What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Search Settings 1.2 reported by CA as Trojan Horse

56 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hi Gary, Just thought you'd like to know, your DDS link is a '404'. I grabbed it from , which seems to be another forum established to help folks with their computer problems (accept there were lots of pop-ups). Anyway, I'll be back when I have data for you. -SusanT
Post #17
Gary, The instructions for DDS say that the ATTACH.TXT file should be zipped and uploaded instead of pasting the .txt file to the forum. Please advise. Thank you. Susan T.
Post #18
Hi Gary,

I would prefer not to paste this information, if you can receive it through the uploaded zip files. If that does not meet with your requirements to do this process, please let me know. I appreciate all this help so much! Thank you. Susan
  • DDS.ZIP
  • ATTACH.ZIP
  • GMERLOG.ZIP
Post #19
Nothing showing in your logs that would explain the disappearance of OTMI, or the fact that HJT no longer worked. No signs that you've been hacked either.

Question: Did you press the CleanUp button in OTMoveIt at any point? That would remove OTMI and all the files and folders it created (and a few other things as well, if they were installed).

Can you try downloading a new version of HJT and running a scan please.

Download HJTInstall.exe to your Desktop.
  • Doubleclick HJTInstall.exe to install it.
  • By default it will install to C:\Program Files\Trend Micro\HijackThis .
  • Click on Install.
  • It will create a HijackThis icon on the desktop.
  • Once installed, it will launch Hijackthis.
  • Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
  • Copy/Paste the log to your next reply please.

If this version won't run, let me know.

Any other strange occurrences since we last spoke?
Post #20
Hi Gary, I think it is entirely possible that I pressed the "Clean Up" button. I'm getting kind of fried. I haven't noticed anything weird since we spoke, but I actually had to go to work (at my real job) today. I tried to download a new version of HJT and load it over the old one, (since I get the same message when I try to delete it), and it didn't work. Still the same thing. I've learned enough from working through this, that I'm a bit afraid to go in and just start deleting the program, without using the Add/Remove Software in the Control Panel. The "backup" folder has 34 objects in it. I could manually delete everything including the TrendMicro folder, but I would not begin to know how to handle the registry. I regularly use Registry Booster by Uniblue to defrag the registry, and I know how to search it, but that's the extent of my bravery. I'd be real interested in seeing another run of HJT myself. I wonder if it would be possible (or even wise) to share my "C" drive with my husband's computer and trying running the HJT on his machine against it? Waiting to hear your thoughts. Thanks, SusanT
Post #21
Latest edition of HJT (Trend Micro Version 2.02) doesn't appear to have an uninstaller, which is strange because the earlier pre Trend Micro versions did.

Seems we'll have to do a manual hack, then try a fresh install to see if we can resolve why it's not working on your computer.

Before we do that, please try the following.

Navigate to HijackThis.exe and re-name it Scanner.exe then try running a scan. If it works please post me the log.

If not, re-name Scanner.exe to HijackThis.exe then do the following.

Download FileFind by Atribune.
  • Double click on FileFind.exe to open the programme.
  • Enter HijackThis.exe into the File: box.
  • Click on the Search button.
  • After a while a list of file locations will appear in the List of Files: box.
  • Click on the Export button.

This will create a Notepad file named Export.txt located in the C:\ folder, copy and paste it to your next post please.

Next

We need to use Regsearch again, which you downloaded and used earlier.
  • Double click regsearch.exe to launch the programme.
  • Copy/Paste the following into the Search Box HijackThis
  • On the next line Copy/Paste Trend Micro
  • Click OK.

Regsearch will now search your Registry for the required strings, when it is finished it will open a Notepad file RegSearch.txt, saved to the Regsearch folder.

Copy/Paste that file into your next post please.
Post #22
Hi Gary, The rename didn't work, so I'm off to run the FileFind and regsearch. I found it curious last night: I stopped to play a game, and with nothing else running, received a message that I didn't have enough memory. I have 1 GB of RAM installed. This morning, out of curiousity, I pulled up the log that gets sent to Microsoft when HiJackThis fails, discovered that it was an XML Database file. I've pasted a new one below, in the event that it makes more sense to you than it does me. Back later with the reports you requested. SusanT ————————————————————— ———– END REPORT —————–
Post #23
Hi Gary, Here is Export.txt from FileFind: ——————————————– C:\Program Files\Trend Micro\HijackThis\HijackThis.exe - 396288 Bytes [End file] And, here is RegSearch.txt from regsearch: ———————————————————- Windows Registry Editor Version 5.00 ; Registry Search 2.0 by Bobbi Flekman © 2005 ; Version: 2.0.6.0 ; Results at 2/14/2009 1:52:00 PM for strings: ; 'hijackthis' ; 'trend micro' ; Strings excluded from search: ; (None) ; Search in: ; Registry Keys Registry Values Registry Data ; HKEY_LOCAL_MACHINE HKEY_USERS [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\HijackThis.exe] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\HijackThis.exe] "Path"="C:\\Program Files\\Trend Micro\\HijackThis" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HijackThis] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HijackThis] "DisplayName"="HijackThis 2.0.2" "UninstallString"="\"C:\\Program Files\\Trend Micro\\HijackThis\\HijackThis.exe\" /uninstall" "DisplayIcon"="C:\\Program Files\\Trend Micro\\HijackThis\\HijackThis.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\HijackThis] [HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*] "g"="C:\\Program Files\\Trend Micro\\HijackThis\\HijackThis.exe" "i"="C:\\Program Files\\Trend Micro\\HijackThis\\Scanner.exe" "f"="C:\\Documents and Settings\\Susan Trapnell\\Desktop\\HijackThis.lnk" [HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\exe] "j"="C:\\Program Files\\Trend Micro\\HijackThis\\HijackThis.exe" "f"="C:\\Program Files\\Trend Micro\\HijackThis\\Scanner.exe" [HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\lnk] "c"="C:\\Documents and Settings\\Susan Trapnell\\Desktop\\HijackThis.lnk" [HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\HijackThis] [HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU] "f"="\"C:\\Program Files\\Trend Micro\\HijackThis\\HijackThis.exe\"\\1" "g"="\"C:\\Program Files\\Trend Micro\\HijackThis\\Scanner.exe\"\\1" [HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\ShellNoRoam\MUICache] "C:\\Program Files\\Trend Micro\\HijackThis\\HijackThis.exe"="HijackThis" ; End Of The Log…
Post #24
OK, lets remove HJT and then try installing a new copy, hopefully it will resolve the problems with it.

Before we do, there's a couple of things I'd like you to do.

First

Go to C:\Program Files\Trend Micro\HijackThis and move the folder Backups to a new location where you can find it later.

Next

Make a backup of your Registry with ERUNT.
  • Double click ERUNT to launch the programme.
  • You'll get a little pop-up box telling you about ERUNT, click OK
  • The next box will ask you where you want to store your backup, accept the default location and click OK
  • You'll be told the folder doesn't exist and asked to create it, click Yes
  • ERUNT will create a backup, when finished it will notify you, click OK to exit.

Once you've created a backup

  • Double-click OTMoveIt3.exe to run it.
  • Copy the lines in the codebox below.
:Files
C:\Program Files\Trend Micro\HijackThis

:Reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\HijackThis.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HijackThis]
[-HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\HijackThis]
[HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*]
"g"=-
"i"=-
"f"=-
[HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\exe]
"j"=-
"f"=-
[HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\lnk]
"c"=-
[-HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\HijackThis]
[HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU]
"f"=-
"g"=-
[HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Program Files\\Trend Micro\\HijackThis\\HijackThis.exe"=-
  • Return to OTMoveIt3, right click in the Paste Instructions for Items to be Moved window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar), and paste it in your next reply.
  • Close OTMoveIt3

Next

Download HJTInstall.exe to your Desktop.
  • Doubleclick HJTInstall.exe to install it.
  • By default it will install to C:\Program Files\Trend Micro\HijackThis .
  • Click on Install.
  • It will create a HijackThis icon on the desktop.
  • Once installed, it will launch Hijackthis.
  • Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
  • Copy/Paste the log to your next reply please.
  • Don't use the Analyse This button, its findings are dangerous if misinterpreted.
  • Don't have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

Any problems let me know.

Not sure about the other report you sent me, I do notice reference to the orphaned Symantec service we removed, might be worth having a look to see if there's any other Symantec remnants that might be linked to it.

  • Double click regsearch.exe to launch the programme.
  • Copy/Paste the following into the Search Box Symantec
  • On the next line Copy/Paste Norton
  • Click OK.

Regsearch will now search your Registry for the required strings, when it is finished it will open a Notepad file RegSearch.txt, saved to the Regsearch folder.

Copy/Paste that file into your next post.
Post #25
Hello Gary R, I was successful and will paste the 3 reports you have requested. However, I need clarification: 1) Am I to "snooze" my virus / firewall protection in order to run HJT? …other programs? (I was only successful in running HJT when I temporarily disabled protection.) 2) I moved the "backups" file from HJT and it is still in the other directory. Thank you. SusanT OUTPUT FROM OTMoveIt3 ========== FILES ========== C:\Program Files\Trend Micro\HijackThis moved successfully. ========== REGISTRY ========== Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\HijackThis.exe\\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HijackThis\\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\HijackThis\\ deleted successfully. Registry value HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\\g deleted successfully. Registry value HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\\i deleted successfully. Registry value HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\\f deleted successfully. Registry value HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\exe\\j deleted successfully. Registry value HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\exe\\f deleted successfully. Registry value HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\lnk\\c deleted successfully. Registry key HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\HijackThis\\ deleted successfully. Registry value HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\\f deleted successfully. Registry value HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\\g deleted successfully. Registry value HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\ShellNoRoam\MUICache\\C:\Program Files\Trend Micro\HijackThis\HijackThis.exe not found. OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 02152009_150130 ====================================================
Post #26
Hi Gary R,

Log file of HJT – no changes made. SusanT
=============================


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:16:31 PM, on 2/15/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Linksys Wireless-G PCI Adapter with SRX400\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Adapter with SRX400\WMP54GX.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfsem.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\CA\CA Internet Security Suite\casc.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-7.0.0.510\QOELoader.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\CA\CA Internet Security Suite\CA Website Inspector\Light\CAGlobalLight.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer presented by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: CA Toolbar Helper - {FBF2401B-7447-4727-BE5D-C19B2075CA84} - C:\Program Files\CA\CA Internet Security Suite\CA Website Inspector\Toolbar\CallingIDIE.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: CA Toolbar - {10134636-E7AF-4AC5-A1DC-C7C44BB97D81} - C:\Program Files\CA\CA Internet Security Suite\CA Website Inspector\Toolbar\CallingIDIE.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [cctray] C:\Program Files\CA\CA Internet Security Suite\casc.exe
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [cafw] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe -cl
O4 - HKLM\..\Run: [capfasem] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
O4 - HKLM\..\Run: [capfupgrade] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe
O4 - HKLM\..\Run: [USRpdA] C:\WINDOWS\SYSTEM32\USRmlnkA.exe RunServices \Device\3cpipe-USRpdA
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CAPPActiveProtection] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe"
O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-7.0.0.510\QOELoader.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.metrolistmls.com
O15 - Trusted Zone: http://www.oprah.com
O15 - Trusted Zone: http://www.runaware.com
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} - http://www.comcastsupport.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.usmd.edu/wfplayer/tdserver.cab
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {51045741-8C4E-4EAC-8F03-08E43A6FBB29} - http://aft.ancestry.com/aftfiles/files/ins…yFamilyTree.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1220474767231
O16 - DPF: {75565ED2-1560-4F15-B841-20358DE6A0D1} (ImageControl Class) - http://c.ancestry.com/cab/ImageViewer/MFImgVwr.cab
O16 - DPF: {861DB4B6-3838-11D2-8E50-002018200E57} (MrSIDI Control) - http://images.myfamily.net/isfiles/downloads/MrSIDI.cab
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://rtc3.webresponse.one.microsoft.com/…p/TLIEFlash.CAB
O16 - DPF: {AA59BA6E-B44F-4514-AB3C-0C1DD2306FC3} (MSN Money Charting) - http://fdl.msn.com/public/investor/v12/invinstl.exe
O16 - DPF: {BE5431D2-0F30-11D4-89D9-00C04F509C0A} (SDCInstaller Class) - http://www.stamps.com/download/us/cab/stam…file=stamps.cab
O16 - DPF: {F5D98C43-DB16-11CF-8ECA-0000C0FD59C7} (ActiveCGM Control) - http://www.ahtd.state.ar.us/Road/acgm.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: CA Common Scheduler Service (ccSchedulerSVC) - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: PPCtlPriv - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)
O23 - Service: HIPS Event Manager (UmxAgent) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
O23 - Service: HIPS Configuration Interpreter (UmxCfg) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
O23 - Service: HIPS Firewall Helper (UmxFwHlp) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
O23 - Service: HIPS Policy Manager (UmxPol) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
O23 - Service: WMP54GX4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Adapter with SRX400\WLService.exe

–
End of file - 13390 bytes
Post #27
Hi Gary, Here's the third and final report you requested – a registry search. SusanT. ============= Windows Registry Editor Version 5.00 ; Registry Search 2.0 by Bobbi Flekman © 2005 ; Version: 2.0.6.0 ; Results at 2/15/2009 3:24:10 PM for strings: ; 'symantec' ; 'norton' ; Strings excluded from search: ; (None) ; Search in: ; Registry Keys Registry Values Registry Data ; HKEY_LOCAL_MACHINE HKEY_USERS [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{E39D1C81-7E76-4d84-9F25-E2CC76EC050B}] "LocalService"="Symantec Core LC" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ED40800-D38D-11D3-B562-00902771A435}\InProcServer32] @="C:\\Program Files\\Symantec\\LiveUpdate\\LuComServerPS_3_0.DLL" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{60C70E11-2B08-4798-B366-C8450CDA7B1A}\LocalServer32] @="C:\\Program Files\\Common Files\\Symantec Shared\\CCPD-LC\\symlcsvc.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8B0DE85A-F975-11D2-A985-00A0244D507A}\InprocServer32] @="C:\\Program Files\\Common Files\\Symantec Shared\\IraLsClt.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\C5185C80E6C28f447884E016CBA9BF86] "ProductName"="Symantec KB-DocID:2003093015493306" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\C5185C80E6C28f447884E016CBA9BF86\SourceList] ; Contents of value: ; n;1;C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec\LIVEUP~1\DOWNLO~1\Updt933\ "LastUsedSource"=hex(2):6e,00,3b,00,31,00,3b,00,43,00,3a,00,5c,00,44,00,4f,00,\ 43,00,55,00,4d,00,45,00,7e,00,31,00,5c,00,41,00,4c,00,4c,00,55,00,53,00,45,\ 00,7e,00,31,00,5c,00,41,00,50,00,50,00,4c,00,49,00,43,00,7e,00,31,00,5c,00,\ 53,00,79,00,6d,00,61,00,6e,00,74,00,65,00,63,00,5c,00,4c,00,49,00,56,00,45,\ 00,55,00,50,00,7e,00,31,00,5c,00,44,00,4f,00,57,00,4e,00,4c,00,4f,00,7e,00,\ 31,00,5c,00,55,00,70,00,64,00,74,00,39,00,33,00,33,00,5c,00,00,00 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\C5185C80E6C28f447884E016CBA9BF86\SourceList\Net] ; Contents of value: ; C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec\LIVEUP~1\DOWNLO~1\Updt933\ "1"=hex(2):43,00,3a,00,5c,00,44,00,4f,00,43,00,55,00,4d,00,45,00,7e,00,31,00,\ 5c,00,41,00,4c,00,4c,00,55,00,53,00,45,00,7e,00,31,00,5c,00,41,00,50,00,50,\ 00,4c,00,49,00,43,00,7e,00,31,00,5c,00,53,00,79,00,6d,00,61,00,6e,00,74,00,\ 65,00,63,00,5c,00,4c,00,49,00,56,00,45,00,55,00,50,00,7e,00,31,00,5c,00,44,\ 00,4f,00,57,00,4e,00,4c,00,4f,00,7e,00,31,00,5c,00,55,00,70,00,64,00,74,00,\ 39,00,33,00,33,00,5c,00,00,00 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{54635C92-DFAF-4A99-8802-92FB068A6154}\1.0] @="Symantec Core LC Type Library" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{54635C92-DFAF-4A99-8802-92FB068A6154}\1.0\0\win32] @="C:\\Program Files\\Common Files\\Symantec Shared\\CCPD-LC\\symlcsvc.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{54635C92-DFAF-4A99-8802-92FB068A6154}\1.0\HELPDIR] @="C:\\Program Files\\Common Files\\Symantec Shared\\CCPD-LC\\" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\Compatibility\NortonSystemInfo] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\\Program Files\\Common Files\\Symantec Shared\\Script Blocking\\"="" "C:\\Documents and Settings\\All Users\\Application Data\\Symantec\\Norton Internet Security Professional\\Log\\"="1" "C:\\Documents and Settings\\All Users\\Application Data\\Symantec\\Norton Internet Security Professional\\"="1" "C:\\Program Files\\Norton Internet Security Professional\\"="" "C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Norton Internet Security Professional\\"="" "C:\\Documents and Settings\\All Users\\Application Data\\Symantec\\Norton AntiVirus\\"="1" "C:\\Program Files\\Norton AntiVirus\\Quarantine\\"="1" "C:\\Program Files\\Norton AntiVirus\\Quarantine\\Portal\\"="1" "C:\\Program Files\\Norton AntiVirus\\Quarantine\\Incoming\\"="1" "C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Norton Internet Security Professional\\Norton AntiVirus\\"="" "C:\\Program Files\\Common Files\\Symantec Shared\\IDSDefs\\"="1" "C:\\Program Files\\Common Files\\Symantec Shared\\SPManifests\\"="1" "C:\\Documents and Settings\\All Users\\Application Data\\Symantec\\Common Client\\"="1" "C:\\Program Files\\Norton Internet Security\\"="" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\26E26975905FAE44A83FCFAEC0303A0E] "00000000000000000000000000000000"="C:\\Program Files\\Norton Internet Security Professional\\nisum.dat" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4799D30A4DDA954429D8D4ED011517F9] "00000000000000000000000000000000"="C:\\Program Files\\Common Files\\Symantec Shared\\Script Blocking\\ScrAuth.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6E6F3C7100A0DAA4ABEDD82C170B843D] "C5185C80E6C28f447884E016CBA9BF86"="02:\\SOFTWARE\\Symantec\\CCPD-LC\\KStore\\" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8A496394D4654AD42B68DFDFFEDCD6CB] "C5185C80E6C28f447884E016CBA9BF86"="C:\\Program Files\\Common Files\\Symantec Shared\\SPManifests\\symcleng.sig" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BBAE3AAB8D0042547990AF991553C16B] "00000000000000000000000000000000"="C:\\Program Files\\Common Files\\Symantec Shared\\Script Blocking\\ScrBlock.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C3BD2CD6023CED14080DED74FA48DDCA] "C5185C80E6C28f447884E016CBA9BF86"="C:\\Program Files\\Common Files\\Symantec Shared\\CCPD-LC\\" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EACA16BD93C3AC64E9487A0F15FA0CB7] "C5185C80E6C28f447884E016CBA9BF86"="C:\\Documents and Settings\\All Users\\Application Data\\Symantec\\" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\C5185C80E6C28f447884E016CBA9BF86\InstallProperties] "InstallSource"="C:\\DOCUME~1\\ALLUSE~1\\APPLIC~1\\Symantec\\LIVEUP~1\\DOWNLO~1\\Updt933\\" "Publisher"="Symantec Corporation" "DisplayName"="Symantec KB-DocID:2003093015493306" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{08C5815C-2C6E-44f8-8748-0E61BC9AFB68}] "InstallSource"="C:\\DOCUME~1\\ALLUSE~1\\APPLIC~1\\Symantec\\LIVEUP~1\\DOWNLO~1\\Updt933\\" "Publisher"="Symantec Corporation" "DisplayName"="Symantec KB-DocID:2003093015493306" [HKEY_LOCAL_MACHINE\SOFTWARE\Symantec] [HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\CCPD-LC] [HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\CCPD-LC\SymLCSvc] [HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps] [HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps] "IDSDefs"="C:\\Program Files\\Common Files\\Symantec Shared\\IDSDefs\\" "CCPD-LC"="C:\\Program Files\\Common Files\\Symantec Shared\\CCPD-LC" [HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\LiveSubscribe] [HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\LiveSubscribe\Settings] [HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Norton AntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Norton AntiVirus\Quarantine] [HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Norton AntiVirus\Quarantine] "QuarantinePath"="C:\\Documents and Settings\\All Users\\Application Data\\Symantec\\Norton AntiVirus\\Quarantine" "TempPath"="C:\\Documents and Settings\\All Users\\Application Data\\Symantec\\Norton AntiVirus\\Quarantine\\Portal" "IncomingPath"="C:\\Documents and Settings\\All Users\\Application Data\\Symantec\\Norton AntiVirus\\Quarantine\\Incoming" [HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SharedDefs] [HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SharedDefs\MicroDefs] [HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SharedUsage] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\BackupRestore\FilesNotToBackup] ; Contents of value: ; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsys.dll ; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll ; "Symantec Core Components"=hex(7):43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,\ 00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,43,00,6f,00,6d,00,\ 6d,00,6f,00,6e,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,53,00,79,00,6d,\ 00,61,00,6e,00,74,00,65,00,63,00,20,00,53,00,68,00,61,00,72,00,65,00,64,00,\ 5c,00,43,00,43,00,50,00,44,00,2d,00,4c,00,43,00,5c,00,73,00,79,00,6d,00,6c,\ 00,63,00,73,00,79,00,73,00,2e,00,64,00,6c,00,6c,00,00,00,43,00,3a,00,5c,00,\ 50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,\ 00,5c,00,43,00,6f,00,6d,00,6d,00,6f,00,6e,00,20,00,46,00,69,00,6c,00,65,00,\ 73,00,5c,00,53,00,79,00,6d,00,61,00,6e,00,74,00,65,00,63,00,20,00,53,00,68,\ 00,61,00,72,00,65,00,64,00,5c,00,43,00,43,00,50,00,44,00,2d,00,4c,00,43,00,\ 5c,00,73,00,79,00,6d,00,6c,00,63,00,72,00,73,00,74,00,2e,00,64,00,6c,00,6c,\ 00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_EECTRL\0000] "DeviceDesc"="Symantec Eraser Control driver" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SYMANTEC_CORE_LC] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SYMANTEC_CORE_LC\0000] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SYMANTEC_CORE_LC\0000] "Service"="Symantec Core LC" "DeviceDesc"="Symantec Core LC" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\eeCtrl] ; Contents of value: ; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys "ImagePath"=hex(2):5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,\ 67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,43,00,6f,\ 00,6d,00,6d,00,6f,00,6e,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,53,00,\ 79,00,6d,00,61,00,6e,00,74,00,65,00,63,00,20,00,53,00,68,00,61,00,72,00,65,\ 00,64,00,5c,00,45,00,45,00,4e,00,47,00,49,00,4e,00,45,00,5c,00,65,00,65,00,\ 43,00,74,00,72,00,6c,00,2e,00,73,00,79,00,73,00,00,00 "DisplayName"="Symantec Eraser Control driver" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\eeCtrl\Parameters] "SPManifest"="\\??\\C:\\Program Files\\Common Files\\Symantec Shared\\SPManifests" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\ccPwdSvc] ; Contents of value: ; C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe "EventMessageFile"=hex(2):43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,\ 00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,43,00,6f,00,6d,00,6d,00,\ 6f,00,6e,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,53,00,79,00,6d,00,61,\ 00,6e,00,74,00,65,00,63,00,20,00,53,00,68,00,61,00,72,00,65,00,64,00,5c,00,\ 63,00,63,00,50,00,77,00,64,00,53,00,76,00,63,00,2e,00,65,00,78,00,65,00,00,\ 00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\NProtectService] ; Contents of value: ; C:\PROGRA~1\NORTON~1\AdvTools\NPROTECT.EXE "EventMessageFile"=hex(2):43,00,3a,00,5c,00,50,00,52,00,4f,00,47,00,52,00,41,\ 00,7e,00,31,00,5c,00,4e,00,4f,00,52,00,54,00,4f,00,4e,00,7e,00,31,00,5c,00,\ 41,00,64,00,76,00,54,00,6f,00,6f,00,6c,00,73,00,5c,00,4e,00,50,00,52,00,4f,\ 00,54,00,45,00,43,00,54,00,2e,00,45,00,58,00,45,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\NUEWizard] ; Contents of value: ; C:\PROGRA~1\NORTON~1\AdvTools\UE32.EXE "EventMessageFile"=hex(2):43,00,3a,00,5c,00,50,00,52,00,4f,00,47,00,52,00,41,\ 00,7e,00,31,00,5c,00,4e,00,4f,00,52,00,54,00,4f,00,4e,00,7e,00,31,00,5c,00,\ 41,00,64,00,76,00,54,00,6f,00,6f,00,6c,00,73,00,5c,00,55,00,45,00,33,00,32,\ 00,2e,00,45,00,58,00,45,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Symantec Core LC] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Symantec Core LC] ; Contents of value: ; "C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe" "ImagePath"=hex(2):22,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,\ 6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,43,00,6f,00,6d,00,6d,00,6f,\ 00,6e,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,53,00,79,00,6d,00,61,00,\ 6e,00,74,00,65,00,63,00,20,00,53,00,68,00,61,00,72,00,65,00,64,00,5c,00,43,\ 00,43,00,50,00,44,00,2d,00,4c,00,43,00,5c,00,73,00,79,00,6d,00,6c,00,63,00,\ 73,00,76,00,63,00,2e,00,65,00,78,00,65,00,22,00,00,00 "DisplayName"="Symantec Core LC" "Description"="Symantec Core LC" "Group"="Symantec Services" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Symantec Core LC\Security] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Symantec Core LC\Enum] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Symantec Core LC\Enum] "0"="Root\\LEGACY_SYMANTEC_CORE_LC\\0000" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\BackupRestore\FilesNotToBackup] ; Contents of value: ; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsys.dll ; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll ; "Symantec Core Components"=hex(7):43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,\ 00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,43,00,6f,00,6d,00,\ 6d,00,6f,00,6e,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,53,00,79,00,6d,\ 00,61,00,6e,00,74,00,65,00,63,00,20,00,53,00,68,00,61,00,72,00,65,00,64,00,\ 5c,00,43,00,43,00,50,00,44,00,2d,00,4c,00,43,00,5c,00,73,00,79,00,6d,00,6c,\ 00,63,00,73,00,79,00,73,00,2e,00,64,00,6c,00,6c,00,00,00,43,00,3a,00,5c,00,\ 50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,\ 00,5c,00,43,00,6f,00,6d,00,6d,00,6f,00,6e,00,20,00,46,00,69,00,6c,00,65,00,\ 73,00,5c,00,53,00,79,00,6d,00,61,00,6e,00,74,00,65,00,63,00,20,00,53,00,68,\ 00,61,00,72,00,65,00,64,00,5c,00,43,00,43,00,50,00,44,00,2d,00,4c,00,43,00,\ 5c,00,73,00,79,00,6d,00,6c,00,63,00,72,00,73,00,74,00,2e,00,64,00,6c,00,6c,\ 00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_EECTRL\0000] "DeviceDesc"="Symantec Eraser Control driver" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SYMANTEC_CORE_LC] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SYMANTEC_CORE_LC\0000] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SYMANTEC_CORE_LC\0000] "Service"="Symantec Core LC" "DeviceDesc"="Symantec Core LC" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\eeCtrl] ; Contents of value: ; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys "ImagePath"=hex(2):5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,\ 67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,43,00,6f,\ 00,6d,00,6d,00,6f,00,6e,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,53,00,\ 79,00,6d,00,61,00,6e,00,74,00,65,00,63,00,20,00,53,00,68,00,61,00,72,00,65,\ 00,64,00,5c,00,45,00,45,00,4e,00,47,00,49,00,4e,00,45,00,5c,00,65,00,65,00,\ 43,00,74,00,72,00,6c,00,2e,00,73,00,79,00,73,00,00,00 "DisplayName"="Symantec Eraser Control driver" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\eeCtrl\Parameters] "SPManifest"="\\??\\C:\\Program Files\\Common Files\\Symantec Shared\\SPManifests" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\Application\ccPwdSvc] ; Contents of value: ; C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe "EventMessageFile"=hex(2):43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,\ 00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,43,00,6f,00,6d,00,6d,00,\ 6f,00,6e,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,53,00,79,00,6d,00,61,\ 00,6e,00,74,00,65,00,63,00,20,00,53,00,68,00,61,00,72,00,65,00,64,00,5c,00,\ 63,00,63,00,50,00,77,00,64,00,53,00,76,00,63,00,2e,00,65,00,78,00,65,00,00,\ 00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\Application\NProtectService] ; Contents of value: ; C:\PROGRA~1\NORTON~1\AdvTools\NPROTECT.EXE "EventMessageFile"=hex(2):43,00,3a,00,5c,00,50,00,52,00,4f,00,47,00,52,00,41,\ 00,7e,00,31,00,5c,00,4e,00,4f,00,52,00,54,00,4f,00,4e,00,7e,00,31,00,5c,00,\ 41,00,64,00,76,00,54,00,6f,00,6f,00,6c,00,73,00,5c,00,4e,00,50,00,52,00,4f,\ 00,54,00,45,00,43,00,54,00,2e,00,45,00,58,00,45,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\Application\NUEWizard] ; Contents of value: ; C:\PROGRA~1\NORTON~1\AdvTools\UE32.EXE "EventMessageFile"=hex(2):43,00,3a,00,5c,00,50,00,52,00,4f,00,47,00,52,00,41,\ 00,7e,00,31,00,5c,00,4e,00,4f,00,52,00,54,00,4f,00,4e,00,7e,00,31,00,5c,00,\ 41,00,64,00,76,00,54,00,6f,00,6f,00,6c,00,73,00,5c,00,55,00,45,00,33,00,32,\ 00,2e,00,45,00,58,00,45,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Symantec Core LC] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Symantec Core LC] ; Contents of value: ; "C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe" "ImagePath"=hex(2):22,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,\ 6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,43,00,6f,00,6d,00,6d,00,6f,\ 00,6e,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,53,00,79,00,6d,00,61,00,\ 6e,00,74,00,65,00,63,00,20,00,53,00,68,00,61,00,72,00,65,00,64,00,5c,00,43,\ 00,43,00,50,00,44,00,2d,00,4c,00,43,00,5c,00,73,00,79,00,6d,00,6c,00,63,00,\ 73,00,76,00,63,00,2e,00,65,00,78,00,65,00,22,00,00,00 "DisplayName"="Symantec Core LC" "Description"="Symantec Core LC" "Group"="Symantec Services" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Symantec Core LC\Security] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToBackup] ; Contents of value: ; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsys.dll ; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll ; "Symantec Core Components"=hex(7):43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,\ 00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,43,00,6f,00,6d,00,\ 6d,00,6f,00,6e,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,53,00,79,00,6d,\ 00,61,00,6e,00,74,00,65,00,63,00,20,00,53,00,68,00,61,00,72,00,65,00,64,00,\ 5c,00,43,00,43,00,50,00,44,00,2d,00,4c,00,43,00,5c,00,73,00,79,00,6d,00,6c,\ 00,63,00,73,00,79,00,73,00,2e,00,64,00,6c,00,6c,00,00,00,43,00,3a,00,5c,00,\ 50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,\ 00,5c,00,43,00,6f,00,6d,00,6d,00,6f,00,6e,00,20,00,46,00,69,00,6c,00,65,00,\ 73,00,5c,00,53,00,79,00,6d,00,61,00,6e,00,74,00,65,00,63,00,20,00,53,00,68,\ 00,61,00,72,00,65,00,64,00,5c,00,43,00,43,00,50,00,44,00,2d,00,4c,00,43,00,\ 5c,00,73,00,79,00,6d,00,6c,00,63,00,72,00,73,00,74,00,2e,00,64,00,6c,00,6c,\ 00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EECTRL\0000] "DeviceDesc"="Symantec Eraser Control driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SYMANTEC_CORE_LC] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SYMANTEC_CORE_LC\0000] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SYMANTEC_CORE_LC\0000] "Service"="Symantec Core LC" "DeviceDesc"="Symantec Core LC" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eeCtrl] ; Contents of value: ; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys "ImagePath"=hex(2):5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,\ 67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,43,00,6f,\ 00,6d,00,6d,00,6f,00,6e,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,53,00,\ 79,00,6d,00,61,00,6e,00,74,00,65,00,63,00,20,00,53,00,68,00,61,00,72,00,65,\ 00,64,00,5c,00,45,00,45,00,4e,00,47,00,49,00,4e,00,45,00,5c,00,65,00,65,00,\ 43,00,74,00,72,00,6c,00,2e,00,73,00,79,00,73,00,00,00 "DisplayName"="Symantec Eraser Control driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eeCtrl\Parameters] "SPManifest"="\\??\\C:\\Program Files\\Common Files\\Symantec Shared\\SPManifests" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\ccPwdSvc] ; Contents of value: ; C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe "EventMessageFile"=hex(2):43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,\ 00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,43,00,6f,00,6d,00,6d,00,\ 6f,00,6e,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,53,00,79,00,6d,00,61,\ 00,6e,00,74,00,65,00,63,00,20,00,53,00,68,00,61,00,72,00,65,00,64,00,5c,00,\ 63,00,63,00,50,00,77,00,64,00,53,00,76,00,63,00,2e,00,65,00,78,00,65,00,00,\ 00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\NProtectService] ; Contents of value: ; C:\PROGRA~1\NORTON~1\AdvTools\NPROTECT.EXE "EventMessageFile"=hex(2):43,00,3a,00,5c,00,50,00,52,00,4f,00,47,00,52,00,41,\ 00,7e,00,31,00,5c,00,4e,00,4f,00,52,00,54,00,4f,00,4e,00,7e,00,31,00,5c,00,\ 41,00,64,00,76,00,54,00,6f,00,6f,00,6c,00,73,00,5c,00,4e,00,50,00,52,00,4f,\ 00,54,00,45,00,43,00,54,00,2e,00,45,00,58,00,45,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\NUEWizard] ; Contents of value: ; C:\PROGRA~1\NORTON~1\AdvTools\UE32.EXE "EventMessageFile"=hex(2):43,00,3a,00,5c,00,50,00,52,00,4f,00,47,00,52,00,41,\ 00,7e,00,31,00,5c,00,4e,00,4f,00,52,00,54,00,4f,00,4e,00,7e,00,31,00,5c,00,\ 41,00,64,00,76,00,54,00,6f,00,6f,00,6c,00,73,00,5c,00,55,00,45,00,33,00,32,\ 00,2e,00,45,00,58,00,45,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Symantec Core LC] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Symantec Core LC] ; Contents of value: ; "C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe" "ImagePath"=hex(2):22,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,\ 6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,43,00,6f,00,6d,00,6d,00,6f,\ 00,6e,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,53,00,79,00,6d,00,61,00,\ 6e,00,74,00,65,00,63,00,20,00,53,00,68,00,61,00,72,00,65,00,64,00,5c,00,43,\ 00,43,00,50,00,44,00,2d,00,4c,00,43,00,5c,00,73,00,79,00,6d,00,6c,00,63,00,\ 73,00,76,00,63,00,2e,00,65,00,78,00,65,00,22,00,00,00 "DisplayName"="Symantec Core LC" "Description"="Symantec Core LC" "Group"="Symantec Services" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Symantec Core LC\Security] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Symantec Core LC\Enum] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Symantec Core LC\Enum] "0"="Root\\LEGACY_SYMANTEC_CORE_LC\\0000" [HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://securityresponse.symantec.com/avcenter/fix_homepage/" [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\ShellNoRoam\MUICache] "C:\\PROGRA~1\\SYMNET~1\\SNDWarn.exe"="Symantec Network Driver Update Notification" "C:\\Program Files\\Symantec\\LiveUpdate\\ALUNOTIFY.EXE"="Symantec ALUNotify Module" "C:\\PROGRA~1\\Symantec\\LIVEUP~1\\LUALL.EXE"="LiveUpdate Wizard" "C:\\Program Files\\Symantec\\LiveUpdate\\LUALL.EXE"="LiveUpdate Wizard" [HKEY_USERS\.DEFAULT\Software\Symantec] [HKEY_USERS\.DEFAULT\Software\Symantec\Norton AntiVirus] [HKEY_USERS\.DEFAULT\Software\Symantec\Norton Utilities] [HKEY_USERS\.DEFAULT\Software\Symantec\Norton Utilities\Norton UnErase] [HKEY_USERS\.DEFAULT\Software\Symantec\Norton Utilities\Norton UnErase\StateIcons] [HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://securityresponse.symantec.com/avcenter/fix_homepage/" [HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://securityresponse.symantec.com/avcenter/fix_homepage/" [HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Office\Outlook\Addins\MsouPlug.OutlookPlug] "FriendlyName"="Norton AntiSpam Outlook Plugin" "Description"="Norton AntiSpam Outlook Plugin" [HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\RAS Autodial\Addresses\liveupdate.symantecliveupdate.com] [HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\Norton AntiVirus] [HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\Norton Internet Security] [HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\Norton Internet Security Professional] [HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\Norton Internet Security Professional\Norton AntiVirus] [HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Norton AntiVirus] [HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Classes\TypeLib\{941F23D1-BD56-4F90-B99F-134D55D86053}\1.0\HELPDIR] @="C:\\Program Files\\Common Files\\Symantec Shared\\" [HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006_Classes\TypeLib\{941F23D1-BD56-4F90-B99F-134D55D86053}\1.0\HELPDIR] @="C:\\Program Files\\Common Files\\Symantec Shared\\" [HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://securityresponse.symantec.com/avcenter/fix_homepage/" [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\ShellNoRoam\MUICache] "C:\\PROGRA~1\\SYMNET~1\\SNDWarn.exe"="Symantec Network Driver Update Notification" "C:\\Program Files\\Symantec\\LiveUpdate\\ALUNOTIFY.EXE"="Symantec ALUNotify Module" "C:\\PROGRA~1\\Symantec\\LIVEUP~1\\LUALL.EXE"="LiveUpdate Wizard" "C:\\Program Files\\Symantec\\LiveUpdate\\LUALL.EXE"="LiveUpdate Wizard" [HKEY_USERS\S-1-5-18\Software\Symantec] [HKEY_USERS\S-1-5-18\Software\Symantec\Norton AntiVirus] [HKEY_USERS\S-1-5-18\Software\Symantec\Norton Utilities] [HKEY_USERS\S-1-5-18\Software\Symantec\Norton Utilities\Norton UnErase] [HKEY_USERS\S-1-5-18\Software\Symantec\Norton Utilities\Norton UnErase\StateIcons] ; End Of The Log…
Post #28
Glad we were able to get a HJT log.

Strange that you had to disable CA to run it. I've never known a necessity to disable protection to get HJT to run before. However as it takes an export of several Registry keys specifically associated with autostart processes, it's quite possible that CA might see that as "suspicious" behaviour and block it.

As you've not had to do this before, it may be due to a new update by your CA software, might be worth contacting them about it.

OK, there's still a couple of items in your latest HJT log need attending to, and it's as well if we remove the other Symantec orphans. However, looking at the number of them that are still present on your computer, I think it's best we don't do a manual hack. Better we use a tool that Symantec creates for this purpose.

First

To uninstall Norton go to HERE and follow the directions appropriate to your version. As you're not bothered about re-installing it, it won't be necessary for you to get the product key information.

Next

Disconnect from the internet and disable CA so that it doesn't interfere with HJT and OTMI.

Run a scan with HJT and when finished check the following items (if found).

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com

O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)



Now close all open windows and click Fix Checked to remove them.

Next

Run a new scan with HJT and post me the log please.

Next

Run a new RegSearch scan using the same search parameters as last time and post me the log please.

Summary of the logs I need from you in your next post:
  • New HJT log
  • New RegSearch log


Please post each log separately to prevent them being cut off by the forum post size limiter.
Post #29
Hi Gary,

I downloaded the Norton Removal Tool. It cautions that it may have to be run several times. I've run it twice, and the Registry Editor is still reporting extensive Symantec modules. Here are the latest logs per your request. I can not believe we are taking this amount of time to get my machine straight. I can keep going if you are willing. Thank you so much. –SusanT
——————————-
HJT
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:10:31 PM, on 2/16/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Linksys Wireless-G PCI Adapter with SRX400\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Adapter with SRX400\WMP54GX.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfsem.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\CA\CA Internet Security Suite\casc.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-7.0.0.510\QOELoader.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer presented by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: CA Toolbar Helper - {FBF2401B-7447-4727-BE5D-C19B2075CA84} - C:\Program Files\CA\CA Internet Security Suite\CA Website Inspector\Toolbar\CallingIDIE.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: CA Toolbar - {10134636-E7AF-4AC5-A1DC-C7C44BB97D81} - C:\Program Files\CA\CA Internet Security Suite\CA Website Inspector\Toolbar\CallingIDIE.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [cctray] C:\Program Files\CA\CA Internet Security Suite\casc.exe
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [cafw] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe -cl
O4 - HKLM\..\Run: [capfasem] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
O4 - HKLM\..\Run: [capfupgrade] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe
O4 - HKLM\..\Run: [USRpdA] C:\WINDOWS\SYSTEM32\USRmlnkA.exe RunServices \Device\3cpipe-USRpdA
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CAPPActiveProtection] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe"
O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-7.0.0.510\QOELoader.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.metrolistmls.com
O15 - Trusted Zone: http://www.oprah.com
O15 - Trusted Zone: http://www.runaware.com
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} - http://www.comcastsupport.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.usmd.edu/wfplayer/tdserver.cab
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {51045741-8C4E-4EAC-8F03-08E43A6FBB29} - http://aft.ancestry.com/aftfiles/files/ins…yFamilyTree.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1220474767231
O16 - DPF: {75565ED2-1560-4F15-B841-20358DE6A0D1} (ImageControl Class) - http://c.ancestry.com/cab/ImageViewer/MFImgVwr.cab
O16 - DPF: {861DB4B6-3838-11D2-8E50-002018200E57} (MrSIDI Control) - http://images.myfamily.net/isfiles/downloads/MrSIDI.cab
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://rtc3.webresponse.one.microsoft.com/…p/TLIEFlash.CAB
O16 - DPF: {AA59BA6E-B44F-4514-AB3C-0C1DD2306FC3} (MSN Money Charting) - http://fdl.msn.com/public/investor/v12/invinstl.exe
O16 - DPF: {BE5431D2-0F30-11D4-89D9-00C04F509C0A} (SDCInstaller Class) - http://www.stamps.com/download/us/cab/stam…file=stamps.cab
O16 - DPF: {F5D98C43-DB16-11CF-8ECA-0000C0FD59C7} (ActiveCGM Control) - http://www.ahtd.state.ar.us/Road/acgm.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: CA Common Scheduler Service (ccSchedulerSVC) - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: PPCtlPriv - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
O23 - Service: HIPS Event Manager (UmxAgent) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
O23 - Service: HIPS Configuration Interpreter (UmxCfg) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
O23 - Service: HIPS Firewall Helper (UmxFwHlp) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
O23 - Service: HIPS Policy Manager (UmxPol) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
O23 - Service: WMP54GX4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Adapter with SRX400\WLService.exe

–
End of file - 13012 bytes
Post #30
Hi Gary,

I downloaded the Norton Removal Tool. It cautions that it may have to be run several times. I've run it twice, and the Registry Editor is still reporting extensive Symantec modules. Here are the latest logs per your request. I can not believe we are taking this amount of time to get my machine straight. I can keep going if you are willing. Thank you so much. –SusanT
——————————-
HJT
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:10:31 PM, on 2/16/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Linksys Wireless-G PCI Adapter with SRX400\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Adapter with SRX400\WMP54GX.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfsem.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\CA\CA Internet Security Suite\casc.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-7.0.0.510\QOELoader.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer presented by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: CA Toolbar Helper - {FBF2401B-7447-4727-BE5D-C19B2075CA84} - C:\Program Files\CA\CA Internet Security Suite\CA Website Inspector\Toolbar\CallingIDIE.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: CA Toolbar - {10134636-E7AF-4AC5-A1DC-C7C44BB97D81} - C:\Program Files\CA\CA Internet Security Suite\CA Website Inspector\Toolbar\CallingIDIE.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [cctray] C:\Program Files\CA\CA Internet Security Suite\casc.exe
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [cafw] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe -cl
O4 - HKLM\..\Run: [capfasem] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
O4 - HKLM\..\Run: [capfupgrade] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe
O4 - HKLM\..\Run: [USRpdA] C:\WINDOWS\SYSTEM32\USRmlnkA.exe RunServices \Device\3cpipe-USRpdA
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CAPPActiveProtection] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe"
O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-7.0.0.510\QOELoader.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.metrolistmls.com
O15 - Trusted Zone: http://www.oprah.com
O15 - Trusted Zone: http://www.runaware.com
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} - http://www.comcastsupport.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.usmd.edu/wfplayer/tdserver.cab
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {51045741-8C4E-4EAC-8F03-08E43A6FBB29} - http://aft.ancestry.com/aftfiles/files/ins…yFamilyTree.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1220474767231
O16 - DPF: {75565ED2-1560-4F15-B841-20358DE6A0D1} (ImageControl Class) - http://c.ancestry.com/cab/ImageViewer/MFImgVwr.cab
O16 - DPF: {861DB4B6-3838-11D2-8E50-002018200E57} (MrSIDI Control) - http://images.myfamily.net/isfiles/downloads/MrSIDI.cab
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://rtc3.webresponse.one.microsoft.com/…p/TLIEFlash.CAB
O16 - DPF: {AA59BA6E-B44F-4514-AB3C-0C1DD2306FC3} (MSN Money Charting) - http://fdl.msn.com/public/investor/v12/invinstl.exe
O16 - DPF: {BE5431D2-0F30-11D4-89D9-00C04F509C0A} (SDCInstaller Class) - http://www.stamps.com/download/us/cab/stam…file=stamps.cab
O16 - DPF: {F5D98C43-DB16-11CF-8ECA-0000C0FD59C7} (ActiveCGM Control) - http://www.ahtd.state.ar.us/Road/acgm.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: CA Common Scheduler Service (ccSchedulerSVC) - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: PPCtlPriv - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
O23 - Service: HIPS Event Manager (UmxAgent) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
O23 - Service: HIPS Configuration Interpreter (UmxCfg) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
O23 - Service: HIPS Firewall Helper (UmxFwHlp) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
O23 - Service: HIPS Policy Manager (UmxPol) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
O23 - Service: WMP54GX4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Adapter with SRX400\WLService.exe

–
End of file - 13012 bytes

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI