What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved]Hjt Log For Missing Control Panel

27 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Trevuren: The reply in the text file was: ! REG.EXE VERSION 3.0 HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel –TvH
Post #17
So nothing blocking you out there. Let's try another key: cmd /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system" /s >> %systemdrive%\Result.txt && notepad %systemdrive%\Result.txt Same procedure as before.
Post #18
Trevuren: This one is: ! REG.EXE VERSION 3.0 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\system –TvH
Post #21
This probably will not work but it is worth a try inasmuch as I am running out of ideas. This usually requires the original CD. With all the time that we have spent on this problem, you would have been up and running a long time ago with a format and reinstall. :rofl:

1. Please go to Start -> Run -> type cmd and press Enter.

2. At the command prompt type sfc /scannow, making sure to put a space between the "c" and the slash, and then press Enter. This will run the System File Checker.

3. Follow the prompts, and insert your Windows installation CD if requested.

4. Then please REBOOT your computer.
Post #22
Trevuren: I ran scannow. I was asked to insert the CD on a drive, and did so. It spent a bit of time doing its bit. I rebooted. Things didn't change. I still cannot access the Control Panel. Sometimes I get a window for the CP with the flashlight searching for a minute or two, but then the window goes away, and I get a DrWatson Postmortem Debugger message, and am asked to send a report to Microsoft, which never seems to get sent. If I don't get the screen I man (or may not) get the DrWatson message. Regardless, I then have to get into the Task Manager and end the DrWatson process to get back to using the PC at all. All this has been happening without fail since I upgraded to XP Home. Other than that, things work fine–I think. Short of animal sacrifice, it appears that I've come up with a problem that no one seems able to fathom. I don't know whether to be amazed or in total frustration with the situation. I think I'll go with amazed–for now. What other options, short of ponying up yet more $$$ to Microsoft to purchase a full XP Home disk to fix what shouldn't need fixing in the first place, do I have? There's GOT to be something… Thanks for all your help and patience so far–TvH
Post #23
Download Deckard's System Scanner to your Desktop from either of these locations:
  • Close all applications and windows.
  • Double-click on dss.exe to run it, and follow the prompts.
  • When the scan is complete, a text file will open - Main.txt
  • Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of Main.txt in your thread in the HijackThis Log Help Forum.
  • A folder, C:\Deckard, will also open. In it will be another text file, Extra.txt.
  • Post Extra.txt in your reply. Due to the length of these reports, it may be advisable to use a separate reply for the Extra.txt file
Note: some firewalls may warn that sigcheck.exe is trying to access the internet - please ensure that you allow sigcheck.exe permission to do so.

What Deckard's System Scanner will do:

  • create a new System Restore point in Windows XP and Vista.
  • clean your Temporary Files, Downloaded Program Files, and Internet Cache Files, and also empty the Recycle Bin on all drives.
  • check some important areas of your system and produce a report for your analyst to review. Deckard's System Scanner automatically runs HijackThis for you, but it will also install and place a shortcut to HijackThis on your desktop if you do not already have HijackThis installed.


Reports to post:
  • Main.Txt
  • Extra.txt
Post #24
Trevuren:

Ran Deckard's. Here's the Main.txt log:

Deckard's System Scanner v20070711.54
Run by [removed] on 2007-07-16 at 20:22:04
Computer is in Normal Mode.
——————————————————————————–

– System Restore ————————————————————–

Successfully created a Deckard's System Scanner Restore Point.


– Last 1 Restore Point(s) –
1: 2007-07-17 01:22:14 UTC - RP23 - Deckard's System Scanner Restore Point


Backed up registry hives.

Performed disk cleanup.


– HijackThis (run as default.exe) ———————————————

Logfile of HijackThis v1.99.1
Scan saved at 8:24:51 PM, on 7/16/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\Documents and Settings\default\Desktop\dss.exe
C:\DOCUME~1\ALLUSE~1\Desktop\SYSTEM~1\HIJACK~1\default.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN2\YCOMP5_5_7_0.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN2\YCOMP5_5_7_0.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: POWERR~1.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\All Users\Start Menu\Programs\>IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: WebWorks Help 2.0 - file://C:\Program Files\procreate Painter Classic\Help\wwhelp2.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedCon…bin/AvSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://zone.msn.com/bingame/rtlw/default/R…bGameLoader.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe


– HijackThis Fixed Entries (C:\DOCUME~1\ALLUSE~1\Desktop\SYSTEM~1\HIJACK~1\backups\) ——————————————————————————–

