Spyware / Malware / Virus Removal

[Resolved] Save me from SaveTheInformation.com

12 min read

Looking for the outcome? Ask AI

DaveMor Topic Starter

Post #1October 24, 2007, 3:51 PM UTC last edited October 24, 2007, 11:54 PM UTC

I have been having excessive popups as well as fake system warnings trying to get me to download virus protection. There are also shortcuts for "Online Security Guide" and "Live Safety Center" in my start menu as well as on my desktop. If erased they reappear. I have McAfee as well as have ran Adaware and a popup stopper. I have successfully followed the instructions and ran ATF Cleaner, Spybot S&D, AVG Anti Spyware and HiJackThis. I am still overwhelmed by popups and fake warnings.

Below is the log for HiJackThis. I must have made some mistake in the AVG log there are not readable characters in it. I will attach it as well as the HiJack This Log.

Logfile of HijackThis v1.99.1
Scan saved at 6:05:58 PM, on 10/23/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\lkcitdl.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\lkads.exe
C:\WINDOWS\CYB2K.EXE
C:\Program Files\Xpoint\PE\Skin\rrpcsb.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
C:\WINDOWS\system32\lktsrv.exe
C:\Program Files\McAfee\Managed VirusScan\Agent\myagttry.exe
C:\Program Files\Xpoint\PE\pcrecsa.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\mnmsrvc.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\National Instruments\MAX\nimxs.exe
C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
C:\WINDOWS\system32\nisvcloc.exe
C:\Program Files\National Instruments\Shared\Tagger\tagsrv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Xpoint\xpadmin\xpadmin.exe
C:\PROGRA~1\Xpoint\agent\Xpagent.exe
C:\WINDOWS\System32\mqsvc.exe
C:\PROGRA~1\Xpoint\EEClient\xpclient.exe
C:\WINDOWS\System32\mqtgsvc.exe
C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe
C:\WINDOWS\SYSTEM32\Rpcnet.exe
C:\dkm\hijackthis.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\System32\roilkmjt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Bart Station] C:\Program Files\ISP50\hta\station.sbrt
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [setup2k.exe] c:\wutemp\setup2k.exe
O4 - HKLM\..\Run: [C2K] C:\WINDOWS\CYB2K.EXE
O4 - HKLM\..\Run: [Rapid Restore] C:\Program Files\Xpoint\PE\Skin\rrpcsb.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
O4 - HKLM\..\Run: [SchoolCashReminderService] wjview /cp:p "C:\Program Files\SchoolCashReminderService\System\Code" Main lp: "C:\Program Files\SchoolCashReminderService"
O4 - HKLM\..\Run: [Rosary Reminder] C:\PROGRA~1\VIRTUA~1\reminder.exe
O4 - HKLM\..\Run: [TaskPlus] C:\Program Files\TaskPlus\taskplus0.exe
O4 - HKLM\..\Run: [McAfee Managed Services Tray] "C:\Program Files\McAfee\Managed VirusScan\Agent\myagttry.exe"
O4 - HKLM\..\Run: [MVS Splash] C:\Program Files\McAfee\Managed VirusScan\Agent\Splash.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\RunOnce: [!CleanupNetMeetingDispDriver] "C:\WINDOWS\system32\rundll32.exe" msconf.dll,CleanupNetMeetingDispDriver 0
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - Startup: TA_Start.lnk = C:\WINDOWS\system32\kkdsrngp.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: SchoolCash - file://C:\Program Files\SchoolCashReminderService\System\Temp\scash_script.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Golden Tiger Poker - {772B5BF8-12E8-4a5d-B48F-652B5E82025D} - C:\Program Files\goldentigerMPP\MPPoker.exe (file missing)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: SchoolCash - {011E1110-AF57-11d4-AC1C-E843E6000000} - file://C:\Program Files\SchoolCashReminderService\System\Temp\scash_script.htm (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: 6th Street Omaha Poker by pogo - http://game1.pogo.com/applet-6.6.4.21/omaha/omaha-en_US.cab
O16 - DPF: Aces Up! by pogo - http://game1.pogo.com/applet-6.6.5.22/aces/aces-en_US.cab
O16 - DPF: Backgammon by pogo - http://game1.pogo.com/applet-6.6.5.22/back…ammon-en_US.cab
O16 - DPF: Blooop by pogo - http://game1.pogo.com/applet-6.6.5.22/casc…scade-en_US.cab
O16 - DPF: Bump by pogo - http://www.pogo.com/applet-6.7.1.23/bump/bump-en_US.cab
O16 - DPF: Canasta by pogo - http://game1.pogo.com/applet-6.7.2.33/cana…nasta-en_US.cab
O16 - DPF: Command & Conquer Generals Comanche Strike by pogo.com - http://ccstrike.pogo.com/applet/ccstrike/c…e-ob-assets.cab
O16 - DPF: Dice City Roller by pogo - http://game1.pogo.com/applet-6.7.1.33/ytz/ytz-en_US.cab
O16 - DPF: EA Sports Web Soccer by pogo - http://game1.pogo.com/applet-6.7.1.23/socc…occer-en_US.cab
O16 - DPF: First Class Solitaire by pogo - http://game1.pogo.com/applet-6.6.5.22/firs…lass2-en_US.cab
O16 - DPF: Fortune Bingo by pogo - http://game1.pogo.com/applet-6.6.4.29/supe…bingo-en_US.cab
O16 - DPF: Harvest Mania by pogo - http://game1.pogo.com/applet-6.6.5.31/harv…rvest-en_US.cab
O16 - DPF: High Stakes Pool by pogo - http://game1.pogo.com/applet-6.7.2.33/pool2/pool-en_US.cab
O16 - DPF: Jungle Gin by pogo - http://game1.pogo.com/applet-6.6.5.22/gin/gin-en_US.cab
O16 - DPF: Keno by pogo - http://game1.pogo.com/applet-6.6.5.31/keno/keno-en_US.cab
O16 - DPF: Lost Temple Poker by pogo - http://game1.pogo.com/applet-6.6.5.31/mhpo…poker-en_US.cab
O16 - DPF: Lottso by pogo - http://game1.pogo.com/applet-6.7.0.32/lott…ottso-en_US.cab
O16 - DPF: Mah Jong Garden by pogo - http://game1.pogo.com/applet-6.6.5.31/mahj…hjong-en_US.cab
O16 - DPF: Multiline Slots by pogo - http://game1.pogo.com/applet-6.7.0.40/mlsl…slots-en_US.cab
O16 - DPF: Payday FreeCell by pogo - http://game1.pogo.com/applet-6.7.1.23/free…ecell-en_US.cab
O16 - DPF: Pebble Beach 3 Hole Challenge by pogo.com - http://threehole01.pogo.com/applet/threeho…e-ob-assets.cab
O16 - DPF: Penguin Blocks by pogo - http://game1.pogo.com/applet-6.6.5.22/peng…guins-en_US.cab
O16 - DPF: Perfect Pair Solitaire by pogo - http://game1.pogo.com/applet-6.6.5.22/wate…wheel-en_US.cab
O16 - DPF: Phlinx by pogo - http://game1.pogo.com/applet-6.7.0.32/flin…inger-en_US.cab
O16 - DPF: Pinochle by pogo - http://game1.pogo.com/applet-6.6.4.21/pino…ochle-en_US.cab
O16 - DPF: Pirate's Gold by pogo - http://game1.pogo.com/applet-6.6.5.31/pira…sgold-en_US.cab
O16 - DPF: Pop Fu by pogo - http://game1.pogo.com/applet-6.6.5.22/popfu/popfu-en_US.cab
O16 - DPF: PoppaZoppa by pogo - http://game1.pogo.com/applet-6.6.2.21/popp…zoppa-en_US.cab
O16 - DPF: Poppit by pogo - http://game1.pogo.com/applet-6.7.1.33/popp…ppit2-en_US.cab
O16 - DPF: Quick Quack by pogo - http://game1.pogo.com/applet-6.6.5.31/hots…treak-en_US.cab
O16 - DPF: Showbiz Slots 2 by pogo - http://game1.pogo.com/applet-6.6.3.34/slot…wbiz2-en_US.cab
O16 - DPF: Showbiz Slots by pogo - http://game1.pogo.com/applet-6.6.5.31/slot…owbiz-en_US.cab
O16 - DPF: Shuffle Bump by pogo - http://game1.pogo.com/applet-6.7.0.32/puck/puck-en_US.cab
O16 - DPF: Squelchies by pogo - http://game1.pogo.com/applet-6.6.4.21/sque…chies-en_US.cab
O16 - DPF: Texas Hold'em Poker by pogo - http://game1.pogo.com/applet-6.7.2.33/hold…oldem-en_US.cab
O16 - DPF: Top Down Baseball Challenge by pogo - http://game1.pogo.com/applet-6.7.1.23/topd…down2-en_US.cab
O16 - DPF: Tri-Peaks by pogo - http://game1.pogo.com/applet-6.6.4.29/peaks/peaks-en_US.cab
O16 - DPF: Tumble Bees by pogo - http://game1.pogo.com/applet-6.6.4.21/jumb…umbee-en_US.cab
O16 - DPF: Turbo 21 v2 by pogo - http://game1.pogo.com/applet-6.7.0.32/turb…rbo22-en_US.cab
O16 - DPF: Wonderland Memories by pogo - http://game1.pogo.com/applet-6.6.5.22/memo…ories-en_US.cab
O16 - DPF: Word Whomp by pogo - http://game1.pogo.com/applet-6.6.5.31/word…homp2-en_US.cab
O16 - DPF: Word Whomp Whackdown by pogo - http://game1.pogo.com/applet-6.6.5.31/whac…kdown-en_US.cab
O16 - DPF: WordJong by pogo - http://game1.pogo.com/applet-6.7.0.40/word…djong-en_US.cab
O16 - DPF: World Class Solitaire by pogo - http://game1.pogo.com/applet-6.7.1.23/worl…class-en_US.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://www.worldwinner.com/games/v47/share…GamesLoader.cab
O16 - DPF: {2DFF31F9-7893-4922-AF66-C9A1EB4EBB31} (Rhapsody Player Engine) - http://forms.real.com/real/player/download…ne_Inst_Win.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} (PogoWebLauncher Control) - http://www.pogo.com/cdl/launcher/PogoWebLa…erInstaller.CAB
O16 - DPF: {380BBEC2-4CAE-4ECE-8AFF-36CDE7916386} (Surgient URA Local Proxy Client (v2)) - http://ni-us.demoservers.com/URA/URA/lib/L…roxyActiveX.cab
O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} (king.com) - http://games.king.com/ctl/kingcomie.cab
O16 - DPF: {4EDCB26C-D24C-4E72-AF07-B576699AC0DE} (Microsoft RDP Client Control (redist)) - http://ni-us.demoservers.com/URA/URA/lib/srdp.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/4058/ftp…tle/Coupons.cab
O16 - DPF: {B06CE1BC-5D9D-4676-BD28-1752DBF394E0} (Hangman Control) - http://www.worldwinner.com/games/v41/hangman/hangman.cab
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - https://www.verizon.net/WhatsNext/CheckMyPc…tivePreQual.cab
O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) - http://www.worldwinner.com/games/v47/famil…/familyfeud.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir…l/installer.exe
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://games.pogo.com/online2/pogo/insaniq…aploader_v6.cab
O18 - Protocol: bw+0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: myrm - {4D034FC3-013F-4B95-B544-44D49ABE3E76} - C:\Program Files\McAfee\Managed VirusScan\Agent\MyRmProt4.5.1.191.dll
O18 - Protocol: offline-8876480 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Lookout Citadel Server (LkCitadelServer) - National Instruments, Inc. - C:\WINDOWS\system32\lkcitdl.exe
O23 - Service: National Instruments PSP Server Locator (lkClassAds) - National Instruments, Inc. - C:\WINDOWS\system32\lkads.exe
O23 - Service: National Instruments Time Synchronization (lkTimeSync) - National Instruments, Inc. - C:\WINDOWS\system32\lktsrv.exe
O23 - Service: McShield - McAfee, Inc. - C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe
O23 - Service: NI Configuration Manager (mxssvr) - National Instruments Corporation - C:\Program Files\National Instruments\MAX\nimxs.exe
O23 - Service: McAfee Virus and Spyware Protection Service (myAgtSvc) - McAfee, Inc. - C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
O23 - Service: National Instruments Domain Service (NIDomainService) - National Instruments, Inc. - C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
O23 - Service: NILM License Manager - Macrovision Corporation - C:\Program Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe
O23 - Service: NI Service Locator (niSvcLoc) - National Instruments Corp. - C:\WINDOWS\system32\nisvcloc.exe
O23 - Service: National Instruments Variable Engine (NITaggerService) - National Instruments, Inc. - C:\Program Files\National Instruments\Shared\Tagger\tagsrv.exe
O23 - Service: Xpoint PCRadmin Server (PCRadminServer) - Unknown owner - C:\PROGRA~1\Xpoint\PE\pcradmin.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Remote Procedure Call (RPC) Net (Rpcnet) - Absolute Software Corp. - C:\WINDOWS\SYSTEM32\Rpcnet.exe
O23 - Service: Xpoint Admin Server (XPadminServer) - Unknown owner - C:\PROGRA~1\Xpoint\xpadmin\xpadmin.exe
O23 - Service: Xpoint Agent Server (xpAgentServer) - Unknown owner - C:\PROGRA~1\Xpoint\agent\Xpagent.exe

I also forgot to mention that there was a "security toolbar" I thought I successfully removed it but I see it in the hijackthis log. Please help the popups are becoming more and more inappropriate and I have young children.

