Spyware / Malware / Virus Removal

Internet Surfing Slow-Help

10 min read

Looking for the outcome? Ask AI

jayberns Topic Starter

Post #1February 11, 2007, 4:39 PM UTC

Please review my HJT file and see what can be done.
OS=Windows XP Home

Logfile of HijackThis v1.99.1
Scan saved at 11:30:10 AM, on 2/11/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\PROGRA~1\SYMNET~1\SNDMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\Personal Printing Solutions Product Research\HP Product Research.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Common Files\AOL\1124555650\ee\aolsoftware.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Canon\BJCard\Bjmcmng.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\iPod\bin\iPodService.exe
c:\program files\common files\aol\1124555650\ee\aexplore.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Jaime Bernstein\Local Settings\Temp\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.averatec.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.averatec.com/
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O2 - BHO: BhoApp Class - {0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} - C:\Program Files\WinBudget\bin\matrix.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1124555650\ee\AOLHostManager.exe
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Metrics] C:\Program Files\HP\Personal Printing Solutions Product Research\HP Product Research.exe a
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 3.0\resources\en-US\local\search.html
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…?p=ZCxdm737YYUS
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.averatec.com
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f…tup1.0.0.15.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-24.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/200312…meInstaller.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1164064991169
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/1450/ftp…02/cpbrkpie.cab
O16 - DPF: {9E17A5F9-2B9C-4C66-A592-199A4BA1FBC8} (AIM UPF Control) - http://pictures04.aim.com/ygp/aol/plugin/u…AIM.9.5.1.8.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/…tiveXPlugin.cab
O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FD} (Photo Upload Plugin Class) - http://cvs.pnimedia.com/upload/activex/v2_…tupv2.0.0.9.cab?
O20 - AppInit_DLLs:
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Canon BJ Memory Card Manager (Bjmcmng) - CANON INC. - C:\Program Files\Canon\BJCard\Bjmcmng.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

beynac

Post #2February 12, 2007, 9:13 AM UTC

Hi jayberns.

Please download FindAWF from: http://noahdfear.geekstogo.com/FindAWF.exe and save it on your desktop. Double-click on the file to run it. It will produce a report (awf.txt). Please post that report as a reply to this thread.

Note: If a DOS window does not stay open throughout the search (approx a minute), you need to change how the program runs:

Locate the file
Right-click and select Properties
Select Compatibility and select Run this program in compatibility mode for: Windows 98/Windows ME and click OK.
The tool should now work.

Let me know if you have any problems.

beynac

Post #3February 14, 2007, 11:32 AM UTC

Hi jayberns. Are you having trouble running FindAWF? If so, please let me know. It's important we move quickly on this one!

jayberns

Post #4February 14, 2007, 3:56 PM UTC

Hi jayberns.

Are you having trouble running FindAWF? If so, please let me know. It's important we move quickly on this one!

jayberns

Post #5February 14, 2007, 4:00 PM UTC

Sorry I didn't get back to you yesterday…this is the awf search result Find AWF report by noahdfear ©2006 21504 byte files found ~~~~~~~~~~~~~ 21504 byte files sorted with strings ~~~~~~~~~~~~~~~~~~~~~ 25600 byte files found ~~~~~~~~~~~~~ 25600 byte files sorted with strings ~~~~~~~~~~~~~~~~~~~~~ 26450 byte files found ~~~~~~~~~~~~~ 26450 byte files sorted with strings ~~~~~~~~~~~~~~~~~~~~~ bak folders found ~~~~~~~~~~~ Directory of C:\PROGRA~1\AIM\BAK 08/05/2005 02:08 PM 67,160 aim.exe 1 File(s) 67,160 bytes Directory of C:\PROGRA~1\QUICKT~1\BAK 12/11/2005 08:34 PM 155,648 qttask.exe 1 File(s) 155,648 bytes Directory of C:\PROGRA~1\SYMNET~1\BAK 08/15/2006 10:01 PM 95,960 SNDMon.exe 1 File(s) 95,960 bytes Directory of C:\PROGRA~1\REAL\REALPL~1\BAK 06/15/2004 01:52 PM 26,112 RealPlay.exe 1 File(s) 26,112 bytes Directory of C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\BAK 09/08/2006 08:47 PM 28,672 mwsoemon.exe 1 File(s) 28,672 bytes Directory of C:\PROGRA~1\COMMON~1\AOL\112455~1\EE\BAK 11/02/2005 10:01 PM 13,416 AOLHostManager.exe 1 File(s) 13,416 bytes Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ 4206824 Jun 15 2004 "C:\AOL Instant Messenger\AIM.exe" 67112 Aug 1 2006 "C:\Program Files\AIM\aim.exe" 67160 Aug 5 2005 "C:\Program Files\AIM\bak\aim.exe" 282624 Sep 24 2006 "C:\Program Files\QuickTime\qttask.exe" 155648 Dec 11 2005 "C:\Program Files\QuickTime\bak\qttask.exe" 25600 Oct 11 2006 "C:\Program Files\SymNetDrv\SNDMon.exe" 95960 Aug 15 2006 "C:\Program Files\SymNetDrv\bak\SNDMon.exe" 25600 Oct 11 2006 "C:\Program Files\Real\RealPlayer\RealPlay.exe" 26112 Jun 15 2004 "C:\Program Files\Real\RealPlayer\bak\RealPlay.exe" 25600 Oct 11 2006 "C:\Program Files\MyWebSearch\bar\1.bin\mwsoemon.exe" 28672 Sep 8 2006 "C:\Program Files\MyWebSearch\bar\1.bin\bak\mwsoemon.exe" 25600 Oct 11 2006 "C:\Program Files\Common Files\AOL\1124555650\ee\AOLHostManager.exe" 13416 Nov 2 2005 "C:\Program Files\Common Files\AOL\1124555650\ee\bak\AOLHostManager.exe" end of report

beynac

Post #6February 14, 2007, 5:48 PM UTC

Hi jayberns.

You have got a rather nasty infection. I'm afraid that there's quite a lot to do in this post. Take it one step at a time and do everything in the order given. If you have any questions or problems, stop and ask me.

———————————————————

Move HijackThis

You are running HijackThis from your temporary folder (C:\Documents and Settings\Jaime Bernstein\Local Settings\Temp\). We need to move this into its own folder so that its backup files are kept safe.

Click on 'Start', then 'My Computer'
Double click on your Local Disk (usually C:\).
Double click to open the 'Program Files' folder.
Right click on the right hand panel and select 'New' then 'Folder'.
Rename the new folder 'HijackThis'.
Locate the program file 'HijackThis.exe' and right-click on it and select 'Cut'.
Open the new 'C:\Program Files\HijackThis' folder and paste the program into it.

Always run HijackThis from this new location (create a shortcut on your desktop).

———————————————————

Uninstall Programs

Please go to Start -> Control Panel -> Add or Remove Programs and uninstall the following programs, if they are present. Don't worry if they're not there, but please let me know in your next post.

MyWebSearch
WinBudget

—————————————————–

Download Programs

#1: Download ATF Cleaner by Atribune © from here : http://www.atribune.org/ccount/click.php?id=1
This is a stand-alone program that does not need to be installed. Save it to a convenient location and make a shortcut on your desktop.

#2: Download the trial version of AVG Anti-Spyware from here and install it. When the program has been installed, and you click the Finish button, AVG Anti-Spyware will open. Do not run a scan yet.

If the program does not automatically update itself during installation, or you are unsure whether it has done so, please do the following:

Click the Update icon at the top and under Manual Update click the Start update button.
The program will either update or inform you that no update was available.

You will need to change the following settings:

Click the Shield icon at the top and under Resident shield is… click active. This should now change to inactive.
Click the Update icon and untick the automatic update option.
Click the Scanner icon at the top and then click the Settings Tab.
Under How to act? click Recommended actions and select Quarantine from the menu.

You can now close AVG Anti-Spyware. Do not scan yet.

#3: Download these files to your Desktop. Right-click and select Save Link As (in Firefox) or Save Target As (in IE) to download them.

http://www.mvps.org/winhelp2002/DelDomains.inf
http://www.mvps.org/winhelp2002/ResetProtocolDefaults.reg

Don't do anything with them yet.

——————————————————-

Prepare Batch File

Select the contents of the Code Box below, right-click and copy it, then paste into Notepad.

@echo off
if exist "C:\Program Files\SymNetDrv\SNDMon.exe" del /q "C:\Program Files\SymNetDrv\SNDMon.exe"
copy /y "C:\Program Files\SymNetDrv\bak\SNDMon.exe" "C:\Program Files\SymNetDrv\SNDMon.exe"
if exist "C:\Program Files\Real\RealPlayer\RealPlay.exe" del /q "C:\Program Files\Real\RealPlayer\RealPlay.exe"
copy /y "C:\Program Files\Real\RealPlayer\bak\RealPlay.exe" "C:\Program Files\Real\RealPlayer\RealPlay.exe"
if exist "C:\Program Files\Common Files\AOL\1124555650\ee\AOLHostManager.exe" del /q "C:\Program Files\Common Files\AOL\1124555650\ee\AOLHostManager.exe"
copy /y "C:\Program Files\Common Files\AOL\1124555650\ee\bak\AOLHostManager.exe" "C:\Program Files\Common Files\AOL\1124555650\ee\AOLHostManager.exe"
if exist "C:\Program Files\MyWebSearch\bar\1.bin\mwsoemon.exe" del /q "C:\Program Files\MyWebSearch\bar\1.bin\mwsoemon.exe"
del beynac.bat

Still in Notepad, go to Format (upper menu bar) and untick Word Wrap
Go to File (upper menu bar), and select: Save as
In the Save as prompt:
- Save in: Desktop
- File Name: beynac.bat
- Save as Type: All files
Click: Save
Exit out of Notepad.

