[Resolved]Keylogged?

I was visiting some WoW forum and I visited a link posted on it. Then there were people detecting a pop-up trojan attempt (KKvr.sigsign32.dll - malicious data entry unit) when opening the link. However, I didnt pickup on anything. I dont have the best protection so I wouldnt know and Id like to be safe. Here's my log and I'd appreciate any help I can get.

Logfile of HijackThis v1.99.1
Scan saved at 9:10:32 AM, on 7/29/2007
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O11 - Options group: [INTERNATIONAL] International*
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

Hi toed,

Can't see anything bad in your HijackThis log, but we'll do a couple of checks to make sure your machine is clean.

When you visited the link, did anything occur - like a UAC prompt? If so, tell me whether you approved the prompt and any other information you think might be relevant.

You have restrictions on your Internet Explorer control panel settings. These are often put in place by protection programs but can also be done by malware. Let me know whether you think these restrictions should be in place, and if you wish to remove them.

Download Dr.WEB CureIt to your desktop from here:
ftp://ftp.drweb.com/pub/drweb/cureit/cureit.exe

• Right-click cureit.exe and choose Run as administrator to start the program. Allow the UAC prompt.
• Press Start and then OK to start the Express scan
• The Express scan takes just a few moments to finish, if something is found, click Yes to cure it
• Once the short scan has finished, Click Options->Change settings
• Choose the Scan tab and remove the check mark from Heuristic analysis
• Choose the Actions tab and next to Infected objects select Move, then press OK to close the settings box.
• Select all hard drives to be scanned by clicking on them - choose all drives - a red dot confirms they will be scanned
• Click the green arrow on the right to start the scan
• Click Yes to all if it asks if you want to move a file
• Click File-> Save report list and save the report to your desktop
• Close Dr.Web Cureit and reboot your computer (this is important as files may be moved/deleted during reboot)

Download Deckard's System Scanner (DSS)

• Close all applications and windows.
• Right-click on dss.exe and select Run as administrator to start the program, then follow the prompts.
• When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt<-this one will be minimized
• Make sure Format->Word Wrap is unchecked
• Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and extra.txt in your reply

Once complete, please post the Dr Web log and both DSS logs, you won't need to produce a new HijackThis log as DSS produces one for you.

Hello _silver_,

First off, Id like to thank you for the assistance. When I visited the link, I do not recall getting any popups or any kind of prompt with Firefox. I used DrWeb's Cureit and everything came up clean.

Heres the DSS log.

Deckard's System Scanner v20070729.57
Run by [removed] on 2007-07-30 at 12:40:22
Computer is in Normal Mode.
——————————————————————————–

– Last 5 Restore Point(s) –
16: 2007-07-29 03:36:04 UTC - RP147 - Removed Halo 2 for Windows Vista
15: 2007-07-29 03:18:10 UTC - RP146 - Removed LIVE gaming on Windows Runtime Version 1.0.6027
14: 2007-07-29 03:11:11 UTC - RP145 - Restore Operation
13: 2007-07-28 11:45:39 UTC - RP144 - Removed ATLAS Translation Double Pack V13.0 Trial Version
12: 2007-07-28 11:21:06 UTC - RP143 - Removed Microsoft AppLocale


– First Restore Point –
1: 2007-07-28 05:42:14 UTC - RP128 - ???????? PRODUCT_NAME


Backed up registry hives.

Performed disk cleanup.


– HijackThis Clone ————————————————————

Emulating logfile of HijackThis v1.99.1
Scan saved at 2007-07-30 12:41:24
Platform: Windows Vista (6.00.6000)
MSIE: Internet Explorer (7.00.6000.16386)

Running processes:
C:\Windows\System32\taskeng.exe
C:\Windows\System32\dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\Windows\System32\mobsync.exe
C:\Users\Guolin Wang\Desktop\utorrent.exe
C:\Windows\explorer.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Guolin Wang\Desktop\dss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O4 - HKEY_LOCAL_MACHINE\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKEY_LOCAL_MACHINE\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKEY_LOCAL_MACHINE\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKEY_LOCAL_MACHINE\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKEY_LOCAL_MACHINE\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKEY_LOCAL_MACHINE\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKEY_LOCAL_MACHINE\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O20 - Winlogon Notify: avgwlntf - C:\Windows\system32\avgwlntf.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgemc.exe


– File Associations ———————————————————–

All associations okay.


– Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ———————

R3 AvgWFP (AVG7 Firewall Driver x86) - c:\windows\system32\drivers\avgwfp.sys
R3 pgfilter - \??\c:\program files\peerguardian2\pgfilter.sys

S3 ENTECH - \??\c:\windows\system32\drivers\entech.sys


– Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ——————–

All services whitelisted.


– Scheduled Tasks ————————————————————-

2007-07-30 06:05:33 430 –ah—– C:\Windows\Tasks\User_Feed_Synchronization-{E76537CB-C56F-4DFE-9E6F-166AF3A2B80A}.job


– Files created between 2007-06-30 and 2007-07-30 —————————–

2007-07-30 11:11:33 0 d——– C:\Users\Guolin Wang\DoctorWeb
2007-07-29 20:49:34 2379 –a—— C:\Windows\mozver.dat
2007-07-28 22:12:22 0 d——– C:\Users\Guolin Wang\.housecall6.6
2007-07-25 15:21:01 0 d——– C:\Windows\Internet Logs
2007-07-24 03:59:00 0 d——– C:\Users\All Users\Microsoft Games


– Find3M Report —————————————————————

2007-07-30 12:41:33 0 d——– C:\Program Files\PeerGuardian2
2007-07-30 12:41:32 0 d——– C:\Users\Guolin Wang\AppData\Roaming\uTorrent
2007-07-30 11:04:33 0 d——– C:\Users\Guolin Wang\AppData\Roaming\AVG7
2007-07-30 08:56:00 0 d——– C:\Users\Guolin Wang\AppData\Roaming\LimeWire
2007-07-29 22:59:30 0 d——– C:\Program Files\Warcraft III
2007-07-28 23:37:26 0 d——– C:\Program Files\Microsoft Games
2007-07-28 23:13:20 0 d——– C:\Users\Guolin Wang\AppData\Roaming\Winamp
2007-07-28 23:13:20 0 d——– C:\Users\Guolin Wang\AppData\Roaming\Ventrilo
2007-07-28 02:53:27 0 d–h—– C:\Program Files\InstallShield Installation Information
2007-07-28 01:42:06 0 d——– C:\Program Files\Common Files\InstallShield
2007-07-27 22:59:08 0 d——– C:\Users\Guolin Wang\AppData\Roaming\Microsoft Game Studios
2007-07-23 15:12:54 0 d——– C:\Program Files\World of Warcraft
2007-07-23 15:12:30 0 d——– C:\Users\Guolin Wang\AppData\Roaming\WowAceUpdater
2007-07-23 02:19:46 0 d——– C:\Program Files\Combined Community Codec Pack
2007-07-22 07:45:40 24227 –a—— C:\Users\Guolin Wang\AppData\Roaming\UserTile.png
2007-07-16 18:11:18 0 d——– C:\Program Files\WC3Banlist
2007-07-11 11:54:45 0 d——– C:\Program Files\Windows Mail
2007-07-09 21:33:02 0 d——– C:\Users\Guolin Wang\AppData\Roaming\WinRAR
2007-07-04 00:04:17 0 d——– C:\Program Files\DivX
2007-06-29 14:53:59 0 d——– C:\Program Files\Analog Devices
2007-06-15 03:08:23 0 d——– C:\Users\Guolin Wang\AppData\Roaming\Sun
2007-06-11 16:26:10 0 d——– C:\Program Files\LimeWire
2007-06-11 16:26:03 0 d——– C:\Program Files\Java
2007-06-11 16:24:53 0 d——– C:\Program Files\Common Files
2007-06-11 16:24:53 0 d——– C:\Program Files\Common Files\Java
2007-06-11 16:17:36 0 d——– C:\Users\Guolin Wang\AppData\Roaming\Sony
2007-06-11 16:08:39 0 d——– C:\Users\Guolin Wang\AppData\Roaming\Publish Providers
2007-06-11 15:29:08 0 d——– C:\Program Files\Vstplugins
2007-06-11 15:28:47 0 d——– C:\Program Files\Sony
2007-06-11 15:27:13 0 d——– C:\Program Files\Sony Setup
2007-06-09 16:47:35 0 d——– C:\Users\Guolin Wang\AppData\Roaming\Apple Computer
2007-06-09 16:45:42 0 d——– C:\Program Files\QuickTime
2007-06-07 21:15:56 530 –a—— C:\Windows\eReg.dat
2007-06-05 18:40:14 0 d——– C:\Program Files\Common Files\Invictus
2007-06-05 18:37:30 0 d——– C:\Program Files\DAEMON Tools
2007-05-31 09:28:26 0 d——– C:\Program Files\Starcraft
2007-05-30 18:16:42 33926 –a—— C:\Windows\scunin.dat
2007-05-30 18:16:41 967 –a—— C:\Windows\ScUnin.pif
2007-05-30 18:16:41 70656 –a—— C:\Windows\ScUnin.exe

Sorry about that. Couldnt find the extra.txt at first.