backup-20050318-213023-728 O15 - Trusted Zone: *.mt-download.com (HKLM)
backup-20050318-213023-645 O15 - Trusted IP range: 206.161.125.149
backup-20050318-213023-425 O15 - Trusted IP range: 206.161.125.149 (HKLM)
backup-20050323-173614-957 R3 - Default URLSearchHook is missing
backup-20050318-213023-759 O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php…8a29296baabe1d6
backup-20050318-213023-738 O16 - DPF: {00000EF1-0786-4633-87C6-1AA7A44297DA} - http://install.spywarelabs.com/landing/253…rapperouter.exe
backup-20050318-213023-130 O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/03863ca7510940…ip/RdxIE601.cab
backup-20050318-213024-839 O16 - DPF: {87D1A6EF-8CBC-458A-84B5-0333562418CD} - http://www.sitetracking.info/cttdl.cab
backup-20050318-233557-564 O15 - Trusted IP range: 206.161.125.149
backup-20050318-233557-854 O15 - Trusted IP range: 206.161.125.149 (HKLM)
backup-20050318-234634-261 R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = http://clearsurfing.net/srch.php?qq=%s
backup-20050318-234634-834 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
backup-20050318-234634-614 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
backup-20050318-234634-823 R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = about:blank
backup-20050318-234634-646 R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
backup-20050318-234634-913 R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
backup-20050318-234634-239 R3 - URLSearchHook: (no name) - {B21B6847-4A17-C1E5-A278-02504198DFDF} - ms-its.dll (file missing)
backup-20050401-212742-952 O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe
backup-20050318-234634-908 O2 - BHO: PynixObj Class - {00000000-DD60-0064-6EC2-6E0100000000} - C:\WINDOWS\PYNIX.DLL
backup-20050318-234634-947 O3 - Toolbar: FreshBar - {06ABAA2D-34AB-4902-A326-409BD9B9A7A5} - C:\WINDOWS\SYSTEM\IECUSTOM32.DLL
backup-20050318-234634-702 O4 - HKLM\..\Run: [pmr] C:\Program Files\Common Files\Presentia\pmr.exe
backup-20050318-234634-439 O4 - HKLM\..\Run: [95inf32w] C:\WINDOWS\SYSTEM\95inf32w.exe
backup-20050318-234634-962 O4 - HKLM\..\Run: [xitdhcifgdbv] C:\WINDOWS\SYSTEM\znngvj.exe
backup-20050318-234634-517 O4 - HKLM\..\Run: [FARMMEXT] C:\WINDOWS\FARMMEXT.exe
backup-20050318-234634-758 O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
backup-20050318-234634-677 O4 - HKLM\..\Run: [wormexe] prgsys0984.exe
backup-20050318-234634-741 O4 - HKLM\..\Run: [EbatesMoeMoneyMaker0] "C:\PROGRAM FILES\EBATES_MOEMONEYMAKER\EbatesMoeMoneyMaker0.exe"
backup-20050318-234634-820 O4 - HKLM\..\RunServices: [APIBZ32.EXE] C:\WINDOWS\SYSTEM\APIBZ32.EXE
backup-20050318-234635-982 O4 - HKCU\..\Run: [ATLIEHELPER] Brong32.exe
backup-20050318-234635-754 O4 - HKCU\..\Run: [defect08] Shaitan1678.exe
backup-20050318-234635-705 O4 - HKCU\..\Run: [corrida] newbreed.exe
backup-20050323-173614-736 O2 - BHO: DLMaxObj Class - {00000000-59D4-4008-9058-080011001200} - C:\WINDOWS\DLMAX.DLL
backup-20050318-234635-587 O4 - Startup: hkhhkf.exe
backup-20050318-234635-379 O15 - Trusted IP range: 206.161.125.149
backup-20050318-234635-321 O15 - Trusted IP range: 206.161.125.149 (HKLM)
backup-20050318-234635-759 O16 - DPF: {24D1BDCE-D835-11D6-BF84-0050047EA0E7} (BlueStream_Flash Class) - http://www.rovion.com/Controls/Rovion.cab?affiliate=BRANDY
backup-20050323-173614-695 O4 - HKLM\..\Run: [znngvj] c:\windows\system\znngvj.exe
backup-20050323-173614-510 O4 - HKLM\..\Run: [FARMMEXT] C:\WINDOWS\FARMMEXT.exe
backup-20050323-173614-332 O4 - Startup: HKHHKF.EXE
backup-20050323-173614-897 O9 - Extra button: (no name) - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\PROGRAM FILES\EBATES_MOEMONEYMAKER\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
backup-20050323-173615-422 O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 69.50.184.84,195.225.176.37
backup-20050325-053146-458 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id==
backup-20050325-053146-375 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id==
backup-20050325-053146-250 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id==
backup-20050325-053146-645 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id==
backup-20050325-053146-459 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
backup-20050325-053146-282 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
backup-20050325-053146-579 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q==
backup-20050325-053146-778 O2 - BHO: DLMaxObj Class - {00000000-59D4-4008-9058-080011001200} - C:\WINDOWS\DLMAX.DLL
backup-20050325-053146-303 O4 - HKLM\..\Run: [driver64] clamav.exe
backup-20050325-053146-296 O4 - HKLM\..\Run: [FARMMEXT] C:\WINDOWS\FARMMEXT.exe
backup-20050326-232623-528 O4 - Startup: Resume Windows Update Installation.lnk = C:\WINDOWS\Windows Update Setup Files\ie6setup.exe
backup-20050401-212743-304 O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe
backup-20070712-162334-418 O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
backup-20070712-162335-141 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
backup-20070712-162336-547 O16 - DPF: Win32 Classes -
backup-20070712-162336-752 O16 - DPF: {B4831DED-3A57-4CC6-9E4B-0E7C5B08DBF4} - http://www.alwaysupdatednews.com/install/aun_0008.exe
backup-20070712-221457-630 O4 - HKLM\..\RunServices: [MOSearch] C:\PROGRA~1\COMMON~1\System\MOSearch\Bin\mosearch.exe
backup-20070712-221457-816 O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

– File Associations ———————————————————–

.bat - batfile - DefaultIcon - C:\WINDOWS\SYSTEM32\SHELL32.DLL,-153
.hlp - hlpfile - DefaultIcon - C:\WINDOWS\SYSTEM32\SHELL32.DLL,23
.ini - inifile - DefaultIcon - shell32.dll,-151
.js - JSFile - DefaultIcon - C:\WINDOWS\system32\migicons.exe,12
.reg - regfile - DefaultIcon - C:\WINDOWS\regedit.exe,1
.txt - txtfile - DefaultIcon - shell32.dll,-152
.vbs - VBSFile - DefaultIcon - C:\WINDOWS\system32\migicons.exe,11


– Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ———————

S0 kl1 - c:\windows\system32\drivers\kl1.sys (file missing)
S3 catchme - c:\docume~1\default\locals~1\temp\catchme.sys (file missing)


– Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ——————–

All services whitelisted.


– Scheduled Tasks ————————————————————-

2007-07-16 20:15:04 360 –a—— C:\WINDOWS\Tasks\PCHealth Scheduler for Data Collection.job
2007-07-07 23:00:02 502 –a—— C:\WINDOWS\Tasks\Tune-up Application Start.job
2007-07-06 22:34:32 258 –a—— C:\WINDOWS\Tasks\Uninstall Expiration Reminder.job
2001-08-27 11:15:10 236 –a—— C:\WINDOWS\Tasks\Video Reminder.job
2001-08-27 09:07:08 416 –a—— C:\WINDOWS\Tasks\Symantec NetDetect.job


– Files created between 2007-06-16 and 2007-07-16 —————————–

2007-07-12 22:28:44 0 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-07-12 22:28:41 0 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-07-10 20:09:04 0 d——– C:\Documents and Settings\default\Application Data\Lavasoft
2007-07-10 16:43:38 0 d——– C:\Program Files\Microsoft FrontPage Express
2007-07-09 13:57:59 0 d——– C:\Documents and Settings\Rose vonHatten\Application Data\Macromedia
2007-07-09 13:56:57 0 d——– C:\Documents and Settings\Rose vonHatten\Application Data\Mozilla
2007-07-09 13:53:56 0 d——– C:\Documents and Settings\Rose vonHatten\Application Data\AVG7
2007-07-08 22:49:27 0 d——– C:\Documents and Settings\Grace vonHatten\Application Data\Macromedia
2007-07-08 22:47:50 0 d——– C:\Documents and Settings\Grace vonHatten\Application Data\Mozilla
2007-07-08 22:45:57 0 d——– C:\Documents and Settings\Grace vonHatten\Application Data\AVG7
2007-07-08 22:44:51 0 d——– C:\Documents and Settings\Grace vonHatten\Application Data\Identities
2007-07-08 22:44:27 0 d——– C:\Documents and Settings\Grace vonHatten\Application Data\WTablet
2007-07-08 22:44:18 0 d–h—– C:\Documents and Settings\Grace vonHatten\Templates
2007-07-08 22:44:18 0 dr——- C:\Documents and Settings\Grace vonHatten\Start Menu
2007-07-08 22:44:18 0 dr-h—– C:\Documents and Settings\Grace vonHatten\SendTo
2007-07-08 22:44:18 0 dr-h—– C:\Documents and Settings\Grace vonHatten\Recent
2007-07-08 22:44:18 0 d–h—– C:\Documents and Settings\Grace vonHatten\PrintHood
2007-07-08 22:44:18 0 d–h—– C:\Documents and Settings\Grace vonHatten\NetHood
2007-07-08 22:44:18 0 dr——- C:\Documents and Settings\Grace vonHatten\My Documents
2007-07-08 22:44:18 0 dr——- C:\Documents and Settings\Grace vonHatten\Favorites
2007-07-08 22:44:18 0 d——– C:\Documents and Settings\Grace vonHatten\Desktop
2007-07-08 22:44:18 0 d–hs—- C:\Documents and Settings\Grace vonHatten\Cookies
2007-07-08 22:44:18 0 dr-h—– C:\Documents and Settings\Grace vonHatten\Application Data
2007-07-08 22:44:18 0 d—s—- C:\Documents and Settings\Grace vonHatten\Application Data\Microsoft
2007-07-08 22:44:17 2621440 –ah—– C:\Documents and Settings\Grace vonHatten\ntuser.dat
2007-07-08 22:44:17 0 d–h—– C:\Documents and Settings\Grace vonHatten\Local Settings
2007-07-08 20:11:44 0 d——– C:\Documents and Settings\LocalService\Application Data\AVG7
2007-07-08 20:11:28 0 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2007-07-08 19:56:39 0 d——– C:\Documents and Settings\default\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142150}
2007-07-08 12:57:36 0 d——– C:\Documents and Settings\All Users\Application Data\MailFrontier
2007-07-08 12:57:18 11264 –a—— C:\WINDOWS\system32\SpOrder.dll
Post #25
And here's the Extra.txt log:

Deckard's System Scanner v20070711.54
Extra logfile - please post this as an attachment with your post.
——————————————————————————–

– System Information ———————————————————-

Microsoft Windows XP Home Edition (build 2600) SP 2.0
Architecture: X86; Language: English

CPU 0: Intel® Pentium® 4 CPU 1300MHz
Percentage of Memory in Use: 36%
Physical Memory (total/avail): 767.07 MiB / 489.64 MiB
Pagefile Memory (total/avail): 1878.32 MiB / 1576.27 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1945.73 MiB

A: is Removable (No Media)
C: is Fixed (FAT32) - 37.24 GiB total, 11.39 GiB free.
D: is CDROM (No Media)
E: is CDROM (No Media)


– Security Center ————————————————————-

AUOptions is scheduled to auto-install.
Windows Internal Firewall is disabled.

FirstRunDisabled is set.

