = 6.14.10.5216 | Size = 430152 bytes | Modified Date = 10/6/2003 2:16:00 PM | Attr = ]
{32683183-48a0-441b-a342-7c2a440a9478} [HKLM] -> Reg Data - Key not found [Media Band] -> File not found
{42071714-76d4-11d1-8b24-00a0c9068ff3} [HKLM] -> deskpan.dll [Display Panning CPL Extension] -> File not found
{5E44E225-A408-11CF-B581-008029601108} [HKLM] -> C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\Shellex.dll [Adaptec DirectCD Shell Extension] -> Roxio [Ver = 5.2.0.91 | Size = 180224 bytes | Modified Date = 4/10/2002 3:41:50 PM | Attr = ]
{764BF0E1-F219-11ce-972D-00AA00A14F56} [HKLM] -> Reg Data - Key not found [Shell extensions for file compression] -> File not found
{7A9D77BD-5403-11d2-8785-2E0420524153} [HKLM] -> Reg Data - Key not found [User Accounts] -> File not found
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} [HKLM] -> Reg Data - Key not found [Encryption Context Menu] -> File not found
{88895560-9AA2-1069-930E-00AA0030EBC8} [HKLM] -> C:\WINDOWS\SYSTEM32\HTICONS.DLL [HyperTerminal Icon Ext] -> Hilgraeve, Inc. [Ver = 5.1.2600.0 | Size = 44544 bytes | Modified Date = 8/18/2001 5:00:00 AM | Attr = ]
{8FF88D21-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [WinAce Archiver 2.6b4 (beta test) Context Menu Shell Extension] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
{8FF88D23-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [WinAce Archiver 2.6b4 (beta test) Property Sheet Shell Extension] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
{8FF88D25-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [WinAce Archiver 2.6b4 (beta test) DragDrop Shell Extension] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
{8FF88D27-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [WinAce Archiver 2.6b4 (beta test) Context Menu Shell Extension] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} [HKLM] -> C:\Program Files\Grisoft\AVG Free\avgse.dll [AVG7 Shell Extension] -> GRISOFT, s.r.o. [Ver = 7.5.0.409 | Size = 50688 bytes | Modified Date = 12/17/2006 8:37:44 AM | Attr = ]
{9F97547E-460A-42C5-AE0C-81C61FFAEBC3} [HKLM] -> C:\Program Files\Grisoft\AVG Free\avgse.dll [AVG7 Find Extension] -> GRISOFT, s.r.o. [Ver = 7.5.0.409 | Size = 50688 bytes | Modified Date = 12/17/2006 8:37:44 AM | Attr = ]
{acb4a560-3606-11d3-aef4-00104bd0f92d} [HKLM] -> C:\Program Files\Common Files\Kodak\ifscore\KodakShX.dll [KodakShellExtension] -> Eastman Kodak Company [Ver = 2.0.2300.3 | Size = 183296 bytes | Modified Date = 3/31/2005 7:53:42 AM | Attr = ]
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} [HKLM] -> C:\Program Files\iTunes\iTunesMiniPlayer.dll [iTunes] -> Apple Computer, Inc. [Ver = 7.0.2.16 | Size = 132672 bytes | Modified Date = 10/30/2006 9:36:36 AM | Attr = ]
{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} [HKLM] -> C:\Program Files\Real\RealOne Player\rpplugins\ierpplug.dll [Shell Extensions for RealOne Player] -> RealNetworks [Ver = 1.0.0.301 | Size = 180736 bytes | Modified Date = 6/22/2002 7:20:56 AM | Attr = ]
< ContextMenuHandlers - * [HKLM] > -> HKEY_LOCAL_MACHINE\Software\Classes\*\shellex\ContextMenuHandlers\
{8934FCEF-F5B8-468f-951F-78A921CD3920} [HKLM] -> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll [AVG Anti-Spyware] -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 49 | Size = 98304 bytes | Modified Date = 10/6/2006 5:40:48 AM | Attr = ]
{1E2CDF40-419B-11D2-A5A1-002018648BA7} [HKLM] -> Reg Data - Key not found [AVG Shell Extension] -> File not found
{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} [HKLM] -> C:\Program Files\Grisoft\AVG Free\avgse.dll [AVG7 Shell Extension] -> GRISOFT, s.r.o. [Ver = 7.5.0.409 | Size = 50688 bytes | Modified Date = 12/17/2006 8:37:44 AM | Attr = ]
{7DBF2913-1F89-4104-B1F4-932A29945C13} [HKLM] -> C:\Program Files\Morpheus\MorphShellExt.dll [MorpheusShellExt] -> TODO: [Ver = 1.0.0.1 | Size = 53248 bytes | Modified Date = 9/11/2006 4:21:40 PM | Attr = ]
{8FF88D27-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [ZFAdd] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
< ContextMenuHandlers - Directory [HKLM] > -> HKEY_LOCAL_MACHINE\Software\Classes\Directory\shellex\ContextMenuHandlers\
{8934FCEF-F5B8-468f-951F-78A921CD3920} [HKLM] -> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll [AVG Anti-Spyware] -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 49 | Size = 98304 bytes | Modified Date = 10/6/2006 5:40:48 AM | Attr = ]
{8FF88D27-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [ZFAdd] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
< ContextMenuHandlers - Folder [HKLM] > -> HKEY_LOCAL_MACHINE\Software\Classes\Folder\shellex\ContextMenuHandlers\
{1E2CDF40-419B-11D2-A5A1-002018648BA7} [HKLM] -> Reg Data - Key not found [AVG Shell Extension] -> File not found
{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} [HKLM] -> C:\Program Files\Grisoft\AVG Free\avgse.dll [AVG7 Shell Extension] -> GRISOFT, s.r.o. [Ver = 7.5.0.409 | Size = 50688 bytes | Modified Date = 12/17/2006 8:37:44 AM | Attr = ]
{7DBF2913-1F89-4104-B1F4-932A29945C13} [HKLM] -> C:\Program Files\Morpheus\MorphShellExt.dll [MorpheusShellExt] -> TODO: [Ver = 1.0.0.1 | Size = 53248 bytes | Modified Date = 9/11/2006 4:21:40 PM | Attr = ]
< DNS Name Servers [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\
{F22F6660-02CA-4B75-AAC4-260C7BD2EBEA} -> (GVC-REALTEK Ethernet 10/100 PCI Adapter) ->
< Protocol Handlers [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\
ipp -> Reg Data - Key not found -> File not found
msdaipp -> Reg Data - Key not found -> File not found