Attachments:

LDTate

Post #2October 24, 2007, 11:51 PM UTC

Hello and welcome to the forums

Please don't attach any scans, you need to postthem.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.

Next:

Open the HijackThis Folder. Find the file HijackThis.exe, Right Click on the file and Select Rename. Rename Hijackthis.exe to Spyware.exe.

Please do not delete anything unless instructed to.

Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:

Download ComboFix from Here to your Desktop.

Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you, combofix.txt. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick while its running. That may cause it to stall

DaveMor

Post #3October 25, 2007, 5:32 AM UTC

LDTate,

First of all thank you for helping me. I did as you requested. I did make one mistake. In an attampt to clear up my wife's desktop so I could find things I inadvertantly copyed two of the shortcuts "Online Security Guide" and "Live Safety Center" to a folder on the desktop.

I am still having popups, false warnings and the shortcuts on the desktop and in the start menu.

I received a message near the start of the combofix run. I do not know if it is real or not anymore. I cannot believe anything on the scrren theese days on this machine. Well here is the info FYI.

swreg.cfexe - Application Error

The instruction "0x7c9111de" referenced memory "0x4f444e49". The memory could not be "read". Click on OK to terminate the program.

I waited for 10 minutes and Combofix did not get past perparing to run. At this point I answered "OK", my only option, and ComboFix seemed to continue to run.

OK, here are the logs.

Combo Log
ComboFix 07-10-23.1 - Parent 2007-10-25 0:37:44.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.143 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Parent\Desktop\Live Safety Center.lnk
C:\Documents and Settings\Parent\Desktop\Online Security Guide.lnk
C:\Documents and Settings\Parent\Favorites\Online Security Guide.lnk
C:\Documents and Settings\Parent\Start Menu\Programs\Startup old\ta_start.lnk
C:\WINDOWS\system32\awvtq.dll
C:\WINDOWS\system32\ifjiiewa.dll
C:\WINDOWS\system32\phvrchbj.dll
C:\WINDOWS\system32\qtvwa.bak1
C:\WINDOWS\system32\qtvwa.bak2
C:\WINDOWS\system32\qtvwa.ini
C:\WINDOWS\system32\roilkmjt.dllbox
C:\WINDOWS\system32\zxdnt3d.cfg

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_IPRIP
——-\Iprip

((((((((((((((((((((((((( Files Created from 2007-09-25 to 2007-10-25 )))))))))))))))))))))))))))))))
.

2007-10-25 00:17 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-10-23 15:29 d——– C:\Documents and Settings\Parent\Application Data\Grisoft
2007-10-23 15:29 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-10-22 15:14 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-10-21 11:10 340,032 –a—— C:\WINDOWS\system32\ujcsmdgg.dll
2007-10-21 11:10 340,032 –a—— C:\WINDOWS\system32\roilkmjt.dll
2007-10-19 23:03 34,304 –a—— C:\WINDOWS\system32\opnmnol.dll
2007-10-19 20:07 d——– C:\Documents and Settings\Parent\Application Data\Pogo Games
2007-10-09 20:26 584,192 —–c— C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-10-07 23:04 d——– C:\Program Files\MFInstall

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-25 04:56 47,104 —-a-w C:\WINDOWS\system32\rpcnet.dll
2007-10-25 04:56 17,408 —-a-w C:\WINDOWS\system32\rpcnetp.exe
2007-10-23 22:00 47,104 —-a-w C:\WINDOWS\system32\rpcnet.exe
2007-10-23 21:57 17,408 —-a-w C:\WINDOWS\system32\rpcnetp.dll
2007-10-23 13:54 ——— d—–w C:\Program Files\Oberon Media
2007-10-22 19:16 ——— d—–w C:\Program Files\Lavasoft
2007-10-22 19:16 ——— d—–w C:\Documents and Settings\Parent\Application Data\Lavasoft
2007-10-22 18:58 ——— d—–w C:\Program Files\Yahoo!
2007-10-22 15:24 ——— d—–w C:\Program Files\AWS
2007-10-22 15:23 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-10-22 15:23 ——— d—–w C:\Program Files\verizon
2007-10-22 15:19 ——— d—–w C:\Program Files\The Weather Channel FW
2007-10-22 15:18 ——— d—–w C:\Program Files\gamingclubMPP
2007-10-22 15:16 ——— d—–w C:\Program Files\Real
2007-10-22 15:15 ——— d—–w C:\Program Files\PokerRewardsCalculator
2007-10-22 15:10 ——— d—–w C:\Program Files\GameHouse
2007-10-22 14:42 ——— d—–w C:\Program Files\Logitech
2007-09-28 19:52 9,796 —-a-w C:\WINDOWS\system32\gnfil.dll
2007-09-28 19:52 9,634 —-a-w C:\WINDOWS\system32\pkmon.dll
2007-09-28 19:52 88,076 —-a-w C:\WINDOWS\system32\adwfil.dll
2007-09-28 19:52 8,652 —-a-w C:\WINDOWS\system32\jbfil.dll
2007-09-28 19:52 7,778 —-a-w C:\WINDOWS\system32\movfil.dll
2007-09-28 19:52 7,642 —-a-w C:\WINDOWS\system32\auctfil.dll
2007-09-28 19:52 6,830 —-a-w C:\WINDOWS\system32\swfil.dll
2007-09-28 19:52 6,050 —-a-w C:\WINDOWS\system32\wrestfil.dll
2007-09-28 19:52 5,782 —-a-w C:\WINDOWS\system32\vgamfil.dll
2007-09-28 19:52 5,180 —-a-w C:\WINDOWS\system32\iawfil.dll
2007-09-28 19:52 4,506 —-a-w C:\WINDOWS\system32\hatfil.dll
2007-09-28 19:52 4,084 —-a-w C:\WINDOWS\system32\viofil.dll
2007-09-28 19:52 3,444 —-a-w C:\WINDOWS\system32\srchin.dll
2007-09-28 19:52 3,286 —-a-w C:\WINDOWS\system32\lgwfil.dll
2007-09-28 19:52 22,618 —-a-w C:\WINDOWS\system32\perfil.dll
2007-09-28 19:52 17,488 —-a-w C:\WINDOWS\system32\nvgamfil.dll
2007-09-28 19:52 16,778 —-a-w C:\WINDOWS\system32\popfil.dll
2007-09-28 19:52 157,916 —-a-w C:\WINDOWS\system32\pxyfil.dll
2007-09-28 19:52 14,712 —-a-w C:\WINDOWS\system32\tafil.dll
2007-09-28 19:52 13,154 —-a-w C:\WINDOWS\system32\finfil.dll
2007-09-28 19:52 13,034 —-a-w C:\WINDOWS\system32\gblfil.dll
2007-09-28 19:52 12,730 —-a-w C:\WINDOWS\system32\psyfil.dll
2007-09-28 19:52 12,422 —-a-w C:\WINDOWS\system32\entfil.dll
2007-09-28 19:52 12,266 —-a-w C:\WINDOWS\system32\sporfil.dll
2007-09-28 19:52 11,338 —-a-w C:\WINDOWS\system32\fmfil.dll
2007-09-28 19:52 10,862 —-a-w C:\WINDOWS\system32\chtfil.dll
2007-08-21 06:15 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
2007-08-14 00:35 471,216 —-a-w C:\msgr8us.exe
2007-08-09 23:43 32,256 —-a-w C:\WINDOWS\system32\identprv.dll
2007-07-30 23:19 92,504 —-a-w C:\WINDOWS\system32\cdm.dll
2007-07-30 23:19 549,720 —-a-w C:\WINDOWS\system32\wuapi.dll
2007-07-30 23:19 53,080 —-a-w C:\WINDOWS\system32\wuauclt.exe
2007-07-30 23:19 43,352 —-a-w C:\WINDOWS\system32\wups2.dll
2007-07-30 23:19 325,976 —-a-w C:\WINDOWS\system32\wucltui.dll
2007-07-30 23:19 271,224 —-a-w C:\WINDOWS\system32\mucltui.dll
2007-07-30 23:19 207,736 —-a-w C:\WINDOWS\system32\muweb.dll
2007-07-30 23:19 203,096 —-a-w C:\WINDOWS\system32\wuweb.dll
2007-07-30 23:19 1,712,984 —-a-w C:\WINDOWS\system32\wuaueng.dll
2007-07-30 23:18 33,624 —-a-w C:\WINDOWS\system32\wups.dll
2007-04-27 14:38 33,528 —-a-w C:\Documents and Settings\Parent\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00000000-0000-0000-0000-000000000240}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{232D2677-68EE-4FA1-B988-279EBC8969ED}]
2007-10-19 23:03 34304 –a—— C:\WINDOWS\system32\opnmnol.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8CA5ED52-F3FB-4414-A105-2E3491156990}]
C:\PROGRA~1\IWINGA~1\IWINGA~1.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]
2007-10-21 11:10 340032 –a—— C:\WINDOWS\System32\roilkmjt.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{11A69AE4-FBED-4832-A2BF-45AF82825583}"= C:\WINDOWS\System32\roilkmjt.dll [2007-10-21 11:10 340032]

[HKEY_CLASSES_ROOT\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-04-07 00:19]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 00:07]
"C2K"="C:\WINDOWS\CYB2K.EXE" [2003-07-19 15:56]
"Bart Station"="C:\Program Files\ISP50\hta\station.sbrt" []
"MsmqIntCert"="regsvr32 /s mqrt.dll" []
"setup2k.exe"="c:\wutemp\setup2k.exe" [2003-07-19 16:01]
"Rapid Restore"="C:\Program Files\Xpoint\PE\Skin\rrpcsb.exe" [2003-04-21 13:49]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe" [2004-12-14 12:07]
"SchoolCashReminderService"="wjview /cp:p C:\Program Files\SchoolCashReminderService\System\Code Main lp: C:\Program Files\SchoolCashReminderService" []
"Rosary Reminder"="C:\PROGRA~1\VIRTUA~1\reminder.exe" []
"TaskPlus"="C:\Program Files\TaskPlus\taskplus0.exe" []
"McAfee Managed Services Tray"="C:\Program Files\McAfee\Managed VirusScan\Agent\myagttry.exe" [2007-05-18 04:03]
"MVS Splash"="C:\Program Files\McAfee\Managed VirusScan\Agent\Splash.exe" [2007-03-06 17:25]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-01-16 08:18]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 13:03]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-06-16 10:39]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11]
"YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" []
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24]
"PhotoShow Deluxe Media Manager"="C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe" [2005-01-21 20:04]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" []
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 21:05]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 17:45]
"PopUpStopperFreeEdition"="C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe" [2003-10-29 11:01]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{232D2677-68EE-4FA1-B988-279EBC8969ED}"= C:\WINDOWS\system32\opnmnol.dll [2007-10-19 23:03 34304]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\opnmnol]
opnmnol.dll 2007-10-19 23:03 34304 C:\WINDOWS\system32\opnmnol.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\roilkmjt]
roilkmjt.dll 2007-10-21 11:10 340032 C:\WINDOWS\system32\roilkmjt.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\mljjh.dll

R1 mfetdik;McAfee Inc.;C:\WINDOWS\system32\drivers\mfetdik.sys
R2 cvintdrv;cvintdrv;C:\WINDOWS\system32\drivers\cvintdrv.sys
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys

.
**************************************************************************

catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-25 00:59:53
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

C:\WINDOWS\system32\hjjlm.ini 317 bytes
C:\WINDOWS\system32\mljjh.dll 315488 bytes executable

scan completed successfully
hidden files: 2

**************************************************************************
.
Completion time: 2007-10-25 1:04:09 - machine was rebooted
.
— E O F —

HiJackThis log (as spyware.exe)
Logfile of HijackThis v1.99.1
Scan saved at 1:09:57 AM, on 10/25/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\lkcitdl.exe
C:\WINDOWS\system32\lkads.exe
C:\WINDOWS\system32\lktsrv.exe
C:\WINDOWS\System32\mnmsrvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\National Instruments\MAX\nimxs.exe
C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
C:\WINDOWS\system32\nisvcloc.exe
C:\Program Files\National Instruments\Shared\Tagger\tagsrv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\SYSTEM32\Rpcnet.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Xpoint\xpadmin\xpadmin.exe
C:\PROGRA~1\Xpoint\agent\Xpagent.exe
C:\PROGRA~1\Xpoint\EEClient\xpclient.exe
C:\WINDOWS\System32\mqsvc.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\CYB2K.EXE
C:\Program Files\Xpoint\PE\Skin\rrpcsb.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
C:\Program Files\McAfee\Managed VirusScan\Agent\myagttry.exe
C:\WINDOWS\System32\mqtgsvc.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Xpoint\PE\pcrecsa.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe
C:\dkm\Spyware.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
O2 - BHO: (no name) - {00000000-0000-0000-0000-000000000240} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {232D2677-68EE-4FA1-B988-279EBC8969ED} - C:\WINDOWS\system32\opnmnol.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: IEHlprObj Class - {8CA5ED52-F3FB-4414-A105-2E3491156990} - C:\PROGRA~1\IWINGA~1\IWINGA~1.DLL (file missing)
O2 - BHO: (no name) - {9F26446E-65C9-4B1C-BA4C-F56296C2C0C0} - C:\WINDOWS\system32\mljjh.dll
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\System32\roilkmjt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\System32\roilkmjt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [C2K] C:\WINDOWS\CYB2K.EXE
O4 - HKLM\..\Run: [Bart Station] C:\Program Files\ISP50\hta\station.sbrt
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [setup2k.exe] c:\wutemp\setup2k.exe
O4 - HKLM\..\Run: [Rapid Restore] C:\Program Files\Xpoint\PE\Skin\rrpcsb.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
O4 - HKLM\..\Run: [SchoolCashReminderService] wjview /cp:p "C:\Program Files\SchoolCashReminderService\System\Code" Main lp: "C:\Program Files\SchoolCashReminderService"
O4 - HKLM\..\Run: [Rosary Reminder] C:\PROGRA~1\VIRTUA~1\reminder.exe
O4 - HKLM\..\Run: [TaskPlus] C:\Program Files\TaskPlus\taskplus0.exe
O4 - HKLM\..\Run: [McAfee Managed Services Tray] "C:\Program Files\McAfee\Managed VirusScan\Agent\myagttry.exe"
O4 - HKLM\..\Run: [MVS Splash] C:\Program Files\McAfee\Managed VirusScan\Agent\Splash.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: SchoolCash - file://C:\Program Files\SchoolCashReminderService\System\Temp\scash_script.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Golden Tiger Poker - {772B5BF8-12E8-4a5d-B48F-652B5E82025D} - C:\Program Files\goldentigerMPP\MPPoker.exe (file missing)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: SchoolCash - {011E1110-AF57-11d4-AC1C-E843E6000000} - file://C:\Program Files\SchoolCashReminderService\System\Temp\scash_script.htm (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: 6th Street Omaha Poker by pogo - http://game1.pogo.com/applet-6.6.4.21/omaha/omaha-en_US.cab
O16 - DPF: Aces Up! by pogo - http://game1.pogo.com/applet-6.6.5.22/aces/aces-en_US.cab
O16 - DPF: Backgammon by pogo - http://game1.pogo.com/applet-6.6.5.22/back…ammon-en_US.cab
O16 - DPF: Blooop by pogo - http://game1.pogo.com/applet-6.6.5.22/casc…scade-en_US.cab
O16 - DPF: Bump by pogo - http://www.pogo.com/applet-6.7.1.23/bump/bump-en_US.cab
O16 - DPF: Canasta by pogo - http://game1.pogo.com/applet-6.7.2.33/cana…nasta-en_US.cab
O16 - DPF: Command & Conquer Generals Comanche Strike by pogo.com - http://ccstrike.pogo.com/applet/ccstrike/c…e-ob-assets.cab
O16 - DPF: Dice City Roller by pogo - http://game1.pogo.com/applet-6.7.1.33/ytz/ytz-en_US.cab
O16 - DPF: EA Sports Web Soccer by pogo - http://game1.pogo.com/applet-6.7.1.23/socc…occer-en_US.cab
O16 - DPF: First Class Solitaire by pogo - http://game1.pogo.com/applet-6.6.5.22/firs…lass2-en_US.cab
O16 - DPF: Fortune Bingo by pogo - http://game1.pogo.com/applet-6.6.4.29/supe…bingo-en_US.cab
O16 - DPF: Harvest Mania by pogo - http://game1.pogo.com/applet-6.6.5.31/harv…rvest-en_US.cab
O16 - DPF: High Stakes Pool by pogo - http://game1.pogo.com/applet-6.7.2.33/pool2/pool-en_US.cab
O16 - DPF: Jungle Gin by pogo - http://game1.pogo.com/applet-6.6.5.22/gin/gin-en_US.cab
O16 - DPF: Keno by pogo - http://game1.pogo.com/applet-6.6.5.31/keno/keno-en_US.cab
O16 - DPF: Lost Temple Poker by pogo - http://game1.pogo.com/applet-6.6.5.31/mhpo…poker-en_US.cab
O16 - DPF: Lottso by pogo - http://game1.pogo.com/applet-6.7.0.32/lott…ottso-en_US.cab
O16 - DPF: Mah Jong Garden by pogo - http://game1.pogo.com/applet-6.6.5.31/mahj…hjong-en_US.cab
O16 - DPF: Multiline Slots by pogo - http://game1.pogo.com/applet-6.7.0.40/mlsl…slots-en_US.cab
O16 - DPF: Payday FreeCell by pogo - http://game1.pogo.com/applet-6.7.1.23/free…ecell-en_US.cab
O16 - DPF: Pebble Beach 3 Hole Challenge by pogo.com - http://threehole01.pogo.com/applet/threeho…e-ob-assets.cab
O16 - DPF: Penguin Blocks by pogo - http://game1.pogo.com/applet-6.6.5.22/peng…guins-en_US.cab
O16 - DPF: Perfect Pair Solitaire by pogo - http://game1.pogo.com/applet-6.6.5.22/wate…wheel-en_US.cab
O16 - DPF: Phlinx by pogo - http://game1.pogo.com/applet-6.7.0.32/flin…inger-en_US.cab
O16 - DPF: Pinochle by pogo - http://game1.pogo.com/applet-6.6.4.21/pino…ochle-en_US.cab
O16 - DPF: Pirate's Gold by pogo - http://game1.pogo.com/applet-6.6.5.31/pira…sgold-en_US.cab
O16 - DPF: Pop Fu by pogo - http://game1.pogo.com/applet-6.6.5.22/popfu/popfu-en_US.cab
O16 - DPF: PoppaZoppa by pogo - http://game1.pogo.com/applet-6.6.2.21/popp…zoppa-en_US.cab
O16 - DPF: Poppit by pogo - http://game1.pogo.com/applet-6.7.1.33/popp…ppit2-en_US.cab
O16 - DPF: Quick Quack by pogo - http://game1.pogo.com/applet-6.6.5.31/hots…treak-en_US.cab
O16 - DPF: Showbiz Slots 2 by pogo - http://game1.pogo.com/applet-6.6.3.34/slot…wbiz2-en_US.cab
O16 - DPF: Showbiz Slots by pogo - http://game1.pogo.com/applet-6.6.5.31/slot…owbiz-en_US.cab
O16 - DPF: Shuffle Bump by pogo - http://game1.pogo.com/applet-6.7.0.32/puck/puck-en_US.cab
O16 - DPF: Squelchies by pogo - http://game1.pogo.com/applet-6.6.4.21/sque…chies-en_US.cab
O16 - DPF: Texas Hold'em Poker by pogo - http://game1.pogo.com/applet-6.7.2.33/hold…oldem-en_US.cab
O16 - DPF: Top Down Baseball Challenge by pogo - http://game1.pogo.com/applet-6.7.1.23/topd…down2-en_US.cab
O16 - DPF: Tri-Peaks by pogo - http://game1.pogo.com/applet-6.6.4.29/peaks/peaks-en_US.cab
O16 - DPF: Tumble Bees by pogo - http://game1.pogo.com/applet-6.6.4.21/jumb…umbee-en_US.cab
O16 - DPF: Turbo 21 v2 by pogo - http://game1.pogo.com/applet-6.7.0.32/turb…rbo22-en_US.cab
O16 - DPF: Wonderland Memories by pogo - http://game1.pogo.com/applet-6.6.5.22/memo…ories-en_US.cab
O16 - DPF: Word Whomp by pogo - http://game1.pogo.com/applet-6.6.5.31/word…homp2-en_US.cab
O16 - DPF: Word Whomp Whackdown by pogo - http://game1.pogo.com/applet-6.6.5.31/whac…kdown-en_US.cab
O16 - DPF: WordJong by pogo - http://game1.pogo.com/applet-6.7.0.40/word…djong-en_US.cab
O16 - DPF: World Class Solitaire by pogo - http://game1.pogo.com/applet-6.7.1.23/worl…class-en_US.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://www.worldwinner.com/games/v47/share…GamesLoader.cab
O16 - DPF: {2DFF31F9-7893-4922-AF66-C9A1EB4EBB31} (Rhapsody Player Engine) - http://forms.real.com/real/player/download…ne_Inst_Win.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} (PogoWebLauncher Control) - http://www.pogo.com/cdl/launcher/PogoWebLa…erInstaller.CAB
O16 - DPF: {380BBEC2-4CAE-4ECE-8AFF-36CDE7916386} (Surgient URA Local Proxy Client (v2)) - http://ni-us.demoservers.com/URA/URA/lib/L…roxyActiveX.cab
O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} (king.com) - http://games.king.com/ctl/kingcomie.cab
O16 - DPF: {4EDCB26C-D24C-4E72-AF07-B576699AC0DE} (Microsoft RDP Client Control (redist)) - http://ni-us.demoservers.com/URA/URA/lib/srdp.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/4058/ftp…tle/Coupons.cab
O16 - DPF: {B06CE1BC-5D9D-4676-BD28-1752DBF394E0} (Hangman Control) - http://www.worldwinner.com/games/v41/hangman/hangman.cab
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - https://www.verizon.net/WhatsNext/CheckMyPc…tivePreQual.cab
O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) - http://www.worldwinner.com/games/v47/famil…/familyfeud.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir…l/installer.exe
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://games.pogo.com/online2/pogo/insaniq…aploader_v6.cab
O18 - Protocol: bw+0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: myrm - {4D034FC3-013F-4B95-B544-44D49ABE3E76} - C:\Program Files\McAfee\Managed VirusScan\Agent\MyRmProt4.5.1.191.dll
O18 - Protocol: offline-8876480 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: opnmnol - C:\WINDOWS\SYSTEM32\opnmnol.dll
O20 - Winlogon Notify: roilkmjt - C:\WINDOWS\SYSTEM32\roilkmjt.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Lookout Citadel Server (LkCitadelServer) - National Instruments, Inc. - C:\WINDOWS\system32\lkcitdl.exe
O23 - Service: National Instruments PSP Server Locator (lkClassAds) - National Instruments, Inc. - C:\WINDOWS\system32\lkads.exe
O23 - Service: National Instruments Time Synchronization (lkTimeSync) - National Instruments, Inc. - C:\WINDOWS\system32\lktsrv.exe
O23 - Service: McShield - McAfee, Inc. - C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe
O23 - Service: NI Configuration Manager (mxssvr) - National Instruments Corporation - C:\Program Files\National Instruments\MAX\nimxs.exe
O23 - Service: McAfee Virus and Spyware Protection Service (myAgtSvc) - McAfee, Inc. - C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
O23 - Service: National Instruments Domain Service (NIDomainService) - National Instruments, Inc. - C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
O23 - Service: NILM License Manager - Macrovision Corporation - C:\Program Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe
O23 - Service: NI Service Locator (niSvcLoc) - National Instruments Corp. - C:\WINDOWS\system32\nisvcloc.exe
O23 - Service: National Instruments Variable Engine (NITaggerService) - National Instruments, Inc. - C:\Program Files\National Instruments\Shared\Tagger\tagsrv.exe
O23 - Service: Xpoint PCRadmin Server (PCRadminServer) - Unknown owner - C:\PROGRA~1\Xpoint\PE\pcradmin.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Remote Procedure Call (RPC) Net (Rpcnet) - Absolute Software Corp. - C:\WINDOWS\SYSTEM32\Rpcnet.exe
O23 - Service: Xpoint Admin Server (XPadminServer) - Unknown owner - C:\PROGRA~1\Xpoint\xpadmin\xpadmin.exe
O23 - Service: Xpoint Agent Server (xpAgentServer) - Unknown owner - C:\PROGRA~1\Xpoint\agent\Xpagent.exe

I hope you can figure out what is going on from this info and be able to help me.

