[Closed] Juno: Explorer Browser HiJack

Ok, my wife uses Explorer to browse and her email client is juno.com. This problem only occurs when she uses this combination. Also, this problem only occurs from our home computer. She uses this combo at her office and it works fine.

When she is COMPOSING an email, the computer clicks a few times and then redirects to a "error" page where is seems like it was trying to getting to a Dell page. It has not occurred when I am around, so I can't really describe it any better than that. In any event, she can't recover any of the email she was composing and she has screamed bloody murder when she loses a lengthy email. I have run SpyBot Search and Destroy and this has not eliminated the problem. I also downloaded Fiddler to log the various HTTP requests during a Juno session. Here is the summary of this log:

GET http://www.juno.com/
302 Moved Temporarily to http://my.juno.com/s/sp?cf=www

GET http://my.juno.com/s/sp?cf=www
200 OK

GET http://track.juno.com/s/pv?s=999999&a=…63484&crt=0
200 OK

GET http://cyclops.prod.untd.com/adstream_mjx….2,x33,x60?&
200 OK

GET http://phoenix.untd.com/OASX/RQST/TYPE=phx…7;x48;x49?&
200 OK

GET http://e1.cdn.qnsr.com/jsc/e1/fl.js
200 OK

GET http://e2.cdn.qnsr.com/cgi/d/1281/0/203/17…86;z=2834819943
200 OK

GET http://nztv.prod.untd.com/RealMedia/ads/Cr…fault/empty.gif
304 Not Modified

GET http://ads.addynamix.com/creative/2-213042…?time=294364543
302 Moved Temporarily to http://e13.media.addynamix.com/E17/C25964/…17_C25964-1.GIF?

GET http://nztv.prod.untd.com/RealMedia/ads/Cr…d_red_22x22.gif
304 Not Modified

CONNECT http://urs.microsoft.com:443
200 Connection Established

GET http://nztv.prod.untd.com/RealMedia/ads/Cr…978/22x22_b.gif
304 Not Modified

GET http://nztv.prod.untd.com/RealMedia/ads/Cr…10168/22x22.jpg
304 Not Modified

GET http://ad.doubleclick.net/ad/N5003.netzero…7794.8;sz=22x22
302 Moved Temporarily to http://m1.2mdn.net/viewad/1643336/july8.gif

GET http://ads.addynamix.com/creative/2-213042…time=1391305115
302 Moved Temporarily to http://e13.media.addynamix.com/E17/C25988/…17_C25988-1.gif?

GET http://ads.addynamix.com/creative/2-213042…3454d4142715a47?
200 OK

GET http://e2.cdn.qnsr.com/jsc/e1/fl.js
200 OK

GET http://ad.doubleclick.net/ad/N3285.unitedo…0;ord=787493535?
302 Moved Temporarily to http://m1.2mdn.net/viewad/1420759/2-lmb_lr…amily_05JPG.jpg

GET http://ad.doubleclick.net/ad/N3285.unitedo…1;ord=787493535?
302 Moved Temporarily to http://m1.2mdn.net/viewad/3285/15-1x1pixel.gif

GET http://nztv.prod.untd.com/RealMedia/ads/Cr…_60x60_tiny.jpg
304 Not Modified

GET http://nztv.prod.untd.com/RealMedia/ads/Cr…0x60_sheets.gif
304 Not Modified

GET http://view.atdmt.com/MON/view/clxxumon095…7mon/direct/01/
302 Object moved to http://ll.atdmt.com/b/TRMONMONSMON/logo_60x60_4k.gif