FW: ZoneAlarm Firewall v7.0.362.000 (Check Point, LTD.)
AV: AVG 7.5.476 v7.5.476 (GRISOFT)

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


– Environment Variables ——————————————————-

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\default\Application Data
CLASSPATH=C:\PROGRA~1\PHOTOD~1.1\ADOBEC~1
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=PC_6
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\default
LOGONSERVER=\\PC_6
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\COMMAND;C:\ProgramFiles\CommonFiles\RoxioShared\DLLShared;C:\PROGRA~1\EGIRL_~1;C:\Program Files\Common Files\Roxio Shared\DLLShared;C:\WINDOWS\system32\WBEM
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 0 Stepping 10, GenuineIntel
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=000a
ProgramFiles=C:\Program Files
PROMPT=$p$g
PS5ROOT=C:\Program Files\Roxio\Easy CD Creator 6\PhotoSuite\
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\default\LOCALS~1\Temp
TMP=C:\DOCUME~1\default\LOCALS~1\Temp
TVDUMPFLAGS=8
USERDOMAIN=PC_6
USERNAME=default
USERPROFILE=C:\Documents and Settings\default
winbootdir=C:\WINDOWS
windir=C:\WINDOWS


– User Profiles —————————————————————

default (admin)
Rose vonHatten (admin)
Grace vonHatten (new local, admin)