[Files - Created Wihin 30 days]
ComboFix.txt -> C:\ComboFix.txt -> [Ver = | Size = 15103 bytes | Created Date = 12/25/2006 2:08:46 PM | Attr = ]
dlcq.log -> C:\dlcq.log -> [Ver = | Size = 78 bytes | Created Date = 12/24/2006 10:54:48 AM | Attr = ]
dlcqscan.log -> C:\dlcqscan.log -> [Ver = | Size = 83 bytes | Created Date = 12/24/2006 10:54:50 AM | Attr = ]
hiberfil.sys -> C:\hiberfil.sys -> [Ver = | Size = 267468800 bytes | Created Date = 1/1/1601 6:00:00 AM | Attr = HS]
setupfax.log -> C:\setupfax.log -> [Ver = | Size = 172 bytes | Created Date = 12/4/2006 10:23:08 PM | Attr = ]
IDNMitigationAPIs.log -> C:\WINDOWS\IDNMitigationAPIs.log -> [Ver = | Size = 15726 bytes | Created Date = 12/25/2006 8:03:02 AM | Attr = ]
ie7.log -> C:\WINDOWS\ie7.log -> [Ver = | Size = 54299 bytes | Created Date = 12/25/2006 8:03:53 AM | Attr = ]
ie7_main.log -> C:\WINDOWS\ie7_main.log -> [Ver = | Size = 26998 bytes | Created Date = 12/20/2006 12:04:33 PM | Attr = ]
iexplore.exe-up.txt -> C:\WINDOWS\iexplore.exe-up.txt -> [Ver = | Size = 1855 bytes | Created Date = 12/5/2006 3:21:44 PM | Attr = ]
KB904942.log -> C:\WINDOWS\KB904942.log -> [Ver = | Size = 17531 bytes | Created Date = 12/25/2006 7:54:49 AM | Attr = ]
KB914440.log -> C:\WINDOWS\KB914440.log -> [Ver = | Size = 9087 bytes | Created Date = 12/25/2006 7:56:54 AM | Attr = ]
KB915865.log -> C:\WINDOWS\KB915865.log -> [Ver = | Size = 14665 bytes | Created Date = 12/25/2006 8:01:10 AM | Attr = ]
KB923689.log -> C:\WINDOWS\KB923689.log -> [Ver = | Size = 10942 bytes | Created Date = 12/17/2006 3:04:47 AM | Attr = ]
KB923694.log -> C:\WINDOWS\KB923694.log -> [Ver = | Size = 11904 bytes | Created Date = 12/16/2006 3:48:04 PM | Attr = ]
KB925398.log -> C:\WINDOWS\KB925398.log -> [Ver = | Size = 9413 bytes | Created Date = 12/17/2006 3:06:21 AM | Attr = ]
KB925454.log -> C:\WINDOWS\KB925454.log -> [Ver = | Size = 35985 bytes | Created Date = 12/16/2006 3:52:29 PM | Attr = ]
KB926255.log -> C:\WINDOWS\KB926255.log -> [Ver = | Size = 11927 bytes | Created Date = 12/16/2006 3:48:17 PM | Attr = ]
NLSDownlevelMapping.log -> C:\WINDOWS\NLSDownlevelMapping.log -> [Ver = | Size = 15416 bytes | Created Date = 12/25/2006 8:01:52 AM | Attr = ]
ntbtlog.txt -> C:\WINDOWS\ntbtlog.txt -> [Ver = | Size = 199192 bytes | Created Date = 12/19/2006 8:42:35 PM | Attr = ]
QTFont.for -> C:\WINDOWS\QTFont.for -> [Ver = | Size = 1409 bytes | Created Date = 12/17/2006 4:58:08 PM | Attr = ]
QTFont.qfn -> C:\WINDOWS\QTFont.qfn -> [Ver = | Size = 54156 bytes | Created Date = 12/17/2006 4:58:08 PM | Attr = H ]
d3d8caps.dat -> C:\WINDOWS\System32\d3d8caps.dat -> [Ver = | Size = 552 bytes | Created Date = 12/20/2006 10:07:09 AM | Attr = ]
DLCQinst.dll -> C:\WINDOWS\System32\DLCQinst.dll -> [Ver = | Size = 274432 bytes | Created Date = 12/4/2006 10:20:18 PM | Attr = ]
DLPMONUI.DLL -> C:\WINDOWS\System32\DLPMONUI.DLL -> [Ver = 0.1.35.8 | Size = 32768 bytes | Created Date = 12/4/2006 10:21:54 PM | Attr = ]
DLPRMON.DLL -> C:\WINDOWS\System32\DLPRMON.DLL -> [Ver = 0.1.35.8 | Size = 40960 bytes | Created Date = 12/4/2006 10:21:54 PM | Attr = ]
IM31IMG.DIL -> C:\WINDOWS\System32\IM31IMG.DIL -> Data Techniques, Inc. [Ver = 7.20 | Size = 49152 bytes | Created Date = 12/4/2006 10:21:34 PM | Attr = ]
IM31XPNG.DEL -> C:\WINDOWS\System32\IM31XPNG.DEL -> Data Techniques, Inc. [Ver = 7.20 | Size = 98304 bytes | Created Date = 12/4/2006 10:21:34 PM | Attr = ]
IM31XTIF.DEL -> C:\WINDOWS\System32\IM31XTIF.DEL -> Data Techniques, Inc. [Ver = 7.20 | Size = 69632 bytes | Created Date = 12/4/2006 10:21:34 PM | Attr = ]
IMGMAN32.DLL -> C:\WINDOWS\System32\IMGMAN32.DLL -> Data Techniques, Inc. [Ver = 7.20 | Size = 339968 bytes | Created Date = 12/4/2006 10:21:34 PM | Attr = ]
IMHOST32.DLL -> C:\WINDOWS\System32\IMHOST32.DLL -> Data Techniques, Inc. [Ver = 7.20 | Size = 98345 bytes | Created Date = 12/4/2006 10:21:34 PM | Attr = ]
java.exe -> C:\WINDOWS\System32\java.exe -> Sun Microsystems, Inc. [Ver = 5.0.100.3 | Size = 49248 bytes | Created Date = 12/25/2006 9:56:34 AM | Attr = ]
javaw.exe -> C:\WINDOWS\System32\javaw.exe -> Sun Microsystems, Inc. [Ver = 5.0.100.3 | Size = 53346 bytes | Created Date = 12/25/2006 9:56:34 AM | Attr = ]
javaws.exe -> C:\WINDOWS\System32\javaws.exe -> Sun Microsystems, Inc. [Ver = 5.0.100.3 | Size = 127078 bytes | Created Date = 12/25/2006 9:56:34 AM | Attr = ]
jupdate-1.5.0_10-b03.log -> C:\WINDOWS\System32\jupdate-1.5.0_10-b03.log -> [Ver = | Size = 8657 bytes | Created Date = 12/25/2006 9:55:50 AM | Attr = ]
KGyGaAvL.sys -> C:\WINDOWS\System32\KGyGaAvL.sys -> [Ver = | Size = 3350 bytes | Created Date = 12/5/2006 1:37:28 PM | Attr = HS]
LexFiles.ulf -> C:\WINDOWS\System32\LexFiles.ulf -> [Ver = | Size = 26211 bytes | Created Date = 12/4/2006 10:19:02 PM | Attr = ]
AvgAsCln.sys -> C:\WINDOWS\System32\drivers\AvgAsCln.sys -> GRISOFT, s.r.o. [Ver = 1.0.0.14 | Size = 3968 bytes | Created Date = 12/18/2006 7:10:04 PM | Attr = ]
avgclean.sys -> C:\WINDOWS\System32\drivers\avgclean.sys -> GRISOFT, s.r.o. [Ver = 1.0.0.14 | Size = 3968 bytes | Created Date = 12/17/2006 8:37:49 AM | Attr = ]
avgmfx86.sys -> C:\WINDOWS\System32\drivers\avgmfx86.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.416 | Size = 18240 bytes | Created Date = 12/17/2006 8:37:48 AM | Attr = ]