Thanks Again,
David

LDTate

Post #4October 25, 2007, 4:39 PM UTC

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\ujcsmdgg.dll
C:\WINDOWS\system32\roilkmjt.dll
C:\WINDOWS\system32\opnmnol.dll
C:\WINDOWS\system32\gnfil.dll
C:\WINDOWS\system32\pkmon.dll
C:\WINDOWS\system32\adwfil.dll
C:\WINDOWS\system32\jbfil.dll
C:\WINDOWS\system32\movfil.dll
C:\WINDOWS\system32\auctfil.dll
C:\WINDOWS\system32\swfil.dll
C:\WINDOWS\system32\wrestfil.dll
C:\WINDOWS\system32\vgamfil.dll
C:\WINDOWS\system32\iawfil.dll
C:\WINDOWS\system32\hatfil.dll
C:\WINDOWS\system32\viofil.dll
C:\WINDOWS\system32\srchin.dll
C:\WINDOWS\system32\lgwfil.dll
C:\WINDOWS\system32\perfil.dll
C:\WINDOWS\system32\nvgamfil.dll
C:\WINDOWS\system32\popfil.dll
C:\WINDOWS\system32\pxyfil.dll
C:\WINDOWS\system32\tafil.dll
C:\WINDOWS\system32\finfil.dll
C:\WINDOWS\system32\gblfil.dll
C:\WINDOWS\system32\psyfil.dll
C:\WINDOWS\system32\entfil.dll
C:\WINDOWS\system32\sporfil.dll
C:\WINDOWS\system32\fmfil.dll
C:\WINDOWS\system32\chtfil.dll
C:\WINDOWS\system32\opnmnol.dll
C:\PROGRA~1\IWINGA~1\IWINGA~1.DLL

Folder::
C:\PROGRA~1\IWINGA~1
C:\Program Files\Logitech\Desktop Messenger

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00000000-0000-0000-0000-000000000240}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{232D2677-68EE-4FA1-B988-279EBC8969ED}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8CA5ED52-F3FB-4414-A105-2E3491156990}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{11A69AE4-FBED-4832-A2BF-45AF82825583}]
[-HKEY_CLASSES_ROOT\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{232D2677-68EE-4FA1-B988-279EBC8969ED}"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\opnmnol]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\roilkmjt]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00

Save this as Save this as "CFScript"

[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log

DaveMor

Post #5October 25, 2007, 11:26 PM UTC

LdTate, I completed the instructions. When combofix rebooted the machine I received the following error. The win16 subsystem was unable to enter protected mode, dosx.exe must be in your autoexec.nt and persent in your path. When I tried to access the network I cannot get a connection. The other 2 computers on my router have no problem. It claims the connection is connected and firewalled. Any idea what I might need to do? I cannot post those logs right now. I will either need to get the computer back on the network or copy the files to my flash drive and transfer them to a network capable PC to post them. I have tried resetting my entire network with no changes in the symptoms. David

LDTate

Post #6October 25, 2007, 11:28 PM UTC

Lets see if we can get the PC back on the internet. This file will fit on a floppy or thumb drive.

Get a copy of winsockxpfix.exe You just run it and
things should work OK after it reboots your system.

http://www.snapfiles.com/get/winsockxpfix.html

DaveMor

Post #7October 25, 2007, 11:35 PM UTC

OK here are the logs from the infected PC. I moved them via my flash drive to a network capable PC.

ComboFix Log

ComboFix 07-10-23.1 - Parent 2007-10-25 15:10:46.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.190 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Parent\Desktop\CFScript.txt

FILE::
C:\PROGRA~1\IWINGA~1\IWINGA~1.DLL
C:\WINDOWS\system32\adwfil.dll
C:\WINDOWS\system32\auctfil.dll
C:\WINDOWS\system32\chtfil.dll
C:\WINDOWS\system32\entfil.dll
C:\WINDOWS\system32\finfil.dll
C:\WINDOWS\system32\fmfil.dll
C:\WINDOWS\system32\gblfil.dll
C:\WINDOWS\system32\gnfil.dll
C:\WINDOWS\system32\hatfil.dll
C:\WINDOWS\system32\iawfil.dll
C:\WINDOWS\system32\jbfil.dll
C:\WINDOWS\system32\lgwfil.dll
C:\WINDOWS\system32\movfil.dll
C:\WINDOWS\system32\nvgamfil.dll
C:\WINDOWS\system32\opnmnol.dll
C:\WINDOWS\system32\perfil.dll
C:\WINDOWS\system32\pkmon.dll
C:\WINDOWS\system32\popfil.dll
C:\WINDOWS\system32\psyfil.dll
C:\WINDOWS\system32\pxyfil.dll
C:\WINDOWS\system32\roilkmjt.dll
C:\WINDOWS\system32\sporfil.dll
C:\WINDOWS\system32\srchin.dll
C:\WINDOWS\system32\swfil.dll
C:\WINDOWS\system32\tafil.dll
C:\WINDOWS\system32\ujcsmdgg.dll
C:\WINDOWS\system32\vgamfil.dll
C:\WINDOWS\system32\viofil.dll
C:\WINDOWS\system32\wrestfil.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Parent\Desktop\Live Safety Center.lnk
C:\Documents and Settings\Parent\Desktop\Online Security Guide.lnk
C:\Documents and Settings\Parent\Favorites\Online Security Guide.lnk
C:\PROGRA~1\IWINGA~1
C:\PROGRA~1\IWINGA~1\firefox\chrome\iwinarcade.jar
C:\PROGRA~1\IWINGA~1\firefox\install.rdf
C:\PROGRA~1\IWINGA~1\firefox\iWinArcadeLauncher.exe
C:\PROGRA~1\IWINGA~1\ftdownload.dat
C:\PROGRA~1\IWINGA~1\host.cfg
C:\PROGRA~1\IWINGA~1\iWinGames.exe
C:\PROGRA~1\IWINGA~1\pages\blank.html
C:\PROGRA~1\IWINGA~1\pages\error.html
C:\PROGRA~1\IWINGA~1\pages\iwin_logo.gif
C:\PROGRA~1\IWINGA~1\sounds\animation.wav
C:\PROGRA~1\IWINGA~1\sounds\animationBack.wav
C:\PROGRA~1\IWINGA~1\sounds\button_click.wav
C:\PROGRA~1\IWINGA~1\sounds\download_completed.wav
C:\PROGRA~1\IWINGA~1\sounds\start.wav
C:\PROGRA~1\IWINGA~1\Uninstall.exe
C:\PROGRA~1\IWINGA~1\WebInstaller.exe
C:\PROGRA~1\IWINGA~1\WebUpdater.bmp
C:\PROGRA~1\IWINGA~1\WebUpdater.exe
C:\Program Files\Logitech\Desktop Messenger
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Install\bwUnin.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Install\LiteInst.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Install\readme.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Install\win2000.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Plugins\Npavi32.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\backweb.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\backweb.tlb
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\BWCHelpr.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\BWCmndr.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\BWDocMapExt.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\bwfiles.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\bwlang.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\bwmib.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\BWOfflineUrlAccessor.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\BWPlugProtocol.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\BWPortalPlugin.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\BWScriptExt.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\bwsec.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\BWXMLOffline.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\bwxtext.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\clntutil.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\Cpuinf32.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\ding.wav
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\ClientRc.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\CommStatus\remedy_strings.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\CommStatus\remedy_strings_override.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\CommStatus\strings.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\CommStatus\strings_override.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\Navigation\navigation_strings.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\Navigation\navigation_strings_override.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\arrow_left.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\arrow_right.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\BULLET1.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\closing_the_notification_in.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\deleting_notifications.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\DIAMOND1.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\elements_of_the_statusbar.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\help.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\homebutton_gray.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image003.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image005.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image007.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image009.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image010.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image012.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image014.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image016.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image017.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image018.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image020.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image024.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\image025.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\inbox.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\managing_notifications.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\marking_notifications.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\opening_the_notification_in.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\overview.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\preferences.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\ProactivePortal_Notification_Inbox_Help.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\refreshing_the_notification.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\setting_proactiveportal_not.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\sorting_information_in_the_.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\the_proactiveportal_notific.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\viewing_data_in_the_notific.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\viewing_full_stories.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\viewing_the_availability_of.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\viewing_the_notification_s_.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\viewing_the_notification_su.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\help\xbutton.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\notification_strings.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\NotificationMgr\notification_strings_override.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\resources\global_strings.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\resources\global_strings_override.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\arrow_left.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\arrow_right.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\BULLET1.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\button_edit.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\button_sendagain.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\closing_the_forms_outbox.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\deleting_form_submissions.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\details.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\DIAMOND1.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\form_submission_scheduling.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\help.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\home.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\homebutton_gray.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\how_does_proactiveportal_se.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\image003_forms.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\image005_forms.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\image007_forms.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\image011_forms.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\image013_forms.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\image014_forms.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\image016_forms.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\image019_forms.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\image020_forms.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\managing_form_submissions.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\marking_form_submissions.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\modifying_a_submitted_form.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\modifying_a_submitted_form.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\opening_the_forms_outbox.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\outbox.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\overview_1.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\preferences.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\ProactivePortal_Forms_Outbox_Help.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\refreshing_the_forms_outbox.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\ResponseAvailable.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\resubmitting_a_form.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\send_again.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\setting_form_submission_pre.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\sorting_form_submissions.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\SubmissionCompleted.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\SubmissionFailed.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\the_forms_outbox.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\the_progress_bar.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\the_status_bar.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\the_status_column.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\viewing_data_in_the_forms_o.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\viewing_form_submission_details.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\viewing_form_submission_res.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\viewing_form_submission_sta.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\viewing_submission_details.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\what_are_forms_.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\help\xbutton.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\submission_strings.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\PortalUI\SubmissionMgr\submission_strings_override.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\registerRC.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\SpriteRC.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\EN\UninstallRC.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\GAPlugProtocol.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\IAdHide.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\loading.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\pacsupport.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\CommStatus\functions.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\CommStatus\remedy_functions.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\background.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\BWPortalPlugin.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\CommProblem.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\CommProblem.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\CommStatus.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\decorations.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\disableforms.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\fillFormsForResubmit.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\navigation.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\navigation_override.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalBrokenLink.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalBrokenLink.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalClientInactive.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalFormError.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalFormStatus.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalFormSuccess.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalGoOnline.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalGoOnline.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalGoOnlineTesterMode.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalMsgConfig.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalNoClient.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalNoDoc.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalNoDoc.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalNotRegistered.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalNotRegistered.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalNotSupportedURL.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalNotSupportedURL.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalNoUI.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalNoUI.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalOldDoc.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\Navigation\ProactivePortalOldDoc.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\not.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\link_header.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\link_header_MO.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\notification.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\notification_override.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\notification_params.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\notification_params_override.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\NotificationDetailedStatus.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\NotificationMgrUI.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\offline_link.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\offline_link_MO.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\online_link.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\online_link_MO.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\preferences.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\priority.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\priority_header.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\priority_header_MO.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\NotificationMgr\utilities.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\OfflineMgr.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\OfflineSearch.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\preferences.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\arr_end.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\arr_end_mo.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\arr_end_na.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\arr_next.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\arr_next_mo.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\arr_next_na.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\arr_prev.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\arr_prev_mo.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\arr_prev_na.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\arr_start.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\arr_start_mo.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\arr_start_na.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\background.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\Exit.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\footer.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\global.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\global_override.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\global_params.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\global_params_override.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\header.jpg
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\Help.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\help_MO.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\helper.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\preferences.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\preferences.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\preferences_icon.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\preferences_MO.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\Propert.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\sort_ascending.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\sort_descending.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\table.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\tabs.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\resources\utilities.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\sub.html
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\AddSubmissionMgrLink.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\FormDeleted.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\FormError.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\FormOK.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\FormPending.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\FormProcess.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\FormSuspended.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\FormUpload.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\preferences.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\ResponseAvialable.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\ResponseAvialable_MO.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\submission.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\submission_override.css
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\submission_params.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\submission_params_override.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\SubmissionCompleted.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\SubmissionCompleted_MO.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\SubmissionDetailedStatus.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\SubmissionFailed.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\SubmissionFailed_MO.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\SubmissionMgrUI.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\SubmissionStatus.inc
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PortalUI\SubmissionMgr\utilities.js
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\Pre6Import.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\PUI_Launcher.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\register.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\Restart.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\runner.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\runner.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\Sprite6.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.157-8876480SL\Program\wtsisctd.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\clasid.bak
C:\Program Files\Logitech\Desktop Messenger\8876480\enabled.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\background.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\browser.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\cert.db
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\chandir.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\chandir.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\chn.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\chn.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\DefPrefs.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\GenFlash\1\gen.bif
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\GenFlash\1\gen.bis
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\GenFlash\1\info.iad
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\InfoCenter.GIF
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\InfoCenter.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\main.wkg
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\UpgradePubKey.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\Data\UsrPrefs.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\InitData\PlaceHolder.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\8876480\Parent\InstallerResult.log
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWCHelpr-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWCmndr-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWDocMapExt-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWfiles-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWOfflineUrlAccessor-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPortalPlugin-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\bwscriptext-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWXmlOffline-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrchs.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrcht.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrdan.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrdeu.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmresp.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrfin.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrfra.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrita.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrjpn.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrkor.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrnld.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrnor.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrptb.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ldmrsve.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LiteInstActivator.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LiteInstActivator.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogiLdmC.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogiLdmW.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogiLdmW.tlb
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe.appid.8876480
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\Enable_OAS\enableOAS.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\AuthLib1.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\AuthLib2.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\CRules1.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\EventLib1.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\EventLib2.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\EventMgr1.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\EventMgr2.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\payload1.pub
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\RuleLib1.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\Scripts\RuleExec\RuleLib2.vbs
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\SyncExt.dll
C:\Program Files\Logitech\Desktop Messenger\8876480\readme.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\DataSets.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Cleanup.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41cb\BWEvents.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41cb\chninfo.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41cb\ChnReg.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41cb\segrules.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41cb\Stats.tmp
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41cb\UserProf.bak
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41cb\UserProf.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41ce\10685e1c\_bwfindx.zip
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41ce\10685e1c\060SM.ipk
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41ce\10685e1c\action.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41ce\10685e1c\info.iad
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41ce\10685e1c\main.bis
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41ce\a9a3e36\_bwfindx.zip
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41ce\a9a3e36\info.iad
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41ce\a9a3e53\_bwfindx.zip
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41ce\a9a3e53\info.iad
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41ce\a9a3e54\_bwfindx.zip
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41ce\a9a3e54\info.iad
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41ce\a9a3ef0\_bwfindx.zip
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41ce\a9a3ef0\info.iad
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41ce\a9a3f17\_bwfindx.zip
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41ce\a9a3f17\info.iad
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41ce\BWEvents.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41ce\chninfo.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41ce\ChnReg.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41ce\segrules.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41ce\series.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41ce\Stats.tmp
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41ce\UserProf.bak
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\41ce\UserProf.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\5bfd\BWEvents.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\5bfd\chninfo.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\5bfd\ChnReg.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\5bfd\segrules.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\5bfd\Stats.tmp
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\5bfd\UserProf.bak
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\5bfd\UserProf.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\background.gif
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\browser.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\BWDocMap.pht
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\BWInfopakMap.pht
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\bwsetup.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\cache.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\cert.db
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\chandir.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\chandir.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\chn.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\chn.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\DefPrefs.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\f1f\a9acb3d\_bwfindx.zip
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\f1f\a9acb3d\009ER Welcome Message.ipk
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\f1f\a9acb3d\action.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\f1f\a9acb3d\Close.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\f1f\a9acb3d\Connect.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\f1f\a9acb3d\info.iad
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\f1f\a9acb3d\main.bif
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\f1f\a9acb3d\main.bis
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\f1f\a9acb3d\Privacy.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\f1f\a9acb3d\resources.bis
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\f1f\a9acb3d\Summary.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\f1f\a9acb3d\Teaser.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\f1f\BWEvents.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\f1f\chninfo.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\f1f\ChnReg.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\f1f\segrules.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\f1f\Stats.tmp
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\f1f\submissions.xml
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\f1f\UserProf.bak
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\f1f\UserProf.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\GenFlash\1\gen.bif
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\GenFlash\1\gen.bis
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\GenFlash\1\info.iad
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\HostCache.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\InfoCenter.GIF
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\InfoCenter.htm
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\inuse.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\L0000034.FCS
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\L0000035.FCS
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\L0000036.FCS
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\L0000037.FCS
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\localHost.js
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\main.log
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\player.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\prs.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\prs.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\prs_die.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\prs_die.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\prs_dnd.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\prs_dnd.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\prs_ext.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\prs_ext.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\prs_rcv.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\prs_rcv.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\S0000000.FCS
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\S0000001.FCS
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\storydb.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\storydb.idx
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\upgrade.log
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\UpgradePubKey.txt
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\UsrPrefs.ini
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Data\wg1.wkg
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Misc\Backup\chandir.dat
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Parent\Misc\Backup\chandir.idx
C:\WINDOWS\system32\adwfil.dll
C:\WINDOWS\system32\auctfil.dll
C:\WINDOWS\system32\chtfil.dll
C:\WINDOWS\system32\entfil.dll
C:\WINDOWS\system32\finfil.dll
C:\WINDOWS\system32\fmfil.dll
C:\WINDOWS\system32\gblfil.dll
C:\WINDOWS\system32\gnfil.dll
C:\WINDOWS\system32\hatfil.dll
C:\WINDOWS\system32\hjjlm.bak1
C:\WINDOWS\system32\hjjlm.ini
C:\WINDOWS\system32\iawfil.dll
C:\WINDOWS\system32\jbfil.dll
C:\WINDOWS\system32\lgwfil.dll
C:\WINDOWS\system32\mljjh.dll
C:\WINDOWS\system32\movfil.dll
C:\WINDOWS\system32\nvgamfil.dll
C:\WINDOWS\system32\opnmnol.dll
C:\WINDOWS\system32\perfil.dll
C:\WINDOWS\system32\pkmon.dll
C:\WINDOWS\system32\popfil.dll
C:\WINDOWS\system32\psyfil.dll
C:\WINDOWS\system32\pxyfil.dll
C:\WINDOWS\system32\roilkmjt.dll
C:\WINDOWS\system32\roilkmjt.dllbox
C:\WINDOWS\system32\sporfil.dll
C:\WINDOWS\system32\srchin.dll
C:\WINDOWS\system32\swfil.dll
C:\WINDOWS\system32\tafil.dll
C:\WINDOWS\system32\ujcsmdgg.dll
C:\WINDOWS\system32\vgamfil.dll
C:\WINDOWS\system32\viofil.dll
C:\WINDOWS\system32\wrestfil.dll