GET http://nztv.prod.untd.com/RealMedia/ads/Cr…il-functions.js
304 Not Modified

GET http://nztv.prod.untd.com/RealMedia/ads/Cr…default-text.js
304 Not Modified

GET http://nztv.prod.untd.com/RealMedia/ads/Cr…-bos-widget.css
304 Not Modified

GET http://nztv.prod.untd.com/RealMedia/ads/Cr…s-hp-widget.css
304 Not Modified

GET http://my.juno.com/s/javascript?r=javascri…s/sp%3Fcf%3Dwww
200 OK

GET http://nztv.prod.untd.com/RealMedia/ads/Cr…10054/cf-bg.gif
304 Not Modified

GET http://nztv.prod.untd.com/RealMedia/ads/Cr…flight_logo.gif
304 Not Modified

GET http://nztv.prod.untd.com/RealMedia/ads/Cr…arch_button.gif
304 Not Modified

GET http://l1.cdn.qnsr.com/log/p.gif?a=2007099…53;z=7297271083
200 OK

GET http://e2.cdn.qnsr.com/cgi/k/20070998/1280…03/1886//1/i.js
200 OK

GET http://ad.uolmg.com/st?ad_type=iframe&…ge=&gender=
200 OK

GET http://nztv.prod.untd.com/RealMedia/ads/Cr…VS_photo_60.jpg
304 Not Modified

GET http://nztv.prod.untd.com/RealMedia/ads/Cr…O_PMS215448.jpg
304 Not Modified

GET http://cyclops.prod.untd.com/Media/imglx/j…5a47?_RM_EMPTY_
200 OK

CONNECT http://altfarm.mediaplex.com:443
200 Connection Established

GET http://ad.yieldmanager.com/imp?Z=300x250&a…f%3Dwww&r=0
200 OK

GET http://e1.cdn.qnsr.com/OzoDB/0/5/20070998/…s_blueicons.gif
200 OK

CONNECT http://rd.apmebf.com:443
200 Connection Established

GET http://content.yieldmanager.edgesuite.net/…5d6932e1558.jpg
200 OK

CONNECT http://altfarm.mediaplex.com:443
200 Connection Established

GET http://nztv.prod.untd.com/RealMedia/ads/Cr…tHere_60x60.gif
304 Not Modified

GET http://ad.doubleclick.net/imp;v1;f;1932368…ick.net/dot.gif?[timestamp]
302 Moved Temporarily to http://ad.doubleclick.net/dot.gif?[timestamp]

GET http://nztv.prod.untd.com/RealMedia/ads/Cr…l-1069620-s.jpg
304 Not Modified

GET http://nztv.prod.untd.com/RealMedia/ads/Cr…0275/search.jpg
304 Not Modified

GET http://ad.uolmg.com/st?ad_type=iframe&…ge=&gender=
200 OK

GET http://nztv.prod.untd.com/RealMedia/ads/Cr…ecipes_logo.jpg
304 Not Modified

GET http://nztv.prod.untd.com/RealMedia/ads/Cr…10293/60x60.gif
304 Not Modified

GET http://ad.doubleclick.net/imp;v1;f;5134948…ick.net/dot.gif
302 Moved Temporarily to http://m.doubleclick.net/dot.gif

GET http://nztv.untd.com/feed//img/logo/myhomeideas.gif
304 Not Modified

GET http://nztv.untd.com/feed//img/logo/timebottom_news.gif
304 Not Modified

GET http://nztv.untd.com/feed//img/logo/usatoday_tech.gif
304 Not Modified

GET http://nztv.untd.com/feed//img/logo/people_entertainment.gif
304 Not Modified

GET http://nztv.untd.com/feed//img/logo/cnnmoney_business.gif
304 Not Modified

GET http://nztv.untd.com/feed//img/logo/si_sports.gif
304 Not Modified

GET http://nztv.untd.com/feed//img/logo/ew_tvnews.gif
304 Not Modified

GET http://nztv.untd.com/feed//img/logo/instyle_fashion.gif
304 Not Modified

GET http://cyclops.prod.untd.com/Media/imglx/j…5a47?_RM_EMPTY_
200 OK

GET http://track.untd.com/s/c?k=brand&v=JN…868627362062211
200 OK

GET http://ads.addynamix.com/category/1-17-1
200 OK

GET http://syndication.mmismm.com/mmtnt.php
200 OK

GET http://cyclops.prod.untd.com/Media/imglx/j…5a47?_RM_EMPTY_
200 OK

GET http://ad.yieldmanager.com/imp?Z=160x600&a…f%3Dwww&r=0
502 Fiddler - Connection Failed

GET http://syndication.mmismm.com/mmtnt.php?or…&tzos=25200
200 OK

GET http://track.juno.com/s/pv?s=999999&a=…4&crt=68156
200 OK

GET http://uoljunocom2.112.2o7.net/b/ss/uoljun…/s6480078377854?[AQB]&ndh=1&t=11/6/2008%2018%3A19%3A27%205%20420&pageName=sp%3Aindex&g=http%3A//my.juno.com/s/sp%3Fcf%3Dwww&ch=sp&server=start&cc=USD&c1=JN&v1=start&c2=JN&v2=production&c3=default&v3=Paid&c4=www&c5=%3Asp%3Aindex&c6=Paid%3Asp%3Aindex&s=1680x1050&c=32&j=1.3&v=Y&k=Y&bw=1680&bh=807&ct=lan&hp=N&[AQE]
200 OK