Again, don't do anything with this yet.

——————————————————

HijackThis Fix

Run HijackThis and click Scan and then check (tick) the following, if present (don't worry if any are missing):

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O2 - BHO: BhoApp Class - {0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} - C:\Program Files\WinBudget\bin\matrix.dll
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…?p=ZCxdm737YYUS
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f…tup1.0.0.15.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/200312…meInstaller.exe
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/1450/ftp…02/cpbrkpie.cab
O20 - AppInit_DLLs:

Close down all programs, browsers and other open windows. Make sure that only the above items are checked and then click on Fix checked.

——————————————————-

Show Hidden Files and Folders

HijackThis may not remove all of the files relating to the fixed items. We therefore need to check this and delete them if necessary. First we need to make sure that you can see all of the files.

Click Start
Open My Computer
Select the Tools menu and click Folder Options
Select the View tab
Advanced Settings: Under Hidden files and folders, select Show hidden files and folders
Uncheck the Hide protected operating system files (Recommended) option
Click Yes to confirm
Click OK

————————————————–

Reboot into Safe Mode

Important: If you have an 'always on' connection to the internet, physically disconnect that connection until you are finished with Safe Mode and have rebooted back into normal mode. I suggest that you print out these instructions.

Boot to Safe Mode. To do this:

Restart your computer.
Continually tap the F8 button as your computer is booting a menu appears.
Use up-arrow key to select Safe Mode and press Enter.

————————————————–

Run Batch File etc.

Make sure that all windows are closed. On the Desktop:

Double-click on beynac.bat.
Right-click on DelDomains.inf, and choose Install. (You may not see any noticeable changes or prompts; this is normal).
Right-click on ResetProtocolDefaults.reg and select Merge. Click OK at the prompt.

—————————————————

Delete Folders

Click on Start then My Computer, find the following folders (highlighted in red) and delete them, if present. Don't worry if they're not there, but let me know in your next post.

C:\Program Files\MyWebSearch\
C:\Program Files\WinBudget\

——————————————————

Run ATF Cleaner

Make sure that all browser windows are closed

Double-click the shortcut on your desktop to run the program.
Under Main, choose Select All
Untick Prefetch
Click Empty Selected
If you use Firefox browser,
- Click Firefox at the top and choose Select All
- Click on Empty Selected
- NOTE: If you would like to keep any saved passwords, please untick that option.
Click Exit to close.
If you use Opera browser,
- Click Opera at the top and choose Select All
- Click on Empty Selected
- NOTE: If you would like to keep any saved passwords, please untick that option.
Click Exit to close.

————————————————-

Run AVG Anti-Spyware

Close all open windows and then start AVG Anti-Spyware, which you downloaded earlier

Click on Scanner on the toolbar.
Click on the Settings tab.
- Under How to act? - make sure that Quarantine is selected.
- Under How to scan? - All checkboxes should be ticked.
- Under Possibly unwanted software - All checkboxes should be ticked.
- Under Reports - Select Automatically generate report after every scan and uncheck Only if threats were found.
- Under What to scan? - Select Scan every file.
Click on the Scan tab.
Click on Complete System Scan to start the scan process.
Let the program scan your computer.
When the scan has finished, follow the instructions below:
- Make sure that Set all elements to: shows Quarantine
- Important: Click on the Apply all Actions button (*** This must done before saving the report ***)
- When the program has finished, it will display the message All actions have been applied.
- Then click the Save Scan Report button.
- Click the Save Report as button.
- Save the report to your Desktop.
Right-click the AVG Tray Icon and select Exit.

Reboot in Normal Mode.

————————————————————-

Please post, as a reply to this thread:

The AVG Anti-Spyware report
A new HijackThis log

jayberns

Post #7February 15, 2007, 1:29 AM UTC

Thanks for your help

Could you also help me with another computer? I have posted another thread under the same user name.

Thanks

HJT Log

Logfile of HijackThis v1.99.1
Scan saved at 8:05:52 PM, on 2/14/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.averatec.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.averatec.com/
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 3.0\resources\en-US\local\search.html
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.averatec.com
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-24.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1164064991169
O16 - DPF: {9E17A5F9-2B9C-4C66-A592-199A4BA1FBC8} (AIM UPF Control) - http://pictures04.aim.com/ygp/aol/plugin/u…AIM.9.5.1.8.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/…tiveXPlugin.cab
O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FD} (Photo Upload Plugin Class) - http://cvs.pnimedia.com/upload/activex/v2_…tupv2.0.0.9.cab?
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Canon BJ Memory Card Manager (Bjmcmng) - CANON INC. - C:\Program Files\Canon\BJCard\Bjmcmng.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

Here is the AVG Report

———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 8:02:04 PM 2/14/2007

+ Scan result:

C:\Program Files\hijackthis\backups\backup-20070214-161003-569.dll -> Adware.BHO : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00422560.dll -> Adware.BHO : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{D62CA84F-F786-4600-AE5E-DE1A847A28BF}\RP744\A0086375.old -> Adware.BHO : Cleaned with backup (quarantined).
C:\Program Files\hijackthis\backups\backup-20070214-161004-574.dll -> Adware.Coupons : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00422564.ocx -> Adware.Coupons : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{D62CA84F-F786-4600-AE5E-DE1A847A28BF}\RP699\A0070737.exe/SaveUninst.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{D62CA84F-F786-4600-AE5E-DE1A847A28BF}\RP699\A0070737.exe/ffext.mod/{BEE3E87E-E1C6-4bfe-BE9D-48E84271AB34}\components\whenu_ff.dll -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{D62CA84F-F786-4600-AE5E-DE1A847A28BF}\RP699\A0070738.EXE/Uninst.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{D62CA84F-F786-4600-AE5E-DE1A847A28BF}\RP699\A0070738.EXE/search.dl~ -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{D62CA84F-F786-4600-AE5E-DE1A847A28BF}\RP699\A0070738.EXE/whse.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{D62CA84F-F786-4600-AE5E-DE1A847A28BF}\RP699\A0070745.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{D62CA84F-F786-4600-AE5E-DE1A847A28BF}\RP699\A0070746.dll -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{D62CA84F-F786-4600-AE5E-DE1A847A28BF}\RP699\A0070748.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{D62CA84F-F786-4600-AE5E-DE1A847A28BF}\RP699\A0070750.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{D62CA84F-F786-4600-AE5E-DE1A847A28BF}\RP699\A0070759.EXE -> Adware.SaveNow : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\WUSN.1 -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{D62CA84F-F786-4600-AE5E-DE1A847A28BF}\RP722\A0075703.dll -> Adware.SpyMarshal : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{D62CA84F-F786-4600-AE5E-DE1A847A28BF}\RP722\A0075704.dll -> Adware.SpyMarshal : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{D62CA84F-F786-4600-AE5E-DE1A847A28BF}\RP722\A0075705.dll -> Adware.SpyMarshal : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{D62CA84F-F786-4600-AE5E-DE1A847A28BF}\RP722\A0075706.dll -> Adware.SpyMarshal : Cleaned with backup (quarantined).
C:\Program Files\SpySheriff -> Adware.SpySheriff : Cleaned with backup (quarantined).
C:\Program Files\SpySheriff\Uninstall.exe -> Adware.SpySheriff : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{D62CA84F-F786-4600-AE5E-DE1A847A28BF}\RP722\A0075707.EXE -> Adware.SpySheriff : Cleaned with backup (quarantined).
C:\Documents and Settings\Jaime Bernstein\My Documents\Jaime\My_Christmas_Card.SCR -> Backdoor.SdBot.aad : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{D62CA84F-F786-4600-AE5E-DE1A847A28BF}\RP687\A0062692.exe -> Backdoor.SdBot.aad : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{D62CA84F-F786-4600-AE5E-DE1A847A28BF}\RP687\A0062693.exe -> Backdoor.SdBot.aad : Cleaned with backup (quarantined).
C:\rp.exe -> Backdoor.SdBot.aad : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00422453.exe -> Downloader.Agent.awf : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{D62CA84F-F786-4600-AE5E-DE1A847A28BF}\RP744\A0086350.exe -> Downloader.Agent.awf : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{D62CA84F-F786-4600-AE5E-DE1A847A28BF}\RP744\A0086351.exe -> Downloader.Agent.awf : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{D62CA84F-F786-4600-AE5E-DE1A847A28BF}\RP744\A0086352.exe -> Downloader.Agent.awf : Cleaned with backup (quarantined).
C:\Documents and Settings\Jaime Bernstein\Local Settings\Temp\Temporary Internet Files\Content.IE5\I58B2L4D\checkin[1].htm -> Downloader.Small.co : Cleaned with backup (quarantined).
C:\temp.exe -> Hijacker.VB.kd : Cleaned with backup (quarantined).
C:\WINDOWS\system32\msctupd.exe -> Proxy.Daemonize.bx : Cleaned with backup (quarantined).
C:\winridr.exe -> Proxy.Daemonize.bx : Cleaned with backup (quarantined).

::Report end

beynac

Post #8February 15, 2007, 9:25 AM UTC last edited February 15, 2007, 3:07 PM UTC

Hi jayberns.

I've replied to your other thread, as requested.

There are some worrying omissions on the HijackThis log. Did you run this while in Safe Mode? The AVG Anti-Spyware report shows that you had some other nasty infections which didn't appear in the HijackThis log. I need to get some more information before going any further. I suggest that, in the meantime, you use this computer as little as possible and only connect to the internet for monitoring this thread and running our fixes.

————————————————————

Download WinPFind2.exe to your Desktop and double-click on it to extract the files. It will create a folder named WinPFind2 on your desktop.

Open the WinPFind2 folder and double-click on winpfind2.exe to start the program.
Keep the standard settings.
In the AddOn Options group (on the right-hand side) click the checkboxes for:
- awf.def
- HKCU_IEDesktop.def
- Jobs.def
- Policies.def
- SID_Run_Policies.def
Now click the Run All Scans button on the toolbar.
When the scans are complete click the Simple Report button in the lower right-hand corner to create a report file. Notepad will open with the report file loaded in it.
Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

Copy the report and paste it as a reply to this thread.

————————————————————

F-Secure's BlackLight

Create a new folder, named Blacklight, in the root of your main drive (usually Local Disk (C:)
Download F-Secure's BlackLight from here and save it into this folder.
Log off from the internet and disconnect your modem cable.
Go to Start= >Run, copy and paste the following into the text box and hit OK: "C:\Blacklight\blbeta.exe" /expert
The F-Secure Blacklight Beta window should open.
- Accept the agreement and click OK.
- Click the Scan button to begin.
- Important: Leave the PC idle while the scan takes place.
- When it has completed, click the Close button.
A text file, fsbl-date/time, will be saved in the Blacklight folder, copy and paste this into your next post.

——————————————————

Please post, as a reply to this thread (you may need to do separate posts to avoid the reports being cut off):

The WinPFind2 report
The Blacklight report (C:\Blacklight\]fsbl-date/time)
A new HijackThis log (run in normal startup mode)

Edit: Have you got any new files on your desktop that are not part of what we've done so far? This is a bit of a longshot but, when I had a similar situation, there was a file created with some registry entries. This could have an extension of .txt or .reg.

jayberns

Post #9February 17, 2007, 11:07 PM UTC

Sorry it has taken some time to get back to you. Thanks for your help.

WinPFind2

Logfile created on: 2/17/2007 5:35:28 PM
WinPFind2 by OldTimer - Version 1.0.15 Folder = C:\Documents and Settings\Jaime Bernstein\Desktop\winpfind2\WinPFind2\
Microsoft Windows XP Service Pack 1 (Version = 5.1.2600)
Internet Explorer (Version = 6.0.2800.1106)

< Processes (Non-Microsoft Only) >
c:\progra~1\common~1\aol\acs\acsd.exe - (America Online, Inc. )
c:\program files\common files\aol\1124555650\ee\aexplore.exe - (America Online, Inc. )
c:\program files\common files\aol\1124555650\ee\aolsoftware.exe - (America Online, Inc. )
c:\program files\grisoft\avg anti-spyware 7.5\avgas.exe - (Anti-Malware Development a.s. )
c:\windows\system32\bcmwltry.exe - (Broadcom Corporation )
c:\program files\canon\bjcard\bjmcmng.exe - (CANON INC. )
c:\program files\common files\symantec shared\ccevtmgr.exe - (Symantec Corporation )
c:\program files\grisoft\avg anti-spyware 7.5\guard.exe - (Anti-Malware Development a.s. )
c:\program files\ipod\bin\ipodservice.exe - (Apple Computer, Inc. )
c:\program files\itunes\ituneshelper.exe - (Apple Computer, Inc. )
c:\program files\norton antivirus\navapsvc.exe - (Symantec Corporation )
c:\program files\norton antivirus\advtools\nprotect.exe - (Symantec Corporation )
c:\program files\quicktime\qttask.exe - (Apple Computer, Inc. )
c:\windows\system32\slserv.exe - ( )
c:\windows\wanmpsvc.exe - (America Online, Inc. )
c:\documents and settings\jaime bernstein\desktop\winpfind2\winpfind2\winpfind2.exe - (OldTimer Tools )
c:\windows\system32\wltrysvc.exe - ( )

< Registry Entries >

[>> Internet Explorer Settings <<]
HKLM->Main\\Start Page - http://www.microsoft.com/isapi/redir.dll?p…ER}&ar=home
HKLM->Main\\Search Page - http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
HKLM->Main\\Default_Page_URL - http://www.averatec.com
HKLM->Main\\Default_Search_URL - http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
HKLM->Main\\Local Page - %SystemRoot%\system32\blank.htm
HKCU->Main\\Start Page - http://www.google.com/
HKCU->Main\\Local Page - C:\WINDOWS\System32\blank.htm
HKLM->Search\\CustomizeSearch - http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKLM->Search\\SearchAssistant - http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKCU->URLSearchHooks\\{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - Microsoft Url Search Hook = %SystemRoot%\System32\shdocvw.dll (Microsoft Corporation )
HKCU->URLSearchHooks\\{EA756889-2338-43DB-8F07-D1CA6FB9C90D} - AOLTBSearch Class = C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll (America Online, Inc. )
HKCU->Internet Settings\\ProxyEnable - 0

[>> BHO's <<]
{02478D38-C3F9-4EFB-9B51-7695ECA05670} - Yahoo! Toolbar Helper = C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc. )
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - AcroIEHlprObj Class = C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx ( )
{7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - AOL Toolbar Launcher = C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll (America Online, Inc. )
{AA58ED58-01DD-4d91-8333-CF10577473F7} - Google Toolbar Helper = c:\program files\google\googletoolbar3.dll (Google Inc. )
{BDF3E430-B101-42AD-A544-FADC6B084872} - CNavExtBho Class = C:\Program Files\Norton AntiVirus\NavShExt.dll (Symantec Corporation )

[>> Internet Explorer Bars, Toolbars and Extensions <<]

[HKLM-> Internet Explorer Bars]
{4D5C8C25-D075-11d0-B416-00C04FB90376} - &Tip of the Day = %SystemRoot%\System32\shdocvw.dll (Microsoft Corporation )
{FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - Real.com = C:\WINDOWS\System32\Shdocvw.dll (Microsoft Corporation )

[HKCU-> Internet Explorer Bars]
{30D02401-6A81-11D0-8274-00C04FD5AE38} - Search Band = %SystemRoot%\System32\browseui.dll (Microsoft Corporation )
{32683183-48a0-441b-a342-7c2a440a9478} - Media Band = %SystemRoot%\System32\browseui.dll (Microsoft Corporation )
{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1} - File Search Explorer Band = %SystemRoot%\system32\SHELL32.dll (Microsoft Corporation )
{EFA24E61-B078-11D0-89E4-00C04FC9E26E} - Favorites Band = %SystemRoot%\System32\shdocvw.dll (Microsoft Corporation )
{EFA24E62-B078-11D0-89E4-00C04FC9E26E} - History Band = %SystemRoot%\System32\shdocvw.dll (Microsoft Corporation )
{EFA24E64-B078-11D0-89E4-00C04FC9E26E} - Explorer Band = %SystemRoot%\System32\shdocvw.dll (Microsoft Corporation )
{FE54FA40-D68C-11D2-98FA-00C0F0318AFE} - Real.com = C:\WINDOWS\System32\Shdocvw.dll (Microsoft Corporation )

[HKLM-> Internet Explorer ToolBars]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google = c:\program files\google\googletoolbar3.dll (Google Inc. )
{327C2873-E90D-4c37-AA9D-10AC9BABA46C} - Easy-WebPrint = C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ( )
{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - Norton AntiVirus = C:\Program Files\Norton AntiVirus\NavShExt.dll (Symantec Corporation )
{8E718888-423F-11D2-876E-00A0C9082467} - &Radio = C:\WINDOWS\system32\msdxm.ocx ( )
{DE9C389F-3316-41A7-809B-AA305ED9D922} - AOL Toolbar = C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll (America Online, Inc. )
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar = C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc. )

[HKCU-> Internet Explorer ToolBars]
ShellBrowser\\{01E04581-4EEE-11D0-BFE9-00AA005B4383} - &Address = %SystemRoot%\System32\browseui.dll (Microsoft Corporation )
ShellBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - Norton AntiVirus = C:\Program Files\Norton AntiVirus\NavShExt.dll (Symantec Corporation )
WebBrowser\\{01E04581-4EEE-11D0-BFE9-00AA005B4383} - &Address = %SystemRoot%\System32\browseui.dll (Microsoft Corporation )
WebBrowser\\{0E5CBF21-D15F-11D0-8301-00AA005B4383} - &Links = %SystemRoot%\system32\SHELL32.dll (Microsoft Corporation )
WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} - &Google = c:\program files\google\googletoolbar3.dll (Google Inc. )
WebBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - Norton AntiVirus = C:\Program Files\Norton AntiVirus\NavShExt.dll (Symantec Corporation )
WebBrowser\\{DE9C389F-3316-41A7-809B-AA305ED9D922} - AOL Toolbar = C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll (America Online, Inc. )
WebBrowser\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar = C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc. )

[HKCU-> Internet Explorer CmdMapping]
{3369AF0D-62E9-4bda-8103-B4C75499B578} - 8197 - Reg Data - Value does not exist
{AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - 8195 - Reg Data - Value does not exist
{c95fe080-8f5d-11d2-a20b-00aa003c157a} - 8198 - Reg Data - Key not found
{CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - 8194 - Reg Data - Value does not exist
{FB5F1910-F110-11d2-BB9E-00C04F795683} - 8193 - Messenger
NextId - 8199

[HKLM-> Internet Explorer Extensions]
{3369AF0D-62E9-4bda-8103-B4C75499B578} - ButtonText: AOL Toolbar = Reg Data - Value does not exist (File not found)
{AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - ButtonText: AIM = C:\Program Files\AIM\aim.exe (America Online, Inc. )
{CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - ButtonText: Real.com = Reg Data - Value does not exist (File not found)
{FB5F1910-F110-11d2-BB9E-00C04F795683} - ButtonText: Messenger = C:\Program Files\Messenger\MSMSGS.EXE (Microsoft Corporation )

[HKCU-> Internet Explorer Menu Extensions]
&AOL Toolbar Search - c:\program files\aol\aol toolbar 3.0\resources\en-US\local\search.html (File not found)

[HKLM-> Internet Explorer Plugins]
.spop - Reg Data - Value does not exist = C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll (Intertrust Technologies, Inc. )

[>> Approved Shell Extensions (Non-Microsoft only) <<]

[HKLM-> Approved Shell Extensions]
{0DF44EAA-FF21-4412-828E-260A8728E7F1} - Taskbar and Start Menu = Reg Data - Key not found (File not found)
{32A9D769-5B55-4a25-9A62-86B5683FE50A} - NikonView Drop Extension = C:\Program Files\Nikon\NkView6\NkvDropExt.dll (Nikon Corporation )
{42071714-76d4-11d1-8b24-00a0c9068ff3} - Display Panning CPL Extension = deskpan.dll (File not found)
{764BF0E1-F219-11ce-972D-00AA00A14F56} - Shell extensions for file compression = Reg Data - Key not found (File not found)
{7A9D77BD-5403-11d2-8785-2E0420524153} - User Accounts = Reg Data - Key not found (File not found)
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} - Encryption Context Menu = Reg Data - Key not found (File not found)
{88895560-9AA2-1069-930E-00AA0030EBC8} - HyperTerminal Icon Ext = C:\WINDOWS\System32\hticons.dll (Hilgraeve, Inc. )
{955B7B84-5308-419c-8ED8-0B9CA3C56985} - America Online = C:\PROGRA~1\COMMON~1\aolshare\shell\us\shellext.dll (America Online, Inc. )
{acb4a560-3606-11d3-aef4-00104bd0f92d} - KodakShellExtension = C:\Program Files\Common Files\KODAK\IFSCore\kodakshx.dll (Eastman Kodak Company )
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} - iTunes = C:\Program Files\iTunes\iTunesMiniPlayer.dll (Apple Computer, Inc. )
{E0D79304-84BE-11CE-9641-444553540000} - WinZip = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL (WinZip Computing, Inc. )
{E0D79305-84BE-11CE-9641-444553540000} - WinZip = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL (WinZip Computing, Inc. )
{E0D79306-84BE-11CE-9641-444553540000} - WinZip = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL (WinZip Computing, Inc. )
{E0D79307-84BE-11CE-9641-444553540000} - WinZip = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL (WinZip Computing, Inc. )

[HKCU-> Approved Shell Extensions]
{BDEADF00-C265-11d0-BCED-00A0C90AB50F} - Web Folders = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL ( )

[>> ContextMenuHandlers (Non-Microsoft only) <<]

[HKLM-> ContextMenuHandlers]
* - AVG Anti-Spyware - {8934FCEF-F5B8-468f-951F-78A921CD3920} = C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll (Anti-Malware Development a.s. )
* - Symantec.Norton.Antivirus.IEContextMenu - {5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} = C:\Program Files\Norton AntiVirus\NavShExt.dll (Symantec Corporation )
* - WinZip - {E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL (WinZip Computing, Inc. )
Directory - AVG Anti-Spyware - {8934FCEF-F5B8-468f-951F-78A921CD3920} = C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll (Anti-Malware Development a.s. )
Directory - WinZip - {E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL (WinZip Computing, Inc. )
Folder - Symantec.Norton.Antivirus.IEContextMenu - {5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} = C:\Program Files\Norton AntiVirus\NavShExt.dll (Symantec Corporation )
Folder - WinZip - {E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL (WinZip Computing, Inc. )

[>> ColumnHandlers (Non-Microsoft only) <<]

[HKLM-> ColumnHandlers]
Folder - {F9DB5320-233E-11D1-9F84-707F02C10627} - PDF Shell Extension = C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll (Adobe Systems, Inc. )

[>> File Associations Keys <<]
HKLM->SOFTWARE\Classes\.bat\\'' - batfile
HKLM->SOFTWARE\Classes\batfile\shell\open\command\\'' - "%1" %*
HKLM->SOFTWARE\Classes\.cmd\\'' - cmdfile
HKLM->SOFTWARE\Classes\cmdfile\shell\open\command\\'' - "%1" %*
HKLM->SOFTWARE\Classes\.com\\'' - comfile
HKLM->SOFTWARE\Classes\comfile\shell\open\command\\'' - "%1" %*
HKLM->SOFTWARE\Classes\.exe\\'' - exefile
HKLM->SOFTWARE\Classes\exefile\shell\open\command\\'' - "%1" %*
HKLM->SOFTWARE\Classes\.hta\\'' - htafile
HKLM->SOFTWARE\Classes\htafile\shell\open\command\\'' - C:\WINDOWS\System32\mshta.exe "%1" %*
HKLM->SOFTWARE\Classes\.js\\'' - JSFile
HKLM->SOFTWARE\Classes\jsfile\shell\open\command\\'' - %SystemRoot%\System32\WScript.exe "%1" %*
HKLM->SOFTWARE\Classes\.jse\\'' - JSEFile
HKLM->SOFTWARE\Classes\jsefile\shell\open\command\\'' - %SystemRoot%\System32\WScript.exe "%1" %*
HKLM->SOFTWARE\Classes\.scr\\'' - scrfile
HKLM->SOFTWARE\Classes\scrfile\shell\open\command\\'' - "%1" /S
HKLM->SOFTWARE\Classes\.vbe\\'' - VBEFile
HKLM->SOFTWARE\Classes\vbefile\shell\open\command\\'' - %SystemRoot%\System32\WScript.exe "%1" %*
HKLM->SOFTWARE\Classes\.vbs\\'' - VBSFile
HKLM->SOFTWARE\Classes\vbsfile\shell\open\command\\'' - %SystemRoot%\System32\WScript.exe "%1" %*
HKLM->SOFTWARE\Classes\.wsf\\'' - WSFFile
HKLM->SOFTWARE\Classes\wsffile\shell\open\command\\'' - %SystemRoot%\System32\WScript.exe "%1" %*
HKLM->SOFTWARE\Classes\.wsh\\'' - WSHFile
HKLM->SOFTWARE\Classes\wshfile\shell\open\command\\'' - %SystemRoot%\System32\WScript.exe "%1" %*
HKLM->SOFTWARE\Classes\.txt\\'' - txtfile
HKLM->SOFTWARE\Classes\txtfile\shell\open\command\\'' - %SystemRoot%\system32\NOTEPAD.EXE %1

[>> Registry Run Keys <<]
HKLM->Run\\!AVG Anti-Spyware - "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized (Anti-Malware Development a.s. )
HKLM->Run\\iTunesHelper - "C:\Program Files\iTunes\iTunesHelper.exe" (Apple Computer, Inc. )
HKLM->Run\\QuickTime Task - "C:\Program Files\QuickTime\qttask.exe" -atboottime (Apple Computer, Inc. )
HKLM->RunOnceEx\\ - (File not found)
HKLM->Run\OptionalComponents\IMAIL - Installed = 1
HKLM->Run\OptionalComponents\MAPI - Installed = 1
HKLM->Run\OptionalComponents\MSFS - Installed = 1
HKCU->Run\\AIM - C:\Program Files\AIM\aim.exe -cnetwait.odl (File not found)

[>> Miscellaneous Startup Keys <<]

[AppInit DLLs]
AppInit_DLL - (File not found)

[Image File Execution Options]
Your Image File Name Here without a path - Debugger = ntsd -d

[Shell Service Object Delay Load]
CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll (Microsoft Corporation )
PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll (Microsoft Corporation )
SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\System32\stobject.dll (Microsoft Corporation )
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\System32\webcheck.dll (Microsoft Corporation )

[Shell Execute Hooks]
{57B86673-276A-48B2-BAE7-C6DBB3020EB8} - CShellExecuteHookImpl Object = C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll (Anti-Malware Development a.s. )
{AEB6717E-7E19-11d0-97EE-00C04FD91972} - URL Exec Hook = shell32.dll (Microsoft Corporation )