[Files - Modified Wihin 30 days]
ComboFix.txt -> C:\ComboFix.txt -> [Ver = | Size = 15103 bytes | Modified Date = 12/25/2006 2:18:20 PM | Attr = ]
dlcq.log -> C:\dlcq.log -> [Ver = | Size = 78 bytes | Modified Date = 12/24/2006 10:54:50 AM | Attr = ]
dlcqscan.log -> C:\dlcqscan.log -> [Ver = | Size = 83 bytes | Modified Date = 12/24/2006 10:54:52 AM | Attr = ]
hiberfil.sys -> C:\hiberfil.sys -> [Ver = | Size = 267468800 bytes | Modified Date = 12/25/2006 10:28:12 PM | Attr = HS]
setupfax.log -> C:\setupfax.log -> [Ver = | Size = 172 bytes | Modified Date = 12/4/2006 10:28:40 PM | Attr = ]
0.LOG -> C:\WINDOWS\0.LOG -> [Ver = | Size = 0 bytes | Modified Date = 12/25/2006 10:29:18 PM | Attr = ]
BOOTSTAT.DAT -> C:\WINDOWS\BOOTSTAT.DAT -> [Ver = | Size = 2048 bytes | Modified Date = 12/25/2006 10:28:16 PM | Attr = S]
comsetup.log -> C:\WINDOWS\comsetup.log -> [Ver = | Size = 69113 bytes | Modified Date = 12/25/2006 8:06:46 AM | Attr = ]
FaxSetup.log -> C:\WINDOWS\FaxSetup.log -> [Ver = | Size = 1149090 bytes | Modified Date = 12/25/2006 8:06:44 AM | Attr = ]
IDNMitigationAPIs.log -> C:\WINDOWS\IDNMitigationAPIs.log -> [Ver = | Size = 15726 bytes | Modified Date = 12/25/2006 8:03:50 AM | Attr = ]
ie7.log -> C:\WINDOWS\ie7.log -> [Ver = | Size = 54299 bytes | Modified Date = 12/25/2006 8:06:46 AM | Attr = ]
ie7_main.log -> C:\WINDOWS\ie7_main.log -> [Ver = | Size = 26998 bytes | Modified Date = 12/25/2006 8:07:22 AM | Attr = ]
iexplore.exe-up.txt -> C:\WINDOWS\iexplore.exe-up.txt -> [Ver = | Size = 1855 bytes | Modified Date = 12/5/2006 3:21:46 PM | Attr = ]
IIS6.LOG -> C:\WINDOWS\IIS6.LOG -> [Ver = | Size = 181481 bytes | Modified Date = 12/25/2006 8:06:46 AM | Attr = ]
imsins.BAK -> C:\WINDOWS\imsins.BAK -> [Ver = | Size = 1393 bytes | Modified Date = 12/25/2006 8:03:50 AM | Attr = ]
imsins.log -> C:\WINDOWS\imsins.log -> [Ver = | Size = 1393 bytes | Modified Date = 12/25/2006 8:06:46 AM | Attr = ]
KB904942.log -> C:\WINDOWS\KB904942.log -> [Ver = | Size = 17531 bytes | Modified Date = 12/25/2006 7:56:36 AM | Attr = ]
KB914440.log -> C:\WINDOWS\KB914440.log -> [Ver = | Size = 9087 bytes | Modified Date = 12/25/2006 7:59:10 AM | Attr = ]
KB915865.log -> C:\WINDOWS\KB915865.log -> [Ver = | Size = 14665 bytes | Modified Date = 12/25/2006 8:01:48 AM | Attr = ]
KB923689.log -> C:\WINDOWS\KB923689.log -> [Ver = | Size = 10942 bytes | Modified Date = 12/17/2006 3:06:20 AM | Attr = ]
KB923694.log -> C:\WINDOWS\KB923694.log -> [Ver = | Size = 11904 bytes | Modified Date = 12/17/2006 3:04:36 AM | Attr = ]
KB925398.log -> C:\WINDOWS\KB925398.log -> [Ver = | Size = 9413 bytes | Modified Date = 12/17/2006 3:07:04 AM | Attr = ]
KB925454.log -> C:\WINDOWS\KB925454.log -> [Ver = | Size = 35985 bytes | Modified Date = 12/25/2006 7:59:08 AM | Attr = ]
KB926255.log -> C:\WINDOWS\KB926255.log -> [Ver = | Size = 11927 bytes | Modified Date = 12/17/2006 3:04:48 AM | Attr = ]
mozver.dat -> C:\WINDOWS\mozver.dat -> [Ver = | Size = 8622 bytes | Modified Date = 11/29/2006 7:11:34 PM | Attr = ]
MSGSOCM.LOG -> C:\WINDOWS\MSGSOCM.LOG -> [Ver = | Size = 57843 bytes | Modified Date = 12/25/2006 8:06:44 AM | Attr = ]
NLSDownlevelMapping.log -> C:\WINDOWS\NLSDownlevelMapping.log -> [Ver = | Size = 15416 bytes | Modified Date = 12/25/2006 8:02:58 AM | Attr = ]
ntbtlog.txt -> C:\WINDOWS\ntbtlog.txt -> [Ver = | Size = 199192 bytes | Modified Date = 12/25/2006 10:17:02 PM | Attr = ]
ntdtcsetup.log -> C:\WINDOWS\ntdtcsetup.log -> [Ver = | Size = 236254 bytes | Modified Date = 12/25/2006 8:06:46 AM | Attr = ]
ocgen.log -> C:\WINDOWS\ocgen.log -> [Ver = | Size = 104829 bytes | Modified Date = 12/25/2006 8:06:44 AM | Attr = ]
OCMSN.LOG -> C:\WINDOWS\OCMSN.LOG -> [Ver = | Size = 54356 bytes | Modified Date = 12/25/2006 8:06:46 AM | Attr = ]
QTFont.for -> C:\WINDOWS\QTFont.for -> [Ver = | Size = 1409 bytes | Modified Date = 12/17/2006 4:58:10 PM | Attr = ]
QTFont.qfn -> C:\WINDOWS\QTFont.qfn -> [Ver = | Size = 54156 bytes | Modified Date = 12/24/2006 10:11:08 PM | Attr = H ]
SchedLgU.Txt -> C:\WINDOWS\SchedLgU.Txt -> [Ver = | Size = 32388 bytes | Modified Date = 12/25/2006 8:08:04 PM | Attr = ]
setupapi.log -> C:\WINDOWS\setupapi.log -> [Ver = | Size = 310012 bytes | Modified Date = 12/25/2006 8:06:44 AM | Attr = ]
SIERRA.INI -> C:\WINDOWS\SIERRA.INI -> [Ver = | Size = 512 bytes | Modified Date = 11/29/2006 5:32:34 PM | Attr = ]
spupdsvc.log -> C:\WINDOWS\spupdsvc.log -> [Ver = | Size = 41837 bytes | Modified Date = 12/25/2006 8:46:54 AM | Attr = ]
TSOC.LOG -> C:\WINDOWS\TSOC.LOG -> [Ver = | Size = 448019 bytes | Modified Date = 12/25/2006 8:06:46 AM | Attr = ]
UninstallFirefox.exe -> C:\WINDOWS\UninstallFirefox.exe -> [Ver = | Size = 99965 bytes | Modified Date = 11/29/2006 7:11:42 PM | Attr = ]
updspapi.log -> C:\WINDOWS\updspapi.log -> [Ver = | Size = 69985 bytes | Modified Date = 12/25/2006 8:06:14 AM | Attr = ]
WIADEBUG.LOG -> C:\WINDOWS\WIADEBUG.LOG -> [Ver = | Size = 157 bytes | Modified Date = 12/25/2006 10:28:44 PM | Attr = ]
WIASERVC.LOG -> C:\WINDOWS\WIASERVC.LOG -> [Ver = | Size = 50 bytes | Modified Date = 12/25/2006 10:28:38 PM | Attr = ]
WindowsUpdate.log -> C:\WINDOWS\WindowsUpdate.log -> [Ver = | Size = 1256878 bytes | Modified Date = 12/25/2006 10:28:42 PM | Attr = ]
wmsetup.log -> C:\WINDOWS\wmsetup.log -> [Ver = | Size = 24364 bytes | Modified Date = 12/18/2006 3:49:22 PM | Attr = ]
yacs.log -> C:\WINDOWS\yacs.log -> [Ver = | Size = 28457 bytes | Modified Date = 11/28/2006 8:48:02 PM | Attr = ]
d3d8caps.dat -> C:\WINDOWS\System32\d3d8caps.dat -> [Ver = | Size = 552 bytes | Modified Date = 12/20/2006 10:07:10 AM | Attr = ]
jupdate-1.5.0_10-b03.log -> C:\WINDOWS\System32\jupdate-1.5.0_10-b03.log -> [Ver = | Size = 8657 bytes | Modified Date = 12/25/2006 9:56:32 AM | Attr = ]
KGyGaAvL.sys -> C:\WINDOWS\System32\KGyGaAvL.sys -> [Ver = | Size = 3350 bytes | Modified Date = 12/22/2006 11:49:54 AM | Attr = HS]
LexFiles.ulf -> C:\WINDOWS\System32\LexFiles.ulf -> [Ver = | Size = 26211 bytes | Modified Date = 12/4/2006 10:32:50 PM | Attr = ]
WPA.DBL -> C:\WINDOWS\System32\WPA.DBL -> [Ver = | Size = 1170 bytes | Modified Date = 12/25/2006 10:29:26 PM | Attr = ]
avg7core.sys -> C:\WINDOWS\System32\drivers\avg7core.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.429 | Size = 816672 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
avg7rsw.sys -> C:\WINDOWS\System32\drivers\avg7rsw.sys -> GRISOFT, s.r.o. [Ver = 7,0,0,340 | Size = 4224 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
avg7rsxp.sys -> C:\WINDOWS\System32\drivers\avg7rsxp.sys -> GRISOFT, s.r.o. [Ver = 7,1,0,398 | Size = 28416 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
avgclean.sys -> C:\WINDOWS\System32\drivers\avgclean.sys -> GRISOFT, s.r.o. [Ver = 1.0.0.14 | Size = 3968 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
avgmfx86.sys -> C:\WINDOWS\System32\drivers\avgmfx86.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.416 | Size = 18240 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
avgtdi.sys -> C:\WINDOWS\System32\drivers\avgtdi.sys -> GRISOFT, s.r.o. [Ver = 7,0,0,346 | Size = 4960 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]

[File String Scan - Non-Microsoft Only]
UPX0 , -> C:\ar505enu.exe -> InstallShield Software Corporation [Ver = 2.02.001 | Size = 8981440 bytes | Modified Date = 7/9/2002 6:18:42 PM | Attr = ]
UPX0 , -> C:\avg6386fu_free.exe -> [Ver = | Size = 5433344 bytes | Modified Date = 9/17/2002 9:28:30 PM | Attr = ]
Thawte Consulting , -> C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\core3.zip -> [Ver = | Size = 3290841 bytes | Modified Date = 12/6/2004 10:57:36 PM | Attr = ]
USERTRUST , -> C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\patch-jre1.5.0_09.b03\patchjre.exe -> Sun Microsystems, Inc. [Ver = 1, 0, 0, 1 | Size = 4490872 bytes | Modified Date = 10/12/2006 3:41:58 AM | Attr = ]
USERTRUST , -> C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\patch-jre1.5.0_10.b03\patchjre.exe -> Sun Microsystems, Inc. [Ver = 1, 0, 0, 1 | Size = 4650616 bytes | Modified Date = 11/9/2006 3:38:38 PM | Attr = ]
FSG! , -> C:\Program Files\Common Files\Microsoft Shared\Shoebox\STANDARD.SBT -> [Ver = | Size = 19954310 bytes | Modified Date = 6/21/2000 3:59:14 AM | Attr = ]
PEC2 , -> C:\Program Files\Common Files\Sony Shared\AVLib\Metallic.dll -> Sony Corporation [Ver = 2.7.00.14160 | Size = 229376 bytes | Modified Date = 2/17/2004 8:16:12 AM | Attr = ]
UPX! , UPX0 , -> C:\WINDOWS\Zambelli Fireworks Screensaver.scr -> [Ver = | Size = 671744 bytes | Modified Date = 9/27/2001 2:04:28 PM | Attr = ]
PEC2 , -> C:\WINDOWS\System32\DFRG.MSC -> [Ver = | Size = 41397 bytes | Modified Date = 8/18/2001 5:00:00 AM | Attr = ]
winsync , -> C:\WINDOWS\System32\WBDBASE.DEU -> [Ver = | Size = 1309184 bytes | Modified Date = 8/18/2001 5:00:00 AM | Attr = ]
Thawte Consulting , -> C:\WINDOWS\System32\XceedFtp.dll -> Xceed Software Inc [removed] [removed] www.xceedsoft.com [Ver = 1.1.129.0 | Size = 279392 bytes | Modified Date = 8/31/2005 10:35:40 AM | Attr = ]
UPX! , FSG! , PEC2 , aspack , -> C:\WINDOWS\System32\drivers\avg7core.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.429 | Size = 816672 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
PTech , -> C:\WINDOWS\System32\drivers\mtlstrm.sys -> Smart Link [Ver = 3.80.01MC15 | Size = 1309184 bytes | Modified Date = 8/3/2004 11:41:38 PM | Attr = ]

< End of report >

OldTimer

Post #24December 26, 2006, 6:08 AM UTC

Hi PatRick B. It looks like ComboFix took care of it. How are things running now? Any more problems?