GET http://track.juno.com/s/lc?s=142024&u=…i-bin/login.cgi
302 Moved Temporarily to http://webmail.juno.com/cgi-bin/login.cgi

GET http://webmail.juno.com/cgi-bin/login.cgi
200 OK

GET http://webmailb.juno.com/webmail/new/7?ses…ount=1215825584
200 OK

GET http://cyclops.prod.untd.com/adstream_mjx….10557@x20?&
200 OK

GET http://track.juno.com/s/pv?s=999999&a=…&crt=0&
200 OK

GET http://cyclops.prod.untd.com/adstream_mjx….ottomLeft?&
200 OK

GET http://nztv.prod.untd.com/RealMedia/ads/Cr…_heartsblue.gif
304 Not Modified

GET http://cyclops.prod.untd.com/Media/imglx/e…5a47?_RM_EMPTY_
200 OK

GET http://cyclops.prod.untd.com/adstream_sx.a…8@Bottom3?&
200 OK

GET http://ads.addynamix.com/creative/2-213042…3454d4142715a47?
200 OK

GET http://cyclops.prod.untd.com/Media/imglx/e…5a47?_RM_EMPTY_
200 OK

GET http://ad.uolmg.com/st?ad_type=iframe&…ge=&gender=
200 OK

CONNECT http://urs.microsoft.com:443
200 Connection Established

GET http://ad.yieldmanager.com/imp?Z=120x600&a…3%3F%26&r=0
200 OK

GET http://ad.uolmg.com/iframe3?AAAAAJ7kAwCv-A…8@bottom3?&
302 Found to http://ad.yieldmanager.com/iframe3?AAAAAJ7…8@bottom3?&

GET http://ad.yieldmanager.com/iframe3?AAAAAJ7…8@bottom3?&
200 OK

GET http://servedby.advertising.com/site=74203…2526gender%253D
302 MOVED to http://servedby.advertising.com/ctst=1/sit…2526gender%253D

GET http://servedby.advertising.com/ctst=1/sit…2526gender%253D
200 OK

GET http://webmailb.juno.com/webmail/new/26?co…content=central
200 OK

GET http://cyclops.prod.untd.com/adstream_mjx….62817@x64?&
200 OK

GET http://track.juno.com/s/pv?s=999999&a=…&crt=0&
200 OK

GET http://nztv.prod.untd.com/RealMedia/ads/Cr…fault/empty.gif
304 Not Modified

GET http://cyclops.prod.untd.com/adstream_mjx….ottomLeft?&
200 OK

GET http://nztv.prod.untd.com/RealMedia/ads/Cr…_heartsblue.gif
304 Not Modified

GET http://cyclops.prod.untd.com/Media/imglx/e…5a47?_RM_EMPTY_
200 OK

GET http://cyclops.prod.untd.com/adstream_sx.a…9@Bottom3?&
200 OK

GET http://ads.addynamix.com/creative/2-213042…3454d4142715a47?
200 OK

GET http://cyclops.prod.untd.com/Media/imglx/e…5a47?_RM_EMPTY_
200 OK

GET http://ad.uolmg.com/st?ad_type=iframe&…ge=&gender=
200 OK

CONNECT http://urs.microsoft.com:443
200 Connection Established

GET http://ad.yieldmanager.com/imp?Z=120x600&a…3%3F%26&r=0
200 OK

GET http://ad.uolmg.com/iframe3?AAAAAJ7kAwCv-A…9@bottom3?&
302 Found to http://ad.yieldmanager.com/iframe3?AAAAAJ7…9@bottom3?&

GET http://webmailb.juno.com/webmail/new/31?co…15825869&_=
200 OK

GET http://webmailb.juno.com/webmail/new/31?co…15825869&_=
200 OK

GET http://ad.yieldmanager.com/iframe3?AAAAAJ7…9@bottom3?&
200 OK

GET http://webmailb.juno.com/webmail/new/31?co…15825869&_=
200 OK

GET http://servedby.advertising.com/site=74203…2526gender%253D
302 MOVED to http://servedby.advertising.com/ctst=1/sit…2526gender%253D

GET http://servedby.advertising.com/ctst=1/sit…2526gender%253D
200 OK

GET http://cyclops.prod.untd.com/adstream_sx.a…8@Bottom3?&
200 OK

GET http://cyclops.prod.untd.com/Media/imglx/e…5a47?_RM_EMPTY_
200 OK

GET http://ad.uolmg.com/st?ad_type=iframe&…ge=&gender=
200 OK

CONNECT http://urs.microsoft.com:443
200 Connection Established

GET http://ad.yieldmanager.com/imp?Z=120x600&a…3%3F%26&r=0
200 OK

GET http://ad.uolmg.com/iframe3?AAAAAJ7kAwCv-A…8@bottom3?&
302 Found to http://ad.yieldmanager.com/iframe3?AAAAAJ7…8@bottom3?&

GET http://ad.yieldmanager.com/iframe3?AAAAAJ7…8@bottom3?&
200 OK

GET http://servedby.advertising.com/site=74203…2526gender%253D
302 MOVED to http://servedby.advertising.com/ctst=1/sit…2526gender%253D

GET http://servedby.advertising.com/ctst=1/sit…2526gender%253D
200 OK

GET http://cyclops.prod.untd.com/adstream_sx.a…1@Bottom3?&
200 OK

GET http://cyclops.prod.untd.com/Media/imglx/e…5a47?_RM_EMPTY_
200 OK

GET http://ad.uolmg.com/st?ad_type=iframe&…ge=&gender=
200 OK

CONNECT http://urs.microsoft.com:443
200 Connection Established

GET http://ad.yieldmanager.com/imp?Z=120x600&a…3%3F%26&r=0
200 OK

GET http://ad.uolmg.com/iframe3?AAAAAJ7kAwCv-A…1@bottom3?&
302 Found to http://ad.yieldmanager.com/iframe3?AAAAAJ7…1@bottom3?&

GET http://ad.yieldmanager.com/iframe3?AAAAAJ7…1@bottom3?&
200 OK

GET http://servedby.advertising.com/site=74203…2526gender%253D
302 MOVED to http://servedby.advertising.com/ctst=1/sit…2526gender%253D

GET http://servedby.advertising.com/ctst=1/sit…2526gender%253D
200 OK

GET http://cyclops.prod.untd.com/adstream_sx.a…0@Bottom3?&
200 OK

GET http://cyclops.prod.untd.com/Media/imglx/e…5a47?_RM_EMPTY_
200 OK

GET http://ad.uolmg.com/st?ad_type=iframe&…ge=&gender=
200 OK

CONNECT http://urs.microsoft.com:443
200 Connection Established

GET http://ad.yieldmanager.com/imp?Z=120x600&a…3%3F%26&r=0
200 OK

GET http://ad.uolmg.com/iframe3?AAAAAJ7kAwCv-A…0@bottom3?&
302 Found to http://ad.yieldmanager.com/iframe3?AAAAAJ7…0@bottom3?&

GET http://ad.yieldmanager.com/iframe3?AAAAAJ7…0@bottom3?&
200 OK

GET http://servedby.advertising.com/site=74203…2526gender%253D
302 MOVED to http://servedby.advertising.com/ctst=1/sit…2526gender%253D

GET http://servedby.advertising.com/ctst=1/sit…2526gender%253D
200 OK

GET http://cyclops.prod.untd.com/adstream_sx.a…3@Bottom3?&
200 OK

GET http://cyclops.prod.untd.com/Media/imglx/e…5a47?_RM_EMPTY_
200 OK

GET http://ad.uolmg.com/st?ad_type=iframe&…ge=&gender=
200 OK

CONNECT http://urs.microsoft.com:443
200 Connection Established

GET http://ad.yieldmanager.com/imp?Z=120x600&a…3%3F%26&r=0
200 OK

GET http://ad.uolmg.com/iframe3?AAAAAJ7kAwCv-A…3@bottom3?&
302 Found to http://ad.yieldmanager.com/iframe3?AAAAAJ7…3@bottom3?&

GET http://ad.yieldmanager.com/iframe3?AAAAAJ7…3@bottom3?&
200 OK

GET http://servedby.advertising.com/site=74203…2526gender%253D
302 MOVED to http://servedby.advertising.com/ctst=1/sit…2526gender%253D