[Shared Task Scheduler]
{438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader = %SystemRoot%\System32\browseui.dll (Microsoft Corporation )
{8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon = %SystemRoot%\System32\browseui.dll (Microsoft Corporation )

[SafeBoot Option]

[HKLM Command Processor AutoRun]
HKLM->Command Processor\\AutoRun -

[HKCU Command Processor AutoRun]

[Security Providers]
SecurityProviders\\SecurityProviders - msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll

[BootExecute]
Session Manager\\BootExecute - autocheck autochk *;

[PendingFileRenameOperations]

[FileRenameOperations]

[ExcludeFromKnownDlls]
Session Manager\\ExcludeFromKnownDlls -

[>> Disabled MSConfig Items <<]
StartUpFolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk - Adobe Reader Speed Launch = C:\PROGRA~1\Adobe\ACROBA~2.0\Reader\READER~1.EXE (Adobe Systems Incorporated )
StartUpFolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk - America Online 9.0 Tray Icon = C:\PROGRA~1\AMERIC~1.0\aoltray.exe -check (America Online, Inc. )
StartUpFolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk - Kodak EasyShare software = C:\PROGRA~1\Kodak\KODAKE~1\bin\EASYSH~1.EXE -h (Eastman Kodak Company )
StartUpFolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak software updater.lnk - Kodak software updater = C:\PROGRA~1\Kodak\KODAKS~1\7288971\Program\KODAKS~1.EXE ( )
StartUpFolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk - Microsoft Office = C:\PROGRA~1\MICROS~4\Office\OSA9.EXE -b -l (Microsoft Corporation )
StartUpFolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NkvMon.exe.lnk - NkvMon.exe = C:\PROGRA~1\Nikon\NkView6\NkvMon.exe (Nikon Corporation )
StartUpReg\Advanced Tools Check - ADVCHK = C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE (Symantec Corporation )
StartUpReg\AIM - aim = C:\Program Files\AIM\aim.exe -cnetwait.odl (File not found)
StartUpReg\Aim6 - AOLLaunch = "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp (America Online, Inc. )
StartUpReg\BJLaunchEXE - BJLaunch = C:\Program Files\Canon\BJCard\BJLaunch.exe (CANON INC. )
StartUpReg\BJPD HID Control - TVMon = C:\Program Files\Canon\BJPV\TVMon.exe (Canon Inc. )
StartUpReg\ccApp - ccApp = C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation )
StartUpReg\ccRegVfy - ccRegVfy = C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe (Symantec Corporation )
StartUpReg\HostManager - AOLHostManager = C:\Program Files\Common Files\AOL\1124555650\ee\AOLHostManager.exe (America Online, Inc. )
StartUpReg\HP Metrics - HP Product Research = C:\Program Files\HP\Personal Printing Solutions Product Research\HP Product Research.exe a (Hewlett-Packard Corporation )
StartUpReg\iTunesHelper - iTunesHelper = "C:\Program Files\iTunes\iTunesHelper.exe" (Apple Computer, Inc. )
StartUpReg\MSMSGS - msmsgs = "C:\Program Files\Messenger\msmsgs.exe" /background (Microsoft Corporation )
StartUpReg\mspid - msctupd = C:\WINDOWS\System32\msctupd.exe (File not found)
StartUpReg\NeroCheck - NeroCheck = C:\WINDOWS\System32\\NeroCheck.exe (Ahead Software Gmbh )
StartUpReg\PlaxoUpdate - PlaxoHelper = C:\Program Files\Plaxo\2.5.10.21\PlaxoHelper.exe -a (Plaxo, Inc. )
StartUpReg\PowerBar - PowerBar = "C:\Program Files\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe" /AtBootTime (Cyberlink, Corp. )
StartUpReg\QuickTime Task - qttask = "C:\Program Files\QuickTime\qttask.exe" -atboottime (Apple Computer, Inc. )
StartUpReg\RealTray - RealPlay = C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER (RealNetworks, Inc. )
StartUpReg\RemoteControl - PDVDServ = "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" (Cyberlink Corp. )
StartUpReg\SSC_UserPrompt - UsrPrmpt = C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe (Symantec Corporation )
StartUpReg\Symantec NetDriver Monitor - SNDMon = C:\PROGRA~1\SYMNET~1\SNDMon.exe (Symantec Corporation )
StartUpReg\SynTPEnh - SynTPEnh = C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc. )
StartUpReg\SynTPLpr - SynTPLpr = C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc. )
StartUpReg\updateMgr - AdobeUpdateManager = C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_0 (Adobe Systems Incorporated )
StartUpReg\ViewMgr - ViewMgr = C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe (Viewpoint Corporation )

[>> User Agent Post Platform <<]

[>> Winlogon <<]
HMLM->AltDefaultDomainName - LAPTOP
HMLM->AltDefaultUserName - Jaime Bernstein
HMLM->AutoAdminLogon - Reg Data - Value does not exist
HMLM->DefaultDomainName - LAPTOP
HMLM->DefaultUserName - Jaime Bernstein
HKLM->Shell - Explorer.exe (Microsoft Corporation )
HKLM->System - (File not found)
HMLM->UserInit - C:\WINDOWS\system32\userinit.exe, (Microsoft Corporation )
HKLM->VMApplet - rundll32 shell32,Control_RunDLL "sysdm.cpl"
Notify\crypt32chain - crypt32.dll (Microsoft Corporation )
Notify\cryptnet - cryptnet.dll (Microsoft Corporation )
Notify\cscdll - cscdll.dll (Microsoft Corporation )
Notify\ScCertProp - wlnotify.dll (Microsoft Corporation )
Notify\Schedule - wlnotify.dll (Microsoft Corporation )
Notify\sclgntfy - sclgntfy.dll (Microsoft Corporation )
Notify\SensLogn - WlNotify.dll (Microsoft Corporation )
Notify\termsrv - wlnotify.dll (Microsoft Corporation )
Notify\wlballoon - wlnotify.dll (Microsoft Corporation )

[>> DNS Name Servers <<]
{0711C75E-0F76-4C14-8651-B4A52A9B31D5} - (VIA Rhine II Fast Ethernet Adapter)
{B23F79E1-B944-4510-956A-2229D9DECACB} - (Linksys Etherfast USB 10/100 Ethernet Adapter)
{F5F9F1B8-44F6-4E4A-9A55-FCBC38664166} - ()

[>> All Winsock2 Catalogs <<]
NameSpace_Catalog5\Catalog_Entries\000000000001 (Tcpip) - %SystemRoot%\System32\mswsock.dll (Microsoft Corporation )
NameSpace_Catalog5\Catalog_Entries\000000000002 (NTDS) - %SystemRoot%\System32\winrnr.dll (Microsoft Corporation )
NameSpace_Catalog5\Catalog_Entries\000000000003 (Network Location Awareness (NLA) Namespace) - %SystemRoot%\System32\mswsock.dll (Microsoft Corporation )
Protocol_Catalog9\Catalog_Entries\000000000001 - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation )
Protocol_Catalog9\Catalog_Entries\000000000002 - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation )
Protocol_Catalog9\Catalog_Entries\000000000003 - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation )
Protocol_Catalog9\Catalog_Entries\000000000004 - %SystemRoot%\system32\rsvpsp.dll (Microsoft Corporation )
Protocol_Catalog9\Catalog_Entries\000000000005 - %SystemRoot%\system32\rsvpsp.dll (Microsoft Corporation )
Protocol_Catalog9\Catalog_Entries\000000000006 - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation )
Protocol_Catalog9\Catalog_Entries\000000000007 - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation )
Protocol_Catalog9\Catalog_Entries\000000000008 - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation )
Protocol_Catalog9\Catalog_Entries\000000000009 - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation )
Protocol_Catalog9\Catalog_Entries\000000000010 - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation )
Protocol_Catalog9\Catalog_Entries\000000000011 - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation )
Protocol_Catalog9\Catalog_Entries\000000000012 - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation )
Protocol_Catalog9\Catalog_Entries\000000000013 - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation )
Protocol_Catalog9\Catalog_Entries\000000000014 - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation )
Protocol_Catalog9\Catalog_Entries\000000000015 - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation )
Protocol_Catalog9\Catalog_Entries\000000000016 - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation )
Protocol_Catalog9\Catalog_Entries\000000000017 - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation )
Protocol_Catalog9\Catalog_Entries\000000000018 - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation )
Protocol_Catalog9\Catalog_Entries\000000000019 - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation )

[>> Protocol Handlers (Non-Microsoft only) <<]
ipp - (File not found)
msdaipp - (File not found)
vnd.ms.radio - C:\WINDOWS\system32\msdxm.ocx ( )

[>> Protocol Filters (Non-Microsoft only) <<]

< Services (Non-Microsoft Only) >
AOL Connectivity Service (AOL ACS) - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe (America Online, Inc. ) [Automatic - Running - Win32, running in it's own process]
AVG Anti-Spyware Guard (AVG Anti-Spyware Guard) - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe (Anti-Malware Development a.s. ) [Automatic - Running - Win32, running in it's own process]
Canon BJ Memory Card Manager (Bjmcmng) - C:\Program Files\Canon\BJCard\Bjmcmng.exe (CANON INC. ) [Automatic - Running - Win32, running in it's own process]
Symantec Event Manager (ccEvtMgr) - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (Symantec Corporation ) [Automatic - Running - Win32, running in it's own process]
iPod Service (iPod Service) - "C:\Program Files\iPod\bin\iPodService.exe" (Apple Computer, Inc. ) [On Demand - Running - Win32, running in it's own process]
Norton AntiVirus Auto Protect Service (navapsvc) - "C:\Program Files\Norton AntiVirus\navapsvc.exe" (Symantec Corporation ) [Automatic - Running - Win32, running in it's own process]
Norton Unerase Protection (NProtectService) - "C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE" (Symantec Corporation ) [Automatic - Running - Win32, running in it's own process]
SmartLinkService (SLService) - slserv.exe ( ) [Automatic - Running - Win32, running in it's own process]
WAN Miniport (ATW) Service (WANMiniportService) - "C:\WINDOWS\wanmpsvc.exe" (America Online, Inc. ) [Automatic - Running - Win32, running in it's own process]
WLTRYSVC (WLTRYSVC) - C:\WINDOWS\System32\wltrysvc.exe C:\WINDOWS\System32\bcmwltry.exe (File not found)) [Automatic - Running - Win32, running in it's own process]

< Files >

Auto-Start Folders

HKLM->Explorer\Shell Folders\\Common Startup = C:\Documents and Settings\All Users\Start Menu\Programs\Startup
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini - ( [Ver = | Size = 84 bytes | Date = 1/13/2004 6:15:28 AM | Attr = HS])

HKLM->Explorer\User Shell Folders\\Common Startup = %ALLUSERSPROFILE%\Start Menu\Programs\Startup

HKLM->Explorer\Shell Folders\\Startup = C:\Documents and Settings\Jaime Bernstein\Start Menu\Programs\Startup
C:\Documents and Settings\Jaime Bernstein\Start Menu\Programs\Startup\desktop.ini - ( [Ver = | Size = 84 bytes | Date = 1/13/2004 6:15:28 AM | Attr = HS])

HKCU->Explorer\User Shell Folders\\Startup = %USERPROFILE%\Start Menu\Programs\Startup

Miscellaneous Auto-Start Files
System.ini->[Boot]\\Shell - Explorer.exe

Miscellaneous Folders

AllUsers ApplicationData Folder
C:\Documents and Settings\All Users\Application Data\desktop.ini - ( [Ver = | Size = 62 bytes | Date = 1/12/2004 10:07:44 PM | Attr = HS])
C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache - ( [Ver = | Size = 4472 bytes | Date = 1/11/2007 4:16:34 PM | Attr = ])

CurrentUser ApplicationData Folder
C:\Documents and Settings\Jaime Bernstein\Application Data\desktop.ini - ( [Ver = | Size = 62 bytes | Date = 1/12/2004 10:07:44 PM | Attr = HS])
C:\Documents and Settings\Jaime Bernstein\Application Data\Install.dat - ( [Ver = | Size = 1442985 bytes | Date = 12/27/2006 4:33:36 PM | Attr = ])
C:\Documents and Settings\Jaime Bernstein\Application Data\RipEditBurn.ini - ( [Ver = | Size = 62 bytes | Date = 2/15/2007 6:01:00 PM | Attr = ])
C:\Documents and Settings\Jaime Bernstein\Application Data\SQSDRVRM.SYS - ( [Ver = | Size = 66 bytes | Date = 2/15/2007 6:19:28 PM | Attr = ])

Program Files Folder
C:\Program Files\Uninstall_CDS.exe - ( [Ver = | Size = 40960 bytes | Date = 1/5/2004 6:55:30 PM | Attr = ])

Common Files Folder

DPF files
{1239CC52-59EF-4DFA-8C61-90FFA846DF7E} - Musicnotes Viewer - CodeBase = http://www.musicnotes.com/download/mnviewer.cab
{166B1BCA-3F9C-11CF-8075-444553540000} - Shockwave ActiveX Control - CodeBase = http://active.macromedia.com/director/cabs/sw.cab
{17492023-C23A-453E-A040-C7C580BBF700} - Windows Genuine Advantage Validation Tool - CodeBase = http://go.microsoft.com/fwlink/?linkid=39204
{19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} - MSSecurityAdvisor Class - CodeBase = http://protect.microsoft.com/security/prot…b?1164072601299
{1F2F4C9E-6F09-47BC-970D-3C54734667FE} - LSSupCtl Class - CodeBase = http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
{3451DEDE-631F-421C-8127-FD793AFC6CC8} - ActiveDataInfo Class - CodeBase = http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
{44990200-3C9D-426D-81DF-AAB636FA4345} - Symantec SmartIssue - CodeBase = http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
{44990301-3C9D-426D-81DF-AAB636FA4345} - Symantec Script Runner Class - CodeBase = http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
{4C39376E-FA9D-4349-BACC-D305C1750EF3} - EPUImageControl Class - CodeBase = http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-24.cab
{5F8469B4-B055-49DD-83F7-62B522420ECC} - Facebook Photo Uploader Control - CodeBase = http://upload.facebook.com/controls/Facebo…otoUploader.cab
{6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - MUWebControl Class - CodeBase = http://update.microsoft.com/microsoftupdat…b?1164064991169
{9E17A5F9-2B9C-4C66-A592-199A4BA1FBC8} - AIM UPF Control - CodeBase = http://pictures04.aim.com/ygp/aol/plugin/u…AIM.9.5.1.8.cab
{9F1C11AA-197B-4942-BA54-47A8489BB47F} - - CodeBase = http://v4.windowsupdate.microsoft.com/CAB/…7998.6649305556
{A8F2B9BD-A6A0-486A-9744-18920D898429} - ScorchPlugin Class - CodeBase = http://www.sibelius.com/download/software/…tiveXPlugin.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} - Shockwave Flash Object - CodeBase = http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab
{F127B9BA-89EA-4B04-9C67-2074A9DF61FD} - Photo Upload Plugin Class - CodeBase = http://cvs.pnimedia.com/upload/activex/v2_…tupv2.0.0.9.cab?
DirectAnimation Java Classes - - CodeBase = file://C:\WINDOWS\Java\classes\dajava.cab
Microsoft XML Parser for Java - - CodeBase = file://C:\WINDOWS\Java\classes\xmldso.cab

Hosts file = 813 bytes. Reading all entries. C:\WINDOWS\System32\drivers\etc\Hosts
# Copyright © 1993-2004 Microsoft Corp. -
# -
# AutoGenerated by Microsoft ® Windows ® Malicious Software Removal Tool. -
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows. -
# -
# This file contains the mappings of IP addresses to host names. Each -
# entry should be kept on an individual line. The IP address should -
# be placed in the first column followed by the corresponding host name. -
# The IP address and the host name should be separated by at least one -
# space. -
# -
# Additionally, comments (such as these) may be inserted on individual -
# lines or following the machine name denoted by a '#' symbol. -
# -
# For example: -
# -
# 102.54.94.97 rhino.acme.com # source server -
# 38.25.63.10 x.acme.com # x client host -
-
127.0.0.1 localhost -

< Add On's >

>>>>Output for AddOn file awf.def<<<<

DIR - C:\*.* - Parameters = Size of 21504; Include SubFolders
C:\Documents and Settings\Jaime Bernstein\My Documents\Schedule Fall 2006.xls - ( [Ver = | Size = 21504 bytes | Date = 10/16/2006 6:31:16 AM | Attr = ])
C:\Documents and Settings\Jaime Bernstein\My Documents\Jaime\best timed peice entry slip.doc - ( [Ver = | Size = 21504 bytes | Date = 5/30/2005 9:05:04 PM | Attr = ])
C:\Documents and Settings\Jaime Bernstein\My Documents\Jaime\Exploratory essay rough draft.doc - ( [Ver = | Size = 21504 bytes | Date = 10/16/2006 5:05:14 PM | Attr = ])
C:\Documents and Settings\Jaime Bernstein\My Documents\Jaime\reflection.doc - ( [Ver = | Size = 21504 bytes | Date = 11/19/2006 11:23:10 PM | Attr = ])
C:\Documents and Settings\Jaime Bernstein\My Documents\Jaime\shows.wps - ( [Ver = | Size = 21504 bytes | Date = 8/11/2006 5:25:56 PM | Attr = ])
C:\Documents and Settings\Jaime Bernstein\My Documents\Jaime\the tenth man monologue.doc - ( [Ver = | Size = 21504 bytes | Date = 1/28/2007 3:40:32 PM | Attr = ])
C:\Documents and Settings\Jaime Bernstein\My Documents\Jaime\Transportation_Alt.doc - ( [Ver = | Size = 21504 bytes | Date = 10/3/2006 5:44:14 AM | Attr = ])
C:\Documents and Settings\Jaime Bernstein\My Documents\Jaime\word definitions.doc - ( [Ver = | Size = 21504 bytes | Date = 11/12/2006 5:28:40 PM | Attr = ])
C:\Documents and Settings\Jaime Bernstein\My Documents\My Pictures\jai\Thumbs.db - ( [Ver = | Size = 21504 bytes | Date = 4/6/2005 10:19:16 AM | Attr = HS])
C:\Program Files\Canon\PhotoStitch\PhotoStitch\Lfwmf70n.dll - (LEAD Technologies, Inc. [Ver = 7.00.0.004 | Size = 21504 bytes | Date = 4/17/1997 10:36:32 AM | Attr = ])
C:\Program Files\Common Files\aolshare\Coach\Player\plugin\DllsPlug.dll - (GTek Technologies Ltd. [Ver = 1, 0, 0, 13 | Size = 21504 bytes | Date = 2/27/2003 2:44:14 PM | Attr = ])
C:\Program Files\Microsoft Office\Clipart\standard\stddir1\BD06118_.WMF - ( [Ver = | Size = 21504 bytes | Date = 3/15/1998 9:41:00 AM | Attr = ])
C:\WINDOWS\$hf_mig$\KB873339\update\spcustom.dll - (Microsoft Corporation [Ver = 5.5.0033.0 (SRV03_QFE.031113-0918) | Size = 21504 bytes | Date = 10/14/2004 10:36:16 AM | Attr = ])
C:\WINDOWS\$hf_mig$\KB885835\update\spcustom.dll - (Microsoft Corporation [Ver = 5.5.0033.0 (SRV03_QFE.031113-0918) | Size = 21504 bytes | Date = 10/14/2004 11:36:16 AM | Attr = ])
C:\WINDOWS\$hf_mig$\KB885836\update\spcustom.dll - (Microsoft Corporation [Ver = 5.5.0033.0 (SRV03_QFE.031113-0918) | Size = 21504 bytes | Date = 10/14/2004 11:36:16 AM | Attr = ])
C:\WINDOWS\$hf_mig$\KB888302\update\spcustom.dll - (Microsoft Corporation [Ver = 5.5.0033.0 (SRV03_QFE.031113-0918) | Size = 21504 bytes | Date = 11/30/2004 8:22:40 PM | Attr = ])
C:\WINDOWS\$hf_mig$\KB891781\update\spcustom.dll - (Microsoft Corporation [Ver = 5.5.0033.0 (SRV03_QFE.031113-0918) | Size = 21504 bytes | Date = 11/30/2004 8:22:40 PM | Attr = ])
C:\WINDOWS\$hf_mig$\KB900725\SP2QFE\xpsp3res.dll - (Microsoft Corporation [Ver = 5.1.2600.2764 (xpsp.050926-1615) | Size = 21504 bytes | Date = 9/26/2005 7:29:46 PM | Attr = ])
C:\WINDOWS\Fonts\smallf.fon - (Microsoft Corporation [Ver = 3.10 | Size = 21504 bytes | Date = 8/29/2002 7:00:00 AM | Attr = H ])
C:\WINDOWS\msagent\agentpsh.dll - (Microsoft Corporation [Ver = 2.00.0.3422 | Size = 21504 bytes | Date = 8/29/2002 7:00:00 AM | Attr = ])
C:\WINDOWS\msagent\agtintl.dll - (Microsoft Corporation [Ver = 2.00.0.3422 | Size = 21504 bytes | Date = 8/29/2002 7:00:00 AM | Attr = ])
C:\WINDOWS\msagent\intl\agt0407.dll - (Microsoft Corporation [Ver = 2.00.0.3422 | Size = 21504 bytes | Date = 8/29/2002 7:00:00 AM | Attr = ])
C:\WINDOWS\msagent\intl\agt040c.dll - (Microsoft Corporation [Ver = 2.00.0.3422 | Size = 21504 bytes | Date = 8/29/2002 7:00:00 AM | Attr = ])
C:\WINDOWS\PCHealth\HelpCtr\Binaries\brpinfo.dll - (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 21504 bytes | Date = 8/29/2002 7:00:00 AM | Attr = ])
C:\WINDOWS\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\dpvacm.dll - (Microsoft Corporation [Ver = 5.03.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 21504 bytes | Date = 8/4/2004 2:56:42 AM | Attr = ])
C:\WINDOWS\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\feclient.dll - (Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 21504 bytes | Date = 8/4/2004 2:56:42 AM | Attr = ])
C:\WINDOWS\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\hidserv.dll - (Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 21504 bytes | Date = 8/4/2004 2:56:42 AM | Attr = ])
C:\WINDOWS\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\rcp.exe - (Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 21504 bytes | Date = 8/4/2004 2:56:56 AM | Attr = ])
C:\WINDOWS\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\spupdwxp.exe - (Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 21504 bytes | Date = 8/4/2004 2:56:58 AM | Attr = ])
C:\WINDOWS\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\lang\cintlgnt.ime - (Microsoft Corporation [Ver = 4.4.2714 | Size = 21504 bytes | Date = 8/28/2002 9:39:44 PM | Attr = ])
C:\WINDOWS\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\update\spcustom.dll - (Microsoft Corporation [Ver = 5.5.1005.0 (SRV03_QFE.031113-0918) | Size = 21504 bytes | Date = 8/3/2004 10:42:30 PM | Attr = ])
C:\WINDOWS\system32\dmserver.dll - (Microsoft Corp. [Ver = 2600.0.503.0 | Size = 21504 bytes | Date = 8/29/2002 7:00:00 AM | Attr = ])
C:\WINDOWS\system32\ipxrip.dll - (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 21504 bytes | Date = 8/29/2002 7:00:00 AM | Attr = ])
C:\WINDOWS\system32\lfCUT12n.dll - (LEAD Technologies, Inc. [Ver = 12.1.0.063 | Size = 21504 bytes | Date = 1/10/2003 3:00:00 AM | Attr = ])
C:\WINDOWS\system32\pathping.exe - (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 21504 bytes | Date = 8/29/2002 7:00:00 AM | Attr = ])
C:\WINDOWS\system32\wsock32.dll - (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 21504 bytes | Date = 8/29/2002 7:00:00 AM | Attr = ])
C:\WINDOWS\system32\dllcache\agentpsh.dll - (Microsoft Corporation [Ver = 2.00.0.3422 | Size = 21504 bytes | Date = 8/29/2002 7:00:00 AM | Attr = ])
C:\WINDOWS\system32\dllcache\agt0407.dll - (Microsoft Corporation [Ver = 2.00.0.3422 | Size = 21504 bytes | Date = 8/29/2002 7:00:00 AM | Attr = ])
C:\WINDOWS\system32\dllcache\agt040c.dll - (Microsoft Corporation [Ver = 2.00.0.3422 | Size = 21504 bytes | Date = 8/29/2002 7:00:00 AM | Attr = ])
C:\WINDOWS\system32\dllcache\agtintl.dll - (Microsoft Corporation [Ver = 2.00.0.3422 | Size = 21504 bytes | Date = 8/29/2002 7:00:00 AM | Attr = ])
C:\WINDOWS\system32\dllcache\brpinfo.dll - (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 21504 bytes | Date = 8/29/2002 7:00:00 AM | Attr = ])
C:\WINDOWS\system32\dllcache\dmserver.dll - (Microsoft Corp. [Ver = 2600.0.503.0 | Size = 21504 bytes | Date = 8/29/2002 7:00:00 AM | Attr = ])
C:\WINDOWS\system32\dllcache\ipxrip.dll - (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 21504 bytes | Date = 8/29/2002 7:00:00 AM | Attr = ])
C:\WINDOWS\system32\dllcache\pathping.exe - (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 21504 bytes | Date = 8/29/2002 7:00:00 AM | Attr = ])
C:\WINDOWS\system32\dllcache\wsock32.dll - (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 21504 bytes | Date = 8/29/2002 7:00:00 AM | Attr = ])

DIR - C:\*.* - Parameters = Size of 25600; Include SubFolders
C:\Documents and Settings\Jaime Bernstein\My Documents\Jaime\itironim.wps - ( [Ver = | Size = 25600 bytes | Date = 9/21/2006 8:24:38 PM | Attr = ])
C:\Documents and Settings\Jaime Bernstein\My Documents\Jaime\rewrite of GM pg 33-36.doc - ( [Ver = | Size = 25600 bytes | Date = 11/15/2006 6:57:22 AM | Attr = ])
C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\de.lproj\SoftwareUpdateLocalized.dll - (Apple Computer, Inc. [Ver = 1.0.0.3 | Size = 25600 bytes | Date = 10/10/2006 5:13:38 PM | Attr = ])
C:\Program Files\Canon\PhotoStitch\PhotoStitch\Lttwn70n.dll - (LEAD Technologies, Inc. [Ver = 7.00.0.004 | Size = 25600 bytes | Date = 4/17/1997 10:36:00 AM | Attr = ])
C:\Program Files\CyberLink DVD Solution\MediaShow\lfmac10N.dll - (LEAD Technologies, Inc. [Ver = 10.0.0.022 | Size = 25600 bytes | Date = 3/29/1999 1:07:12 AM | Attr = ])
C:\Program Files\Microsoft Office\Clipart\photohm\J0144917.JPG - ( [Ver = | Size = 25600 bytes | Date = 8/4/1998 6:19:40 PM | Attr = ])
C:\Program Files\Microsoft Works\1033\Wizards\lstfamus.wwd - ( [Ver = | Size = 25600 bytes | Date = 6/20/2002 12:57:58 PM | Attr = R ])
C:\Program Files\QuickTime\PictureViewer.Resources\PictureViewer.qtr - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 10/25/2006 7:17:34 PM | Attr = ])
C:\Program Files\QuickTime\PropertyPanels\PanelHelperBase.Resources\PanelHelperBase.qtr - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 10/25/2006 7:17:34 PM | Attr = ])
C:\Program Files\QuickTime\QTSystem\CoreVideo.Resources\CoreVideo.qtr - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 10/25/2006 7:17:20 PM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\da.lproj\QuickTimeAuthoringLocalized.dll - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 11:19:00 AM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\de.lproj\QuickTimeAuthoringLocalized.dll - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 11:18:48 AM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\en.lproj\QuickTimeAuthoringLocalized.dll - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 10/25/2006 7:17:12 PM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\es.lproj\QuickTimeAuthoringLocalized.dll - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 11:19:12 AM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\fi.lproj\QuickTimeAuthoringLocalized.dll - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 11:19:58 AM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\fr.lproj\QuickTimeAuthoringLocalized.dll - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 11:19:24 AM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\it.lproj\QuickTimeAuthoringLocalized.dll - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 11:20:44 AM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\ja.lproj\QuickTimeAuthoringLocalized.dll - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 11:19:46 AM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\ko.lproj\QuickTimeAuthoringLocalized.dll - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 11:20:08 AM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\nb.lproj\QuickTimeAuthoringLocalized.dll - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 11:19:34 AM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\nl.lproj\QuickTimeAuthoringLocalized.dll - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 11:20:20 AM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\sv.lproj\QuickTimeAuthoringLocalized.dll - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 11:20:32 AM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\zh_CN.lproj\QuickTimeAuthoringLocalized.dll - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 11:18:36 AM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.Resources\zh_TW.lproj\QuickTimeAuthoringLocalized.dll - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 11:20:56 AM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeH264.Resources\da.lproj\QuickTimeH264Localized.qtr - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 10/25/2006 7:39:12 PM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeH264.Resources\en.lproj\QuickTimeH264Localized.qtr - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 10/25/2006 7:17:14 PM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeH264.Resources\es.lproj\QuickTimeH264Localized.qtr - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 10/25/2006 7:39:12 PM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeH264.Resources\fi.lproj\QuickTimeH264Localized.qtr - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 10/25/2006 7:39:12 PM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeH264.Resources\fr.lproj\QuickTimeH264Localized.qtr - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 10/25/2006 7:39:12 PM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeH264.Resources\ja.lproj\QuickTimeH264Localized.qtr - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 10/25/2006 7:39:12 PM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeH264.Resources\ko.lproj\QuickTimeH264Localized.qtr - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 10/25/2006 7:39:12 PM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeH264.Resources\nb.lproj\QuickTimeH264Localized.qtr - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 10/25/2006 7:39:12 PM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeH264.Resources\sv.lproj\QuickTimeH264Localized.qtr - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 10/25/2006 7:39:10 PM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeH264.Resources\zh_CN.lproj\QuickTimeH264Localized.qtr - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 10/25/2006 7:39:10 PM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeH264.Resources\zh_TW.lproj\QuickTimeH264Localized.qtr - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 10/25/2006 7:39:10 PM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\da.lproj\QuickTimeWebHelperLocalized.dll - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 11:19:00 AM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\en.lproj\QuickTimeWebHelperLocalized.dll - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 10/25/2006 7:17:18 PM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\fi.lproj\QuickTimeWebHelperLocalized.dll - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 11:19:58 AM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\it.lproj\QuickTimeWebHelperLocalized.dll - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 11:20:44 AM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\ja.lproj\QuickTimeWebHelperLocalized.dll - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 11:19:46 AM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\ko.lproj\QuickTimeWebHelperLocalized.dll - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 11:20:08 AM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\nb.lproj\QuickTimeWebHelperLocalized.dll - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 11:19:34 AM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\sv.lproj\QuickTimeWebHelperLocalized.dll - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 11:20:32 AM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\zh_CN.lproj\QuickTimeWebHelperLocalized.dll - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 11:18:36 AM | Attr = ])
C:\Program Files\QuickTime\QTSystem\QuickTimeWebHelper.Resources\zh_TW.lproj\QuickTimeWebHelperLocalized.dll - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 11:20:56 AM | Attr = ])
C:\RECYCLER\NPROTECT\00427693.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 9/24/2006 2:43:50 AM | Attr = ])
C:\RECYCLER\NPROTECT\00427708.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 9/24/2006 2:44:02 AM | Attr = ])
C:\RECYCLER\NPROTECT\00427724.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 9/24/2006 2:44:02 AM | Attr = ])
C:\RECYCLER\NPROTECT\00427857.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 10:19:00 AM | Attr = ])
C:\RECYCLER\NPROTECT\00427859.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 10:18:48 AM | Attr = ])
C:\RECYCLER\NPROTECT\00427862.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 10:19:12 AM | Attr = ])
C:\RECYCLER\NPROTECT\00427864.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 10:19:58 AM | Attr = ])
C:\RECYCLER\NPROTECT\00427866.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 10:19:24 AM | Attr = ])
C:\RECYCLER\NPROTECT\00427868.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 10:20:44 AM | Attr = ])
C:\RECYCLER\NPROTECT\00427870.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 10:19:46 AM | Attr = ])
C:\RECYCLER\NPROTECT\00427872.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 10:20:08 AM | Attr = ])
C:\RECYCLER\NPROTECT\00427874.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 10:19:34 AM | Attr = ])
C:\RECYCLER\NPROTECT\00427876.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 10:20:20 AM | Attr = ])
C:\RECYCLER\NPROTECT\00427878.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 10:20:32 AM | Attr = ])
C:\RECYCLER\NPROTECT\00427880.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 10:18:36 AM | Attr = ])
C:\RECYCLER\NPROTECT\00427882.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 10:20:56 AM | Attr = ])
C:\RECYCLER\NPROTECT\00427930.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 9/24/2006 3:05:16 AM | Attr = ])
C:\RECYCLER\NPROTECT\00427932.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 9/24/2006 2:43:46 AM | Attr = ])
C:\RECYCLER\NPROTECT\00427933.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 9/24/2006 3:05:16 AM | Attr = ])
C:\RECYCLER\NPROTECT\00427934.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 9/24/2006 3:05:16 AM | Attr = ])
C:\RECYCLER\NPROTECT\00427935.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 9/24/2006 3:05:16 AM | Attr = ])
C:\RECYCLER\NPROTECT\00427937.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 9/24/2006 3:05:16 AM | Attr = ])
C:\RECYCLER\NPROTECT\00427938.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 9/24/2006 3:05:16 AM | Attr = ])
C:\RECYCLER\NPROTECT\00427939.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 9/24/2006 3:05:16 AM | Attr = ])
C:\RECYCLER\NPROTECT\00427941.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 9/24/2006 3:05:16 AM | Attr = ])
C:\RECYCLER\NPROTECT\00427942.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 9/24/2006 3:05:16 AM | Attr = ])
C:\RECYCLER\NPROTECT\00427943.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 9/24/2006 3:05:16 AM | Attr = ])
C:\RECYCLER\NPROTECT\00428140.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 10:19:00 AM | Attr = ])
C:\RECYCLER\NPROTECT\00428144.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 9/24/2006 2:43:50 AM | Attr = ])
C:\RECYCLER\NPROTECT\00428148.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 10:19:58 AM | Attr = ])
C:\RECYCLER\NPROTECT\00428152.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 10:20:44 AM | Attr = ])
C:\RECYCLER\NPROTECT\00428154.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 10:19:46 AM | Attr = ])
C:\RECYCLER\NPROTECT\00428156.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 10:20:08 AM | Attr = ])
C:\RECYCLER\NPROTECT\00428158.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 10:19:34 AM | Attr = ])
C:\RECYCLER\NPROTECT\00428162.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 10:20:32 AM | Attr = ])
C:\RECYCLER\NPROTECT\00428164.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 10:18:36 AM | Attr = ])
C:\RECYCLER\NPROTECT\00428166.rbf - (Apple Computer, Inc. [Ver = 7.1.3 | Size = 25600 bytes | Date = 8/25/2006 10:20:56 AM | Attr = ])
C:\WINDOWS\twunk_32.exe - (Twain Working Group [Ver = 1,7,1,0 | Size = 25600 bytes | Date = 8/29/2002 7:00:00 AM | Attr = ])
C:\WINDOWS\$NtUninstallKB911280$\winipsec.dll - (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 25600 bytes | Date = 8/29/2002 7:00:00 AM | Attr = ])
C:\WINDOWS\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\hidbth.sys - (Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 25600 bytes | Date = 8/4/2004 1:10:36 AM | Attr = ])
C:\WINDOWS\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\netsetup.cpl - (Microsoft Corporation

beynac

Post #10February 17, 2007, 11:27 PM UTC

Your reply has got cut off. Please post the remainder of the WinpFind2 report, the Blacklight report and the HijackThis log.

beynac

Post #11February 19, 2007, 4:58 PM UTC

Hi jayberns.

Please could you post the reports requested in my previous post.

The remainder of the WinPFind2 report
The Blacklight report
The new HijackThis log

little eagle

Post #12March 24, 2007, 9:04 PM UTC

Due to a lack of a responce this topic is now closed.

If you wish it reopened, please send us an email (Click for address) with a link to your thread.
Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

To help keep your PC clean follow the recommendations here by shelf life.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Internet Surfing Slow-Help

✨ Ask AI

Ask AI