.
((((((((((((((((((((((((( Files Created from 2007-09-25 to 2007-10-25 )))))))))))))))))))))))))))))))
.

2007-10-25 00:17 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-10-23 15:29 d——– C:\Documents and Settings\Parent\Application Data\Grisoft
2007-10-23 15:29 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-10-22 15:14 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-10-19 20:07 d——– C:\Documents and Settings\Parent\Application Data\Pogo Games
2007-10-09 20:26 584,192 —–c— C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-10-07 23:04 d——– C:\Program Files\MFInstall

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-25 19:40 47,104 —-a-w C:\WINDOWS\system32\rpcnet.dll
2007-10-25 19:40 17,408 —-a-w C:\WINDOWS\system32\rpcnetp.exe
2007-10-25 19:26 ——— d—–w C:\Program Files\Logitech
2007-10-23 22:00 47,104 —-a-w C:\WINDOWS\system32\rpcnet.exe
2007-10-23 21:57 17,408 —-a-w C:\WINDOWS\system32\rpcnetp.dll
2007-10-23 13:54 ——— d—–w C:\Program Files\Oberon Media
2007-10-22 19:16 ——— d—–w C:\Program Files\Lavasoft
2007-10-22 19:16 ——— d—–w C:\Documents and Settings\Parent\Application Data\Lavasoft
2007-10-22 18:58 ——— d—–w C:\Program Files\Yahoo!
2007-10-22 15:24 ——— d—–w C:\Program Files\AWS
2007-10-22 15:23 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-10-22 15:23 ——— d—–w C:\Program Files\verizon
2007-10-22 15:19 ——— d—–w C:\Program Files\The Weather Channel FW
2007-10-22 15:18 ——— d—–w C:\Program Files\gamingclubMPP
2007-10-22 15:16 ——— d—–w C:\Program Files\Real
2007-10-22 15:15 ——— d—–w C:\Program Files\PokerRewardsCalculator
2007-10-22 15:10 ——— d—–w C:\Program Files\GameHouse
2007-08-21 06:15 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
2007-08-14 00:35 471,216 —-a-w C:\msgr8us.exe
2007-08-09 23:43 32,256 —-a-w C:\WINDOWS\system32\identprv.dll
2007-07-30 23:19 92,504 —-a-w C:\WINDOWS\system32\cdm.dll
2007-07-30 23:19 549,720 —-a-w C:\WINDOWS\system32\wuapi.dll
2007-07-30 23:19 53,080 —-a-w C:\WINDOWS\system32\wuauclt.exe
2007-07-30 23:19 43,352 —-a-w C:\WINDOWS\system32\wups2.dll
2007-07-30 23:19 325,976 —-a-w C:\WINDOWS\system32\wucltui.dll
2007-07-30 23:19 271,224 —-a-w C:\WINDOWS\system32\mucltui.dll
2007-07-30 23:19 207,736 —-a-w C:\WINDOWS\system32\muweb.dll
2007-07-30 23:19 203,096 —-a-w C:\WINDOWS\system32\wuweb.dll
2007-07-30 23:19 1,712,984 —-a-w C:\WINDOWS\system32\wuaueng.dll
2007-07-30 23:18 33,624 —-a-w C:\WINDOWS\system32\wups.dll
2007-04-27 14:38 33,528 —-a-w C:\Documents and Settings\Parent\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((( snapshot@2007-10-25_ 1.01.04.32 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-10-25 04:57:11 223,022 —-a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
+ 2007-10-25 19:43:06 223,008 —-a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
+ 2007-10-25 19:40:35 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_84c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-04-07 00:19]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 00:07]
"C2K"="C:\WINDOWS\CYB2K.EXE" [2003-07-19 15:56]
"Bart Station"="C:\Program Files\ISP50\hta\station.sbrt" []
"MsmqIntCert"="regsvr32 /s mqrt.dll" []
"setup2k.exe"="c:\wutemp\setup2k.exe" [2003-07-19 16:01]
"Rapid Restore"="C:\Program Files\Xpoint\PE\Skin\rrpcsb.exe" [2003-04-21 13:49]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe" [2004-12-14 12:07]
"SchoolCashReminderService"="wjview /cp:p C:\Program Files\SchoolCashReminderService\System\Code Main lp: C:\Program Files\SchoolCashReminderService" []
"Rosary Reminder"="C:\PROGRA~1\VIRTUA~1\reminder.exe" []
"TaskPlus"="C:\Program Files\TaskPlus\taskplus0.exe" []
"McAfee Managed Services Tray"="C:\Program Files\McAfee\Managed VirusScan\Agent\myagttry.exe" [2007-05-18 04:03]
"MVS Splash"="C:\Program Files\McAfee\Managed VirusScan\Agent\Splash.exe" [2007-03-06 17:25]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-01-16 08:18]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 13:03]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-06-16 10:39]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11]
"YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" []
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24]
"PhotoShow Deluxe Media Manager"="C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe" [2005-01-21 20:04]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" []
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 21:05]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 17:45]
"PopUpStopperFreeEdition"="C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe" [2003-10-29 11:01]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