GET http://servedby.advertising.com/ctst=1/sit…2526gender%253D
200 OK

GET http://cyclops.prod.untd.com/adstream_sx.a…1@Bottom3?&
200 OK

GET http://cyclops.prod.untd.com/Media/imglx/e…5a47?_RM_EMPTY_
200 OK

GET http://ad.uolmg.com/st?ad_type=iframe&…ge=&gender=
200 OK

CONNECT http://urs.microsoft.com:443
200 Connection Established

GET http://ad.yieldmanager.com/imp?Z=120x600&a…3%3F%26&r=0
200 OK

GET http://ad.uolmg.com/iframe3?AAAAAJ7kAwCv-A…1@bottom3?&
302 Found to http://ad.yieldmanager.com/iframe3?AAAAAJ7…1@bottom3?&

GET http://ad.yieldmanager.com/iframe3?AAAAAJ7…1@bottom3?&
200 OK

GET http://servedby.advertising.com/site=74203…2526gender%253D
302 MOVED to http://servedby.advertising.com/ctst=1/sit…2526gender%253D

GET http://servedby.advertising.com/ctst=1/sit…2526gender%253D
200 OK



I then ran HiJack and here is the log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:52:52 PM, on 7/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\GameSpot\DownloadManager_Win32.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\ehome\RMSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TVersity\Media Server\MediaServer.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\UltiDev\Cassini Web Server for ASP.NET 2.0\UltiDevCassinWebServer2a.exe
C:\Program Files\WebGuide\WebGuide4\bin\WebGuideTranscodeService.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\CTHELPER.EXE
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\ehome\RMSysTry.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\ArcSoft\TotalMedia Backup & Record\uBBMonitor.exe
C:\Program Files\Yahoo!\Yahoo! Autosync\AutosyncForYahoo.exe
C:\Program Files\YPOPs\YPOPs.exe
C:\Program Files\Common Files\Intellisync\PushSyncService\PushSyncService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fiddler2\Fiddler.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://cm.my.yahoo.com/p/1.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8888;https=127.0.0.1:8888;
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: NetXfer - {83B80A9C-D91A-4F22-8DCF-EA7204039F79} - C:\Program Files\Xi\NetXfer\NXIEHelper.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: NetXfer - {C16CBAAC-A75C-4DB5-A0DD-CDF5CAFCDD3A} - C:\Program Files\Xi\NetXfer\NXToolBar.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe"
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: YPOPs.lnk = ?
O4 - Global Startup: Extender Resource Monitor.lnk = C:\WINDOWS\ehome\RMSysTry.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: TotalMedia Backup Monitor.lnk = C:\Program Files\ArcSoft\TotalMedia Backup & Record\uBBMonitor.exe
O4 - Global Startup: Yahoo! Autosync.lnk = C:\Program Files\Yahoo!\Yahoo! Autosync\AutosyncForYahoo.exe
O8 - Extra context menu item: Download all by NetXfer - C:\Program Files\Xi\NetXfer\NXAddList.html
O8 - Extra context menu item: Download by NetXfer - C:\Program Files\Xi\NetXfer\NXAddLink.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Fiddler2 - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "C:\Program Files\Fiddler2\Fiddler.exe" (file missing)
O9 - Extra 'Tools' menuitem: Fiddler2 - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "C:\Program Files\Fiddler2\Fiddler.exe" (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.dell.com
O15 - Trusted Zone: *.hp.com
O15 - Trusted Zone: *.windowsmedia.com
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.costcophotocenter.com/CostcoActivia.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.maricopa.gov/assessor/gis/plugin/mgaxctrl.cab
O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/…_2/axofupld.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,avgrsstx.dll
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: DNADownloader - CNET Networks - C:\Program Files\GameSpot\DownloadManager_Win32.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: TVersityMediaServer - Unknown owner - C:\Program Files\TVersity\Media Server\MediaServer.exe
O23 - Service: UltiDev Cassini Web Server for ASP.NET 2.0 - UltiDev LLC - C:\Program Files\UltiDev\Cassini Web Server for ASP.NET 2.0\UltiDevCassinWebServer2a.exe
O23 - Service: WebGuideTranscode - WebGuide LLC - C:\Program Files\WebGuide\WebGuide4\bin\WebGuideTranscodeService.exe

–
End of file - 14557 bytes



Any ideas?