There are just a couple of registry entries to finish with.

Start WinPFind3U. Copy/Paste the information in the quotebox below into the pane where it says "Paste fix here" and then click the Run Fix button.

[Registry - Non-Microsoft Only]
< BHO's > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
YY -> {BA849497-5825-54F6-74F6-70450779229C} [HKLM] -> C:\WINDOWS\system32\bbtqp.dll [Reg Data - Value does not exist]
< Internet Explorer ToolBars [HKCU] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\
YN -> ShellBrowser\\{5CBE2611-C31B-401F-89BC-4CBB25E853D7} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found]
YN -> WebBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found]

The fix should only take a very short time.

Post the following back here:

a new WinPFind3U report
the latest .log file from the WinPFind3u folder (it will have a name in the format mmddyyyy_hhmmss.log)

I will review the information when it comes back in.

Cheers.

OT

PatRick B

Post #25December 27, 2006, 9:49 PM UTC

OT Fix did not run Program opened W/ error message I/O error 103 Hit ok & program opened. Pasted fix & hit run Got error message Access violation at address 00472CB3 in module "winPFind3u.exe". read address 00000004 Tried several times w/ same result. Patrick

OldTimer

Post #26December 27, 2006, 10:34 PM UTC

Hi PatRick B. That usually means that a file or folder is missing. Is the patterns.txt file in the WinPFind3u folder where the executable is and is the MovedFiles folder present there also?

Cheers.

OT

PatRick B

Post #27December 29, 2006, 4:01 AM UTC

OT,
Everything in the WinP file looks OK, but I dumped it & re-downloaded it.

When I pasted the fix & hit run the fix screen went blank so I don't know if it worked

Ran scan again
Below is the files & log

Patrick

WinPFind3 logfile created on: 12/28/2006 9:31:27 PM
WinPFind3U by OldTimer - Version 1.0.4 Folder = C:\Documents and Settings\Patrick Boyle\Desktop\WinPFind3u\
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600)
Internet Explorer (Version = 7.0.5730.11)

[Processes - Non-Microsoft Only]
avgamsvr.exe -> C:\Program Files\Grisoft\AVG Free\avgamsvr.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 343552 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
avgas.exe -> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 50 | Size = 6266880 bytes | Modified Date = 10/7/2006 6:20:00 AM | Attr = ]
avgcc.exe -> C:\Program Files\Grisoft\AVG Free\avgcc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.418 | Size = 406016 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
avgemc.exe -> C:\Program Files\Grisoft\AVG Free\avgemc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.432 | Size = 323072 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
avgupsvc.exe -> C:\Program Files\Grisoft\AVG Free\avgupsvc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 49664 bytes | Modified Date = 12/17/2006 8:37:48 AM | Attr = ]
ctsvccda.exe -> C:\WINDOWS\SYSTEM32\CTSVCCDA.EXE -> Creative Technology Ltd [Ver = 1.0.1.0 | Size = 44032 bytes | Modified Date = 12/13/1999 12:01:00 AM | Attr = ]
damon.exe -> C:\Program Files\Dell\Support\Alert\bin\DAMon.exe -> [Ver = 1, 0, 0, 1 | Size = 282624 bytes | Modified Date = 4/3/2002 5:06:18 PM | Attr = ]
devldr32.exe -> C:\WINDOWS\SYSTEM32\devldr32.exe -> Creative Technology Ltd. [Ver = 1, 0, 0, 22 | Size = 25600 bytes | Modified Date = 8/31/2001 12:44:30 PM | Attr = ]
dlcqcoms.exe -> C:\WINDOWS\SYSTEM32\dlcqcoms.exe -> [Ver = 6.3.22.0 | Size = 528384 bytes | Modified Date = 7/13/2006 5:27:16 PM | Attr = ]
dlcqmon.exe -> C:\Program Files\Dell Photo AIO Printer 966\dlcqmon.exe -> [Ver = 0.1.25.0 | Size = 286720 bytes | Modified Date = 6/20/2006 11:37:42 AM | Attr = ]
easyshare.exe -> C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe -> [Ver = 5, 0, 25, 230 | Size = 151552 bytes | Modified Date = 7/22/2005 3:47:22 AM | Attr = ]
evntsvc.exe -> C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -> RealNetworks, Inc. [Ver = 0.1.0.880 | Size = 146432 bytes | Modified Date = 6/22/2002 7:20:54 AM | Attr = ]
ezsp_px.exe -> C:\WINDOWS\SYSTEM32\ezSP_Px.exe -> Easy Systems Japan Ltd. [Ver = 1, 0, 0, 0 | Size = 40960 bytes | Modified Date = 8/20/2002 10:29:26 AM | Attr = ]
firefox.exe -> C:\Program Files\Mozilla Firefox\firefox.exe -> Mozilla [Ver = 1.0.7 | Size = 6637156 bytes | Modified Date = 9/15/2005 6:26:00 PM | Attr = ]
googletoolbarnotifier.exe -> C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe -> Google Inc. [Ver = 1, 2, 908, 5008 | Size = 163576 bytes | Modified Date = 10/27/2006 9:41:44 PM | Attr = ]
guard.exe -> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 47 | Size = 204800 bytes | Modified Date = 9/28/2006 8:13:20 AM | Attr = ]
ipodservice.exe -> C:\Program Files\iPod\bin\iPodService.exe -> Apple Computer, Inc. [Ver = 7.0.2.16 | Size = 492608 bytes | Modified Date = 10/30/2006 9:36:32 AM | Attr = ]
ituneshelper.exe -> C:\Program Files\iTunes\iTunesHelper.exe -> Apple Computer, Inc. [Ver = 7.0.2.16 | Size = 256576 bytes | Modified Date = 10/30/2006 9:36:36 AM | Attr = ]
jusched.exe -> C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe -> Sun Microsystems, Inc. [Ver = 5.0.100.3 | Size = 49263 bytes | Modified Date = 11/9/2006 3:07:30 PM | Attr = ]
kodak software updater.exe -> C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe -> [Ver = | Size = 16423 bytes | Modified Date = 2/13/2004 2:12:08 PM | Attr = ]
mediadetect.exe -> C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe -> Corel, Inc. [Ver = 6.0.0 (20050831.10) | Size = 106496 bytes | Modified Date = 8/31/2005 11:06:18 AM | Attr = ]
memcard.exe -> C:\Program Files\Dell Photo AIO Printer 966\memcard.exe -> [Ver = 1.0.18.1 | Size = 299008 bytes | Modified Date = 6/27/2006 5:34:50 AM | Attr = ]
mm_tray.exe -> C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe -> MUSICMATCH, Inc. [Ver = 7.10.0053 | Size = 90112 bytes | Modified Date = 2/27/2002 12:17:08 PM | Attr = ]
morpheus.exe -> C:\Program Files\Morpheus\Morpheus.exe -> Streamcast Networks, Inc [Ver = 1.0.0.1 | Size = 721408 bytes | Modified Date = 9/12/2006 1:17:26 PM | Attr = ]
nvsvc32.exe -> C:\WINDOWS\SYSTEM32\nvsvc32.exe -> NVIDIA Corporation [Ver = 6.14.10.5216 | Size = 81920 bytes | Modified Date = 10/6/2003 2:16:00 PM | Attr = ]
qttask.exe -> C:\Program Files\QuickTime\qttask.exe -> Apple Computer, Inc. [Ver = 7.1.3 | Size = 282624 bytes | Modified Date = 10/25/2006 6:58:18 PM | Attr = ]
sagent2.exe -> C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe -> SEIKO EPSON CORPORATION [Ver = 2, 2, 0, 0 | Size = 90112 bytes | Modified Date = 10/25/2001 1:02:00 AM | Attr = ]
viewmgr.exe -> C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe -> Viewpoint Corporation [Ver = 2, 0, 0, 42 | Size = 111816 bytes | Modified Date = 11/10/2004 10:15:32 PM | Attr = ]
winpfind3u.exe -> C:\Documents and Settings\Patrick Boyle\Desktop\WinPFind3u\WinPFind3U.exe -> Oldtimer Tools [Ver = 1.0.4.0 | Size = 303104 bytes | Modified Date = 12/28/2006 1:16:46 PM | Attr = ]
wkufind.exe -> C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe -> Microsoft® Corporation [Ver = 6.00.3215.0 | Size = 28738 bytes | Modified Date = 8/16/2001 9:41:58 PM | Attr = ]
ymsgr_tray.exe -> C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe -> Yahoo! Inc. [Ver = 8,1,0,0 | Size = 103928 bytes | Modified Date = 10/24/2006 4:10:18 PM | Attr = ]