Here it is.
Deckard's System Scanner v20070729.57
Extra logfile - please post this as an attachment with your post.
——————————————————————————–

– System Information ———————————————————-

Microsoft® Windows Vista™ Home Basic (build 6000)
Architecture: X86; Language: English

CPU 0: Intel® Core™2 CPU 6300 @ 1.86GHz
Percentage of Memory in Use: 58%
Physical Memory (total/avail): 2045.94 MiB / 847.72 MiB
Pagefile Memory (total/avail): 4312.9 MiB / 3293.69 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1945.05 MiB

C: is Fixed (NTFS) - 465.77 GiB total, 363.38 GiB free.
D: is CDROM (CDFS)
E: is CDROM (No Media)


– Security Center ————————————————————-

AUOptions is scheduled to auto-install.
Windows Internal Firewall is enabled.

AV: AVG 7.5.476 v7.5.476 (GRISOFT)
AS: Windows Defender v1.1.1505.0 (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\Groove Games\\LASR\\LASR.exe"="C:\\Program Files\\Groove Games\\LASR\\LASR.exe:*:Enabled:LASR"


– Environment Variables ——————————————————-

ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Guolin Wang\AppData\Roaming
CLASSPATH=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=GUOLINWANG-PC
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Guolin Wang
LOCALAPPDATA=C:\Users\Guolin Wang\AppData\Local
LOGONSERVER=\\GUOLINWANG-PC
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Microsoft SQL Server\80\Tools\Binn\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 15 Stepping 2, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0f02
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
PROMPT=$P$G
PUBLIC=C:\Users\Public
QTJAVA=C:\Program Files\QuickTime\QTSystem\QTJava.zip
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\GUOLIN~1\AppData\Local\Temp
TMP=C:\Users\GUOLIN~1\AppData\Local\Temp
USERDOMAIN=GuolinWang-PC
USERNAME=Guolin Wang
USERPROFILE=C:\Users\Guolin Wang
windir=C:\Windows


– User Profiles —————————————————————

Guolin Wang (admin)


– Add/Remove Programs ———————————————————

–> "C:\Quake\ezuninstall.exe"
Adobe Flash Player Plugin –> C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Shockwave Player –> C:\Windows\System32\Macromed\SHOCKW~1\UNWISE.EXE C:\Windows\System32\Macromed\SHOCKW~1\Install.log
AIM 6 –> C:\Program Files\AIM6\uninst.exe
AVG 7.5 –> C:\Program Files\Grisoft\AVG7\setup.exe /UNINSTALL
Combined Community Codec Pack 2007-07-22 –> "C:\Program Files\Combined Community Codec Pack\unins001.exe"
DivX Content Uploader –> C:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
DivX Web Player –> C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Fraps (remove only) –> "C:\Fraps\uninstall.exe"
InterVideo WinDVD 5 –> "C:\Program Files\InstallShield Installation Information\{1B399A41-C1D0-40A2-9E4F-095868EFAF01}\setup.exe" REMOVEALL
J2SE Runtime Environment 5.0 Update 3 –> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150030}
LimeWire PRO 4.12.11 –> "C:\Program Files\LimeWire\uninstall.exe"
Microsoft Visual C++ 2005 Redistributable –> MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mozilla Firefox (2.0.0.5) –> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
NVIDIA Drivers –> C:\Windows\system32\NVUNINST.EXE UninstallGUI
PeerGuardian 2.0 –> "C:\Program Files\PeerGuardian2\unins000.exe"
QuickTime –> MsiExec.exe /I{08094E03-AFE4-4853-9D31-6D0743DF5328}
Sony Media Manager 2.2 –> MsiExec.exe /X{878D2EB2-2D55-42A9-955E-1E08F28529FD}
Sony Vegas 7.0 –> MsiExec.exe /X{DFB951D6-4270-42D8-B4B7-AA4B01911DC3}
SoundMAX –> C:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\setup.exe -runfromtemp -l0x0009 -removeonly
Starcraft –> C:\Windows\SCunin.exe C:\Windows\SCunin.dat
Ventrilo Client –> MsiExec.exe /I{789289CA-F73A-4A16-A331-54D498CE069F}
Viewpoint Media Player –> C:\Program Files\Viewpoint\Viewpoint Experience Technology\mtsAxInstaller.exe /u
Warcraft III –> C:\Windows\War3Unin.exe C:\Windows\War3Unin.dat
Warcraft III: All Products –> C:\Windows\War3Unin.exe C:\Windows\War3Unin.dat
WC3Banlist –> "C:\Program Files\WC3Banlist\unins000.exe"
Winamp (remove only) –> "C:\Program Files\Winamp\UninstWA.exe"
Windows Media Player Firefox Plugin –> MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
WinPcap 4.0 –> C:\Program Files\WinPcap\uninstall.exe
WinRAR archiver –> C:\Program Files\WinRAR\uninstall.exe
World of Warcraft –> C:\Program Files\Common Files\Blizzard Entertainment\World of Warcraft\Uninstall.exe


– End of Deckard's System Scanner: finished at 2007-07-30 at 12:41:59 ———