R1 mfetdik;McAfee Inc.;C:\WINDOWS\system32\drivers\mfetdik.sys
R2 cvintdrv;cvintdrv;C:\WINDOWS\system32\drivers\cvintdrv.sys
R2 mxssvr;NI Configuration Manager;"C:\Program Files\National Instruments\MAX\nimxs.exe"
R2 myAgtSvc;McAfee Virus and Spyware Protection Service;C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe /ServiceStart
R2 NITaggerService;National Instruments Variable Engine;"C:\Program Files\National Instruments\Shared\Tagger\tagsrv.exe"
R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\System32\inetsrv\inetinfo.exe
R2 SRFilter;SRFilter;C:\WINDOWS\system32\drivers\srntflt.sys
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys

.
**************************************************************************

catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-25 15:41:19
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-25 15:46:08 - machine was rebooted
C:\ComboFix2.txt … 2007-10-25 01:04
.
— E O F —
——
HiJackThis log - Renamed spyware2.exe

Logfile of HijackThis v1.99.1
Scan saved at 3:56:27 PM, on 10/25/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\lkcitdl.exe
C:\WINDOWS\system32\lkads.exe
C:\WINDOWS\system32\lktsrv.exe
C:\WINDOWS\System32\mnmsrvc.exe
C:\Program Files\National Instruments\MAX\nimxs.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
C:\WINDOWS\system32\nisvcloc.exe
C:\Program Files\National Instruments\Shared\Tagger\tagsrv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\SYSTEM32\Rpcnet.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Xpoint\xpadmin\xpadmin.exe
C:\PROGRA~1\Xpoint\agent\Xpagent.exe
C:\WINDOWS\System32\mqsvc.exe
C:\PROGRA~1\Xpoint\EEClient\xpclient.exe
C:\WINDOWS\System32\mqtgsvc.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\CYB2K.EXE
C:\Program Files\Xpoint\PE\Skin\rrpcsb.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
C:\Program Files\McAfee\Managed VirusScan\Agent\myagttry.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Xpoint\PE\pcrecsa.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe
C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\dkm\Spyware2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [C2K] C:\WINDOWS\CYB2K.EXE
O4 - HKLM\..\Run: [Bart Station] C:\Program Files\ISP50\hta\station.sbrt
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [setup2k.exe] c:\wutemp\setup2k.exe
O4 - HKLM\..\Run: [Rapid Restore] C:\Program Files\Xpoint\PE\Skin\rrpcsb.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
O4 - HKLM\..\Run: [SchoolCashReminderService] wjview /cp:p "C:\Program Files\SchoolCashReminderService\System\Code" Main lp: "C:\Program Files\SchoolCashReminderService"
O4 - HKLM\..\Run: [Rosary Reminder] C:\PROGRA~1\VIRTUA~1\reminder.exe
O4 - HKLM\..\Run: [TaskPlus] C:\Program Files\TaskPlus\taskplus0.exe
O4 - HKLM\..\Run: [McAfee Managed Services Tray] "C:\Program Files\McAfee\Managed VirusScan\Agent\myagttry.exe"
O4 - HKLM\..\Run: [MVS Splash] C:\Program Files\McAfee\Managed VirusScan\Agent\Splash.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: SchoolCash - file://C:\Program Files\SchoolCashReminderService\System\Temp\scash_script.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Golden Tiger Poker - {772B5BF8-12E8-4a5d-B48F-652B5E82025D} - C:\Program Files\goldentigerMPP\MPPoker.exe (file missing)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: SchoolCash - {011E1110-AF57-11d4-AC1C-E843E6000000} - file://C:\Program Files\SchoolCashReminderService\System\Temp\scash_script.htm (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: 6th Street Omaha Poker by pogo - http://game1.pogo.com/applet-6.6.4.21/omaha/omaha-en_US.cab
O16 - DPF: Aces Up! by pogo - http://game1.pogo.com/applet-6.6.5.22/aces/aces-en_US.cab
O16 - DPF: Backgammon by pogo - http://game1.pogo.com/applet-6.6.5.22/back…ammon-en_US.cab
O16 - DPF: Blooop by pogo - http://game1.pogo.com/applet-6.6.5.22/casc…scade-en_US.cab
O16 - DPF: Bump by pogo - http://www.pogo.com/applet-6.7.1.23/bump/bump-en_US.cab
O16 - DPF: Canasta by pogo - http://game1.pogo.com/applet-6.7.2.33/cana…nasta-en_US.cab
O16 - DPF: Command & Conquer Generals Comanche Strike by pogo.com - http://ccstrike.pogo.com/applet/ccstrike/c…e-ob-assets.cab
O16 - DPF: Dice City Roller by pogo - http://game1.pogo.com/applet-6.7.1.33/ytz/ytz-en_US.cab
O16 - DPF: EA Sports Web Soccer by pogo - http://game1.pogo.com/applet-6.7.1.23/socc…occer-en_US.cab
O16 - DPF: First Class Solitaire by pogo - http://game1.pogo.com/applet-6.6.5.22/firs…lass2-en_US.cab
O16 - DPF: Fortune Bingo by pogo - http://game1.pogo.com/applet-6.6.4.29/supe…bingo-en_US.cab
O16 - DPF: Harvest Mania by pogo - http://game1.pogo.com/applet-6.6.5.31/harv…rvest-en_US.cab
O16 - DPF: High Stakes Pool by pogo - http://game1.pogo.com/applet-6.7.2.33/pool2/pool-en_US.cab
O16 - DPF: Jungle Gin by pogo - http://game1.pogo.com/applet-6.6.5.22/gin/gin-en_US.cab
O16 - DPF: Keno by pogo - http://game1.pogo.com/applet-6.6.5.31/keno/keno-en_US.cab
O16 - DPF: Lost Temple Poker by pogo - http://game1.pogo.com/applet-6.6.5.31/mhpo…poker-en_US.cab
O16 - DPF: Lottso by pogo - http://game1.pogo.com/applet-6.7.0.32/lott…ottso-en_US.cab
O16 - DPF: Mah Jong Garden by pogo - http://game1.pogo.com/applet-6.6.5.31/mahj…hjong-en_US.cab
O16 - DPF: Multiline Slots by pogo - http://game1.pogo.com/applet-6.7.0.40/mlsl…slots-en_US.cab
O16 - DPF: Payday FreeCell by pogo - http://game1.pogo.com/applet-6.7.1.23/free…ecell-en_US.cab
O16 - DPF: Pebble Beach 3 Hole Challenge by pogo.com - http://threehole01.pogo.com/applet/threeho…e-ob-assets.cab
O16 - DPF: Penguin Blocks by pogo - http://game1.pogo.com/applet-6.6.5.22/peng…guins-en_US.cab
O16 - DPF: Perfect Pair Solitaire by pogo - http://game1.pogo.com/applet-6.6.5.22/wate…wheel-en_US.cab
O16 - DPF: Phlinx by pogo - http://game1.pogo.com/applet-6.7.0.32/flin…inger-en_US.cab
O16 - DPF: Pinochle by pogo - http://game1.pogo.com/applet-6.6.4.21/pino…ochle-en_US.cab
O16 - DPF: Pirate's Gold by pogo - http://game1.pogo.com/applet-6.6.5.31/pira…sgold-en_US.cab
O16 - DPF: Pop Fu by pogo - http://game1.pogo.com/applet-6.6.5.22/popfu/popfu-en_US.cab
O16 - DPF: PoppaZoppa by pogo - http://game1.pogo.com/applet-6.6.2.21/popp…zoppa-en_US.cab
O16 - DPF: Poppit by pogo - http://game1.pogo.com/applet-6.7.1.33/popp…ppit2-en_US.cab
O16 - DPF: Quick Quack by pogo - http://game1.pogo.com/applet-6.6.5.31/hots…treak-en_US.cab
O16 - DPF: Showbiz Slots 2 by pogo - http://game1.pogo.com/applet-6.6.3.34/slot…wbiz2-en_US.cab
O16 - DPF: Showbiz Slots by pogo - http://game1.pogo.com/applet-6.6.5.31/slot…owbiz-en_US.cab
O16 - DPF: Shuffle Bump by pogo - http://game1.pogo.com/applet-6.7.0.32/puck/puck-en_US.cab
O16 - DPF: Squelchies by pogo - http://game1.pogo.com/applet-6.6.4.21/sque…chies-en_US.cab
O16 - DPF: Texas Hold'em Poker by pogo - http://game1.pogo.com/applet-6.7.2.33/hold…oldem-en_US.cab
O16 - DPF: Top Down Baseball Challenge by pogo - http://game1.pogo.com/applet-6.7.1.23/topd…down2-en_US.cab
O16 - DPF: Tri-Peaks by pogo - http://game1.pogo.com/applet-6.6.4.29/peaks/peaks-en_US.cab
O16 - DPF: Tumble Bees by pogo - http://game1.pogo.com/applet-6.6.4.21/jumb…umbee-en_US.cab
O16 - DPF: Turbo 21 v2 by pogo - http://game1.pogo.com/applet-6.7.0.32/turb…rbo22-en_US.cab
O16 - DPF: Wonderland Memories by pogo - http://game1.pogo.com/applet-6.6.5.22/memo…ories-en_US.cab
O16 - DPF: Word Whomp by pogo - http://game1.pogo.com/applet-6.6.5.31/word…homp2-en_US.cab
O16 - DPF: Word Whomp Whackdown by pogo - http://game1.pogo.com/applet-6.6.5.31/whac…kdown-en_US.cab
O16 - DPF: WordJong by pogo - http://game1.pogo.com/applet-6.7.0.40/word…djong-en_US.cab
O16 - DPF: World Class Solitaire by pogo - http://game1.pogo.com/applet-6.7.1.23/worl…class-en_US.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://www.worldwinner.com/games/v47/share…GamesLoader.cab
O16 - DPF: {2DFF31F9-7893-4922-AF66-C9A1EB4EBB31} (Rhapsody Player Engine) - http://forms.real.com/real/player/download…ne_Inst_Win.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} (PogoWebLauncher Control) - http://www.pogo.com/cdl/launcher/PogoWebLa…erInstaller.CAB
O16 - DPF: {380BBEC2-4CAE-4ECE-8AFF-36CDE7916386} (Surgient URA Local Proxy Client (v2)) - http://ni-us.demoservers.com/URA/URA/lib/L…roxyActiveX.cab
O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} (king.com) - http://games.king.com/ctl/kingcomie.cab
O16 - DPF: {4EDCB26C-D24C-4E72-AF07-B576699AC0DE} (Microsoft RDP Client Control (redist)) - http://ni-us.demoservers.com/URA/URA/lib/srdp.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/4058/ftp…tle/Coupons.cab
O16 - DPF: {B06CE1BC-5D9D-4676-BD28-1752DBF394E0} (Hangman Control) - http://www.worldwinner.com/games/v41/hangman/hangman.cab
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - https://www.verizon.net/WhatsNext/CheckMyPc…tivePreQual.cab
O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) - http://www.worldwinner.com/games/v47/famil…/familyfeud.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir…l/installer.exe
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://games.pogo.com/online2/pogo/insaniq…aploader_v6.cab
O18 - Protocol: bw+0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw+0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw-0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw-0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw00 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw00s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw10 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw10s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw20 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw20s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw30 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw30s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw40 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw40s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw50 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw50s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw60 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw60s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw70 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw70s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw80 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw80s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw90 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw90s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwa0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwa0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwb0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwb0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwc0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwc0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwd0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwd0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwe0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwe0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwf0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwf0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwg0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwg0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwh0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwh0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwi0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwi0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwj0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwj0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwk0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwk0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwl0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwl0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwm0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwm0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwn0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwn0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwo0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwo0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwp0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwp0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwq0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwq0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwr0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwr0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bws0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bws0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwt0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwt0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwu0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwu0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwv0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwv0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bww0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bww0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwx0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwx0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwy0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwy0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwz0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwz0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: myrm - {4D034FC3-013F-4B95-B544-44D49ABE3E76} - C:\Program Files\McAfee\Managed VirusScan\Agent\MyRmProt4.5.1.191.dll
O18 - Protocol: offline-8876480 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Lookout Citadel Server (LkCitadelServer) - National Instruments, Inc. - C:\WINDOWS\system32\lkcitdl.exe
O23 - Service: National Instruments PSP Server Locator (lkClassAds) - National Instruments, Inc. - C:\WINDOWS\system32\lkads.exe
O23 - Service: National Instruments Time Synchronization (lkTimeSync) - National Instruments, Inc. - C:\WINDOWS\system32\lktsrv.exe
O23 - Service: McShield - McAfee, Inc. - C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe
O23 - Service: NI Configuration Manager (mxssvr) - National Instruments Corporation - C:\Program Files\National Instruments\MAX\nimxs.exe
O23 - Service: McAfee Virus and Spyware Protection Service (myAgtSvc) - McAfee, Inc. - C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
O23 - Service: National Instruments Domain Service (NIDomainService) - National Instruments, Inc. - C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
O23 - Service: NILM License Manager - Macrovision Corporation - C:\Program Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe
O23 - Service: NI Service Locator (niSvcLoc) - National Instruments Corp. - C:\WINDOWS\system32\nisvcloc.exe
O23 - Service: National Instruments Variable Engine (NITaggerService) - National Instruments, Inc. - C:\Program Files\National Instruments\Shared\Tagger\tagsrv.exe
O23 - Service: Xpoint PCRadmin Server (PCRadminServer) - Unknown owner - C:\PROGRA~1\Xpoint\PE\pcradmin.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Remote Procedure Call (RPC) Net (Rpcnet) - Absolute Software Corp. - C:\WINDOWS\SYSTEM32\Rpcnet.exe
O23 - Service: Xpoint Admin Server (XPadminServer) - Unknown owner - C:\PROGRA~1\Xpoint\xpadmin\xpadmin.exe
O23 - Service: Xpoint Agent Server (xpAgentServer) - Unknown owner - C:\PROGRA~1\Xpoint\agent\Xpagent.exe