[Win32 Services - Non-Microsoft Only]
(AVG Anti-Spyware Guard) AVG Anti-Spyware Guard [Win32_Own | Auto | Running] -> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 47 | Size = 204800 bytes | Modified Date = 9/28/2006 8:13:20 AM | Attr = ]
(Avg7Alrt) AVG7 Alert Manager Server [Win32_Own | Auto | Running] -> C:\Program Files\Grisoft\AVG Free\avgamsvr.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 343552 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
(Avg7UpdSvc) AVG7 Update Service [Win32_Own | Auto | Running] -> C:\Program Files\Grisoft\AVG Free\avgupsvc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 49664 bytes | Modified Date = 12/17/2006 8:37:48 AM | Attr = ]
(AVGEMS) AVG E-mail Scanner [Win32_Own | Auto | Running] -> C:\Program Files\Grisoft\AVG Free\avgemc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.432 | Size = 323072 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
(Creative Service for CDROM Access) Creative Service for CDROM Access [Win32_Own | Auto | Running] -> C:\WINDOWS\SYSTEM32\CTSVCCDA.EXE -> Creative Technology Ltd [Ver = 1.0.1.0 | Size = 44032 bytes | Modified Date = 12/13/1999 12:01:00 AM | Attr = ]
(dlcq_device) dlcq_device [Win32_Own | Auto | Running] -> C:\WINDOWS\SYSTEM32\dlcqcoms.exe -> [Ver = 6.3.22.0 | Size = 528384 bytes | Modified Date = 7/13/2006 5:27:16 PM | Attr = ]
(dmadmin) Logical Disk Manager Administrative Service [Win32_Shared | On_Demand | Stopped] -> C:\WINDOWS\SYSTEM32\dmadmin.exe -> Microsoft Corp., Veritas Software [Ver = 2600.2180.503.0 | Size = 224768 bytes | Modified Date = 8/4/2004 1:56:48 AM | Attr = ]
(EPSONStatusAgent2) EPSON Printer Status Agent2 [Win32_Own | Auto | Running] -> C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe -> SEIKO EPSON CORPORATION [Ver = 2, 2, 0, 0 | Size = 90112 bytes | Modified Date = 10/25/2001 1:02:00 AM | Attr = ]
(iPod Service) iPod Service [Win32_Own | On_Demand | Running] -> C:\Program Files\iPod\bin\iPodService.exe -> Apple Computer, Inc. [Ver = 7.0.2.16 | Size = 492608 bytes | Modified Date = 10/30/2006 9:36:32 AM | Attr = ]
(KodakCCS) Kodak Camera Connection Software [Win32_Own | On_Demand | Stopped] -> C:\WINDOWS\SYSTEM32\DRIVERS\KodakCCS.exe -> Eastman Kodak Company [Ver = 1.1.5100.4 | Size = 411920 bytes | Modified Date = 3/30/2005 4:46:56 PM | Attr = ]
(NVSvc) NVIDIA Display Driver Service [Win32_Own | Auto | Running] -> C:\WINDOWS\SYSTEM32\nvsvc32.exe -> NVIDIA Corporation [Ver = 6.14.10.5216 | Size = 81920 bytes | Modified Date = 10/6/2003 2:16:00 PM | Attr = ]
(PACSPTISVR) PACSPTISVR [Win32_Own | On_Demand | Stopped] -> C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe -> Sony Corporation [Ver = 4.0.00.05270 | Size = 53337 bytes | Modified Date = 5/27/2004 1:14:58 AM | Attr = ]
(SPTISRV) Sony SPTI Service [Win32_Own | On_Demand | Stopped] -> C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe -> Sony Corporation [Ver = 4.0.00.05270 | Size = 69718 bytes | Modified Date = 5/27/2004 1:13:00 AM | Attr = ]

[Registry - Non-Microsoft Only]
< Run [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
!AVG Anti-Spyware -> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 50 | Size = 6266880 bytes | Modified Date = 10/7/2006 6:20:00 AM | Attr = ]
AVG7_CC -> C:\Program Files\Grisoft\AVG Free\avgcc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.418 | Size = 406016 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
Corel Photo Downloader -> C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe -> Corel, Inc. [Ver = 6.0.0 (20050831.10) | Size = 106496 bytes | Modified Date = 8/31/2005 11:06:18 AM | Attr = ]
Dell|Alert -> C:\Program Files\Dell\Support\Alert\bin\DAMon.exe -> [Ver = 1, 0, 0, 1 | Size = 282624 bytes | Modified Date = 4/3/2002 5:06:18 PM | Attr = ]
DLCQCATS -> C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\dlcqtime.dll [rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCQtime.dll,_RunDLLEntry@16] -> [Ver = 1.20.0.0 | Size = 106496 bytes | Modified Date = 6/7/2006 12:17:18 PM | Attr = ]
dlcqmon.exe -> C:\Program Files\Dell Photo AIO Printer 966\dlcqmon.exe -> [Ver = 0.1.25.0 | Size = 286720 bytes | Modified Date = 6/20/2006 11:37:42 AM | Attr = ]
ezShieldProtector for Px -> C:\WINDOWS\SYSTEM32\ezSP_Px.exe -> Easy Systems Japan Ltd. [Ver = 1, 0, 0, 0 | Size = 40960 bytes | Modified Date = 8/20/2002 10:29:26 AM | Attr = ]
FaxCenterServer -> C:\Program Files\Dell PC Fax\fm3032.exe -> [Ver = 0.1.35.8 | Size = 307200 bytes | Modified Date = 6/15/2006 4:03:30 AM | Attr = ]
ISUSPM Startup -> C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe -> InstallShield Software Corporation [Ver = 4, 50, 100, 33433 | Size = 249856 bytes | Modified Date = 6/10/2005 10:44:02 AM | Attr = ]
ISUSScheduler -> C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe -> InstallShield Software Corporation [Ver = 4, 50, 100, 33433 | Size = 81920 bytes | Modified Date = 6/10/2005 10:44:02 AM | Attr = ]
iTunesHelper -> C:\Program Files\iTunes\iTunesHelper.exe -> Apple Computer, Inc. [Ver = 7.0.2.16 | Size = 256576 bytes | Modified Date = 10/30/2006 9:36:36 AM | Attr = ]
MemoryCardManager -> C:\Program Files\Dell Photo AIO Printer 966\memcard.exe -> [Ver = 1.0.18.1 | Size = 299008 bytes | Modified Date = 6/27/2006 5:34:50 AM | Attr = ]
Microsoft Works Update Detection -> C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe -> Microsoft® Corporation [Ver = 6.00.3215.0 | Size = 28738 bytes | Modified Date = 8/16/2001 9:41:58 PM | Attr = ]
MMTray -> C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe -> MUSICMATCH, Inc. [Ver = 7.10.0053 | Size = 90112 bytes | Modified Date = 2/27/2002 12:17:08 PM | Attr = ]
NvCplDaemon -> C:\WINDOWS\SYSTEM32\nvcpl.dll [RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup] -> NVIDIA Corporation [Ver = 6.14.10.5216 | Size = 5058560 bytes | Modified Date = 10/6/2003 2:16:00 PM | Attr = ]
QuickTime Task -> C:\Program Files\QuickTime\qttask.exe -> Apple Computer, Inc. [Ver = 7.1.3 | Size = 282624 bytes | Modified Date = 10/25/2006 6:58:18 PM | Attr = ]
SunJavaUpdateSched -> C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe -> Sun Microsystems, Inc. [Ver = 5.0.100.3 | Size = 49263 bytes | Modified Date = 11/9/2006 3:07:30 PM | Attr = ]
TkBellExe -> C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -> RealNetworks, Inc. [Ver = 0.1.0.880 | Size = 146432 bytes | Modified Date = 6/22/2002 7:20:54 AM | Attr = ]
ViewMgr -> C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe -> Viewpoint Corporation [Ver = 2, 0, 0, 42 | Size = 111816 bytes | Modified Date = 11/10/2004 10:15:32 PM | Attr = ]
< RunOnceEx [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
-> -> File not found
< OptionalComponents [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\
IMAIL -> Installed = 1 ->
MAPI -> Installed = 1 ->
MSFS -> Installed = 1 ->
< Run [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Works Update Detection -> C:\Program Files\Microsoft Works\WkDetect.exe -> File not found
MoneyAgent -> C:\Program Files\Microsoft Money\System\Money Express.exe -> File not found
swg -> C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe -> File not found
Yahoo! Pager -> C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe -> Yahoo! Inc. [Ver = 8,1,0,195 | Size = 4662776 bytes | Modified Date = 10/24/2006 4:10:18 PM | Attr = ]
< Common Startup > -> C:\Documents and Settings\All Users\Start Menu\Programs\Startup
-> C:\Documents and Settings\All Users\Start Menu\Programs\Startup\EPSON Status Monitor 3 Environment Check 2.lnk -> File not found
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk -> C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe -> [Ver = 5, 0, 25, 230 | Size = 151552 bytes | Modified Date = 7/22/2005 3:47:22 AM | Attr = ]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\KODAK Software Updater.lnk -> C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe -> [Ver = | Size = 16423 bytes | Modified Date = 2/13/2004 2:12:08 PM | Attr = ]
-> C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk -> File not found
< User Startup > -> C:\Documents and Settings\Patrick Boyle\Start Menu\Programs\Startup
C:\Documents and Settings\Patrick Boyle\Start Menu\Programs\Startup\Morpheus.lnk -> C:\Program Files\Morpheus\Morpheus.exe -> Streamcast Networks, Inc [Ver = 1.0.0.1 | Size = 721408 bytes | Modified Date = 9/12/2006 1:17:26 PM | Attr = ]
< ShellExecuteHooks [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{57B86673-276A-48B2-BAE7-C6DBB3020EB8} [HKLM] -> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll [AVG Anti-Spyware 7.5] -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 47 | Size = 73728 bytes | Modified Date = 9/28/2006 8:13:28 AM | Attr = ]
< SecurityProviders [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders
< Winlogon settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
*VMApplet* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet ->
Control_RunDLL -> -> File not found
< Policy Settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{BDEADF00-C265-11D0-BCED-00A0C90AB50F} -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} -> 1073741857 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{0DF44EAA-FF21-4412-828E-260A8728E7F1} -> 32 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\dontdisplaylastusername -> 0 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\legalnoticecaption -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\legalnoticetext -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\shutdownwithoutlogon -> 1 ->
< Policy Settings [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Associations\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 95 ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools -> 0 ->
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\ -> ->
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\ -> ->
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\\Homepage -> 0 ->
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions\ -> ->
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions\\NoBrowserOptions -> 0 ->
< HOSTS File > -> C:\WINDOWS\System32\drivers\etc\Hosts
< Internet Explorer Settings > ->
HKLM: Default_Page_URL -> http://go.microsoft.com/fwlink/?LinkId=69157 ->
HKLM: Main\\Default_Search_URL -> http://go.microsoft.com/fwlink/?LinkId=54896 ->
HKLM: Local Page -> %SystemRoot%\system32\blank.htm ->
HKLM: Search Page -> http://go.microsoft.com/fwlink/?LinkId=54896 ->
HKLM: Start Page -> http://go.microsoft.com/fwlink/?LinkId=69157 ->
HKLM: CustomizeSearch -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm ->
HKLM: Search\\Default_Search_URL -> http://www.google.com/ie ->
HKLM: SearchAssistant -> http://www.google.com/ie ->
HKCU: Local Page -> C:\WINDOWS\system32\blank.htm ->
HKCU: Search Bar -> http://www.google.com/ie ->
HKCU: Search Page -> http://www.google.com ->
HKCU: Start Page -> http://www.npr.org/ ->
HKCU: SearchAssistant -> http://www.google.com/ie ->
HKCU: ProxyEnable -> 0 ->
< Trusted Sites > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
msn.com [ - ] -> ->
< Trusted Sites > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
aol.com [ - ] -> ->
free_aol.com [ - ] -> ->
free_aol.com [http] -> ->
< BHO's > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [HKLM] -> C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [AcroIEHlprObj Class] -> [Ver = 1, 0, 0, 1 | Size = 37808 bytes | Modified Date = 4/16/2001 3:39:02 PM | Attr = ]
{53707962-6F74-2D53-2644-206D7942484F} [HKLM] -> C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [] -> Safer Networking Limited [Ver = 1, 4, 0, 0 | Size = 853672 bytes | Modified Date = 5/31/2005 1:04:00 AM | Attr = ]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [HKLM] -> C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll [SSVHelper Class] -> Sun Microsystems, Inc. [Ver = 5.0.100.3 | Size = 440056 bytes | Modified Date = 11/9/2006 3:21:52 PM | Attr = ]
{AA58ED58-01DD-4d91-8333-CF10577473F7} [HKLM] -> c:\program files\Google\googletoolbar3.dll [Google Toolbar Helper] -> Google Inc. [Ver = 4, 0, 1020, 3054 | Size = 2120768 bytes | Modified Date = 10/17/2006 2:04:08 PM | Attr = R ]
< Internet Explorer Bars [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\
{32683183-48a0-441b-a342-7c2a440a9478} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found] -> File not found
< Internet Explorer ToolBars [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar
{2318C2B1-4965-11d4-9B18-009027A5CD4F} [HKLM] -> c:\program files\Google\googletoolbar3.dll [&Google] -> Google Inc. [Ver = 4, 0, 1020, 3054 | Size = 2120768 bytes | Modified Date = 10/17/2006 2:04:08 PM | Attr = R ]
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} [HKLM] -> C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll [MSN] -> File not found
< Internet Explorer ToolBars [HKCU] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\
ShellBrowser\\{5CBE2611-C31B-401F-89BC-4CBB25E853D7} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found] -> File not found
WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} [HKLM] -> c:\program files\Google\googletoolbar3.dll [&Google] -> Google Inc. [Ver = 4, 0, 1020, 3054 | Size = 2120768 bytes | Modified Date = 10/17/2006 2:04:08 PM | Attr = R ]
WebBrowser\\{3F3714A9-89A4-46BE-8AF3-D0C9D1FB03F9} [HKLM] -> C:\Program Files\MorpheusBar\bar\2.bin\MORPHBAR.DLL [Morpheus Toolbar] -> File not found
WebBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found] -> File not found
< Internet Explorer CmdMapping [HKCU] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping
{000007C6-17DF-4438-92A4-DE5537471BA3} -> 8195 - Reg Data - Key not found ->
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} -> 8198 - Sun Java Console ->
{6685509E-B47B-4f47-8E16-9A5F3A62F683} -> 8199 - Reg Data - Key not found ->
{AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} -> 8196 - Reg Data - Key not found ->
{AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} -> 8197 - Reg Data - Key not found ->
{E023F504-0C5A-4750-A1E7-A9046DEA8A21} -> 8193 - Reg Data - Key not found ->
{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} -> 8200 - Yahoo! Messenger ->
{FB5F1910-F110-11d2-BB9E-00C04F795683} -> 8194 - Windows Messenger ->
NextId -> 8201 ->
< Internet Explorer Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKLM] -> C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll [MenuText: Sun Java Console] -> Sun Microsystems, Inc. [Ver = 5.0.100.3 | Size = 75528 bytes | Modified Date = 11/9/2006 3:21:54 PM | Attr = ]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKCU] -> C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll [MenuText: Sun Java Console] -> Sun Microsystems, Inc. [Ver = 5.0.100.3 | Size = 440056 bytes | Modified Date = 11/9/2006 3:21:52 PM | Attr = ]
{e2e2dd38-d088-4134-82b7-f2ba38496583} [HKLM] -> Reg Data - Key not found [MenuText: @xpsp3res.dll,-20001] -> File not found
{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} -> C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [ButtonText: Yahoo! Messenger] -> Yahoo! Inc. [Ver = 8,1,0,195 | Size = 4662776 bytes | Modified Date = 10/24/2006 4:10:18 PM | Attr = ]
< Internet Explorer Plugins [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\Extension\
.spop -> C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll [Reg Data - Value does not exist] -> Intertrust Technologies, Inc. [Ver = 1.0.0.32 | Size = 270336 bytes | Modified Date = 8/1/2001 4:05:42 PM | Attr = ]
< Approved Shell Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
{0DF44EAA-FF21-4412-828E-260A8728E7F1} [HKLM] -> Reg Data - Key not found [Taskbar and Start Menu] -> File not found
{1CDB2949-8F65-4355-8456-263E7C208A5D} [HKLM] -> C:\WINDOWS\SYSTEM32\nvshell.dll [Desktop Explorer] -> NVIDIA Corporation [Ver = 6.14.10.5216 | Size = 430152 bytes | Modified Date = 10/6/2003 2:16:00 PM | Attr = ]
{1E2CDF40-419B-11D2-A5A1-002018648BA7} [HKLM] -> Reg Data - Key not found [AVG Shell Extension] -> File not found
{1E9B04FB-F9E5-4718-997B-B8DA88302A47} [HKLM] -> C:\WINDOWS\SYSTEM32\nvshell.dll [Desktop Explorer Menu] -> NVIDIA Corporation [Ver = 6.14.10.5216 | Size = 430152 bytes | Modified Date = 10/6/2003 2:16:00 PM | Attr = ]
{32683183-48a0-441b-a342-7c2a440a9478} [HKLM] -> Reg Data - Key not found [Media Band] -> File not found
{42071714-76d4-11d1-8b24-00a0c9068ff3} [HKLM] -> deskpan.dll [Display Panning CPL Extension] -> File not found
{5E44E225-A408-11CF-B581-008029601108} [HKLM] -> C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\Shellex.dll [Adaptec DirectCD Shell Extension] -> Roxio [Ver = 5.2.0.91 | Size = 180224 bytes | Modified Date = 4/10/2002 3:41:50 PM | Attr = ]
{764BF0E1-F219-11ce-972D-00AA00A14F56} [HKLM] -> Reg Data - Key not found [Shell extensions for file compression] -> File not found
{7A9D77BD-5403-11d2-8785-2E0420524153} [HKLM] -> Reg Data - Key not found [User Accounts] -> File not found
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} [HKLM] -> Reg Data - Key not found [Encryption Context Menu] -> File not found
{88895560-9AA2-1069-930E-00AA0030EBC8} [HKLM] -> C:\WINDOWS\SYSTEM32\HTICONS.DLL [HyperTerminal Icon Ext] -> Hilgraeve, Inc. [Ver = 5.1.2600.0 | Size = 44544 bytes | Modified Date = 8/18/2001 5:00:00 AM | Attr = ]
{8FF88D21-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [WinAce Archiver 2.6b4 (beta test) Context Menu Shell Extension] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
{8FF88D23-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [WinAce Archiver 2.6b4 (beta test) Property Sheet Shell Extension] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
{8FF88D25-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [WinAce Archiver 2.6b4 (beta test) DragDrop Shell Extension] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
{8FF88D27-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [WinAce Archiver 2.6b4 (beta test) Context Menu Shell Extension] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} [HKLM] -> C:\Program Files\Grisoft\AVG Free\avgse.dll [AVG7 Shell Extension] -> GRISOFT, s.r.o. [Ver = 7.5.0.409 | Size = 50688 bytes | Modified Date = 12/17/2006 8:37:44 AM | Attr = ]
{9F97547E-460A-42C5-AE0C-81C61FFAEBC3} [HKLM] -> C:\Program Files\Grisoft\AVG Free\avgse.dll [AVG7 Find Extension] -> GRISOFT, s.r.o. [Ver = 7.5.0.409 | Size = 50688 bytes | Modified Date = 12/17/2006 8:37:44 AM | Attr = ]
{acb4a560-3606-11d3-aef4-00104bd0f92d} [HKLM] -> C:\Program Files\Common Files\Kodak\ifscore\KodakShX.dll [KodakShellExtension] -> Eastman Kodak Company [Ver = 2.0.2300.3 | Size = 183296 bytes | Modified Date = 3/31/2005 7:53:42 AM | Attr = ]
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} [HKLM] -> C:\Program Files\iTunes\iTunesMiniPlayer.dll [iTunes] -> Apple Computer, Inc. [Ver = 7.0.2.16 | Size = 132672 bytes | Modified Date = 10/30/2006 9:36:36 AM | Attr = ]
{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} [HKLM] -> C:\Program Files\Real\RealOne Player\rpplugins\ierpplug.dll [Shell Extensions for RealOne Player] -> RealNetworks [Ver = 1.0.0.301 | Size = 180736 bytes | Modified Date = 6/22/2002 7:20:56 AM | Attr = ]
< ContextMenuHandlers - * [HKLM] > -> HKEY_LOCAL_MACHINE\Software\Classes\*\shellex\ContextMenuHandlers\
{8934FCEF-F5B8-468f-951F-78A921CD3920} [HKLM] -> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll [AVG Anti-Spyware] -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 49 | Size = 98304 bytes | Modified Date = 10/6/2006 5:40:48 AM | Attr = ]
{1E2CDF40-419B-11D2-A5A1-002018648BA7} [HKLM] -> Reg Data - Key not found [AVG Shell Extension] -> File not found
{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} [HKLM] -> C:\Program Files\Grisoft\AVG Free\avgse.dll [AVG7 Shell Extension] -> GRISOFT, s.r.o. [Ver = 7.5.0.409 | Size = 50688 bytes | Modified Date = 12/17/2006 8:37:44 AM | Attr = ]
{7DBF2913-1F89-4104-B1F4-932A29945C13} [HKLM] -> C:\Program Files\Morpheus\MorphShellExt.dll [MorpheusShellExt] -> TODO: [Ver = 1.0.0.1 | Size = 53248 bytes | Modified Date = 9/11/2006 4:21:40 PM | Attr = ]
{8FF88D27-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [ZFAdd] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
< ContextMenuHandlers - Directory [HKLM] > -> HKEY_LOCAL_MACHINE\Software\Classes\Directory\shellex\ContextMenuHandlers\
{8934FCEF-F5B8-468f-951F-78A921CD3920} [HKLM] -> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll [AVG Anti-Spyware] -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 49 | Size = 98304 bytes | Modified Date = 10/6/2006 5:40:48 AM | Attr = ]
{8FF88D27-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [ZFAdd] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
< ContextMenuHandlers - Folder [HKLM] > -> HKEY_LOCAL_MACHINE\Software\Classes\Folder\shellex\ContextMenuHandlers\
{1E2CDF40-419B-11D2-A5A1-002018648BA7} [HKLM] -> Reg Data - Key not found [AVG Shell Extension] -> File not found
{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} [HKLM] -> C:\Program Files\Grisoft\AVG Free\avgse.dll [AVG7 Shell Extension] -> GRISOFT, s.r.o. [Ver = 7.5.0.409 | Size = 50688 bytes | Modified Date = 12/17/2006 8:37:44 AM | Attr = ]
{7DBF2913-1F89-4104-B1F4-932A29945C13} [HKLM] -> C:\Program Files\Morpheus\MorphShellExt.dll [MorpheusShellExt] -> TODO: [Ver = 1.0.0.1 | Size = 53248 bytes | Modified Date = 9/11/2006 4:21:40 PM | Attr = ]
< DNS Name Servers [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\
{F22F6660-02CA-4B75-AAC4-260C7BD2EBEA} -> (GVC-REALTEK Ethernet 10/100 PCI Adapter) ->
< Protocol Handlers [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\
ipp -> Reg Data - Key not found -> File not found
msdaipp -> Reg Data - Key not found -> File not found

