[Resolved] She Might As Well Have Given Them Her Ssn

Hi! Welcome to the WTT forums.
My name is Scotty. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.
Please be patient and I'd be grateful if you would note the following:

• I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for this issue on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.

SDFix will have created a log called report.txt which will be in the SDFix folder. post the contents of that in your next reply.

Download and Run ComboFix

• Download this file from below:
  
  Here
  
• Disconnect from the Internet, than disable your anti-virus and any real-time anti-spyware monitors that are running.
• Then double click combofix.exe & follow the prompts.
• When finished, it shall produce a log for you. Post that log in your next reply with a new HijackThis log.

Note 1: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Note 2:Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.

Hi Scotty, Appreciate any help. I've included the report file I had under SDfix. I've also included the system report from under the SDfix. Hope it helps. Once I download the Combofix, transfer it to the other computer and run it, I'll post the log. Thanks again, Steve SDFix: Version 1.105 Run by [removed] on Mon 09/17/2007 at 10:11 PM Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Restoring Default HomePage Restoring Default Desktop Components Value Rebooting… Normal Mode: Checking Files: Trojan Files Found: C:\Documents and Settings\Dad\Desktop\Error Cleaner.url - Deleted C:\Documents and Settings\Dad\Favorites\Error Cleaner.url - Deleted C:\Documents and Settings\Dad\Desktop\Privacy Protector.url - Deleted C:\Documents and Settings\Dad\Favorites\Privacy Protector.url - Deleted C:\Documents and Settings\Dad\Desktop\Spyware&Malware; Protection.url - Deleted C:\Documents and Settings\Dad\Favorites\Spyware&Malware; Protection.url - Deleted C:\WINDOWS\cbeb.exe.tmp - Deleted C:\WINDOWS\exehadyt.exe.tmp - Deleted C:\WINDOWS\ezytgrwn.exe.tmp - Deleted C:\WINDOWS\ncvwx.exe.tmp - Deleted C:\WINDOWS\privacy_danger\index.htm - Deleted C:\WINDOWS\privacy_danger\images\capt.gif - Deleted C:\WINDOWS\privacy_danger\images\danger.jpg - Deleted C:\WINDOWS\privacy_danger\images\down.gif - Deleted C:\WINDOWS\privacy_danger\images\spacer.gif - Deleted C:\Program Files\VideoAccessCodec\install.ico - Deleted C:\Program Files\VideoAccessCodec\Uninstall.exe - Deleted C:\Program Files\VideoAccessCodec\VideoAccessCodec.ocx - Deleted C:\WINDOWS\dat.txt - Deleted C:\WINDOWS\main_uninstaller.exe - Deleted C:\WINDOWS\msmdev.dll - Deleted C:\WINDOWS\msmhost.dll - Deleted C:\WINDOWS\nsduo.dll - Deleted C:\WINDOWS\rs.txt - Deleted Folder C:\Program Files\VideoAccessCodec - Removed Folder C:\WINDOWS\privacy_danger - Removed Removing Temp Files… ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: —————— Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\America Online 9.0a\\waol.exe"="C:\\Program Files\\America Online 9.0a\\waol.exe:*:Enabled:America Online 9.0a" "C:\\Program Files\\JavaSoft\\JRE\\1.3.1_04\\bin\\javaw.exe"="C:\\Program Files\\JavaSoft\\JRE\\1.3.1_04\\bin\\javaw.exe:*:Enabled:javaw" "C:\\Program Files\\support.com\\bin\\tgcmd.exe"="C:\\Program Files\\support.com\\bin\\tgcmd.exe:*:Disabled:Support.com Scheduler and Command Dispatcher" "C:\\Program Files\\Microsoft Games\\Halo\\halo.exe"="C:\\Program Files\\Microsoft Games\\Halo\\halo.exe:*:Disabled:Halo" "C:\\Program Files\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD"="C:\\Program Files\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD:*:Disabled:Age of Empires II" "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "C:\\Program Files\\Microsoft Games\\Age of Mythology\\aomx.exe"="C:\\Program Files\\Microsoft Games\\Age of Mythology\\aomx.exe:*:Enabled:Age of Mythology - The Titans Expansion" "C:\\Program Files\\Sony\\Station\\Launchpad\\LaunchPad.exe"="C:\\Program Files\\Sony\\Station\\Launchpad\\LaunchPad.exe:*:Enabled:LaunchPad" "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.0" "C:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\age2_x1.icd"="C:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\age2_x1.icd:*:Enabled:Age of Empires II Expansion" "C:\\Program Files\\Infogrames Interactive\\Civilization III\\CIV3PTW\\Civilization3X.exe"="C:\\Program Files\\Infogrames Interactive\\Civilization III\\CIV3PTW\\Civilization3X.exe:*:Enabled:Civilization3X" "C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Disabled:Internet Explorer" "C:\\Program Files\\Microsoft Office\\Office10\\WINWORD.EXE"="C:\\Program Files\\Microsoft Office\\Office10\\WINWORD.EXE:*:Enabled:Microsoft Word" "C:\\Program Files\\Microsoft ActiveSync\\WCESCOMM.EXE"="C:\\Program Files\\Microsoft ActiveSync\\WCESCOMM.EXE:*:Enabled:ActiveSync Connection Manager" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\WINDOWS\\system32\\dlcqcoms.exe"="C:\\WINDOWS\\system32\\dlcqcoms.exe:*:Enabled:Lexmark Communications System" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\America Online 9.0a\\waol.exe"="C:\\Program Files\\America Online 9.0a\\waol.exe:*:Enabled:America Online 9.0a" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.0" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" Remaining Files: ————— File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes: C:\Documents and Settings\Mom\NetHood\ftp.ccboe.com\Desktop.ini C:\Program Files\Common Files\aolshare\shell\us\shellext.dll C:\Program Files\America Online 9.0\aolphx.exe C:\Program Files\America Online 9.0\aoltray.exe C:\Program Files\America Online 9.0\RBM.exe C:\Program Files\America Online 9.0\waol.exe C:\Program Files\America Online 9.0a\aolphx.exe C:\Program Files\America Online 9.0a\aoltray.exe C:\Program Files\America Online 9.0a\RBM.exe C:\Program Files\America Online 9.0a\waol.exe C:\Program Files\ATI Multimedia\RemCtrl\x10prod.sys C:\WINDOWS\system32\CD69EC57A2.sys C:\WINDOWS\system32\KGyGaAvL.sys C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\lock.tmp C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp C:\Documents and Settings\Dad\Application Data\Microsoft\Office\Shortcut Bar\Off2.tmp C:\Documents and Settings\Dad\Application Data\Microsoft\Office\Shortcut Bar\Off2h.tmp C:\Documents and Settings\Dad\Application Data\Microsoft\Office\Shortcut Bar\Off2s.tmp C:\Documents and Settings\Dad\Local Settings\Temp\BIT1.tmp C:\Documents and Settings\Dad\Local Settings\Temp\BIT2.tmp C:\Documents and Settings\Mom\Local Settings\Temp\BITE69.tmp C:\Documents and Settings\Mom\Local Settings\Temp\BITE6E.tmp C:\Documents and Settings\Mom\Local Settings\Temp\BITEAF.tmp C:\Documents and Settings\Mom\Local Settings\Temp\BITEF1.tmp C:\Documents and Settings\Mom\Local Settings\Temp\BITEFC.tmp C:\Documents and Settings\Mom\Local Settings\Temp\BITF05.tmp C:\Documents and Settings\Philip\Application Data\Microsoft\Office\Shortcut Bar\Off2.tmp C:\Documents and Settings\Philip\Local Settings\Temp\kyf1F6.tmp C:\Documents and Settings\Philip\Local Settings\Temp\Off2.tmp C:\Documents and Settings\Steven\Local Settings\Temp\kyf1F2.tmp C:\Documents and Settings\Steven\Local Settings\Temp\kyf219.tmp C:\Documents and Settings\Steven\Local Settings\Temp\kyf26D.tmp C:\Documents and Settings\Steven\Local Settings\Temp\kyf7.tmp C:\Program Files\StarWarsGalaxies\BIT68.tmp C:\Program Files\StarWarsGalaxies\BIT69.tmp Finished! System Report ************* Run on Mon 09/17/2007 at 09:58 PM Microsoft Windows XP [Version 5.1.2600] Current user is an administrator Running Processes: \SystemRoot\System32\smss.exe [616] \??\C:\WINDOWS\system32\csrss.exe [664] \??\C:\WINDOWS\system32\winlogon.exe [688] C:\WINDOWS\system32\services.exe [732] C:\WINDOWS\system32\lsass.exe [744] C:\WINDOWS\system32\Ati2evxx.exe [908] C:\WINDOWS\system32\svchost.exe [920] C:\WINDOWS\system32\svchost.exe [1000] C:\WINDOWS\System32\svchost.exe [1100] C:\WINDOWS\system32\svchost.exe [1144] C:\WINDOWS\System32\svchost.exe [1308] C:\WINDOWS\System32\svchost.exe [1384] C:\WINDOWS\system32\spoolsv.exe [1556] C:\WINDOWS\system32\Ati2evxx.exe [1996] C:\WINDOWS\system32\devldr32.exe [160] C:\WINDOWS\Explorer.exe [180] C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe [420] C:\WINDOWS\System32\CTsvcCDA.exe [496] C:\WINDOWS\system32\dlcqcoms.exe [516] c:\program files\mcafee.com\agent\mcdetect.exe [576] c:\PROGRA~1\mcafee.com\vso\mcshield.exe [640] C:\WINDOWS\GWMDMMSG.exe [816] C:\WINDOWS\system32\SK9910DM.EXE [872] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe [936] C:\Program Files\QuickTime\qttask.exe [1068] C:\Program Files\support.com\bin\tgcmd.exe [1084] C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe [1092] C:\PROGRA~1\mcafee.com\agent\mcagent.exe [1116] C:\Program Files\McAfee.com\VSO\mcvsshld.exe [1220] C:\Program Files\McAfee.com\VSO\oasclnt.exe [1200] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe [1196] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [1300] C:\Program Files\ATI Multimedia\main\ATIDtct.EXE [1316] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe [1332] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [1356] C:\Program Files\Dell Photo AIO Printer 966\dlcqmon.exe [1364] C:\Program Files\Dell Photo AIO Printer 966\memcard.exe [1376] C:\Program Files\iTunes\iTunesHelper.exe [1292] c:\progra~1\mcafee.com\vso\mcvsescn.exe [1464] C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe [1472] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe [1628] C:\Program Files\Common Files\AOL\1189803853\ee\AOLSoftware.exe [860] C:\WINDOWS\system32\ctfmon.exe [1676] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe [1708] C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE [1768] c:\PROGRA~1\mcafee.com\agent\mctskshd.exe [1812] C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe [2140] C:\Documents and Settings\All Users\Application Data\U3\U3Launcher\LaunchU3.exe [2248] C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [2252] C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe [2272] C:\WINDOWS\system32\HPZipm12.exe [2320] C:\WINDOWS\System32\svchost.exe [2384] C:\WINDOWS\wanmpsvc.exe [2496] C:\WINDOWS\system32\rundll32.exe [2604] C:\WINDOWS\system32\svchost.exe [2644] C:\Program Files\iPod\bin\iPodService.exe [3368] C:\WINDOWS\System32\alg.exe [3948] C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe [4036] C:\Documents and Settings\Dad\Application Data\U3\00177309614961\LaunchPad.exe [2592] C:\Program Files\Microsoft Money\System\urlmap.exe [3476] C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE [4084] C:\Program Files\Internet Explorer\IEXPLORE.EXE [564] Files Created/Modified 2007: C:\ 09/17/2007 09:51 PM 535,678,976 hiberfil.sys 09/17/2007 09:51 PM 805,306,368 pagefile.sys 09/14/2007 09:07 PM 89,809 VETlog.txt 09/14/2007 09:07 PM 51,663 VETlog.dmp 09/09/2007 01:26 PM 1,152,943 dlcq.log 08/14/2007 07:36 PM 61,440 Thumbs.db 07/08/2007 12:43 PM 108,744 clthumbs.zdx 07/08/2007 12:43 PM 288 clipart.zdx 07/04/2007 03:14 PM 40,781 dlcqscan.log 01/03/2007 08:28 PM 172 setupfax.log 01/03/2007 07:48 PM 491 Wpssu.log C:\WINDOWS\ 09/17/2007 09:56 PM 584 dat.txt 09/17/2007 09:52 PM 0 0.log 09/17/2007 09:52 PM 159 wiadebug.log 09/17/2007 09:52 PM 49 wiaservc.log 09/17/2007 09:51 PM 2,048 bootstat.dat 09/17/2007 09:50 PM 32,526 SchedLgU.Txt 09/17/2007 09:50 PM 1,130,118 WindowsUpdate.log 09/16/2007 11:54 PM 18,250 rs.txt 09/15/2007 02:05 AM 208,896 nsduo.dll 09/15/2007 02:05 AM 32,256 main_uninstaller.exe 09/15/2007 02:05 AM 184,320 msmhost.dll 09/15/2007 02:05 AM 225,280 msmdev.dll 09/14/2007 09:08 PM 54,156 QTFont.qfn 09/14/2007 09:07 PM 1,159 win.ini 09/14/2007 07:33 PM 32,050 cdplayer.ini 09/01/2007 02:09 PM 17,958 DIIDUnin.dat 09/01/2007 02:09 PM 102,400 DIIDUnin.exe 09/01/2007 02:09 PM 2,829 DIIDUnin.pif 08/18/2007 03:23 PM 1,409 QTFont.for 08/14/2007 07:36 PM 9,728 Thumbs.db 06/13/2007 06:23 AM 1,033,216 explorer.exe C:\WINDOWS\system32\ 09/17/2007 09:52 PM 2,206 wpa.dbl 09/17/2007 09:52 PM 127,968 Status.MPF 09/05/2007 10:50 PM 17,474,680 MRT.exe 08/30/2007 09:28 PM 5,852 KGyGaAvL.sys 08/30/2007 09:28 PM 104 CD69EC57A2.sys 08/29/2007 03:00 AM 250,464 TZLog.log 08/25/2007 08:50 AM 3,628 jupdate-1.5.0_04-b05.log 07/30/2007 07:19 PM 1,712,984 wuaueng.dll 07/30/2007 07:19 PM 549,720 wuapi.dll 07/30/2007 07:19 PM 325,976 wucltui.dll 07/30/2007 07:19 PM 25,944 wuaucpl.cpl.mui 07/30/2007 07:19 PM 216,408 wuaucpl.cpl 07/30/2007 07:19 PM 203,096 wuweb.dll 07/30/2007 07:19 PM 92,504 cdm.dll 07/30/2007 07:19 PM 53,080 wuauclt.exe 07/30/2007 07:19 PM 43,352 wups2.dll 07/30/2007 07:19 PM 25,944 wuapi.dll.mui 07/30/2007 07:18 PM 34,136 wucltui.dll.mui 07/30/2007 07:18 PM 33,624 wups.dll 07/30/2007 07:18 PM 20,312 wuaueng.dll.mui 07/19/2007 02:59 AM 3,583,488 mshtml.dll 07/18/2007 08:42 AM 60,416 tzchange.exe 06/27/2007 10:34 AM 232,960 webcheck.dll 06/27/2007 10:34 AM 823,808 wininet.dll 06/27/2007 10:34 AM 105,984 url.dll 06/27/2007 10:34 AM 671,232 mstime.dll 06/27/2007 10:34 AM 102,400 occache.dll 06/27/2007 10:34 AM 1,152,000 urlmon.dll 06/27/2007 10:34 AM 193,024 msrating.dll 06/27/2007 10:34 AM 477,696 mshtmled.dll 06/27/2007 10:34 AM 1,824,256 inetcpl.cpl 06/27/2007 10:34 AM 459,264 msfeeds.dll 06/27/2007 10:34 AM 27,648 jsproxy.dll 06/27/2007 10:34 AM 52,224 msfeedsbs.dll 06/27/2007 10:34 AM 267,776 iertutil.dll 06/27/2007 10:34 AM 44,544 iernonce.dll 06/27/2007 10:34 AM 6,058,496 ieframe.dll 06/27/2007 10:34 AM 384,512 iedkcs32.dll 06/27/2007 10:34 AM 230,400 ieaksie.dll 06/27/2007 10:34 AM 124,928 advpack.dll 06/27/2007 10:34 AM 153,088 ieakeng.dll 06/27/2007 10:34 AM 383,488 ieapfltr.dll 06/27/2007 10:34 AM 132,608 extmgr.dll 06/27/2007 04:27 AM 13,824 ieudinit.exe 06/27/2007 04:27 AM 63,488 ie4uinit.exe 06/27/2007 03:00 AM 161,792 ieakui.dll 06/26/2007 02:08 AM 1,104,896 msxml3.dll 06/19/2007 09:31 AM 282,112 gdi32.dll 06/11/2007 11:51 PM 10,834,944 wmp.dll 05/17/2007 07:28 AM 549,376 oleaut32.dll 05/16/2007 11:12 AM 683,520 inetcomm.dll 05/16/2007 06:27 AM 28,672 f3PSSavr.scr 05/08/2007 03:03 PM 1,275,392 msxml4.dll 04/28/2007 11:08 AM 4,027 jupdate-1.6.0_01-b06.log 04/25/2007 10:21 AM 144,896 schannel.dll 04/18/2007 12:12 PM 2,854,400 msi.dll 04/17/2007 05:28 AM 2,455,488 ieapfltr.dat 04/16/2007 11:52 AM 984,576 kernel32.dll 04/05/2007 03:09 AM 466,800 FNTCACHE.DAT 03/17/2007 09:43 AM 292,864 winsrv.dll 03/16/2007 07:51 AM 499,712 msvcp71.dll 03/15/2007 06:19 PM 1,476,992 LegitCheckControl.dll 03/15/2007 06:17 PM 336,768 WgaTray.exe 03/15/2007 06:16 PM 236,928 WgaLogon.dll 03/14/2007 02:04 AM 139,264 javaws.exe 03/14/2007 02:04 AM 69,632 javacpl.cpl 03/14/2007 12:31 AM 135,168 javaw.exe 03/14/2007 12:31 AM 135,168 java.exe 03/11/2007 01:28 PM 380,680 perfh009.dat 03/11/2007 01:28 PM 52,968 perfc009.dat 03/11/2007 01:28 PM 439,734 PerfStringBackup.INI 03/09/2007 07:28 AM 248,320 xpsp3res.dll 03/08/2007 11:36 AM 577,536 user32.dll 03/08/2007 11:36 AM 40,960 mf3216.dll 03/08/2007 09:47 AM 1,843,584 win32k.sys 02/28/2007 05:10 AM 2,180,352 ntoskrnl.exe 02/28/2007 04:38 AM 2,057,600 ntkrnlpa.exe 02/16/2007 10:54 AM 49,152 QuickTime.qts 02/16/2007 10:54 AM 65,536 QuickTimeVR.qtx 02/05/2007 04:17 PM 185,344 upnphost.dll 01/23/2007 03:29 PM 546,304 hhctrl.ocx 01/08/2007 08:07 PM 991,232 ieframe.dll.mui 01/08/2007 08:01 PM 17,408 corpol.dll 01/03/2007 08:30 PM 27,700 LexFiles.ulf C:\WINDOWS\system32\drivers\ 04/23/2007 06:32 AM 364,160 update.sys 02/09/2007 07:10 AM 574,464 ntfs.sys C:\WINDOWS\system32\dllcache\ 07/30/2007 07:19 PM 1,712,984 wuaueng.dll 07/30/2007 07:19 PM 549,720 wuapi.dll 07/30/2007 07:19 PM 325,976 wucltui.dll 07/30/2007 07:19 PM 203,096 wuweb.dll 07/30/2007 07:19 PM 216,408 wuaucpl.cpl 07/30/2007 07:19 PM 92,504 cdm.dll 07/30/2007 07:19 PM 53,080 wuauclt.exe 07/30/2007 07:18 PM 33,624 wups.dll 07/19/2007 02:59 AM 3,583,488 mshtml.dll 07/12/2007 07:31 PM 765,952 vgx.dll 06/27/2007 10:34 AM 823,808 wininet.dll 06/27/2007 10:34 AM 232,960 webcheck.dll 06/27/2007 10:34 AM 1,152,000 urlmon.dll 06/27/2007 10:34 AM 105,984 url.dll 06/27/2007 10:34 AM 193,024 msrating.dll 06/27/2007 10:34 AM 102,400 occache.dll 06/27/2007 10:34 AM 671,232 mstime.dll 06/27/2007 10:34 AM 477,696 mshtmled.dll 06/27/2007 10:34 AM 27,648 jsproxy.dll 06/27/2007 10:34 AM 1,824,256 inetcpl.cpl 06/27/2007 10:34 AM 459,264 msfeeds.dll 06/27/2007 10:34 AM 52,224 msfeedsbs.dll 06/27/2007 10:34 AM 44,544 iernonce.dll 06/27/2007 10:34 AM 267,776 iertutil.dll 06/27/2007 10:34 AM 6,058,496 ieframe.dll 06/27/2007 10:34 AM 230,400 ieaksie.dll 06/27/2007 10:34 AM 153,088 ieakeng.dll 06/27/2007 10:34 AM 384,512 iedkcs32.dll 06/27/2007 10:34 AM 124,928 advpack.dll 06/27/2007 10:34 AM 132,608 extmgr.dll 06/27/2007 10:34 AM 383,488 ieapfltr.dll 06/27/2007 04:27 AM 625,152 iexplore.exe 06/27/2007 04:27 AM 13,824 ieudinit.exe 06/27/2007 04:27 AM 63,488 ie4uinit.exe 06/27/2007 03:00 AM 161,792 ieakui.dll 06/26/2007 10:10 PM 317,440 unregmp2.exe 06/26/2007 02:08 AM 1,104,896 msxml3.dll 06/19/2007 09:31 AM 282,112 gdi32.dll 06/13/2007 06:23 AM 1,033,216 explorer.exe 06/11/2007 11:51 PM 10,834,944 wmp.dll 05/17/2007 07:28 AM 549,376 oleaut32.dll 05/16/2007 11:12 AM 85,504 wabimp.dll 05/16/2007 11:12 AM 510,976 wab32.dll 05/16/2007 11:12 AM 1,314,816 msoe.dll 05/16/2007 11:12 AM 683,520 inetcomm.dll 05/16/2007 11:12 AM 86,528 directdb.dll 04/25/2007 10:21 AM 144,896 schannel.dll 04/23/2007 06:32 AM 364,160 update.sys 04/18/2007 12:12 PM 2,854,400 msi.dll 04/17/2007 05:28 AM 2,455,488 ieapfltr.dat 04/16/2007 11:52 AM 984,576 kernel32.dll 03/17/2007 09:43 AM 292,864 winsrv.dll 03/15/2007 06:17 PM 336,768 WgaTray.exe 03/15/2007 06:16 PM 236,928 WgaLogon.dll 03/09/2007 09:58 AM 57,344 agentdpv.dll 03/08/2007 11:36 AM 577,536 user32.dll 03/08/2007 11:36 AM 40,960 mf3216.dll 03/08/2007 09:47 AM 1,843,584 win32k.sys 02/28/2007 05:10 AM 2,180,352 ntoskrnl.exe 02/28/2007 05:08 AM 2,136,064 ntkrnlmp.exe 02/28/2007 04:38 AM 2,015,744 ntkrpamp.exe 02/28/2007 04:38 AM 2,057,600 ntkrnlpa.exe 02/09/2007 07:10 AM 574,464 ntfs.sys 02/05/2007 04:17 PM 185,344 upnphost.dll 01/31/2007 02:47 AM 991,232 ieframe.dll.mui 01/23/2007 03:29 PM 546,304 hhctrl.ocx 01/08/2007 08:01 PM 17,408 corpol.dll C:\Documents and Settings\Dad\ 09/17/2007 09:59 PM 57,344 ntuser.dat.LOG 09/17/2007 09:57 PM 5,767,168 NTUSER.DAT 09/17/2007 09:49 PM 278 ntuser.ini Program Folders: C:\Program Files\ _ArcadeDownloadFolder 3DGroove Adaptec Adobe America Online 9.0 America Online 9.0a AOD AOL AOL Companion Apple Software Update ArcSoft ATI Multimedia ATI Technologies Audible AutoUpdate AV Music Morpher AvantGo Connect Avery Dennison BbChris Broderbund Common Files Corel Creative Crossword Weaver Dell Dell PC Fax Dell Photo AIO Printer 966 Diablo II Shareware Disney dl_cats Electronic Arts FinePixViewer FunWebProducts Gateway Google Hero Editor HP HyperSnap-DX 5 Infogrames Interactive InstallShield Installation Information Intel Internet Explorer InterVideo iPod ISTbar ItsDeductibleEX iTunes Java JavaSoft Kids Cam Sticker Factory Learn2.com LG Drivers LimeWire Listen Rhapsody LucasArts Lycos Math Composer McAfee.com Messenger Microsoft ActiveSync microsoft frontpage Microsoft Games Microsoft Money Microsoft Office Microsoft Visual Studio Movie Maker Mozilla Firefox msaccrt MSN MSN Gaming Zone MSXML 4.0 MusicMatch MyDSC2 MyWebSearch NETGUI NetMeeting Online Services Outlook Express Panasonic PartyGaming.Net PC-Doctor for Windows PCLinq2 High-Speed USB Bridge Cable PhoneTools PS.2 Millennium Keyboard QuickTime Real REGSHAVE Samsung Sony SpamBlockerUtility SpySpotter StarWarsGalaxies STOPzilla! support.com SwiftView Symantec sz8021 The Learning Company The Weather Channel The Weather Channel FW Tranquillity TurboTax Ubi Soft Ubisoft Uninstall Information VideoAccessCodec Viewpoint Web Publish Windows Media Components Windows Media Connect 2 Windows Media Player Windows NT WindowsUpdate xerox Yahoo! C:\Program Files\Common Files\ Adaptec Shared Adobe AnswerWorks 4.0 AOL aolshare ATI Broderbund Corel CyberLink Designer Hewlett-Packard InstallShield Intuit Java Knowledge Adventure L&H; Microsoft Shared MSSoap NSV Nullsoft ODBC Real Services SpeechEngines STOPzilla! SWF Studio Symantec Shared System WinTools xing shared Add/Remove Programs: 3D Home Architect 4 3D Groove Playback Engine The ABI Network- A Division of Direct Revenue Adobe Acrobat 5.0 Adobe Shockwave Player Age of Mythology America Online (Choose which version to remove) ArcSoft VideoImpression 1.6FP ATI Display Driver AudibleManager AV Music Morpher 2.0.96 Barbier As Sleeping Beauty Creative Mass Storage Drivers Crossword Weaver 8.0 Dell PC Fax Dell Photo AIO Printer 966 Desktop Weather by The Weather Channel Diablo II Shareware Software Update Manager FA Multiplication Division Gateway Desktop Manager GTW V.92 Voicemodem HyperSnap-DX 5 Microsoft Internationalized Domain Names Mitigation APIs Windows Internet Explorer 7 ATI Remote Wonder 2.3 ATI Multimedia Center 9.01 LimeWire Age of Empires III Trial DAO ATI Decoder DesignPro 5.0 Media Edition Samsung USB Driver (MCCI 4.34) WHQL v3.0 Java 2 Runtime Environment Standard Edition v1.3.1_04 Windows XP Hotfix - KB867282 Microsoft Data Access Components KB870669 Windows XP Hotfix - KB873333 Windows XP Hotfix - KB873339 Security Update for Windows XP (KB883939) Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB885884 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB887742 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Security Update for Windows XP (KB890046) Windows XP Hotfix - KB890047 Windows XP Hotfix - KB890175 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB890923 Windows XP Hotfix - KB891781 Windows XP Hotfix - KB893066 Windows XP Hotfix - KB893086 Security Update for Windows XP (KB893756) Windows Installer 3.1 (KB893803) Windows Installer 3.1 (KB893803) Update for Windows XP (KB894391) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB896688) Update for Windows XP (KB896727) Update for Windows XP (KB898461) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899588) Security Update for Windows XP (KB899591) Update for Windows XP (KB900485) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB903235) Security Update for Windows XP (KB904706) Update for Windows XP (KB904942) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB905915) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB908531) Update for Windows XP (KB910437) Security Update for Windows XP (KB911280) Security Update for Windows XP (KB911562) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 10 (KB911565) Security Update for Windows XP (KB911567) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912812) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913446) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Hotfix for Windows XP (KB914440) Hotfix for Windows XP (KB915865) Security Update for Windows XP (KB916281) Update for Windows XP (KB916595) Security Update for Windows XP (KB917159) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917422) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918118) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB918899) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920214) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Update for Windows XP (KB920872) Security Update for Windows XP (KB921398) Security Update for Windows XP (KB921503) Security Update for Windows XP (KB921883) Update for Windows XP (KB922582) Security Update for Windows XP (KB922616) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923694) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924496) Security Update for Windows XP (KB924667) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows XP (KB925902) Security Update for Windows XP (KB926247) Security Update for Windows XP (KB926255) Security Update for Windows XP (KB926436) Security Update for Windows XP (KB927779) Security Update for Windows XP (KB927802) Update for Windows XP (KB927891) Security Update for Windows Internet Explorer 7 (KB928090) Security Update for Windows XP (KB928255) Security Update for Windows XP (KB928843) Security Update for Windows XP (KB929123) Update for Windows XP (KB929338) Hotfix for Windows Media Format 11 SDK (KB929399) Security Update for Windows Internet Explorer 7 (KB929969) Security Update for Windows XP (KB930178) Update for Windows XP (KB930916) Security Update for Windows XP (KB931261) Security Update for Windows Internet Explorer 7 (KB931768) Security Update for Windows XP (KB931784) Update for Windows XP (KB931836) Security Update for Windows XP (KB932168) Update for Windows XP (KB933360) Security Update for Windows Internet Explorer 7 (KB933566) Security Update for Windows XP (KB935839) Security Update for Windows XP (KB935840) Security Update for Windows XP (KB936021) Update for Windows XP (KB936357) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Internet Explorer 7 (KB937143) Security Update for Windows Internet Explorer 7 (KB938127) Update for Windows XP (KB938828) Security Update for Windows XP (KB938829) Hotfix for Windows Media Player 11 (KB939683) LG USB Drivers LimeWire PRO 4.10.9 LiveReg (Symantec Corporation) LiveUpdate 1.6 (Symantec Corporation) MBKWBar - Toolbar McAfee Personal Firewall Plus McAfee SecurityCenter Mind Power™ Math - Algebra 1 Mind Power™ Math - Algebra 2 Mozilla Firefox (2.0.0.6) MUSICMATCH Jukebox MusicMatch Update Creative Mass Storage Drivers My Web Search (Smiley Central) Network Play System (Patching) New X Editor 3 Microsoft National Language Support Downlevel APIs PartyPokerNet Passport to 35 Languages PC-Doctor for Windows pedigree Screen Saver Intel® PRO Network Adapters and Drivers RealPlayer RSyncMon Screensavers Installer Shockwave Adobe Flash Player 9 ActiveX PS/2 Millennium Keyboard Sound Blaster Live! Value SpamBlockerUtility Email Toolbar SpamBlockerUtility Browser, Weather and Wowpapers Tools Learn2 Player (Uninstall Only) ComcastSUPPORT Creative System Information The Sims The Weather Channel Desktop Tranquil - Waterfalls Screen Saver Tranquillity 1.0 TurboTax Deluxe 2004 TurboTax Premier 2004 Video Access Codec v1.4 Viewpoint Media Player McAfee VirusScan Weather Services Microsoft Web Publishing Wizard 1.52 WebVideo Support Windows Genuine Advantage Notifications (KB905474) Microsoft ActiveSync 3.7 Windows Media Encoder 9 Series Windows Media Format 11 runtime Windows Media Player 11 Windows SR 2.0 Windows XP Service Pack 2 Windows Media Format 11 runtime Windows Media Player 11 Microsoft User-Mode Driver Framework Feature Pack 1.0 Yahoo! Toolbar Yahoo! Toolbar MSXML4 Parser ATI HYDRAVISION ATI Control Panel Corel Paint Shop Pro X Google Toolbar for Internet Explorer FinePixViewer Ver.2.0 PrintMaster 12 LUMIX Simple Viewer Creative MediaSource J2SE Runtime Environment 5.0 Update 1 J2SE Runtime Environment 5.0 Update 4 J2SE Runtime Environment 5.0 Update 6 Java™ SE Runtime Environment 6 Update 1 ATIRW2 ItsDeductible Express MSXML 4.0 SP2 (KB927978) Microsoft XML Parser and SDK FUJIFILM USB Driver Star Wars Galaxies: 14-Day Trial Print to Fax QuickTime In A Flash 3 Easy CD Creator 5 Basic Windows Genuine Advantage v1.3.0254.0 MSXML 4.0 SP2 Parser and SDK Do More - Home ArcSoft PhotoImpression MyDSC2 ATI Multimedia Center Corel Photo Album 6 Microsoft Office XP Media Content Microsoft Office XP Professional Microsoft Publisher 2002 PCLinq2 High-Speed USB Bridge Cable Intel Application Accelerator Apple Software Update iTunes Adobe Reader 7.0.9 MSXML 4.0 SP2 (KB936181) DVD Player Age of Empires III Trial DAO Microsoft .NET Framework 1.1 Microsoft Money 2002 System Pack U3Launcher ArcSoft Funhouse PhoneTools Windows Media Encoder 9 Series Microsoft Money 2002 WexTech AnswerWorks ATI Decoder DesignPro 5.0 Media Edition HelpSpot Samsung USB Driver (MCCI 4.34) WHQL v3.0 Run Values: [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "GWMDMMSG"="GWMDMMSG.exe" "Hot Key Kbd 9910 Daemon"="SK9910DM.EXE" "AdaptecDirectCD"="\"C:\\Program Files\\Adaptec\\Easy CD Creator 5\\DirectCD\\DirectCD.exe\"" "Speed racer"="C:\\Program Files\\Creative\\PlayCenter\\CTSRReg.exe" "AudioHQ"="C:\\Program Files\\Creative\\SBLive\\AudioHQ\\AHQTB.EXE" "UpdReg"="C:\\WINDOWS\\Updreg.exe" "MoneyStartUp10.0"="\"C:\\Program Files\\Microsoft Money\\System\\Activation.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "REGSHAVE"="C:\\Program Files\\REGSHAVE\\REGSHAVE.EXE /AUTORUN" "cjqter"="C:\\WINDOWS\\cjqter.exe" "hyfin"="C:\\WINDOWS\\hyfin.exe" "axovqr"="C:\\WINDOWS\\axovqr.exe" "mbud"="C:\\WINDOWS\\mbud.exe" "Windows SA"="C:\\Program Files\\WindowsSA\\omniscient.exe" "mswspl"="" "iqbhlu"="" "WinTools"="C:\\PROGRA~1\\COMMON~1\\WinTools\\WToolsA.exe" "tgcmd"="\"C:\\Program Files\\support.com\\bin\\tgcmd.exe\" /server" "ap9h4qmo"="" "farmmext"="" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe" "MCAgentExe"="c:\\PROGRA~1\\mcafee.com\\agent\\mcagent.exe" "MCUpdateExe"="c:\\PROGRA~1\\mcafee.com\\agent\\mcupdate.exe" "VSOCheckTask"="\"C:\\PROGRA~1\\McAfee.com\\VSO\\mcmnhdlr.exe\" /checktask" "VirusScan Online"="C:\\Program Files\\McAfee.com\\VSO\\mcvsshld.exe" "OASClnt"="C:\\Program Files\\McAfee.com\\VSO\\oasclnt.exe" "MPFExe"="C:\\PROGRA~1\\McAfee.com\\PERSON~1\\MpfTray.exe" "ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe" @="" "ATI DeviceDetect"="C:\\Program Files\\ATI Multimedia\\main\\ATIDtct.EXE" "systemdll"="C:\\WINDOWS\\system32\\systemdll.exe" "HydraVisionDesktopManager"="C:\\Program Files\\ATI Technologies\\ATI HYDRAVISION\\HydraDM.exe" "SpamBlocker"="C:\\Program Files\\SpamBlockerUtility\\Bin\\4.7.7.0\\SbOEAddOn.exe" "ISUSPM Startup"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\isuspm.exe\" -startup" "ISUSScheduler"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start" "PrintServer Diagnostic"="C:\\Program Files\\Print Server\\PTP\\PSDiagnostic.exe" "dlcqmon.exe"="\"C:\\Program Files\\Dell Photo AIO Printer 966\\dlcqmon.exe\"" "MemoryCardManager"="\"C:\\Program Files\\Dell Photo AIO Printer 966\\memcard.exe\"" "FaxCenterServer"="\"C:\\Program Files\\Dell PC Fax\\fm3032.exe\" /s" "DLCQCATS"="rundll32 C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\DLCQtime.dll,_RunDLLEntry@16" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "My Web Search Bar Search Scope Monitor"="\"C:\\PROGRA~1\\MYWEBS~1\\bar\\1.bin\\m3SrchMn.exe\" /m=2 /w" "MyWebSearch Email Plugin"="C:\\PROGRA~1\\MYWEBS~1\\bar\\1.bin\\mwsoemon.exe" "HostManager"="C:\\Program Files\\Common Files\\AOL\\1189803853\\ee\\AOLSoftware.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "Weather"="C:\\Program Files\\AWS\\WeatherBug\\Weather.exe 1" @="" "ATI Launchpad"="" "ATI Remote Control"="C:\\Program Files\\ATI Multimedia\\RemCtrl\\ATIRW.exe" "H/PC Connection Agent"="\"C:\\Program Files\\Microsoft ActiveSync\\WCESCOMM.EXE\"" Drivers: \WINDOWS\system32\ntoskrnl.exe \WINDOWS\system32\hal.dll \WINDOWS\system32\KDCOM.DLL \WINDOWS\system32\BOOTVID.dll ACPI.sys \WINDOWS\System32\DRIVERS\WMILIB.SYS pci.sys isapnp.sys pciide.sys \WINDOWS\System32\DRIVERS\PCIIDEX.SYS MountMgr.sys ftdisk.sys PartMgr.sys IdeBusDr.sys VolSnap.sys atapi.sys IdeChnDr.sys disk.sys \WINDOWS\System32\DRIVERS\CLASSPNP.SYS fltmgr.sys sr.sys PxHelp20.sys KSecDD.sys WudfPf.sys Ntfs.sys NDIS.sys Mup.sys agp440.sys \SystemRoot\System32\DRIVERS\intelppm.sys \SystemRoot\system32\DRIVERS\ati2mtag.sys \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS \SystemRoot\System32\DRIVERS\usbuhci.sys \SystemRoot\System32\DRIVERS\USBPORT.SYS \SystemRoot\System32\DRIVERS\usbehci.sys \SystemRoot\System32\DRIVERS\GWMDM.sys \SystemRoot\System32\DRIVERS\ks.sys \SystemRoot\System32\Drivers\Modem.SYS \SystemRoot\system32\drivers\emu10k1f.sys \SystemRoot\system32\drivers\portcls.sys \SystemRoot\system32\drivers\drmk.sys \SystemRoot\system32\drivers\sfman.sys \SystemRoot\system32\drivers\ctlface.sys \SystemRoot\System32\DRIVERS\ctljystk.sys \SystemRoot\System32\DRIVERS\gameenum.sys \SystemRoot\System32\DRIVERS\e100b325.sys \SystemRoot\System32\DRIVERS\fdc.sys \SystemRoot\System32\DRIVERS\serial.sys \SystemRoot\System32\DRIVERS\serenum.sys \SystemRoot\System32\DRIVERS\parport.sys \SystemRoot\System32\DRIVERS\i8042prt.sys \SystemRoot\System32\DRIVERS\Sk99202k.sys \SystemRoot\System32\DRIVERS\kbdclass.sys \SystemRoot\System32\Drivers\Cdr4_xp.SYS \SystemRoot\System32\Drivers\MxlW2k.SYS \SystemRoot\System32\DRIVERS\cdrom.sys \SystemRoot\System32\DRIVERS\redbook.sys \SystemRoot\System32\Drivers\Cdralw2k.SYS \SystemRoot\System32\Drivers\pwd_2K.SYS \SystemRoot\System32\Drivers\GEARAspiWDM.sys \SystemRoot\system32\DRIVERS\imapi.sys \SystemRoot\system32\drivers\smwdm.sys \SystemRoot\system32\drivers\SENSUPGD.SYS \SystemRoot\System32\DRIVERS\audstub.sys \SystemRoot\System32\DRIVERS\rasl2tp.sys \SystemRoot\System32\DRIVERS\ndistapi.sys \SystemRoot\System32\DRIVERS\ndiswan.sys \SystemRoot\System32\DRIVERS\raspppoe.sys \SystemRoot\System32\DRIVERS\raspptp.sys \SystemRoot\System32\DRIVERS\TDI.SYS \SystemRoot\System32\DRIVERS\psched.sys \SystemRoot\System32\DRIVERS\msgpc.sys \SystemRoot\System32\DRIVERS\ptilink.sys \SystemRoot\System32\DRIVERS\raspti.sys \SystemRoot\System32\DRIVERS\wanatw4.sys \SystemRoot\System32\DRIVERS\termdd.sys \SystemRoot\System32\DRIVERS\mouclass.sys \SystemRoot\System32\DRIVERS\swenum.sys \SystemRoot\System32\DRIVERS\update.sys \SystemRoot\System32\DRIVERS\mssmbios.sys \SystemRoot\system32\drivers\ATIRWVD.SYS \SystemRoot\System32\Drivers\mmc_2K.SYS \SystemRoot\System32\Drivers\NDProxy.SYS \SystemRoot\System32\DRIVERS\usbhub.sys \SystemRoot\System32\DRIVERS\USBD.SYS \SystemRoot\system32\drivers\MODEMCSA.sys \SystemRoot\System32\DRIVERS\flpydisk.sys \SystemRoot\System32\Drivers\Fs_Rec.SYS \SystemRoot\System32\Drivers\Null.SYS \SystemRoot\System32\Drivers\Beep.SYS \SystemRoot\System32\DRIVERS\Sk9920nt.sys \SystemRoot\System32\drivers\vga.sys \SystemRoot\System32\Drivers\mnmdd.SYS \SystemRoot\System32\DRIVERS\RDPCDD.sys \SystemRoot\System32\Drivers\cdudf_xp.SYS \SystemRoot\System32\Drivers\Msfs.SYS \SystemRoot\System32\Drivers\Npfs.SYS \SystemRoot\System32\Drivers\UdfReadr_xp.SYS \SystemRoot\System32\DRIVERS\rasacd.sys \SystemRoot\System32\DRIVERS\ipsec.sys \SystemRoot\System32\DRIVERS\tcpip.sys \SystemRoot\System32\Drivers\MpFirewall.sys \SystemRoot\System32\DRIVERS\netbt.sys \SystemRoot\System32\drivers\afd.sys \SystemRoot\System32\DRIVERS\netbios.sys \SystemRoot\System32\DRIVERS\rdbss.sys \SystemRoot\System32\DRIVERS\mrxsmb.sys \SystemRoot\System32\Drivers\Fips.SYS \SystemRoot\System32\DRIVERS\ipnat.sys \SystemRoot\System32\DRIVERS\wanarp.sys \SystemRoot\System32\DRIVERS\hidusb.sys \SystemRoot\System32\DRIVERS\HIDCLASS.SYS \SystemRoot\System32\DRIVERS\HIDPARSE.SYS \SystemRoot\System32\DRIVERS\mouhid.sys \SystemRoot\System32\Drivers\ASPI32.SYS \SystemRoot\System32\Drivers\Cdfs.SYS \SystemRoot\System32\Drivers\dump_IdeChnDr.sys \SystemRoot\System32\win32k.sys \SystemRoot\System32\drivers\Dxapi.sys \SystemRoot\System32\watchdog.sys \SystemRoot\System32\drivers\dxg.sys \SystemRoot\System32\drivers\dxgthk.sys \SystemRoot\System32\ati2dvag.dll \SystemRoot\System32\ati2cqag.dll \SystemRoot\System32\ati3duag.dll \SystemRoot\System32\ativvaxx.dll \SystemRoot\System32\DRIVERS\ndisuio.sys \SystemRoot\system32\drivers\wdmaud.sys \SystemRoot\system32\drivers\sysaudio.sys \SystemRoot\System32\DRIVERS\mrxdav.sys \SystemRoot\System32\Drivers\ParVdm.SYS \SystemRoot\System32\DRIVERS\srv.sys \SystemRoot\system32\drivers\naiavf5x.sys \??\C:\WINDOWS\System32\PfModNT.sys \SystemRoot\System32\DRIVERS\secdrv.sys \SystemRoot\System32\Drivers\HTTP.sys \SystemRoot\System32\DRIVERS\ipfltdrv.sys \SystemRoot\system32\drivers\kmixer.sys \SystemRoot\System32\Drivers\Fastfat.SYS \WINDOWS\system32\ntdll.dll Services: SERVICE_NAME: Alerter Notifies selected users and computers of administrative alerts. If the service is stopped, programs that use administrative alerts will not receive them. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 4 DISABLED BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService DISPLAY_NAME : Alerter SERVICE_NAME: ALG Provides support for 3rd party protocol plug-ins for Internet Connection Sharing and the Windows Firewall. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\alg.exe DISPLAY_NAME : Application Layer Gateway Service SERVICE_NAME: AOL ACS (null) START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe DISPLAY_NAME : AOL Connectivity Service SERVICE_NAME: AppMgmt Provides software installation services such as Assign, Publish, and Remove. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs DISPLAY_NAME : Application Management SERVICE_NAME: aspnet_state Provides support for out-of-process session states for ASP.NET. If this service is stopped, out-of-process requests will not be processed. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe DISPLAY_NAME : ASP.NET State Service SERVICE_NAME: Ati HotKey Poller (null) START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\system32\Ati2evxx.exe DISPLAY_NAME : Ati HotKey Poller SERVICE_NAME: ATI Smart (null) START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\system32\ati2sgag.exe DISPLAY_NAME : ATI Smart SERVICE_NAME: AudioSrv Manages audio devices for Windows-based programs. If this service is stopped, audio devices and effects will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : Windows Audio SERVICE_NAME: BITS Transfers files in the background using idle network bandwidth. If the service is stopped, features such as Windows Update, and MSN Explorer will be unable to automatically download programs and other information. If this service is disabled, any services that explicitly depend on it may fail to transfer files if they do not have a fail safe mechanism to transfer files directly through IE in case BITS has been disabled. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : Background Intelligent Transfer Service SERVICE_NAME: Browser Maintains an updated list of computers on the network and supplies this list to computers designated as browsers. If this service is stopped, this list will not be updated or maintained. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : Computer Browser SERVICE_NAME: cisvc Indexes contents and properties of files on local and remote computers; provides rapid access to files through flexible querying language. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\cisvc.exe DISPLAY_NAME : Indexing Service SERVICE_NAME: ClipSrv Enables ClipBook Viewer to store information and share it with remote computers. If the service is stopped, ClipBook Viewer will not be able to share information with remote computers. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 4 DISABLED BINARY_PATH_NAME : C:\WINDOWS\system32\clipsrv.exe DISPLAY_NAME : ClipBook SERVICE_NAME: COMSysApp Manages the configuration and tracking of Component Object Model (COM)+-based components. If the service is stopped, most COM+-based components will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} DISPLAY_NAME : COM+ System Application SERVICE_NAME: Creative Service for CDROM Access (null) START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\System32\CTsvcCDA.exe DISPLAY_NAME : Creative Service for CDROM Access SERVICE_NAME: CryptSvc Provides three management services: Catalog Database Service, which confirms the signatures of Windows files; Protected Root Service, which adds and removes Trusted Root Certification Authority certificates from this computer; and Key Service, which helps enroll this computer for certificates. If this service is stopped, these management services will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs DISPLAY_NAME : Cryptographic Services SERVICE_NAME: DcomLaunch Provides launch functionality for DCOM services. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\system32\svchost -k DcomLaunch DISPLAY_NAME : DCOM Server Process Launcher SERVICE_NAME: Dhcp Manages network configuration by registering and updating IP addresses and DNS names. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : DHCP Client SERVICE_NAME: dlcq_device (null) START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\system32\dlcqcoms.exe -service DISPLAY_NAME : dlcq_device SERVICE_NAME: dmadmin Configures hard disk drives and volumes. The service only runs for configuration processes and then stops. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\dmadmin.exe /com DISPLAY_NAME : Logical Disk Manager Administrative Service SERVICE_NAME: dmserver Detects and monitors new hard disk drives and sends disk volume information to Logical Disk Manager Administrative Service for configuration. If this service is stopped, dynamic disk status and configuration information may become out of date. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : Logical Disk Manager SERVICE_NAME: Dnscache Resolves and caches Domain Name System (DNS) names for this computer. If this service is stopped, this computer will not be able to resolve DNS names and locate Active Directory domain controllers. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k NetworkService DISPLAY_NAME : DNS Client SERVICE_NAME: ERSvc Allows error reporting for services and applictions running in non-standard environments. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : Error Reporting Service SERVICE_NAME: Eventlog Enables event log messages issued by Windows-based programs and components to be viewed in Event Viewer. This service cannot be stopped. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\system32\services.exe DISPLAY_NAME : Event Log SERVICE_NAME: EventSystem Supports System Event Notification Service (SENS), which provides automatic distribution of events to subscribing Component Object Model (COM) components. If the service is stopped, SENS will close and will not be able to provide logon and logoff notifications. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : COM+ Event System SERVICE_NAME: FastUserSwitchingCompatibility Provides management for applications that require assistance in a multiple user environment. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : Fast User Switching Compatibility SERVICE_NAME: gusvc (null) START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe" DISPLAY_NAME : Google Updater Service SERVICE_NAME: helpsvc Enables Help and Support Center to run on this computer. If this service is stopped, Help and Support Center will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : Help and Support SERVICE_NAME: HidServ Enables generic input access to Human Interface Devices (HID), which activates and maintains the use of predefined hot buttons on keyboards, remote controls, and other multimedia devices. If this service is stopped, hot buttons controlled by this service will no longer function. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 4 DISABLED BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : Human Interface Device Access SERVICE_NAME: HTTPFilter This service implements the secure hypertext transfer protocol (HTTPS) for the HTTP service, using the Secure Socket Layer (SSL). If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k HTTPFilter DISPLAY_NAME : HTTP SSL SERVICE_NAME: IDriverT Provides support for the Running Object Table for InstallShield Drivers START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe" DISPLAY_NAME : InstallDriver Table Manager SERVICE_NAME: ImapiService Manages CD recording using Image Mastering Applications Programming Interface (IMAPI). If this service is stopped, this computer will be unable to record CDs. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\imapi.exe DISPLAY_NAME : IMAPI CD-Burning COM Service SERVICE_NAME: iPod Service iPod hardware management services START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : "C:\Program Files\iPod\bin\iPodService.exe" DISPLAY_NAME : iPod Service SERVICE_NAME: lanmanserver Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : Server SERVICE_NAME: lanmanworkstation Creates and maintains client network connections to remote servers. If this service is stopped, these connections will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : Workstation SERVICE_NAME: LmHosts Enables support for NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService DISPLAY_NAME : TCP/IP NetBIOS Helper SERVICE_NAME: McDetect.exe (null) START_TYPE : 2 AUTO_START BINARY_PATH_NAME : c:\program files\mcafee.com\agent\mcdetect.exe DISPLAY_NAME : McAfee WSC Integration SERVICE_NAME: McShield (null) START_TYPE : 2 AUTO_START BINARY_PATH_NAME : c:\PROGRA~1\mcafee.com\vso\mcshield.exe DISPLAY_NAME : McAfee.com McShield SERVICE_NAME: McTskshd.exe (null) START_TYPE : 2 AUTO_START BINARY_PATH_NAME : c:\PROGRA~1\mcafee.com\agent\mctskshd.exe DISPLAY_NAME : McAfee Task Scheduler SERVICE_NAME: mcupdmgr.exe (null) START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe DISPLAY_NAME : McAfee SecurityCenter Update Manager SERVICE_NAME: MDM Manages local and remote debugging for Visual Studio debuggers START_TYPE : 2 AUTO_START BINARY_PATH_NAME : "C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe" DISPLAY_NAME : Machine Debug Manager SERVICE_NAME: Messenger Transmits net send and Alerter service messages between clients and servers. This service is not related to Windows Messenger. If this service is stopped, Alerter messages will not be transmitted. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 4 DISABLED BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : Messenger SERVICE_NAME: mnmsrvc Enables an authorized user to access this computer remotely by using NetMeeting over a corporate intranet. If this service is stopped, remote desktop sharing will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\mnmsrvc.exe DISPLAY_NAME : NetMeeting Remote Desktop Sharing SERVICE_NAME: MpfService (null) START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe DISPLAY_NAME : McAfee Personal Firewall Service COMMAND : cAfee.com\PERSON~1\MpfService.exe" /servicecrash /fail=%1% SERVICE_NAME: MSDTC Coordinates transactions that span multiple resource managers, such as databases, message queues, and file systems. If this service is stopped, these transactions will not occur. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\msdtc.exe DISPLAY_NAME : Distributed Transaction Coordinator SERVICE_NAME: MSIServer Adds, modifies, and removes applications provided as a Windows Installer (*.msi) package. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\system32\msiexec.exe /V DISPLAY_NAME : Windows Installer SERVICE_NAME: NetDDE Provides network transport and security for Dynamic Data Exchange (DDE) for programs running on the same computer or on different computers. If this service is stopped, DDE transport and security will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 4 DISABLED BINARY_PATH_NAME : C:\WINDOWS\system32\netdde.exe DISPLAY_NAME : Network DDE SERVICE_NAME: NetDDEdsdm Manages Dynamic Data Exchange (DDE) network shares. If this service is stopped, DDE network shares will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 4 DISABLED BINARY_PATH_NAME : C:\WINDOWS\system32\netdde.exe DISPLAY_NAME : Network DDE DSDM SERVICE_NAME: Netlogon Supports pass-through authentication of account logon events for computers in a domain. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\lsass.exe DISPLAY_NAME : Net Logon SERVICE_NAME: Netman Manages objects in the Network and Dial-Up Connections folder, in which you can view both local area network and remote connections. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : Network Connections SERVICE_NAME: Nla Collects and stores network configuration and location information, and notifies applications when this information changes. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : Network Location Awareness (NLA) SERVICE_NAME: NtLmSsp Provides security to remote procedure call (RPC) programs that use transports other than named pipes. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\lsass.exe DISPLAY_NAME : NT LM Security Support Provider SERVICE_NAME: NtmsSvc (null) START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs DISPLAY_NAME : Removable Storage SERVICE_NAME: PictureTaker (null) START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\PCTKRNT.SYS DISPLAY_NAME : PictureTaker SERVICE_NAME: PlugPlay Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\system32\services.exe DISPLAY_NAME : Plug and Play SERVICE_NAME: Pml Driver HPZ12 (null) START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\system32\HPZipm12.exe DISPLAY_NAME : Pml Driver HPZ12 SERVICE_NAME: PolicyAgent Manages IP security policy and starts the ISAKMP/Oakley (IKE) and the IP security driver. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\System32\lsass.exe DISPLAY_NAME : IPSEC Services SERVICE_NAME: ProtectedStorage Provides protected storage for sensitive data, such as private keys, to prevent access by unauthorized services, processes, or users. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\system32\lsass.exe DISPLAY_NAME : Protected Storage SERVICE_NAME: RasAuto Creates a connection to a remote network whenever a program references a remote DNS or NetBIOS name or address. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : Remote Access Auto Connection Manager SERVICE_NAME: RasMan Creates a network connection. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : Remote Access Connection Manager SERVICE_NAME: RDSessMgr Manages and controls Remote Assistance. If this service is stopped, Remote Assistance will be unavailable. Before stopping this service, see the Dependencies tab of the Properties dialog box. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\system32\sessmgr.exe DISPLAY_NAME : Remote Desktop Help Session Manager SERVICE_NAME: RemoteAccess Offers routing services to businesses in local area and wide area network environments. START_TYPE : 4 DISABLED BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : Routing and Remote Access SERVICE_NAME: RpcLocator Manages the RPC name service database. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\locator.exe DISPLAY_NAME : Remote Procedure Call (RPC) Locator SERVICE_NAME: RpcSs Provides the endpoint mapper and other miscellaneous RPC services. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\system32\svchost -k rpcss DISPLAY_NAME : Remote Procedure Call (RPC) SERVICE_NAME: RSVP Provides network signaling and local traffic control setup functionality for QoS-aware programs and control applets. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\rsvp.exe DISPLAY_NAME : QoS RSVP SERVICE_NAME: SamSs Stores security information for local user accounts. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\system32\lsass.exe DISPLAY_NAME : Security Accounts Manager SERVICE_NAME: SCardSvr Manages access to smart cards read by this computer. If this service is stopped, this computer will be unable to read smart cards. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\SCardSvr.exe DISPLAY_NAME : Smart Card SERVICE_NAME: Schedule Enables a user to configure and schedule automated tasks on this computer. If this service is stopped, these tasks will not be run at their scheduled times. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : Task Scheduler SERVICE_NAME: seclogon Enables starting processes under alternate credentials. If this service is stopped, this type of logon access will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : Secondary Logon SERVICE_NAME: SENS Tracks system events such as Windows logon, network, and power events. Notifies COM+ Event System subscribers of these events. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs DISPLAY_NAME : System Event Notification SERVICE_NAME: SharedAccess Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : Windows Firewall/Internet Connection Sharing (ICS) SERVICE_NAME: ShellHWDetection (null) START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : Shell Hardware Detection SERVICE_NAME: SNDSrvc Symantec Network Drivers Service START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe DISPLAY_NAME : Symantec Network Drivers Service SERVICE_NAME: Spooler Loads files to memory for later printing. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\system32\spoolsv.exe DISPLAY_NAME : Print Spooler SERVICE_NAME: srservice Performs system restore functions. To stop service, turn off System Restore from the System Restore tab in My Computer->Properties START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : System Restore Service SERVICE_NAME: SSDPSRV Enables discovery of UPnP devices on your home network. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService DISPLAY_NAME : SSDP Discovery Service SERVICE_NAME: stisvc Provides image acquisition services for scanners and cameras. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k imgsvc DISPLAY_NAME : Windows Image Acquisition (WIA) SERVICE_NAME: SvcProc (null) START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\svcproc.exe DISPLAY_NAME : System Startup Service SERVICE_NAME: SwPrv Manages software-based volume shadow copies taken by the Volume Shadow Copy service. If this service is stopped, software-based volume shadow copies cannot be managed. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\dllhost.exe /Processid:{5DA92CA6-435D-4A81-B281-4A05ABC385A4} DISPLAY_NAME : MS Software Shadow Copy Provider SERVICE_NAME: SysmonLog Collects performance data from local or remote computers based on preconfigured schedule parameters, then writes the data to a log or triggers an alert. If this service is stopped, performance information will not be collected. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\system32\smlogsvc.exe DISPLAY_NAME : Performance Logs and Alerts SERVICE_NAME: TapiSrv Provides Telephony API (TAPI) support for programs that control telephony devices and IP based voice connections on the local computer and, through the LAN, on servers that are also running the service. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : Telephony SERVICE_NAME: TermService Allows multiple users to be connected interactively to a machine as well as the display of desktops and applications to remote computers. The underpinning of Remote Desktop (including RD for Administrators), Fast User Switching, Remote Assistance, and Terminal Server. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost -k DComLaunch DISPLAY_NAME : Terminal Services SERVICE_NAME: Themes Provides user experience theme management. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : Themes SERVICE_NAME: TrkWks Maintains links between NTFS files within a computer or across computers in a network domain. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs DISPLAY_NAME : Distributed Link Tracking Client SERVICE_NAME: upnphost Provides support to host Universal Plug and Play devices. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService DISPLAY_NAME : Universal Plug and Play Device Host SERVICE_NAME: UPS Manages an uninterruptible power supply (UPS) connected to the computer. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\ups.exe DISPLAY_NAME : Uninterruptible Power Supply SERVICE_NAME: VSS Manages and implements Volume Shadow Copies used for backup and other purposes. If this service is stopped, shadow copies will be unavailable for backup and the backup may fail. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\vssvc.exe DISPLAY_NAME : Volume Shadow Copy SERVICE_NAME: W32Time Maintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : Windows Time SERVICE_NAME: WANMiniportService (null) START_TYPE : 2 AUTO_START BINARY_PATH_NAME : "C:\WINDOWS\wanmpsvc.exe" DISPLAY_NAME : WAN Miniport (ATW) Service SERVICE_NAME: WebClient Enables Windows-based programs to create, access, and modify Internet-based files. If this service is stopped, these functions will not be available. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService DISPLAY_NAME : WebClient SERVICE_NAME: winmgmt Provides a common interface and object model to access management information about operating system, devices, applications and services. If this service is stopped, most Windows-based software will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs DISPLAY_NAME : Windows Management Instrumentation SERVICE_NAME: WinToolsSvc (null) START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\Program Files\Common Files\WinTools\WToolsS.exe DISPLAY_NAME : WinTools for IE service SERVICE_NAME: WmdmPmSN Retrieves the serial number of any portable media player connected to this computer. If this service is stopped, protected content might not be down loaded to the device. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : Portable Media Serial Number Service SERVICE_NAME: WmiApSrv Provides performance library information from WMI HiPerf providers. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\wbem\wmiapsrv.exe DISPLAY_NAME : WMI Performance Adapter SERVICE_NAME: WMPNetworkSvc Shares Windows Media Player libraries to other networked players and media devices using Universal Plug and Play START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : "C:\Program Files\Windows Media Player\wmpnetwk.exe" DISPLAY_NAME : Windows Media Player Network Sharing Service SERVICE_NAME: wscsvc Monitors system security settings and configurations. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : Security Center SERVICE_NAME: wuauserv Enables the download and installation of critical Windows updates. If the service is disabled, the operating system can be manually updated at the Windows Update Web site. START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs DISPLAY_NAME : Automatic Updates SERVICE_NAME: WudfSvc Manages user-mode driver host processes START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup DISPLAY_NAME : Windows Driver Foundation - User-mode Driver Framework SERVICE_NAME: WZCSVC Provides automatic configuration for the 802.11 adapters START_TYPE : 2 AUTO_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : Wireless Zero Configuration SERVICE_NAME: x10nets (null) START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe DISPLAY_NAME : X10 Device Network Service SERVICE_NAME: xmlprov Manages XML configuration files on a domain basis for automatic network provisioning. START_TYPE : 3 DEMAND_START BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs DISPLAY_NAME : Network Provisioning Service ShellExecuteHooks:

Hi Post the Combofix log when you can, but Im shutting down soon, so it will be morning before i get chance to go over the logs.

Hi

Open Notepad and Copy/Paste the text in the codebox below into it:

File::
C:\WINDOWS\cjqter.exe
C:\WINDOWS\hyfin.exe
C:\WINDOWS\axovqr.exe
C:\WINDOWS\mbud.exe
C:\WINDOWS\system32\systemdll.exe

Folder::
C:\Program Files\WindowsSA
C:\PROGRA~1\COMMON~1\WinTools
C:\PROGRA~1\MYWEBS~1

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cjqter"=-
"hyfin"=-
"axovqr"=-
"mbud"=-
"Windows SA"=-
"mswspl"=-
"iqbhlu"=-
"WinTools"=-
"ap9h4qmo"=-
"farmmext"=-
"systemdll"=-
"My Web Search Bar Search Scope Monitor"=-

Save this as "CFScript"

[external image: Posted Image]


Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log with a new HijackThis log.

Hi

1) Funnily enough, Im not 100% sure on that, though I am pretty certain the tools we use scan the whole computer. I will get that confirmed.

2)We will update Java once you are clean.

3)Once we are finished you can remove programs that are surplus to requirement.

4)You dont need any particular background to join the Classroom, but a willingness to learn. I personally had no experience when I first began having just gotten my first pc a few months before. I stumbled across these forums purely out of curiosity and joined up. You do learn a lot through the studying, about how Windows works, for one thing. It seems daunting at first but it's worth persevering when you get your first thank you.

Remove programs from Add/Remove Programs List
Please go to:

• Start
• Control Panel
• Add/Remove Programs

Find and remove these programs (if they are present)

• ISTBar

WeatherBug is a system tray icon that offers weather information and includes built-in ads. WeatherBug is controlled by AWS Convergence Technologies (weatherbugmedia.com). There is some controversy over whether WeatherBug should be targeted by anti-parasite software. AWS strongly deny their software is ‘spyware’, and by the definition used here, it is not, as it does not leak information back to its controlling servers. However, WeatherBug has in the past been silently installed by the FavoriteMan parasite and Freeze.com screensavers, and more recently has been bundled by software such as AIM and Blubster. This makes it ‘unsolicited’, and since it is installed to raise money for its creators through the built-in ads it is certainly ‘commercial’. So it does meet the definition for ‘parasite’: unsolicited commercial software. It is nonetheless listed as a borderline case because it is not overtly harmful and many people do install it deliberately. WeatherBug bundles the MySearch parasite in its standalone distribution and has in the past, installed Gator and SVAPlayer.

I recommend that you uninstall WeatherBugand choose one of these alternatives:
Weather Pulse
Weather Watcher
or
Get mozilla Firefox and then get FORECASTFOX!!!
or check the weather at these websites:
Weather Street: US Weather
Intellicast
To uninstall WeatherBug:

• Click Start, point to Settings, and then click Control Panel.
• In Control Panel, double-click Add or Remove Programs.
• In Add or Remove Programs, highlight WeatherBug, click Remove.
• Close the Add or Remove Programs and the Control Panel windows.

Run HijackThis, select Do a system scan only and place checks against the following entries (if they are still present):
R3 - URLSearchHook: {B5AB638F-D76C-415B-A8F2-F3CEAC502212} - - (no file)
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O3 - Toolbar: (no name) - {EA5A82FB-D6BE-44F9-9363-B1ABABC153C1} - (no file)
O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL (file missing)
O3 - Toolbar: (no name) - {D49E9D35-254C-4c6a-9D17-95018D228FF5} - (no file)
O23 - Service: WinTools for IE service (WinToolsSvc) - Unknown owner - C:\Program Files\Common Files\WinTools\WToolsS.exe (file missing)


WITH ALL OTHER WINDOWS CLOSED Click on Fix Checked and exit HijackThis.

• Please go HERE to run PandaActiveScan…
  
  
• Once you are on the Panda site click the Scan your PC button
  
• A new window will open…click the Check Now button
  
• Enter your Country
  
• Enter your State/Province
  
• Enter your e-mail address and click send
  
• Select either Home User or Company
  
• Click the big Scan Now button
  
• If it wants to install an ActiveX component allow it
  
• It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  
  
• When download is complete, click on My Computer to start the scan
  
• When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to your desktop.

Post a new HijackThis log with the report from the Pandascan.

Hi

Forget the Pandascan.

BLACKLIGHT

• Please download F-Secure Blacklight (fsbl.exe) from here
• Save into C:\ with a name of fsbl.exe
• Go to Start > Run
• Copy and paste the contents of the below codebox into the run box
  

  C:\fsbl.exe /expert

• Click OK
• This will launch BlackLight
• Select I accept the agreement
• Click Next
• Click Scan
• Wait for the scan to finish
• Click on Next>
• Click Exit
• A logfile will have been created in the C:\ drive
• It will be named fsbl-xxxxxxxxxxxxxx.log where xxxxxxxxxxxxxx is the date and time of the scan
• Use notepad to open that log
• Post the contents of that log.

Download Superantispyware (SAS) free home version.

SAS Free

Install it and double-click the icon on your desktop to run it.
� It will ask if you want to update the program definitions, click Yes.
� Under Configuration and Preferences, click the Preferences button.
� Click the Scanning Control tab.
� Under Scanner Options make sure the following are checked:

• Close browsers before scanning
• Scan for tracking cookies
• Terminate memory threats before quarantining.
• Please leave the others unchecked.
• Click the Close button to leave the control center screen.

� On the main screen, under Scan for Harmful Software click Scan your computer.
� On the left check C:\Fixed Drive.
� On the right, under Complete Scan, choose Perform Complete Scan.
� Click Next to start the scan. Please be patient while it scans your computer.
� After the scan is complete a summary box will appear. Click OK.
� Make sure everything in the white box has a check next to it, then click Next.
� It will quarantine what it found and if it asks if you want to reboot, click Yes.
� To retrieve the removal information for me please do the following:

• After reboot, double-click the SUPERAntispyware icon on your desktop.
• Click Preferences. Click the Statistics/Logs tab.
• Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
• It will open in your default text editor (such as Notepad/Wordpad).
• Please highlight everything in the notepad, then right-click and choose copy.

� Click close and close again to exit the program.
� Please paste that information here for me with a new HijackThis log.

Here is the Blacklight log. It appears to not find anything. 09/23/07 11:56:21 [Info]: BlackLight Engine 1.0.64 initialized 09/23/07 11:56:21 [Info]: OS: 5.1 build 2600 (Service Pack 2) 09/23/07 11:56:21 [Note]: 7019 4 09/23/07 11:56:21 [Note]: 7005 0 09/23/07 11:56:34 [Note]: 7006 0 09/23/07 11:56:34 [Note]: 7022 0 09/23/07 11:56:34 [Note]: 7011 1108 09/23/07 11:56:34 [Note]: 7026 0 09/23/07 11:56:35 [Note]: 7026 0 09/23/07 11:56:39 [Note]: FSRAW library version 1.7.1022 09/23/07 12:06:30 [Note]: 2000 1012 09/23/07 12:06:30 [Note]: 2000 1012 09/23/07 12:06:30 [Note]: 2000 1012 09/23/07 12:06:30 [Note]: 2000 1012 09/23/07 12:18:59 [Note]: 7007 0

Hi

Do you remember at what point you lost internet connection? it might help pin down the cause of the problem.


Delete bad services
Please copy (Ctrl+C) and paste (Ctrl+V) the following text in the quote to Notepad. Save it as "All Files" and name it FixServices.bat Please save it on your desktop.

@echo off
sc stop "System Startup Service (SvcProc)"
sc delete "System Startup Service (SvcProc)"
del Fixservices.bat
exit

Double click FixServices.bat. A window will open and close. This is normal.

Navigate to and delete the following file, if it is still present

C:\Windows\svcproc.exe

Run HijackThis, select Do a system scan only and place checks against the following entries (if they are still present):
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://as.starware.com/dp/search?x=wKX1ILE…GsRJZdNeVMkZPA=
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…?p=ZNxdm824YYUS
O9 - Extra button: (no name) - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f…p1.0.0.15-3.cab
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing)
O23 - Service: WinTools for IE service (WinToolsSvc) - Unknown owner - C:\Program Files\Common Files\WinTools\WToolsS.exe (file missing)


WITH ALL OTHER WINDOWS CLOSED Click on Fix Checked and exit HijackThis then reboot.


Now post a new Hijackthis log.