LDTate

Post #8October 25, 2007, 11:47 PM UTC

Open notepad and copy/paste the text in the quotebox below into it:

File::
c:\wutemp\setup2k.exe

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"setup2k.exe"=-

Save this as Save this as "CFScript"

[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log

Did you try the winsockfix?

DaveMor

Post #9October 26, 2007, 12:06 AM UTC

How do I run winsockfix?

LDTate

Post #10October 26, 2007, 12:12 AM UTC

How do I run winsockfix?

download it from the link I gave you to your thumb drive, copy it to the pc that doesn't connect.
Put it on the desktop and just double click the winsockxpfix.exe file and reboot.

http://www.snapfiles.com/get/winsockxpfix.html

DaveMor

Post #11October 26, 2007, 12:18 AM UTC

Here are the new logs:

ComboFix 07-10-23.1 - Parent 2007-10-25 19:59:38.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.279 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Parent\Desktop\CFScript.txt
* Created a new restore point

FILE::
c:\wutemp\setup2k.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\wutemp\setup2k.exe

.
((((((((((((((((((((((((( Files Created from 2007-09-25 to 2007-10-25 )))))))))))))))))))))))))))))))
.

2007-10-25 00:17 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-10-23 15:29 d——– C:\Documents and Settings\Parent\Application Data\Grisoft
2007-10-23 15:29 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-10-22 15:14 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-10-19 20:07 d——– C:\Documents and Settings\Parent\Application Data\Pogo Games
2007-10-09 20:26 584,192 —–c— C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-10-07 23:04 d——– C:\Program Files\MFInstall

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-25 22:45 17,408 —-a-w C:\WINDOWS\system32\rpcnetp.exe
2007-10-25 22:44 47,104 —-a-w C:\WINDOWS\system32\rpcnet.dll
2007-10-25 19:26 ——— d—–w C:\Program Files\Logitech
2007-10-23 22:00 47,104 —-a-w C:\WINDOWS\system32\rpcnet.exe
2007-10-23 21:57 17,408 —-a-w C:\WINDOWS\system32\rpcnetp.dll
2007-10-23 13:54 ——— d—–w C:\Program Files\Oberon Media
2007-10-22 19:16 ——— d—–w C:\Program Files\Lavasoft
2007-10-22 19:16 ——— d—–w C:\Documents and Settings\Parent\Application Data\Lavasoft
2007-10-22 18:58 ——— d—–w C:\Program Files\Yahoo!
2007-10-22 15:24 ——— d—–w C:\Program Files\AWS
2007-10-22 15:23 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-10-22 15:23 ——— d—–w C:\Program Files\verizon
2007-10-22 15:19 ——— d—–w C:\Program Files\The Weather Channel FW
2007-10-22 15:18 ——— d—–w C:\Program Files\gamingclubMPP
2007-10-22 15:16 ——— d—–w C:\Program Files\Real
2007-10-22 15:15 ——— d—–w C:\Program Files\PokerRewardsCalculator
2007-10-22 15:10 ——— d—–w C:\Program Files\GameHouse
2007-08-21 06:15 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
2007-08-14 00:35 471,216 —-a-w C:\msgr8us.exe
2007-08-09 23:43 32,256 —-a-w C:\WINDOWS\system32\identprv.dll
2007-07-30 23:19 92,504 —-a-w C:\WINDOWS\system32\cdm.dll
2007-07-30 23:19 549,720 —-a-w C:\WINDOWS\system32\wuapi.dll
2007-07-30 23:19 53,080 —-a-w C:\WINDOWS\system32\wuauclt.exe
2007-07-30 23:19 43,352 —-a-w C:\WINDOWS\system32\wups2.dll
2007-07-30 23:19 325,976 —-a-w C:\WINDOWS\system32\wucltui.dll
2007-07-30 23:19 271,224 —-a-w C:\WINDOWS\system32\mucltui.dll
2007-07-30 23:19 207,736 —-a-w C:\WINDOWS\system32\muweb.dll
2007-07-30 23:19 203,096 —-a-w C:\WINDOWS\system32\wuweb.dll
2007-07-30 23:19 1,712,984 —-a-w C:\WINDOWS\system32\wuaueng.dll
2007-07-30 23:18 33,624 —-a-w C:\WINDOWS\system32\wups.dll
2007-04-27 14:38 33,528 —-a-w C:\Documents and Settings\Parent\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((( snapshot@2007-10-25_ 1.01.04.32 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-10-25 04:57:11 223,022 —-a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
+ 2007-10-25 22:48:53 223,009 —-a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
+ 2007-10-25 22:45:04 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_4c0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-04-07 00:19]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 00:07]
"C2K"="C:\WINDOWS\CYB2K.EXE" [2003-07-19 15:56]
"Bart Station"="C:\Program Files\ISP50\hta\station.sbrt" []
"MsmqIntCert"="regsvr32 /s mqrt.dll" []
"Rapid Restore"="C:\Program Files\Xpoint\PE\Skin\rrpcsb.exe" [2003-04-21 13:49]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe" [2004-12-14 12:07]
"SchoolCashReminderService"="wjview /cp:p C:\Program Files\SchoolCashReminderService\System\Code Main lp: C:\Program Files\SchoolCashReminderService" []
"Rosary Reminder"="C:\PROGRA~1\VIRTUA~1\reminder.exe" []
"TaskPlus"="C:\Program Files\TaskPlus\taskplus0.exe" []
"McAfee Managed Services Tray"="C:\Program Files\McAfee\Managed VirusScan\Agent\myagttry.exe" [2007-05-18 04:03]
"MVS Splash"="C:\Program Files\McAfee\Managed VirusScan\Agent\Splash.exe" [2007-03-06 17:25]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-01-16 08:18]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 13:03]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-06-16 10:39]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11]
"YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" []
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24]
"PhotoShow Deluxe Media Manager"="C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe" [2005-01-21 20:04]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" []
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 21:05]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 17:45]
"PopUpStopperFreeEdition"="C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe" [2003-10-29 11:01]

R1 mfetdik;McAfee Inc.;C:\WINDOWS\system32\drivers\mfetdik.sys
R2 cvintdrv;cvintdrv;C:\WINDOWS\system32\drivers\cvintdrv.sys
R2 mxssvr;NI Configuration Manager;"C:\Program Files\National Instruments\MAX\nimxs.exe"
R2 myAgtSvc;McAfee Virus and Spyware Protection Service;C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe /ServiceStart
R2 NITaggerService;National Instruments Variable Engine;"C:\Program Files\National Instruments\Shared\Tagger\tagsrv.exe"
R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\System32\inetsrv\inetinfo.exe
R2 SRFilter;SRFilter;C:\WINDOWS\system32\drivers\srntflt.sys
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys

.
**************************************************************************

catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-25 20:05:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-25 20:07:45
C:\ComboFix2.txt … 2007-10-25 15:46
C:\ComboFix3.txt … 2007-10-25 01:04
.
— E O F —