[Files - Created Wihin 30 days]
hiberfil.sys -> C:\hiberfil.sys -> [Ver = | Size = 267468800 bytes | Created Date = 1/1/1601 6:00:00 AM | Attr = HS]
QTFont.for -> C:\WINDOWS\QTFont.for -> [Ver = | Size = 1409 bytes | Created Date = 12/17/2006 4:58:08 PM | Attr = ]
QTFont.qfn -> C:\WINDOWS\QTFont.qfn -> [Ver = | Size = 54156 bytes | Created Date = 12/17/2006 4:58:08 PM | Attr = H ]
d3d8caps.dat -> C:\WINDOWS\System32\d3d8caps.dat -> [Ver = | Size = 552 bytes | Created Date = 12/20/2006 10:07:09 AM | Attr = ]
DLCQinst.dll -> C:\WINDOWS\System32\DLCQinst.dll -> [Ver = | Size = 274432 bytes | Created Date = 12/4/2006 10:20:18 PM | Attr = ]
DLPMONUI.DLL -> C:\WINDOWS\System32\DLPMONUI.DLL -> [Ver = 0.1.35.8 | Size = 32768 bytes | Created Date = 12/4/2006 10:21:54 PM | Attr = ]
DLPRMON.DLL -> C:\WINDOWS\System32\DLPRMON.DLL -> [Ver = 0.1.35.8 | Size = 40960 bytes | Created Date = 12/4/2006 10:21:54 PM | Attr = ]
IM31IMG.DIL -> C:\WINDOWS\System32\IM31IMG.DIL -> Data Techniques, Inc. [Ver = 7.20 | Size = 49152 bytes | Created Date = 12/4/2006 10:21:34 PM | Attr = ]
IM31XPNG.DEL -> C:\WINDOWS\System32\IM31XPNG.DEL -> Data Techniques, Inc. [Ver = 7.20 | Size = 98304 bytes | Created Date = 12/4/2006 10:21:34 PM | Attr = ]
IM31XTIF.DEL -> C:\WINDOWS\System32\IM31XTIF.DEL -> Data Techniques, Inc. [Ver = 7.20 | Size = 69632 bytes | Created Date = 12/4/2006 10:21:34 PM | Attr = ]
IMGMAN32.DLL -> C:\WINDOWS\System32\IMGMAN32.DLL -> Data Techniques, Inc. [Ver = 7.20 | Size = 339968 bytes | Created Date = 12/4/2006 10:21:34 PM | Attr = ]
IMHOST32.DLL -> C:\WINDOWS\System32\IMHOST32.DLL -> Data Techniques, Inc. [Ver = 7.20 | Size = 98345 bytes | Created Date = 12/4/2006 10:21:34 PM | Attr = ]
java.exe -> C:\WINDOWS\System32\java.exe -> Sun Microsystems, Inc. [Ver = 5.0.100.3 | Size = 49248 bytes | Created Date = 12/25/2006 9:56:34 AM | Attr = ]
javaw.exe -> C:\WINDOWS\System32\javaw.exe -> Sun Microsystems, Inc. [Ver = 5.0.100.3 | Size = 53346 bytes | Created Date = 12/25/2006 9:56:34 AM | Attr = ]
javaws.exe -> C:\WINDOWS\System32\javaws.exe -> Sun Microsystems, Inc. [Ver = 5.0.100.3 | Size = 127078 bytes | Created Date = 12/25/2006 9:56:34 AM | Attr = ]
KGyGaAvL.sys -> C:\WINDOWS\System32\KGyGaAvL.sys -> [Ver = | Size = 3350 bytes | Created Date = 12/5/2006 1:37:28 PM | Attr = HS]
LexFiles.ulf -> C:\WINDOWS\System32\LexFiles.ulf -> [Ver = | Size = 26211 bytes | Created Date = 12/4/2006 10:19:02 PM | Attr = ]
AvgAsCln.sys -> C:\WINDOWS\System32\drivers\AvgAsCln.sys -> GRISOFT, s.r.o. [Ver = 1.0.0.14 | Size = 3968 bytes | Created Date = 12/18/2006 7:10:04 PM | Attr = ]
avgclean.sys -> C:\WINDOWS\System32\drivers\avgclean.sys -> GRISOFT, s.r.o. [Ver = 1.0.0.14 | Size = 3968 bytes | Created Date = 12/17/2006 8:37:49 AM | Attr = ]
avgmfx86.sys -> C:\WINDOWS\System32\drivers\avgmfx86.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.416 | Size = 18240 bytes | Created Date = 12/17/2006 8:37:48 AM | Attr = ]

[Files - Modified Wihin 30 days]
hiberfil.sys -> C:\hiberfil.sys -> [Ver = | Size = 267468800 bytes | Modified Date = 12/25/2006 10:28:12 PM | Attr = HS]
BOOTSTAT.DAT -> C:\WINDOWS\BOOTSTAT.DAT -> [Ver = | Size = 2048 bytes | Modified Date = 12/25/2006 10:28:16 PM | Attr = S]
imsins.BAK -> C:\WINDOWS\imsins.BAK -> [Ver = | Size = 1393 bytes | Modified Date = 12/25/2006 8:03:50 AM | Attr = ]
mozver.dat -> C:\WINDOWS\mozver.dat -> [Ver = | Size = 8622 bytes | Modified Date = 11/29/2006 7:11:34 PM | Attr = ]
QTFont.for -> C:\WINDOWS\QTFont.for -> [Ver = | Size = 1409 bytes | Modified Date = 12/17/2006 4:58:10 PM | Attr = ]
QTFont.qfn -> C:\WINDOWS\QTFont.qfn -> [Ver = | Size = 54156 bytes | Modified Date = 12/27/2006 9:38:36 PM | Attr = H ]
SIERRA.INI -> C:\WINDOWS\SIERRA.INI -> [Ver = | Size = 608 bytes | Modified Date = 12/28/2006 9:48:38 AM | Attr = ]
UninstallFirefox.exe -> C:\WINDOWS\UninstallFirefox.exe -> [Ver = | Size = 99965 bytes | Modified Date = 11/29/2006 7:11:42 PM | Attr = ]
d3d8caps.dat -> C:\WINDOWS\System32\d3d8caps.dat -> [Ver = | Size = 552 bytes | Modified Date = 12/20/2006 10:07:10 AM | Attr = ]
KGyGaAvL.sys -> C:\WINDOWS\System32\KGyGaAvL.sys -> [Ver = | Size = 3350 bytes | Modified Date = 12/22/2006 11:49:54 AM | Attr = HS]
LexFiles.ulf -> C:\WINDOWS\System32\LexFiles.ulf -> [Ver = | Size = 26211 bytes | Modified Date = 12/4/2006 10:32:50 PM | Attr = ]
WPA.DBL -> C:\WINDOWS\System32\WPA.DBL -> [Ver = | Size = 1170 bytes | Modified Date = 12/26/2006 10:44:10 PM | Attr = ]
avg7core.sys -> C:\WINDOWS\System32\drivers\avg7core.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.429 | Size = 816672 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
avg7rsw.sys -> C:\WINDOWS\System32\drivers\avg7rsw.sys -> GRISOFT, s.r.o. [Ver = 7,0,0,340 | Size = 4224 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
avg7rsxp.sys -> C:\WINDOWS\System32\drivers\avg7rsxp.sys -> GRISOFT, s.r.o. [Ver = 7,1,0,398 | Size = 28416 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
avgclean.sys -> C:\WINDOWS\System32\drivers\avgclean.sys -> GRISOFT, s.r.o. [Ver = 1.0.0.14 | Size = 3968 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
avgmfx86.sys -> C:\WINDOWS\System32\drivers\avgmfx86.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.416 | Size = 18240 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
avgtdi.sys -> C:\WINDOWS\System32\drivers\avgtdi.sys -> GRISOFT, s.r.o. [Ver = 7,0,0,346 | Size = 4960 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]

[File String Scan - Non-Microsoft Only]
UPX0 , -> C:\ar505enu.exe -> InstallShield Software Corporation [Ver = 2.02.001 | Size = 8981440 bytes | Modified Date = 7/9/2002 6:18:42 PM | Attr = ]
UPX0 , -> C:\avg6386fu_free.exe -> [Ver = | Size = 5433344 bytes | Modified Date = 9/17/2002 9:28:30 PM | Attr = ]
Thawte Consulting , -> C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\core3.zip -> [Ver = | Size = 3290841 bytes | Modified Date = 12/6/2004 10:57:36 PM | Attr = ]
USERTRUST , -> C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\patch-jre1.5.0_09.b03\patchjre.exe -> Sun Microsystems, Inc. [Ver = 1, 0, 0, 1 | Size = 4490872 bytes | Modified Date = 10/12/2006 3:41:58 AM | Attr = ]
USERTRUST , -> C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\patch-jre1.5.0_10.b03\patchjre.exe -> Sun Microsystems, Inc. [Ver = 1, 0, 0, 1 | Size = 4650616 bytes | Modified Date = 11/9/2006 3:38:38 PM | Attr = ]
FSG! , -> C:\Program Files\Common Files\Microsoft Shared\Shoebox\STANDARD.SBT -> [Ver = | Size = 19954310 bytes | Modified Date = 6/21/2000 3:59:14 AM | Attr = ]
PEC2 , -> C:\Program Files\Common Files\Sony Shared\AVLib\Metallic.dll -> Sony Corporation [Ver = 2.7.00.14160 | Size = 229376 bytes | Modified Date = 2/17/2004 8:16:12 AM | Attr = ]
UPX! , UPX0 , -> C:\WINDOWS\Zambelli Fireworks Screensaver.scr -> [Ver = | Size = 671744 bytes | Modified Date = 9/27/2001 2:04:28 PM | Attr = ]
PEC2 , -> C:\WINDOWS\System32\DFRG.MSC -> [Ver = | Size = 41397 bytes | Modified Date = 8/18/2001 5:00:00 AM | Attr = ]
winsync , -> C:\WINDOWS\System32\WBDBASE.DEU -> [Ver = | Size = 1309184 bytes | Modified Date = 8/18/2001 5:00:00 AM | Attr = ]
Thawte Consulting , -> C:\WINDOWS\System32\XceedFtp.dll -> Xceed Software Inc [removed] [removed] www.xceedsoft.com [Ver = 1.1.129.0 | Size = 279392 bytes | Modified Date = 8/31/2005 10:35:40 AM | Attr = ]
UPX! , FSG! , PEC2 , aspack , -> C:\WINDOWS\System32\drivers\avg7core.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.429 | Size = 816672 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
PTech , -> C:\WINDOWS\System32\drivers\mtlstrm.sys -> Smart Link [Ver = 3.80.01MC15 | Size = 1309184 bytes | Modified Date = 8/3/2004 11:41:38 PM | Attr = ]

< End of report >

[Registry - Non-Microsoft Only]
Unable to delete registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BA849497-5825-54F6-74F6-70450779229C} .
File C:\WINDOWS\system32\bbtqp.dll not found!
< End of log >
Created on 12/28/2006 17:43:55

OldTimer

Post #28December 29, 2006, 5:22 AM UTC

Hi PatRick B. Everything looks fine now. How are things running? Any more problems? Cheers. OT

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

logfile

✨ Ask AI

Ask AI