Missing documents and hijack log

Deckard's System Scanner v20070328.36
Run by [removed] on 2007-04-09 at 18:08:10
Computer is in Normal Mode.
——————————————————————————–

– System Restore ————————————————————–

System Restore is disabled; attempting to re-enable…success.


– Last 1 Restore Point(s) –
1: 2007-04-09 17:08:13 UTC - RP1 - System Checkpoint


Performed disk cleanup.


– HijackThis (run as Lorna Caswell.exe) —————————————

Logfile of HijackThis v1.99.1
Scan saved at 18:08:29, on 09/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\CTSvcCDA.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\News\NewsUpd.EXE
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\Program Files\Creative\Audio2K\PROGRAM\CTMIX32.EXE
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\Program Files\Creative\ShareDLL\MediaDet.Exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\FotoStation Easy\FotoStation Easy AutoLaunch.exe
C:\Program Files\Nikon\NkView5\NkvMon.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\BT Broadband Basic Help\bin\mpbtn.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Lorna Caswell.OX163JXORENX8MZ\Desktop\dss.exe
C:\DOCUME~1\LORNAC~1.OX1\MYDOCU~1\Unzipped\HIJACK~1\Lorna Caswell.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.btopenworld.com/searchpane
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NewsUpd] C:\Program Files\Creative\News\NewsUpd.EXE /q
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [CreativeMixer] C:\Program Files\Creative\Audio2K\PROGRAM\CTMIX32.EXE /t
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [Smart Start UP] C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe /Automation
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BT Broadband Basic Help.lnk = C:\Program Files\BT Broadband Basic Help\bin\matcli.exe
O4 - Global Startup: FotoStation Easy AutoLaunch.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView5\NkvMon.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://bt.yahoo.com
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {1803B9EF-9905-4F34-AFC4-05D1BAB28801} (RegUserCfgUI Class) - http://us.dl1.yimg.com/download.yahoo.com/…_1/yregucfg.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\commonyinsthelper.dll
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {EC5A4E7B-02EB-451D-B310-D5F2E0A4D8C3} (webhelper Class) - http://register.btinternet.com/templates/btwebcontrol024.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{77215221-1DAC-4961-ABFC-94F6BAAD4886}: NameServer = 62.6.40.162 194.74.65.69
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: BullGuard Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\BullGuard\BullGuard Communicator\xcommsvr.exe (file missing)


– HijackThis Fixed Entries (C:\DOCUME~1\LORNAC~1.OX1\MYDOCU~1\Unzipped\HIJACK~1\backups\) ——————————————————————————–

backup-20070405-200837-500 O23 - Service: BullGuard Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\BullGuard\BullGuard Communicator\xcommsvr.exe (file missing)
backup-20070405-201322-933 O23 - Service: BullGuard Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\BullGuard\BullGuard Communicator\xcommsvr.exe (file missing)
backup-20070406-130326-819 O23 - Service: BullGuard Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\BullGuard\BullGuard Communicator\xcommsvr.exe (file missing)
backup-20070406-130702-813 O23 - Service: BullGuard Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\BullGuard\BullGuard Communicator\xcommsvr.exe (file missing)

– File Associations ———————————————————–

All associations okay.


– Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ———————

R1 NaiAvTdi1 - c:\windows\system32\drivers\mvstdi5x.sys
R1 OMCI - c:\windows\system32\drivers\omci.sys
R2 ASCTRM - c:\windows\system32\drivers\asctrm.sys
R2 PfModNT - c:\windows\system32\pfmodnt.sys
R3 aeaudio - c:\windows\system32\drivers\aeaudio.sys
R3 BCMModem (BCM V.92 56K Modem) - c:\windows\system32\drivers\bcmsm.sys
R3 EntDrv51 - c:\windows\system32\drivers\entdrv51.sys
R3 MODEMCSA (Unimodem Streaming Filter Device) - c:\windows\system32\drivers\modemcsa.sys
R3 NaiAvFilter1 - c:\windows\system32\drivers\naiavf5x.sys
R3 smwdm - c:\windows\system32\drivers\smwdm.sys
R3 wanusb (BT Voyager 105 ADSL Modem) - c:\windows\system32\drivers\gwausb.sys


– Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ——————–

R2 McAfeeFramework (McAfee Framework Service) - c:\program files\network associates\common framework\frameworkservice.exe /servicestart
R2 McTaskManager (Network Associates Task Manager) - "c:\program files\network associates\virusscan\vstskmgr.exe"

S2 XCOMM (BullGuard Communicator) - c:\program files\common files\bullguard\bullguard communicator\xcommsvr.exe /service (file missing)


– Files created between 2007-03-09 and 2007-04-09 —————————–

2007-04-09 17:35:48 1818 –a—— C:\RegQuery.bat
2007-04-05 19:43:59 0 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-04-04 21:30:57 3968 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-03-31 16:40:15 0 d——– C:\Documents and Settings\Lorna Caswell.OX163JXORENX8MZ\Application Data\U3
2007-03-31 13:49:45 148338 –a—— C:\WINDOWS\system32\drivers\gwausb.sys
2007-03-31 13:49:45 160951 —–n— C:\WINDOWS\system32\drivers\gtipdsp_.bin
2007-03-31 13:49:44 24576 –a—— C:\WINDOWS\system32\CoInst.dll
2007-03-31 13:49:36 12288 —–n— C:\WINDOWS\system32\CplEng.dll
2007-03-28 19:52:10 0 d——– C:\Documents and Settings\Cat Club.OX163JXORENX8MZ\Application Data\Adobe
2007-03-27 20:44:59 0 d——– C:\Documents and Settings\Cat Club.OX163JXORENX8MZ\Application Data\Lavasoft


– Find3M Report —————————————————————

2007-04-06 21:04:40 0 d——– C:\Program Files\OpenOffice.org1.1.2
2007-03-31 13:55:48 0 d——– C:\Program Files\BT Voyager 105 ADSL Modem
2007-03-31 13:51:56 0 d——– C:\Program Files\BT Broadband Basic Help
2007-03-30 20:53:24 0 d——– C:\Program Files\FotoStation Easy
2007-03-28 19:23:54 0 d——– C:\Documents and Settings\Lorna Caswell.OX163JXORENX8MZ\Application Data\Adobe
2007-03-27 20:41:46 0 d——– C:\Program Files\Common Files\InstallShield
2007-03-27 20:41:30 0 d–h—– C:\Program Files\InstallShield Installation Information
2007-03-27 20:40:30 0 d——– C:\Program Files\EA Games
2007-03-27 20:40:01 0 d——– C:\Program Files\Microsoft Games
2007-03-27 20:36:06 0 d——– C:\Program Files\Common Files\Adaptec Shared
2007-03-08 16:36:28 577536 –a—— C:\WINDOWS\system32\user32.dll
2007-03-08 16:36:28 40960 —–n— C:\WINDOWS\system32\mf3216.dll
2007-03-08 16:36:28 281600 –a—— C:\WINDOWS\system32\gdi32.dll
2007-03-08 15:17:30 0 d——– C:\Documents and Settings\Lorna Caswell.OX163JXORENX8MZ\Application Data\AdobeUM
2007-03-08 14:47:48 1843584 —–n— C:\WINDOWS\system32\win32k.sys
2007-02-19 09:37:27 0 d——– C:\Program Files\Ubi Soft
2007-02-19 09:22:44 0 d——– C:\Program Files\Bethesda Softworks


– Registry Dump —————————————————————


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"NewsUpd"="C:\\Program Files\\Creative\\News\\NewsUpd.EXE /q"
"Disc Detector"="C:\\Program Files\\Creative\\ShareDLL\\CtNotify.exe"
"CreativeMixer"="C:\\Program Files\\Creative\\Audio2K\\PROGRAM\\CTMIX32.EXE /t"
"RealTray"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER"
"ShStatEXE"="\"C:\\Program Files\\Network Associates\\VirusScan\\SHSTAT.EXE\" /STANDALONE"
"McAfeeUpdaterUI"="\"C:\\Program Files\\Network Associates\\Common Framework\\UpdaterUI.exe\" /StartedFromRunKey"
"Network Associates Error Reporting Service"="\"C:\\Program Files\\Common Files\\Network Associates\\TalkBack\\TBMon.exe\""
"Zone Labs Client"="C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe"
"BCMSMMSG"="BCMSMMSG.exe"
"Smart Start UP"="C:\\Program Files\\NewSoft\\Smart Start UP\\PnPDetect.exe /Automation "
"DSLSTATEXE"="C:\\Program Files\\BT Voyager 105 ADSL Modem\\dslstat.exe icon"
"DSLAGENTEXE"="C:\\Program Files\\BT Voyager 105 ADSL Modem\\dslagent.exe"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
"UnlockerAssistant"="\"C:\\Program Files\\Unlocker\\UnlockerAssistant.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"Win32 Configuration"="videosd32.exe"
"tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00


[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Win32 Configuration"="videosd32.exe"
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=dword:00000000

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0


[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F]
Shell\AutoRun\command F:\LaunchU3.exe -a
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_ENTDRV51


– End of Deckard's System Scanner: finished at 2007-04-09 at 18:08:56 ———

Gary, This is all that appeared. No minimised file. Lorna

Deckard's System Scanner v20070328.36
Extra logfile - please post this as an attachment with your post.
——————————————————————————–

– System Information ———————————————————-

Microsoft Windows XP Home Edition (build 2600) SP 2.0
Architecture: X86; Language: English

CPU 0: Intel® Pentium® 4 CPU 2.53GHz
Percentage of Memory in Use: 69%
Physical Memory (total/avail): 511 MiB / 154.46 MiB
Pagefile Memory (total/avail): 1249.88 MiB / 909.09 MiB
Virtual Memory (total/avail): 2047.88 MiB / 2003.36 MiB

A: is Removable (No Media)
C: is Fixed (NTFS) - 74.49 GiB total, 56.45 GiB free.
D: is CDROM (No Media)
E: is CDROM (No Media)


– Security Center ————————————————————-

AUOptions is scheduled to auto-install.
Windows Internal Firewall is disabled.

FW: ZoneAlarm Firewall v6.0.667.000 (Zone Labs, Inc.)


– Environment Variables ——————————————————-

ALLUSERSPROFILE=C:\Documents and Settings\All Users.WINDOWS
APPDATA=C:\Documents and Settings\Lorna Caswell.OX163JXORENX8MZ\Application Data
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=OX163JXORENX8MZ
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Lorna Caswell.OX163JXORENX8MZ
LOGONSERVER=\\OX163JXORENX8MZ
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\WBEM;C:\Program Files\Common Files\Adaptec Shared\System
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 2 Stepping 7, GenuineIntel
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=0207
ProgramFiles=C:\Program Files
PROMPT=$P$G
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\LORNAC~1.OX1\LOCALS~1\Temp
TMP=C:\DOCUME~1\LORNAC~1.OX1\LOCALS~1\Temp
tvdumpflags=8
USERDOMAIN=OX163JXORENX8MZ
USERNAME=Lorna Caswell
USERPROFILE=C:\Documents and Settings\Lorna Caswell.OX163JXORENX8MZ
windir=C:\WINDOWS


– User Profiles —————————————————————

Lorna Caswell.OX163JXORENX8MZ (admin)
John Caswell.OX163JXORENX8MZ (admin)
GRANDCHILDREN.OX163JXORENX8MZ (admin)
Cat Club.OX163JXORENX8MZ (admin)
Administrator (admin)


– Add/Remove Programs ———————————————————

–> C:\PROGRA~1\BTBROA~1\Uninstall.exe btbb
–> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\Audio2K\CTMixer.isu"
–> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\Audio2K\Midi.isu"
–> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\Audio2K\PlayCenter\Player.isu"
–> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\Audio2K\Recorder\Recorder.isu"
–> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\Audio2K\Wstudio.isu"
–> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\News\CTNews.isu"
–> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\Uninstall\Installer.isu"
–> C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\system32\UninstIPP.isu
–> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Ad-Aware SE Personal –> C:\PROGRA~1\Lavasoft\AD-AWA~2\UNWISE.EXE C:\PROGRA~1\Lavasoft\AD-AWA~2\INSTALL.LOG
Adobe Photoshop Album 2.0 Starter Edition –> MsiExec.exe /I{11B569C2-4BF6-4ED0-9D17-A4273943CB24}
Adobe Reader 7.0.9 –> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70900000002}
ArcSoft Panorama Maker 3.0 –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1CABB679-3958-44AA-BFFF-4E68A2684255}\Setup.exe" -l0x9 -uninst
AVG Anti-Spyware 7.5 –> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe
BCM V.92 56K Modem –> C:\WINDOWS\BCMSMU.exe quiet
Beach Head 2002 –> C:\PROGRA~1\BEACHH~1\unwise.exe C:\PROGRA~1\BEACHH~1\INSTALL.LOG
BT Broadband Basic Help –> C:\WINDOWS\Motive\btbb\MCCUninst.exe
BT Voyager 105 ADSL Modem –> C:\Program Files\BT Voyager 105 ADSL Modem\uninstall.exe
BT Yahoo! Applications –> C:\Program Files\Yahoo!\common\uninstall.exe
BUM –> MsiExec.exe /I{55937F00-A69B-4049-8D3A-1C7729742B6F}
Classic PhoneTools –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E3436EE2-D5CB-4249-840B-3A0140CC34C3}\setup.exe" -l0x9 ControlPanel
Dell ResourceCD –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D78653C3-A8FF-415F-92E6-D774E634FF2D}\setup.exe"
Disney's Treasure Planet: Battle at Procyon –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{465DE3B1-1207-4BBA-828A-0F3ABED81603}\setup.exe" -l0x9 Uninstall
Elasto Mania –> C:\PROGRA~1\ELASTO~1\UNWISE.EXE C:\PROGRA~1\ELASTO~1\INSTALL.LOG
Electronic Arts Product Registration –> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{D7D50E0C-27DD-4999-BC05-E026B580F93A} /l1033
FotoStation Easy –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{67DD948A-974D-41B7-9723-036BCFA45232}\Setup.exe"
Fur Fighters Demo –> MsiExec.exe /X{2DA948A2-4FF9-44C2-BDC8-7A0EC9E5D415}
HijackThis 1.99.1 –> C:\Documents and Settings\Lorna Caswell.OX163JXORENX8MZ\My Documents\Unzipped\hijackthis[1]\HijackThis.exe /uninstall
Hillbilly Whack! 1.0 –> C:\Program Files\Hillbilly Whack!\Uninstal.exe
I Live at Santa's House –> C:\PROGRA~1\ILASH\sh_unins.exe C:\PROGRA~1\ILASH\SM_INST.LOG
IBM ViaVoice Command and Control Runtime 5.3 - UK English –> C:\ViaVoice\Bin\vunUK.exe ProdRunControl Dc En_UK 'IBM ViaVoice™ Command and Control Runtime' C:\WINDOWS\IsUninst.exe -fC:\ViaVoice\DeIsL2.isu
IBM ViaVoice Outloud Runtime - UK English –> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\ViaVoice Outloud\DeIsL2.isu"
Kaspersky Online Scanner –> C:\WINDOWS\system32\KASPER~1\KASPER~1\kavuninstall.exe
KODAK EASYSHARE Gallery Easy Upload, v2.0 –> C:\Documents and Settings\Lorna Caswell.OX163JXORENX8MZ\Local Settings\Application Data\KodakGallery\EasyShareSetup\$SETUP_140007_28a1bb\Setup.exe /APR-REMOVE
Lemmings Revolution –> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Psygnosis\Lemmings Revolution Demo\Uninst.isu"
Mall Tycoon 2 –> C:\WINDOWS\Mall Tycoon 2 Uninstaller.exe
McAfee VirusScan Enterprise –> MsiExec.exe /I{5DF3D1BB-894E-4DCD-8275-159AC9829B43}
McDonald's™ The Hobbit™ Demo 1 –> C:\Program Files\Common Files\Sierra\Uninstall\HobbitUn.exe
Microsoft Office XP Professional with FrontPage –> MsiExec.exe /I{90280409-6000-11D3-8CFE-0050048383C9}
Microsoft Pinball Arcade Trial –> "C:\Program Files\Microsoft Games\Pinball Arcade Trial\UNINSTAL.EXE" /runtemp
Microsoft Works 7.0 –> MsiExec.exe /I{764D06D8-D8DE-411E-A1C8-D9E9380F8A84}
Muscle Car 3 Demo –> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{53DAEDD5-86EC-45A4-9878-D711D8BCC289}
My Disney Kitchen –> C:\WINDOWS\IsUninst.exe -fC:\PROGRA~1\DISNEY~1\MYDISN~1\DeIsL2.isu
Nikon View 5 –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AAB84E83-C8DF-4752-9DFC-2E2A48EE5E9F}\setup.exe" UNINSTALL
NVIDIA Display Driver –> C:\WINDOWS\system32\nvudisp.exe Uninstall C:\WINDOWS\system32\nvdisp.nvu,NVIDIA Display Driver
Petz 4 (remove only) –> "C:\Program Files\PF.Magic\Petz 4\uninstall.exe"
Pirates of the Caribbean –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\Bethesda Softworks\Pirates of the Caribbean\PCUninstall\Setup.exe" -l0x9
PowerDVD –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall
Presto! ImageFolio 4 –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{783033B0-D8E6-11D5-9293-0050BA073EEC}\setup.exe" -l0x9
Presto! Mr. Photo 3 –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BDD8B3C0-0877-418D-ACC9-2AB0064B901A}\Setup.exe" -l0x9
QuickTime –> C:\WINDOWS\unvise32qt.exe C:\WINDOWS\system32\QuickTime\Uninstall.log
RealPlayer Basic –> C:\Program Files\Common Files\Real\Update\\rnuninst.exe RealNetworks|RealPlayer|6.0
Serif PagePlus 6.0 –> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Serif\UninstPP60.isu"
Smart Start UP –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2C9241DC-E141-4BB9-99F2-0BC54D81862F}\setup.exe" -l0x9
Sound Blaster AudioPCI –> C:\Program Files\Creative\Uninstall\CTUNINST.EXE /U:UNINST1.INI
SoundMAX –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\setup.exe"
Spy Sweeper –> C:\WINDOWS\unSpySweeper.exe
Theme Hospital –> C:\WINDOWS\uninst.exe -f"C:\Program Files\Bullfrog\Hospital\DeIsL2.isu"
Theme Park World –> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Bullfrog\Theme Park World\Uninst.isu" -c"C:\Program Files\Bullfrog\Theme Park World\uninst.dll" -BFLANG=2057
Time Force –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BC2092E0-55C4-11D5-B4F8-00A0CCE39AAB}\SETUP.EXE" TimeForceUninstall
Unlocker 1.8.5 –> C:\Program Files\Unlocker\uninst.exe
WinZip –> "C:\Program Files\WinZip\WINZIP32.EXE" /uninstall
ZoneAlarm –> C:\Program Files\Zone Labs\ZoneAlarm\zauninst.exe


– End of Deckard's System Scanner: finished at 2007-04-09 at 22:09:13 ———
Lorna.