– Add/Remove Programs ———————————————————

–> "C:\Program Files\Creative\SBLive\Program\Ctzapxx.EXE" /X /U /S
–> "C:\Program Files\Outlook Express\setup50.exe" /APP:WAB /CALLER:WIN9X /UNINSTALL /PROMPT
–> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
–> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\Launcher\Launcher.isu"
–> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\PlayCenter\Player.isu"
–> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\Recorder\Recorder.isu"
–> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\SBLive\AudioHQ.isu"
–> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\SBLive\Diagnose.isu"
–> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\SBLive\Midi.isu"
–> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\SBLive\Restore.isu"
–> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\SBLive\SBLiveXP.isu"
–> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\SBLive\SoundFont.isu"
–> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\SBLive\Wstudio.isu"
–> C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\mrun32.isu
–> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
1602 A.D. –> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\1602 A.D.\Uninst.isu"
Across Lite –> C:\WINDOWS\UNWISE.EXE C:\PROGRA~1\LITSOFT\ACROSS~1\INSTALL.LOG
Ad-Aware SE Personal –> C:\PROGRA~1\LAVASOFT\AD-AWA~2\UNWISE.EXE C:\PROGRA~1\LAVASOFT\AD-AWA~2\INSTALL.LOG
Adobe Acrobat 5.0 –> C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Common Files\Adobe\Acrobat 5.0\ME\Uninst.isu" -c"C:\Program Files\Common Files\Adobe\Acrobat 5.0\ME\Uninst.dll"
Adobe Acrobat Reader 3.01 –> C:\WINDOWS\uninst.exe -fC:\Acrobat3\Reader\DeIsL1.isu
Adobe Download Manager 1.2 (Remove Only) –> "C:\Program Files\Common Files\Adobe\ESD\uninst.exe"
Adobe Flash Player 9 ActiveX –> C:\WINDOWS\system32\Macromed\Flash\FlashUtil9c.exe -uninstallUnlock
Adobe PhotoDeluxe Business Edition 1.1 –> C:\WINDOWS\UNINST.EXE -f"C:\Program Files\PhotoDeluxe BE 1.1\DeIsL1.isu"
Adobe Photoshop Elements –> C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Adobe\Photoshop Elements\Uninst.isu" -c"C:\Program Files\Adobe\Photoshop Elements\Uninst.dll"
Adobe Reader 6.0.1 –> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A00000000001}
Adobe Shockwave Player –> C:\WINDOWS\SYSTEM32\MACROMED\SHOCKW~2\UNWISE.EXE C:\WINDOWS\SYSTEM32\MACROMED\SHOCKW~2\Install.log
Age of Mythology –> "C:\Program Files\Microsoft Games\Age of Mythology\UNINSTAL.EXE" /runtemp /addremove
AVG 7.5 –> C:\Program Files\Grisoft\AVG7\setup.exe /UNINSTALL
BadCopy Pro –> C:\PROGRA~1\JUFSOFT\BADCOPY\UNWISE.EXE C:\PROGRA~1\JUFSOFT\BADCOPY\INSTALL.LOG
Caere Scan Manager 4.02 –> C:\WINDOWS\UNSCAN40.EXE -f"C:\Program Files\Common Files\Caere\Scan Manager\DeIsL1.isu"
Canon PhotoRecord –> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Canon\PhotoRecord\Uninst.isu" -c"C:\Program Files\Canon\PhotoRecord\Program\uninstdll.dll"
Canon S9000 –> C:\WINDOWS\SYSTEM32\CJPDEL3I.EXE
Canon Utilities Easy-PhotoPrint –> C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Canon\Easy-PhotoPrint\Uninst.isu" -c"C:\Program Files\Canon\Easy-PhotoPrint\EZUNINST.DLL"
Canon Utilities PhotoStitch 3.1 –> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Canon\PhotoStitch\Uninst.isu"
Canon Utilities ZoomBrowser EX –> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Canon\ZoomBrowser EX\Uninst.isu" -c"C:\Program Files\Canon\ZoomBrowser EX\Program\uninstallutilities.dll"
Carmen Sandiego's Great Chase Through Time –> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\The Learning Company\Carmen Sandiego's Great Chase\Uninst.isu"
Carmen Sandiego's ThinkQuick Challenge –> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\The Learning Company\Carmen Sandiego ThinkQuick\Uninst.isu"
Carnivores Ice Age –> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Carnivores Ice Age\Uninst.isu"
Civilization III Complete Edition –> C:\PROGRAM FILES\COMMON FILES\INSTALLSHIELD\DRIVER\8\INTEL 32\IDRIVER.EXE /M{2157961D-0507-44A8-BCF2-1EE2D439E8DF}
Clue –> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Hasbro Interactive\Clue\Uninst.isu"
ClueFinders The Incredible Toy Store Adventure! –> C:\WINDOWS\TLCUninstall.exe -f "C:\Program Files\The Learning Company\ClueFinders The Incredible Toy Store Adventure!\Uninstall.xml"
ClueFinders® 3rd Grade Adventures –> C:\Program Files\The Learning Company\ClueFinders® 3rd Grade Adventures\uninstal.exe
ClueFinders® 5th Grade Adventures –> C:\Program Files\The Learning Company\ClueFinders® 5th Grade Adventures\uninstal.exe
ClueFinders® Search & Solve Adventures™ –> C:\Program Files\The Learning Company\ClueFinders Search & Solve Adventures\uninstal.exe
ClueFinders® Real World Adventure Kit –> C:\Program Files\The Learning Company\ClueFinders® Real World Adventure Kit\uninstal.exe
Colin McRae Rally –> C:\WINDOWS\IsUninst.exe -fC:\Codemasters\CMRally\Uninst.isu
Corel® Applications –> C:\WINDOWS\Corel\Uninst32.exe
DellTouch –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\ENGINE\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{706D5382-7381-4680-9DD0-161832578252}\setup.exe"
DivX Player –> C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
Gizmos and Gadgets! –> C:\WINDOWS\IsUninst.exe -fC:\Tlcwin\Ssgwincd\Uninst\DeIsL1.isu
Gotta Groove™ CD-ROM –> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Mattel Media\Gotta Groove™ CD-ROM\Uninst.isu"
Hemera Photo-Objects Gallery for HP –> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Photo-Objects Gallery for HP\Uninst.isu"
Hollywood –> C:\Hollywd\uninst16.exe -f"C:\Hollywd\deislog.1"
Hotfix for Windows Media Format 11 SDK (KB929399) –> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
HP PrecisionScan Pro –> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan Pro\Uninst.isu"
IMVU Avatar Chat Software –> C:\Documents and Settings\All Users\Desktop\Grace's\IMVU\Uninstall.exe
IrfanView (remove only) –> C:\PROGRAM FILES\IRFANVIEW\iv_uninstall.exe
J2SE Runtime Environment 5.0 Update 1 –> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150010}
Java™ SE Runtime Environment 6 Update 1 –> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
Jumpstart 5th Grade –> C:\WINDOWS\IsUninst.exe -fC:\KA\5G\DeIsL1.isu
Jumpstart 6th Grade v1.0 –> C:\WINDOWS\IsUninst.exe -fC:\KA\JS6G\DeIsL1.isu
Kaspersky Online Scanner –> C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
Kid Pix –> C:\WINDOWS\uninst.exe -fC:\Kidpix\DeIsL1.isu
Knowledge Munchers Deluxe –> C:\WINDOWS\uninst.exe -f"C:\Program Files\The Learning Company\Knowledge Muncher\DeIsL2.isu"
Language pack for Ad-Aware SE –> C:\PROGRA~1\LAVASOFT\AD-AWA~2\PLUGINS\LANGS\UNWISE.EXE C:\PROGRA~1\LAVASOFT\AD-AWA~2\PLUGINS\LANGS\INSTALL.LOG
LEGO Creator Harry Potter –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\ENGINE\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7FB70A9B-6591-42EB-BD84-6F9C55368E06}\SETUP.EXE"
LiveReg (Symantec Corporation) –> C:\Program Files\Common Files\Symantec Shared\LiveReg\VCSETUP.EXE /REMOVE
LiveUpdate 1.6 (Symantec Corporation) –> C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE /U
Logic Quest –> C:\WINDOWS\uninst.exe -fC:\TLCWIN\LQWINCD\uninstal\DeIsL1.isu
Logical Journey of the Zoombinis V1.1.0 –> C:\WINDOWS\uninst.exe -f"C:\Program Files\Broderbund Software\Zoombi32\DeIsL2.isu"
Magic School Bus - Earth –> C:\Program Files\Microsoft Kids\MSB Earth\System\MSBEUNST.EXE /L"C:\Program Files\Microsoft Kids\MSB Earth\System\MSB Earth.log"
Majesty –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\ENGINE\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CEAF3507-FCB3-11D2-850C-00C0F01410B1}\setup.exe" -uninst