HiJackThis renamed spyware3.exe

Logfile of HijackThis v1.99.1
Scan saved at 8:12:23 PM, on 10/25/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\lkcitdl.exe
C:\WINDOWS\system32\lkads.exe
C:\WINDOWS\system32\lktsrv.exe
C:\WINDOWS\System32\mnmsrvc.exe
C:\Program Files\National Instruments\MAX\nimxs.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
C:\WINDOWS\system32\nisvcloc.exe
C:\Program Files\National Instruments\Shared\Tagger\tagsrv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\SYSTEM32\Rpcnet.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Xpoint\xpadmin\xpadmin.exe
C:\PROGRA~1\Xpoint\agent\Xpagent.exe
C:\WINDOWS\System32\mqsvc.exe
C:\PROGRA~1\Xpoint\EEClient\xpclient.exe
C:\WINDOWS\System32\mqtgsvc.exe
C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\CYB2K.EXE
C:\Program Files\Xpoint\PE\Skin\rrpcsb.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
C:\Program Files\Xpoint\PE\pcrecsa.exe
C:\Program Files\McAfee\Managed VirusScan\Agent\myagttry.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\WINDOWS\explorer.exe
C:\dkm\Spyware3.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [C2K] C:\WINDOWS\CYB2K.EXE
O4 - HKLM\..\Run: [Bart Station] C:\Program Files\ISP50\hta\station.sbrt
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [Rapid Restore] C:\Program Files\Xpoint\PE\Skin\rrpcsb.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
O4 - HKLM\..\Run: [SchoolCashReminderService] wjview /cp:p "C:\Program Files\SchoolCashReminderService\System\Code" Main lp: "C:\Program Files\SchoolCashReminderService"
O4 - HKLM\..\Run: [Rosary Reminder] C:\PROGRA~1\VIRTUA~1\reminder.exe
O4 - HKLM\..\Run: [TaskPlus] C:\Program Files\TaskPlus\taskplus0.exe
O4 - HKLM\..\Run: [McAfee Managed Services Tray] "C:\Program Files\McAfee\Managed VirusScan\Agent\myagttry.exe"
O4 - HKLM\..\Run: [MVS Splash] C:\Program Files\McAfee\Managed VirusScan\Agent\Splash.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: SchoolCash - file://C:\Program Files\SchoolCashReminderService\System\Temp\scash_script.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Golden Tiger Poker - {772B5BF8-12E8-4a5d-B48F-652B5E82025D} - C:\Program Files\goldentigerMPP\MPPoker.exe (file missing)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: SchoolCash - {011E1110-AF57-11d4-AC1C-E843E6000000} - file://C:\Program Files\SchoolCashReminderService\System\Temp\scash_script.htm (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: 6th Street Omaha Poker by pogo - http://game1.pogo.com/applet-6.6.4.21/omaha/omaha-en_US.cab
O16 - DPF: Aces Up! by pogo - http://game1.pogo.com/applet-6.6.5.22/aces/aces-en_US.cab
O16 - DPF: Backgammon by pogo - http://game1.pogo.com/applet-6.6.5.22/back…ammon-en_US.cab
O16 - DPF: Blooop by pogo - http://game1.pogo.com/applet-6.6.5.22/casc…scade-en_US.cab
O16 - DPF: Bump by pogo - http://www.pogo.com/applet-6.7.1.23/bump/bump-en_US.cab
O16 - DPF: Canasta by pogo - http://game1.pogo.com/applet-6.7.2.33/cana…nasta-en_US.cab
O16 - DPF: Command & Conquer Generals Comanche Strike by pogo.com - http://ccstrike.pogo.com/applet/ccstrike/c…e-ob-assets.cab
O16 - DPF: Dice City Roller by pogo - http://game1.pogo.com/applet-6.7.1.33/ytz/ytz-en_US.cab
O16 - DPF: EA Sports Web Soccer by pogo - http://game1.pogo.com/applet-6.7.1.23/socc…occer-en_US.cab
O16 - DPF: First Class Solitaire by pogo - http://game1.pogo.com/applet-6.6.5.22/firs…lass2-en_US.cab
O16 - DPF: Fortune Bingo by pogo - http://game1.pogo.com/applet-6.6.4.29/supe…bingo-en_US.cab
O16 - DPF: Harvest Mania by pogo - http://game1.pogo.com/applet-6.6.5.31/harv…rvest-en_US.cab
O16 - DPF: High Stakes Pool by pogo - http://game1.pogo.com/applet-6.7.2.33/pool2/pool-en_US.cab
O16 - DPF: Jungle Gin by pogo - http://game1.pogo.com/applet-6.6.5.22/gin/gin-en_US.cab
O16 - DPF: Keno by pogo - http://game1.pogo.com/applet-6.6.5.31/keno/keno-en_US.cab
O16 - DPF: Lost Temple Poker by pogo - http://game1.pogo.com/applet-6.6.5.31/mhpo…poker-en_US.cab
O16 - DPF: Lottso by pogo - http://game1.pogo.com/applet-6.7.0.32/lott…ottso-en_US.cab
O16 - DPF: Mah Jong Garden by pogo - http://game1.pogo.com/applet-6.6.5.31/mahj…hjong-en_US.cab
O16 - DPF: Multiline Slots by pogo - http://game1.pogo.com/applet-6.7.0.40/mlsl…slots-en_US.cab
O16 - DPF: Payday FreeCell by pogo - http://game1.pogo.com/applet-6.7.1.23/free…ecell-en_US.cab
O16 - DPF: Pebble Beach 3 Hole Challenge by pogo.com - http://threehole01.pogo.com/applet/threeho…e-ob-assets.cab
O16 - DPF: Penguin Blocks by pogo - http://game1.pogo.com/applet-6.6.5.22/peng…guins-en_US.cab
O16 - DPF: Perfect Pair Solitaire by pogo - http://game1.pogo.com/applet-6.6.5.22/wate…wheel-en_US.cab
O16 - DPF: Phlinx by pogo - http://game1.pogo.com/applet-6.7.0.32/flin…inger-en_US.cab
O16 - DPF: Pinochle by pogo - http://game1.pogo.com/applet-6.6.4.21/pino…ochle-en_US.cab
O16 - DPF: Pirate's Gold by pogo - http://game1.pogo.com/applet-6.6.5.31/pira…sgold-en_US.cab
O16 - DPF: Pop Fu by pogo - http://game1.pogo.com/applet-6.6.5.22/popfu/popfu-en_US.cab
O16 - DPF: PoppaZoppa by pogo - http://game1.pogo.com/applet-6.6.2.21/popp…zoppa-en_US.cab
O16 - DPF: Poppit by pogo - http://game1.pogo.com/applet-6.7.1.33/popp…ppit2-en_US.cab
O16 - DPF: Quick Quack by pogo - http://game1.pogo.com/applet-6.6.5.31/hots…treak-en_US.cab
O16 - DPF: Showbiz Slots 2 by pogo - http://game1.pogo.com/applet-6.6.3.34/slot…wbiz2-en_US.cab
O16 - DPF: Showbiz Slots by pogo - http://game1.pogo.com/applet-6.6.5.31/slot…owbiz-en_US.cab
O16 - DPF: Shuffle Bump by pogo - http://game1.pogo.com/applet-6.7.0.32/puck/puck-en_US.cab
O16 - DPF: Squelchies by pogo - http://game1.pogo.com/applet-6.6.4.21/sque…chies-en_US.cab
O16 - DPF: Texas Hold'em Poker by pogo - http://game1.pogo.com/applet-6.7.2.33/hold…oldem-en_US.cab
O16 - DPF: Top Down Baseball Challenge by pogo - http://game1.pogo.com/applet-6.7.1.23/topd…down2-en_US.cab
O16 - DPF: Tri-Peaks by pogo - http://game1.pogo.com/applet-6.6.4.29/peaks/peaks-en_US.cab
O16 - DPF: Tumble Bees by pogo - http://game1.pogo.com/applet-6.6.4.21/jumb…umbee-en_US.cab
O16 - DPF: Turbo 21 v2 by pogo - http://game1.pogo.com/applet-6.7.0.32/turb…rbo22-en_US.cab
O16 - DPF: Wonderland Memories by pogo - http://game1.pogo.com/applet-6.6.5.22/memo…ories-en_US.cab
O16 - DPF: Word Whomp by pogo - http://game1.pogo.com/applet-6.6.5.31/word…homp2-en_US.cab
O16 - DPF: Word Whomp Whackdown by pogo - http://game1.pogo.com/applet-6.6.5.31/whac…kdown-en_US.cab
O16 - DPF: WordJong by pogo - http://game1.pogo.com/applet-6.7.0.40/word…djong-en_US.cab
O16 - DPF: World Class Solitaire by pogo - http://game1.pogo.com/applet-6.7.1.23/worl…class-en_US.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://www.worldwinner.com/games/v47/share…GamesLoader.cab
O16 - DPF: {2DFF31F9-7893-4922-AF66-C9A1EB4EBB31} (Rhapsody Player Engine) - http://forms.real.com/real/player/download…ne_Inst_Win.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} (PogoWebLauncher Control) - http://www.pogo.com/cdl/launcher/PogoWebLa…erInstaller.CAB
O16 - DPF: {380BBEC2-4CAE-4ECE-8AFF-36CDE7916386} (Surgient URA Local Proxy Client (v2)) - http://ni-us.demoservers.com/URA/URA/lib/L…roxyActiveX.cab
O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} (king.com) - http://games.king.com/ctl/kingcomie.cab
O16 - DPF: {4EDCB26C-D24C-4E72-AF07-B576699AC0DE} (Microsoft RDP Client Control (redist)) - http://ni-us.demoservers.com/URA/URA/lib/srdp.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/4058/ftp…tle/Coupons.cab
O16 - DPF: {B06CE1BC-5D9D-4676-BD28-1752DBF394E0} (Hangman Control) - http://www.worldwinner.com/games/v41/hangman/hangman.cab
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - https://www.verizon.net/WhatsNext/CheckMyPc…tivePreQual.cab
O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) - http://www.worldwinner.com/games/v47/famil…/familyfeud.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir…l/installer.exe
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://games.pogo.com/online2/pogo/insaniq…aploader_v6.cab
O18 - Protocol: bw+0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw+0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw-0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw-0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw00 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw00s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw10 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw10s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw20 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw20s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw30 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw30s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw40 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw40s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw50 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw50s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw60 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw60s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw70 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw70s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw80 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw80s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw90 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bw90s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwa0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwa0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwb0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwb0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwc0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwc0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwd0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwd0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwe0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwe0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwf0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwf0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwg0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwg0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwh0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwh0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwi0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwi0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwj0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwj0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwk0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwk0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwl0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwl0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwm0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwm0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwn0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwn0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwo0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwo0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwp0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwp0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwq0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwq0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwr0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwr0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bws0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bws0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwt0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwt0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwu0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwu0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwv0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwv0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bww0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bww0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwx0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwx0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwy0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwy0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwz0 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: bwz0s - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: myrm - {4D034FC3-013F-4B95-B544-44D49ABE3E76} - C:\Program Files\McAfee\Managed VirusScan\Agent\MyRmProt4.5.1.191.dll
O18 - Protocol: offline-8876480 - {54DE5A11-D6CF-4484-A66E-D535963308B2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Lookout Citadel Server (LkCitadelServer) - National Instruments, Inc. - C:\WINDOWS\system32\lkcitdl.exe
O23 - Service: National Instruments PSP Server Locator (lkClassAds) - National Instruments, Inc. - C:\WINDOWS\system32\lkads.exe
O23 - Service: National Instruments Time Synchronization (lkTimeSync) - National Instruments, Inc. - C:\WINDOWS\system32\lktsrv.exe
O23 - Service: McShield - McAfee, Inc. - C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe
O23 - Service: NI Configuration Manager (mxssvr) - National Instruments Corporation - C:\Program Files\National Instruments\MAX\nimxs.exe
O23 - Service: McAfee Virus and Spyware Protection Service (myAgtSvc) - McAfee, Inc. - C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
O23 - Service: National Instruments Domain Service (NIDomainService) - National Instruments, Inc. - C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
O23 - Service: NILM License Manager - Macrovision Corporation - C:\Program Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe
O23 - Service: NI Service Locator (niSvcLoc) - National Instruments Corp. - C:\WINDOWS\system32\nisvcloc.exe
O23 - Service: National Instruments Variable Engine (NITaggerService) - National Instruments, Inc. - C:\Program Files\National Instruments\Shared\Tagger\tagsrv.exe
O23 - Service: Xpoint PCRadmin Server (PCRadminServer) - Unknown owner - C:\PROGRA~1\Xpoint\PE\pcradmin.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Remote Procedure Call (RPC) Net (Rpcnet) - Absolute Software Corp. - C:\WINDOWS\SYSTEM32\Rpcnet.exe
O23 - Service: Xpoint Admin Server (XPadminServer) - Unknown owner - C:\PROGRA~1\Xpoint\xpadmin\xpadmin.exe
O23 - Service: Xpoint Agent Server (xpAgentServer) - Unknown owner - C:\PROGRA~1\Xpoint\agent\Xpagent.exe

LDTate

Post #12October 26, 2007, 12:29 AM UTC

Do you know what this program is?
SchoolCashReminderService\System

Please do not delete anything unless instructed to.

1.Click Start > Settings > Control Panel.
2.Next, open Add/Remove Programs and remove if listed:
Logitech\Desktop Messenger

Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a checkmark/tick in the box on the left side on these:

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: Golden Tiger Poker - {772B5BF8-12E8-4a5d-B48F-652B5E82025D} - C:\Program Files\goldentigerMPP\MPPoker.exe (file missing)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://www.worldwinner.com/games/v47/share…GamesLoader.cab
O16 - DPF: {2DFF31F9-7893-4922-AF66-C9A1EB4EBB31} (Rhapsody Player Engine) - http://forms.real.com/real/player/download…ne_Inst_Win.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/4058/ftp…tle/Coupons.cab
O16 - DPF: {B06CE1BC-5D9D-4676-BD28-1752DBF394E0} (Hangman Control) - http://www.worldwinner.com/games/v41/hangman/hangman.cab
O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) - http://www.worldwinner.com/games/v47/famil…/familyfeud.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir…l/installer.exe

Close ALL windows and browsers except HijackThis and click "Fix checked"

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

DaveMor

Post #13October 27, 2007, 7:04 PM UTC

LDTate, I am sorry but I have not had the time to do the latest suggested things yet. I hopefully will have some time ater today. Here are some other symptoms with the PC. I executed the winsockfix and I still cannot get on the internet through IE. I do not have any other browsers installed. I can ping my router, belkin, and the other computers on the local network. I cannot even access the builtin router maintenance page via IE. Any ideas? David

DaveMor

Post #14October 28, 2007, 1:17 AM UTC

LDTate, More info and things I have tried. I downloaded IE7.0 from Microsofts website to my thumb drive and installed it. I thought we may have corrupted explorer. This made no difference. I got out my Belkin Router CD and ran the install. It checked and told me that the router was out there and good ot use. I also checked all of my network connections with a second computer and they are all the same. I tried to ping my dns server addresses and I can ping those. I did notice that on my PC that is connected properly the connection status shows more received packets than transmitted, about 2 times, on the PC that is not working it is the opposite, twice as many sent packets. I do get an error upon bootup, I may have mentioned this before, WJView Error ERROR: Could not execute MAIN: The system cannot find the file specified. I have not yet made the last set of modifications you posted last to the PC. Should I go ahead and do this? David

LDTate

Post #15October 28, 2007, 2:02 AM UTC

I'm still out of town but SchoolCashReminderService is causing the WJView Error.

Use add/remove programs and remove if listed:
SchoolCashReminderService

Run HJT and fix these.

O4 - HKLM\..\Run: [SchoolCashReminderService] wjview /cp:p "C:\Program Files\SchoolCashReminderService\System\Code" Main lp: "C:\Program Files\SchoolCashReminderService"

O8 - Extra context menu item: SchoolCash - file://C:\Program Files\SchoolCashReminderService\System\Temp\scash_script.htm

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Save me from SaveTheInformation.com

✨ Ask AI

Ask AI