MapleStory –> MsiExec.exe /I{F99C5427-4D78-43E2-B97E-F4C4E622D612}
Math Advantage 2001 –> C:\WINDOWS\IsUninst.exe -fC:\Mathadv4\Uninstma4.isu
Math for the Real World –> D:\setup.exe -funinst.ins
Math Munchers Deluxe –> C:\WINDOWS\uninst.exe -f"C:\Program Files\The Learning Company\Math Munchers Deluxe\DeIsL2.isu"
Microsoft Compression Client Pack 1.0 for Windows XP –> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Crimson Skies –> "C:\Program Files\Microsoft Games\Crimson Skies\UNINSTAL.EXE" /runtemp /addremove
Microsoft Data Access Components KB870669 –> C:\WINDOWS\muninst.exe C:\WINDOWS\INF\KB870669.inf
Microsoft Encarta Encyclopedia Standard 2001 –> MsiExec.exe /I{01001202-5D65-445A-B3B4-3DCE72BA0C6C}
Microsoft Office XP Professional with FrontPage –> MsiExec.exe /I{90280409-6000-11D3-8CFE-0050048383C9}
Microsoft Picture It! Express 2000 –> MsiExec.exe /I{A586D09E-1D2C-11D3-9A6B-00105A98B681}
Microsoft Picture It! Publishing 2001 –> MsiExec.exe /I{15D9EB74-998E-4A04-B468-51C2E7B32182}
Microsoft User-Mode Driver Framework Feature Pack 1.0 –> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Works 2001 Setup Launcher –> C:\Program Files\Microsoft Works Suite 2001\Setup\Launcher.exe D:\
Midnight Rescue! –> C:\WINDOWS\uninst.exe -fC:\Tlcwin\Ssrwincd\uninstal\DeIsL1.isu
Mission: T.H.I.N.K. –> C:\WINDOWS\uninst.exe -fC:\Tlcwin\Ssmwincd\uninstal\DeIsL1.isu
Modem Helper –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\ENGINE\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{00173640-AA6F-11D4-B229-002078017FBF}\SETUP.EXE" -uninst
Monopoly –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\ENGINE\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{20FA8AEE-E785-4F79-98EB-2067A8F395F4}\SETUP.EXE" -l0x9
Mozilla Firefox (2.0.0.4) –> C:\PROGRAM FILES\Mozilla Firefox\uninstall\helper.exe
MSXML4 Parser –> MsiExec.exe /I{01501EBA-EC35-4F9F-8889-3BE346E5DA13}
Multimedia Card Reader –> C:\PROGRAM FILES\COMMON FILES\INSTALLSHIELD\DRIVER\8\INTEL 32\IDRIVER.EXE /M{13B97BA0-1765-4EBA-8902-C6E30291F67B}
Nancy Drew: Message in a Haunted Mansion –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\ENGINE\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Nancy Drew\Message in a Haunted Mansion\SETUP.EXE"
NVIDIA Display Driver –> C:\WINDOWS\SYSTEM32\NVUDISP.EXE Uninstall C:\WINDOWS\SYSTEM\NvDisp.nvu,NVIDIA Display Driver
NVIDIA Drivers –> C:\WINDOWS\system32\nvudisp.exe UninstallGUI
Operation –> C:\WINDOWS\uninst.exe -f"C:\Program Files\Hasbro Interactive\Operation\DeIsL1.isu"
PageKeeper Standard 3.0 –> C:\WINDOWS\PKSUNIN.EXE -f"C:\Program Files\Caere\PageKeeper30\DeIsL1.isu"
penPalette 1.0 –> C:\WINDOWS\unvise32.exe C:\Program Files\uninstal.log
Perfect Scrapbook Maker Express –> MsiExec.exe /X{4BDAD330-094B-440D-8563-64AD47F214C9}
Pinball Science –> C:\WINDOWS\UNINST.EXE -r"DK Multimedia\Pinball Science.01.01.0002" -n"Pinball Science" -fC:\PROGRA~1\DKMULT~1\PINBAL~1\DEISL1.ISU -cC:\PROGRA~1\DKMULT~1\PINBAL~1\UNINST.DLL
procreate™ Painter Classic™ –> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\procreate Painter Classic\UninstPPC.isu"
Puzz-3D Thomas Kinkade –> C:\WINDOWS\unvise32.exe C:\Program Files\Puzz3DTK\uninstal.log
Puzz-3D Thomas Kinkade –> C:\WINDOWS\unvise32.exe C:\Program Files\Puzz3DTK\uninstal.log
QuickTime –> C:\WINDOWS\unvise32qt.exe C:\WINDOWS\SYSTEM32\QuickTime\Uninstall.log
QuickTime for Windows (32-bit) –> C:\WINDOWS\QTW32DEL.EXE
Rally Trophy –> MsiExec.exe /I{42A4EC40-09BC-427C-B657-67978B784058}
Reader Rabbit 1st Grade –> C:\Program Files\The Learning Company\Reader Rabbit 1st Grade\uninstal.exe
RealPlayer –> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
REALTEK Gigabit and Fast Ethernet NIC Driver –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{94FB906A-CF42-4128-A509-D353026A607E}\Setup.exe" -l0x9 REMOVE
RollerCoaster Tycoon –> C:\WINDOWS\UniFish3.exe C:\Program Files\Hasbro Interactive\RollerCoaster Tycoon\RollerCoaster Tycoon.log
Sandlot Games Client Services –> "C:\Program Files\Common Files\Sandlot Shared\unins000.exe"
Scooby-Doo™, Showdown in Ghost Town™ –> C:\Program Files\The Learning Company\Scooby-Doo™, Showdown in Ghost Town™\uninstal.exe
Security Update for Step By Step Interactive Training (KB923723) –> "C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
Shockwave –> C:\WINDOWS\SYSTEM32\MACROMED\SHOCKW~1\UNWISE.EXE C:\WINDOWS\SYSTEM32\MACROMED\SHOCKW~1\INSTALL.LOG
SimLife –> C:\WINDOWS\uninst.exe -f"C:\Program Files\Maxis\SimLife\DeIsL1.isu"
Sound Blaster Live! Value –> C:\Program Files\Creative\SBLive\PROGRAM\CTUNINST.EXE
Sound Blaster Live! Web 2K/XP –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3FCAADB8-EB1B-11D6-AB2D-0090271A23A2}\Setup.exe" -l0x9
Spellbound! –> C:\WINDOWS\uninst.exe -fC:\Tlcwin\Ssbcd\uninstal\DeIsL1.isu
Spybot - Search & Destroy 1.4 –> "C:\Program Files\Spybot - Search & Destroy\unins000.exe"
SpywareBlaster v3.3 –> "C:\Program Files\SpywareBlaster\unins000.exe"
SpywareGuard v2.2 –> "C:\Program Files\SpywareGuard\unins000.exe"
Street Atlas USA 2004 –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\ENGINE\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E4C4A71B-733A-4099-AB44-05BC5793D5B9}\SETUP.EXE" -l0x9 NoMode
Street Atlas USA 2004 Data –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\ENGINE\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{224D1F4B-A9D0-413C-8567-22BC04FDC203}\SETUP.EXE" -l0x9 NoMode
StudyWorks 2001 –> C:\WINDOWS\IsUninst.exe -f"c:\studyworks 2001\Uninst.isu" -c"c:\studyworks 2001\uninst.dll
Super Collapse! –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\ENGINE\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A301896D-9F55-4492-B518-30EAC4C723E1}\SETUP.EXE" -l0x9
Tablet –> C:\Program Files\Tablet\Remove.exe /u
The ClueFinders' Math Ages 9-12 –> C:\WINDOWS\IsUninst.exe -fC:\Tlcwin\CFMath\Uninst\DeIsL1.isu
The ClueFinders 4th Grade Adventures –> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\The Learning Company\The ClueFinders 4th Grade Adventures\Uninst.isu"
The ClueFinders 6th Grade Adventures –> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\The Learning Company\The ClueFinders 6th Grade Adventures\Uninst.isu"
The ClueFinders® Mystery of the Missing Amulet™ –> C:\Program Files\The Learning Company\The ClueFinders® Mystery of the Missing Amulet™\uninstall.exe
The Oregon Trail –> C:\WINDOWS\uninst.exe -f"C:\Program Files\The Learning Company\Oregon Trail\DeIsL1.isu"
Titanic –> C:\Program Files\CyberFlix\Titanic\TITANIC.EXE -U
User's Guides –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\ENGINE\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}\setup.exe"
WebShop –> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Boomerang Software\WebShop\Uninst.isu"
Windows Media Format 11 runtime –> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows XP Uninstall –> %SYSTEMROOT%\system32\osuninst.exe
Word Munchers Deluxe –> C:\WINDOWS\uninst.exe -f"C:\Program Files\The Learning Company\WMuncher\DeIsL2.isu"
Words v2.0 –> "C:\Program Files\Words\unins000.exe"
YOU DON'T KNOW JACK Movies –> c:\windows\ydkjmvs\unwise.exe c:\windows\ydkjmvs\movies.log
YOU DON'T KNOW JACK Television –> C:\SIERRA\YOUDON~1\UNWISE.EXE /A C:\SIERRA\YOUDON~1\INSTALL.LOG
YOU DON'T KNOW JACK Volume 2 –> c:\windows\YDKJ2\uninst.exe
ZoneAlarm –> C:\Program Files\Zone Labs\ZoneAlarm\zauninst.exe
Zoo Tycoon: Complete Collection –> "C:\Program Files\Microsoft Games\Zoo Tycoon\UNINSTAL.EXE" /runtemp /addremove
Zoombinis Mountain Rescue™ –> C:\Program Files\The Learning Company\Zoombinis Mountain Rescue\uninstall.exe


– End of Deckard's System Scanner: finished at 2007-07-16 at 20:32:28 ———
Post #26
I saw something in your "File Associations" that is a associated with Smitfraud usually.

Try this:

Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.

Double-click smitfraudfix.exe
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc…processutil.htm


Regards,

Trevuren
Post #27
Trevuren: Ran SmitFraud Fix. Here's the report–TvH SmitFraudFix v2.204 Scan done at 21:47:20.48, Tue 07/17/2007 Run from C:\Documents and Settings\default\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is FAT32 Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Process C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\Tablet.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\tcpsvcs.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\WTablet\TabUserW.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\Tablet.exe C:\WINDOWS\system32\CTHELPER.EXE C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SpywareGuard\sgmain.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\SpywareGuard\sgbhp.exe C:\WINDOWS\system32\cmd.exe »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS C:\WINDOWS\logo.gif FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 C:\WINDOWS\system32\migicons.exe FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\default »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\default\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\default\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files C:\Program Files\Image ActiveX Access\ FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Rustock »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: 3Com 3C920 Integrated Fast Ethernet Controller (3C905C-TX Compatible) DNS Server Search Order: 24.217.0.55 DNS Server Search Order: 24.217.0.5 DNS Server Search Order: 24.217.1.162 HKLM\SYSTEM\CCS\Services\Tcpip\..\{21DEFFCC-C2C0-455B-9735-6920AF3444C3}: DhcpNameServer=[removed] [removed] [removed] HKLM\SYSTEM\CS1\Services\Tcpip\..\{21DEFFCC-C2C0-455B-9735-6920AF3444C3}: DhcpNameServer=[removed] [removed] [removed] HKLM\SYSTEM\CS2\Services\Tcpip\..\{21DEFFCC-C2C0-455B-9735-6920AF3444C3}: DhcpNameServer=[removed] [removed] [removed] HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed] [removed] HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed] [removed] »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End
Post #28
Please print out or copy these instructions/tutorial to Notepad as the internet will not be available to you at certain points of the removal process (while in Safe Mode). Make sure to work through all the Steps in the exact order in which they are listed below. If there's anything that you don't understand, ask your question(s) before moving on with the fixes.


1. Download and update AVG AntiSpyware 7.5.

First download AVG AntiSpyware from HERE and save that file to your desktop.
This is a 30 day trial of the program
  • Once you have downloaded AVG AntiSpyware, locate the icon on the desktop and double-click it to launch the set up program.
  • Once the setup is complete, run AVG AntiSpyware and update the definition files.
  • On the main screen select the icon "Update" then select the "Update now" link.
    • Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.
  • Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
  • Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
  • Under "Reports"
    • Select "Automatically generate report after every scan"
    • Un-Select "Only if threats were found"
Close AVG AntiSpyware, Do Not run a scan just yet


2. Reboot your computer into Safe Mode.
  • If the computer is running, shut down Windows, and then turn off the power.
  • Wait 30 seconds, and then turn the computer on.
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
  • Login on your usual account.
3. Once in Safe Mode, double-click Smitfraudfix.exe
Select option #2 - Clean by typing 2 and press Enter to delete the infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.
The tool will now check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. Reboot in Safe Mode.

The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.


4. Clean out your Temporary Internet files. Proceed as follows:
  • Quit Internet Explorer and quit any instances of Windows Explorer.
  • Click Start, click Control Panel, and then double-click Internet Options.
  • On the General tab, click Delete Files under Temporary Internet Files.
  • In the Delete Files dialog box, tick the Delete all offline content check box , and then click OK.
  • On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
  • Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
  • Click OK.

5. Next Click Start, click Control Panel and then double-click Display. Click on the Desktop tab, then click the Customize Desktop button. Click on the Web tab. Under Web Pages you should see a checked entry called Security info or something similar. If it is there, select that entry and click the Delete button. Click Ok then Apply and Ok.

6. Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.

7. Launch AVG AntiSpyware by double-clicking the icon on your desktop.
  • Note: IMPORTANT: Do not open any other windows or programs while AVG AntiSpyware is scanning, it may interfere with the scanning proccess
  • Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".
  • AVG AntiSpyware will now begin the scanning process, be patient this may take a little time.
    Once the scan is complete do the following:
  • If you have any infections you will prompted, then select "Apply all actions"
  • Next select the "Reports" icon at the top.
  • Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).
8. Close AVG AntiSpyware and Reboot back into Normal Windows Mode

9. Run SmitfraudFix. Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #3 - Delete Trusted zone by typing 3 and press Enter
Answer YES to the question "Restore Trusted Zone?" by Typing Y and hit Enter.

Note, if you use SpywareBlaster and/or IE-SPYAD, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the program and re-protect all items. For IE-SPYAD, run the batch file and reinstall the protection.

10. Please Post the following logs:
  • c:\rapport.txt
  • AVG AntiSpyware log
  • A new HijackThis log
Your may need several replies to post the requested logs, otherwise they might get cut off.

Regards,

Trevuren
Post #29 last edited
Trevuren: I tried to follow all your instructions, and believe I succeeded. However, my screen in Safe Mode was only 640 X 480, so some of the windows I needed didn't show everything–and I couldn't move the windows around enough to see everything. I couldn't see my login on the screen in Safe Mode (my wife and daughters also use the machine, and their names are higher on the list than mine), so I had to login as Administrator–I hope that doesn't screw things up. I ran AVG Spyware, and told it to save a report–it didn't. Some items were supposedly quarantined, but I checked it after rebooting, and have no proof of that. That means that I have no AVG Spyware report, unfortunately. I DO, however, have the other two. I'll list rapport.txt first, then the HJT log in a separate message. Oh–I could access the Control Panel in Safe Mode. Thanks for all you've helped me with so far–TvH SmitFraudFix v2.204 Scan done at 18:46:05.49, Wed 07/18/2007 Run from C:\Documents and Settings\default\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is FAT32 Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files C:\WINDOWS\logo.gif Deleted C:\WINDOWS\system32\migicons.exe Deleted C:\Program Files\Image ActiveX Access\ Deleted »»»»»»»»»»»»»»»»»»»»»»»» DNS HKLM\SYSTEM\CCS\Services\Tcpip\..\{21DEFFCC-C2C0-455B-9735-6920AF3444C3}: DhcpNameServer=[removed] [removed] [removed] HKLM\SYSTEM\CS1\Services\Tcpip\..\{21DEFFCC-C2C0-455B-9735-6920AF3444C3}: DhcpNameServer=[removed] [removed] [removed] HKLM\SYSTEM\CS2\Services\Tcpip\..\{21DEFFCC-C2C0-455B-9735-6920AF3444C3}: DhcpNameServer=[removed] [removed] [removed] »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End
Post #30
Here's the HJT log–TvH

Logfile of HijackThis v1.99.1
Scan saved at 8:36:09 PM, on 7/18/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\All Users\Desktop\System Integrity\hijackthis\HijackThis.exe

O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN2\YCOMP5_5_7_0.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN2\YCOMP5_5_7_0.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: POWERR~1.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\All Users\Start Menu\Programs\>IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: WebWorks Help 2.0 - file://C:\Program Files\procreate Painter Classic\Help\wwhelp2.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedCon…bin/AvSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://zone.msn.com/bingame/rtlw/default/R…bGameLoader.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI