|
Slow computer...HJT log...any hints?
Hey all,
Friends computer is slower than molasses in january...thought people smarter than me could look through this HJT log and see if you spot anything malicious or spyware related...this is from a few minutes before I went through and fixed some startup loading, but I haven't done much else...any help is greatly appreciated... Logfile of HijackThis v1.99.1 Scan saved at 11:34:29 AM, on 12/13/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\cisvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\wanmpsvc.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe C:\WINDOWS\SM1BG.EXE C:\WINDOWS\Dit.exe C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe C:\WINDOWS\DitExp.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe C:\Program Files\Messenger\msmsgs.exe C:\PROGRA~1\AIM\aim.exe C:\Program Files\AWS\WeatherBug\Weather.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\palmOne\Hotsync.exe C:\WINDOWS\system32\cidaemon.exe C:\Documents and Settings\Michelle Lookadoo\Desktop\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com...r/fix_homepage R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.att.net R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by AT&T WorldNet R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = localhost O1 - Hosts: 66.98.136.25 auto.search.msn.com O1 - Hosts: 66.98.136.25 auto.search.msn.es O1 - Hosts: 66.98.136.25 pagead2.googlesyndication.com O1 - Hosts: 66.98.136.25 auto.search.msn.com O1 - Hosts: 66.98.136.25 auto.search.msn.es O1 - Hosts: 66.98.136.25 pagead2.googlesyndication.com O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE O4 - HKLM\..\Run: [Dit] Dit.exe O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [uninstal] regsvr32 /u /s image.dll O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1 O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe O4 - Global Startup: winlogin.exe O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU) O14 - IERESET.INF: START_PAGE_URL=http://www.att.net O20 - AppInit_DLLs: mlvnmu72v5t913ll.dll.dll.dll.dll.dll.dll.dll.dll.d ll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll .dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.d ll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll .dll.dll.dll.dll.dll.dll.dll.dll.dll O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe |
Howdy Frioden,
Has this computer been on mothballs somewhere? Older infection items here that don't often get seen of late. Let's check more and then make repairs. Also I don't see any antivirus software here - did you uninstall that? Download combofix.exe. Double click combofix.exe & follow the prompts. A window will open with a warning. Type "Y" (and Enter) to start the fix. When the scan completes it will open a text window. Please copy/paste that log back here. A caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. And Go Here and download Silent Runners to your desktop. Run it, and post back here the log it creates. If your AV queries the script, allow it to run. It's not malicious. It will create a file named Startup Programs, and will notify when the scan is complete. Copy the log from the Startup Programs file back here. You can use separate posts here if needed. |
Tom,
Thanks for getting back to me...This is a friends computer who has no AV or firewall (I'll be taking care of that soon) and finally came to me because it is barely running. Here is the combofix log: Michelle Lookadoo - 06-12-15 10:49:07.74 Service Pack 2 ComboFix 06.11.27W - Running from: "C:\Documents and Settings\Michelle Lookadoo\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system.exe ((((((((((((((((((((((((((((((( Files Created from 2006-11-15 to 2006-12-15 )))))))))))))))))))))))))))))))))) 2006-12-13 11:46 <DIR> d-------- C:\Program Files\System Cleaner 2006-12-09 23:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Adobe 2006-11-19 23:19 <DIR> d-------- C:\Program Files\MSXML 4.0 2006-11-19 23:18 <DIR> d-------- C:\acb8a98a9206a8c7c2865fde02 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))) 2006-12-13 12:13 -------- d-------- C:\Program Files\uTorrent 2006-12-13 12:13 -------- d-------- C:\Program Files\palmOne 2006-12-12 15:10 -------- d-------- C:\Documents and Settings\Michelle Lookadoo\Application Data\WeatherBug 2006-12-10 00:01 -------- d-------- C:\Documents and Settings\Michelle Lookadoo\Application Data\Adobe 2006-12-09 23:57 -------- d-------- C:\Program Files\Adobe 2006-12-06 09:38 -------- d-------- C:\Program Files\Lexmark X1100 Series 2006-11-19 23:16 -------- d-------- C:\Program Files\Internet Explorer 2006-11-04 14:14 1245696 --a------ C:\WINDOWS\SYSTEM32\msxml4.dll 2006-10-28 18:46 -------- d--h----- C:\Program Files\InstallShield Installation Information 2006-10-28 18:44 -------- d-------- C:\Program Files\iPod 2006-10-13 07:35 142336 --a------ C:\WINDOWS\SYSTEM32\nwprovau.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\run] "uninstal"="regsvr32 /u /s image.dll" [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\run\Disabled] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "AIM"="C:\\PROGRA~1\\AIM\\aim.exe -cnetwait.odl" "Weather"="C:\\Program Files\\AWS\\WeatherBug\\Weather.exe 1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\run] "SM1BG"="C:\\WINDOWS\\SM1BG.EXE" "Dit"="Dit.exe" "Lexmark X1100 Series"="\"C:\\Program Files\\Lexmark X1100 Series\\lxbkbmgr.exe\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\run\Disabled] "MMTray"="C:\\Program Files\\MUSICMATCH\\MUSICMATCH Jukebox\\mm_tray.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000005 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00 ,34,03,00,00,e4,02,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00 ,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff ,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23 ,00,00,00,a4,00,00,00,9a,00,\ 00,00,01,00,00,00 [HKEY_USERS\.default\software\microsoft\windows\cur rentversion\run] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" [HKEY_USERS\.default\software\microsoft\windows\cur rentversion\runonce] "POSTRBT"="C:\\Program Files\\Norton Internet Security\\Norton AntiVirus\\Navw32.exe /REMEDIATE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runon ce] "POSTRBT"="C:\\Program Files\\Norton Internet Security\\Norton AntiVirus\\Navw32.exe /REMEDIATE" [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\policies\system] "NoDispAppearancePage"=dword:00000000 "NoColorChoice"=dword:00000000 "NoSizeChoice"=dword:00000000 "NoDispBackgroundPage"=dword:00000000 "NoDispScrSavPage"=dword:00000000 "NoDispCPL"=dword:00000000 "NoVisualStyleChoice"=dword:00000000 "NoDispSettingsPage"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "NoActiveDesktop"=dword:00000000 "NoSaveSettings"=dword:00000000 "ClassicShell"=dword:00000000 "NoThemesTab"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 "DisableTaskMgr"=dword:00000000 [HKEY_USERS\.default\software\microsoft\windows\cur rentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\polic ies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 7.0 Tray Icon.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\America Online 7.0 Tray Icon.lnk" "backup"="C:\\WINDOWS\\pss\\America Online 7.0 Tray Icon.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\AMERIC~1.0\\aoltray.e xe -check" "item"="America Online 7.0 Tray Icon" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Digital Line Detect.lnk" "backup"="C:\\WINDOWS\\pss\\Digital Line Detect.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\DIGITA~1\\DLG.exe " "item"="Digital Line Detect" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^GStartup.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\GStartup.lnk" "backup"="C:\\WINDOWS\\pss\\GStartup.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\COMMON~1\\GMT\\GMT.ex e /startup" "item"="GStartup" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 2000 Series.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\hp psc 2000 Series.lnk" "backup"="C:\\WINDOWS\\pss\\hp psc 2000 Series.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\HEWLET~1\\DIGITA~1\\bin\\ hpobnz08.exe " "item"="hp psc 2000 Series" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\KODAK Software Updater.lnk" "backup"="C:\\WINDOWS\\pss\\KODAK Software Updater.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\KODAK\\KODAKS~1\\7288971\ \Program\\BACKWE~1.EXE " "item"="KODAK Software Updater" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Microsoft Office.lnk" "backup"="C:\\WINDOWS\\pss\\Microsoft Office.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\MICROS~2\\Office10\\OSA.E XE -b -l" "item"="Microsoft Office" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^officejet 6100.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\officejet 6100.lnk" "backup"="C:\\WINDOWS\\pss\\officejet 6100.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\HEWLET~1\\DIGITA~1\\bin\\ hposol08.exe " "item"="officejet 6100" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="" "hkey"="HKLM" "command"="" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="DirectCD" "hkey"="HKLM" "command"="\"C:\\Program Files\\Roxio\\Easy CD Creator 5\\DirectCD\\DirectCD.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="aim" "hkey"="HKCU" "command"="C:\\PROGRA~1\\AIM\\aim.exe -cnetwait.odl" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AltnetPointsManager] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="Points Manager" "hkey"="HKLM" "command"="C:\\Program Files\\Altnet\\Points Manager\\Points Manager.exe -s " "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CARPService] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="carpserv" "hkey"="HKLM" "command"="carpserv.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CMESys] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="CMESys" "hkey"="HKLM" "command"="\"C:\\Program Files\\Common Files\\CMEII\\CMESys.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CookiePatrol] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="CookiePatrol" "hkey"="HKLM" "command"="C:\\PROGRA~1\\PESTPA~1\\CookiePatrol.ex e" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DadApp] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="dadapp" "hkey"="HKLM" "command"="C:\\Program Files\\Dell\\AccessDirect\\dadapp.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="DSAgnt" "hkey"="HKCU" "command"="\"C:\\Program Files\\Dell Support\\DSAgnt.exe\" /startup" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X73 Button Manager] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="AcBtnMgr_X73" "hkey"="HKLM" "command"="C:\\PROGRA~1\\LEXMAR~1\\AcBtnMgr_X73.ex e" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X73 Button Monitor] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="ACMonitor_X73" "hkey"="HKLM" "command"="C:\\PROGRA~1\\LEXMAR~1\\ACMonitor_X73.e xe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MediaLoads Installer] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="dw" "hkey"="HKLM" "command"="\"C:\\Program Files\\DownloadWare\\dw.exe\" /H" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="Money Express" "hkey"="HKCU" "command"="\"C:\\Program Files\\Microsoft Money\\System\\Money Express.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyStartUp10.0] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="Activation" "hkey"="HKLM" "command"="\"C:\\Program Files\\Microsoft Money\\System\\Activation.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="msmsgs" "hkey"="HKCU" "command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NAV Agent] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="navapw32" "hkey"="HKLM" "command"="C:\\PROGRA~1\\NORTON~1\\navapw32.ex e" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\New.net Startup] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="NEWDOT~1" "hkey"="HKLM" "command"="rundll32 C:\\PROGRA~1\\NEWDOT~1\\NEWDOT~1.DLL,NewDotNetStar tup" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="NvCpl" "hkey"="HKLM" "command"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="nwiz" "hkey"="HKLM" "command"="nwiz.exe /installquiet" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P2P Networking] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="P2P Networking" "hkey"="HKLM" "command"="C:\\WINDOWS\\System32\\P2P Networking\\P2P Networking.exe /AUTOSTART" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PestPatrol Control Center] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="PPControl" "hkey"="HKLM" "command"="C:\\PROGRA~1\\PESTPA~1\\PPControl.e xe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlaxoUpdate] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="InstallStub" "hkey"="HKCU" "command"="C:\\Program Files\\Plaxo\\2.4.1.5\\InstallStub.exe -a" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PPMemCheck] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="PPMemCheck" "hkey"="HKLM" "command"="C:\\PROGRA~1\\PESTPA~1\\PPMemCheck. exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PrinTray] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="printray" "hkey"="HKLM" "command"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\ W32X86\\3\\printray.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PromulGate] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="PgMonitr" "hkey"="HKLM" "command"="\"C:\\Program Files\\DelFin\\PromulGate\\PgMonitr.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="qttask" "hkey"="HKLM" "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="RealPlay" "hkey"="HKLM" "command"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="hpgs2wnd" "hkey"="HKLM" "command"="C:\\Program Files\\Hewlett-Packard\\HP Share-to-Web\\hpgs2wnd.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyBlocs] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="SpyBlocs" "hkey"="HKLM" "command"="C:\\Program Files\\SpyBlocs\\SpyBlocs.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="SynTPEnh" "hkey"="HKLM" "command"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="SynTPLpr" "hkey"="HKLM" "command"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updmgr] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="updmgr" "hkey"="HKLM" "command"="C:\\Program Files\\Common files\\updmgr\\updmgr.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="ViewMgr" "hkey"="HKLM" "command"="C:\\Program Files\\Viewpoint\\Viewpoint Manager\\ViewMgr.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Weather] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="Weather" "hkey"="HKCU" "command"="C:\\PROGRA~1\\AWS\\WEATHE~1\\Weather.EX E 1" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "SBService"=dword:00000002 "NVSvc"=dword:00000002 "navapsvc"=dword:00000002 "LexBceS"=dword:00000002 "Dcfssvc"=dword:00000002 [HKEY_LOCAL_MACHINE\system\currentcontrolset\contro l\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Completion time: 06-12-15 10:50:44.46 C:\ComboFix.txt ... 06-12-15 10:50 Silentrunners in next post |
And the silentrunners log:
"Silent Runners.vbs", revision 49, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run \ {++} "uninstal" = "regsvr32 /u /s image.dll" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Run \ {++} "SM1BG" = "C:\WINDOWS\SM1BG.EXE" ["Cypress Semiconductor"] "Dit" = "Dit.exe" [null data] "Lexmark X1100 Series" = ""C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"" ["Lexmark International, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] HKLM\Software\Microsoft\Windows\CurrentVersion\She ll Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension" -> {HKLM...CLSID} = "Display Panning CPL Extension" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Outlook File Icon Extension" \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS] "{955B7B84-5308-419c-8ED8-0B9CA3C56985}" = "6 Months of AOL Included" -> {HKLM...CLSID} = "6 Months of AOL Included" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\aolshare\shell\us\shellext.d ll" ["America Online, Inc."] "{5E44E225-A408-11CF-B581-008029601108}" = "Adaptec DirectCD Shell Extension" -> {HKLM...CLSID} = "Adaptec DirectCD Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\Roxio\EASYCD~1\DirectCD\Shellex.d ll" ["Roxio"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes" -> {HKLM...CLSID} = "iTunes" \InProcServer32\(Default) = "C:\Program Files\iTunes\iTunesMiniPlayer.dll" ["Apple Computer, Inc."] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\ <<!>> "AppInit_DLLs" = "mlvnmu72v5t913ll.dll.dll.dll.dll.dll.dll.dll.dll. dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dl l.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll. dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dl l.dll.dll.dll.dll.dll.dll.dll.dll.dll" [file not found] HKLM\Software\Classes\Folder\shellex\ColumnHandler s\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] Group Policies {policy setting}: -------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\Explorer\ "NoActiveDesktop" = (REG_DWORD) hex:0x00000000 {Disable Active Desktop} "NoSaveSettings" = (REG_DWORD) hex:0x00000000 {Don't save settings at exit} "ClassicShell" = (REG_DWORD) hex:0x00000000 {Enable Classic Shell / Turn on Classic Shell} "NoThemesTab" = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System\ "NoDispAppearancePage" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoColorChoice" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoSizeChoice" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoDispBackgroundPage" = (REG_DWORD) hex:0x00000000 {Hide Desktop tab} "NoDispScrSavPage" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoDispCPL" = (REG_DWORD) hex:0x00000000 {Remove Display in Control Panel} "NoVisualStyleChoice" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoDispSettingsPage" = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Pol icies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Devices: Allow undock without having to log on} "DisableTaskMgr" = (REG_DWORD) hex:0x00000000 {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Exp lorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Loca l Settings\Application Data\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Michelle Lookadoo\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp" Startup items in "Michelle Lookadoo" & "All Users" startup folders: ------------------------------------------------------------------- C:\Documents and Settings\All Users\Start Menu\Programs\Startup "Adobe Reader Speed Launch" -> shortcut to: "C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"] "Adobe Reader Synchronizer" -> shortcut to: "C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe" [null data] "HotSync Manager" -> shortcut to: "C:\Program Files\palmOne\Hotsync.exe -logon" ["PalmSource, Inc"] <<!>> "winlogin.exe" [null data] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Pa rameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Pa rameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" -> {HKLM...CLSID} = "Yahoo! Companion" \InProcServer32\(Default) = "C:\WINDOWS\Downloaded Program Files\ycomp5_1_5_0.dll" ["Yahoo! Inc."] "{40D41A8B-D79B-43D7-99A7-9EE0F344C385}" -> {HKLM...CLSID} = "AIM Search" \InProcServer32\(Default) = "C:\Program Files\AIM Toolbar\AIMBar.dll" ["America Online, Inc"] Explorer Bars HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\ {9404901D-06DA-4B23-A0EE-3EA4F64EC9B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "MoneySide" \InProcServer32\(Default) = "C:\Program Files\Microsoft Money\System\mnyviewer.dll" [MS] HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ {FE54FA40-D68C-11D2-98FA-00C0F0318AFE}\(Default) = (no title provided) -> {HKLM...CLSID} = "Real.com" \InProcServer32\(Default) = "C:\WINDOWS\System32\Shdocvw.dll" [MS] HKLM\Software\Classes\CLSID\{0494D0DE-F8E0-41AD-92A3-14154ECE70AC}\(Default) = "SearchBar Quick View" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\WINDOWS\System32\shdocvw.dll" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKCU\Software\Microsoft\Internet Explorer\Extensions\ {AF6CABAB-61F9-4F12-A198-B7D41EF1CB52}\ "ButtonText" = "WeatherBug" "CLSIDExtension" = "{AF6CABAB-61F9-4f12-A198-B7D41EF1CB52}" "Exec" = "C:\PROGRA~1\AWS\WEATHE~1\Weather.exe" ["AWS Convergence Technologies, Inc."] HKLM\Software\Microsoft\Internet Explorer\Extensions\ {AC9E2541-2814-11D5-BC6D-00B0D0A1DE45}\ "ButtonText" = "AIM" "Exec" = "C:\PROGRA~1\AIM\aim.exe" ["America Online, Inc."] {CD67F990-D8E9-11D2-98FE-00C0F0318AFE}\ "ButtonText" = "Real.com" {E023F504-0C5A-4750-A1E7-A9046DEA8A21}\ "ButtonText" = "MoneySide" "CLSIDExtension" = "{301DA1EE-F65C-4188-A417-9E915CC8FBFA}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Money\System\mnyviewer.dll" [MS] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Miscellaneous IE Hijack Points ------------------------------ C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings") Added lines (compared with English-language version): [Strings]: START_PAGE_URL=http://www.att.net Missing lines (compared with English-language version): [Strings]: 1 line HOSTS file ---------- C:\WINDOWS\System32\drivers\etc\HOSTS maps: 7 domain names to IP addresses, 6 of the IP addresses are *not* localhost! Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ LexBce Server, LexBceS, "C:\WINDOWS\system32\LEXBCES.EXE" ["Lexmark International, Inc."] WAN Miniport (ATW) Service, WANMiniportService, ""C:\WINDOWS\wanmpsvc.exe"" ["America Online, Inc."] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monito rs\ Lexmark Network Port\Driver = "LEXLMPM.DLL" ["Lexmark International, Inc."] ---------- <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 116 seconds. ---------- (total run time: 188 seconds) Thanks for all your help. Frioden |
Darn - bunch of startups disabled in msconfig. Friend and foe, and all will need to be allowed to startup so the computer can get cleaned correctly.
Download CWShredder from here and have it ready to use. Then run CWShredder and hit the "Fix" button. Then Disable your antivirus program and go here and run an online scan with BitDefender (you will need to use Internet Explorer for this scan). When the ActiveX Control has loaded, click on "Click here to scan" and grab a coffee. When BitDefender completes the scan, select the "Detected Problems" tab. Click on "Click here to export scan". Save the file as an HTML to your Desktop. Then click on the saved file and allow it to open with your browser. Go to Edit - Select All. Then copy/paste that log back here. ================================================== ===================== Go to Start - Run, type msconfig (and Enter). Under the Startup tab, click Enable All, then Apply/OK to close msconfig. Allow the reboot. After the reboot run new ComboFix, HijackThis and then Silent Runners scans and post those here, along with the BitDefender log please. |
Tom,
The bitdefender scan found stuff but my computer ended up not responding so when I ran it again it had deleted everything it found before. Had nothing left for a log. 3 posts coming with logs Combofix Michelle Lookadoo - 06-12-15 10:49:07.74 Service Pack 2 ComboFix 06.11.27W - Running from: "C:\Documents and Settings\Michelle Lookadoo\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system.exe ((((((((((((((((((((((((((((((( Files Created from 2006-11-15 to 2006-12-15 )))))))))))))))))))))))))))))))))) 2006-12-13 11:46 <DIR> d-------- C:\Program Files\System Cleaner 2006-12-09 23:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Adobe 2006-11-19 23:19 <DIR> d-------- C:\Program Files\MSXML 4.0 2006-11-19 23:18 <DIR> d-------- C:\acb8a98a9206a8c7c2865fde02 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))) 2006-12-13 12:13 -------- d-------- C:\Program Files\uTorrent 2006-12-13 12:13 -------- d-------- C:\Program Files\palmOne 2006-12-12 15:10 -------- d-------- C:\Documents and Settings\Michelle Lookadoo\Application Data\WeatherBug 2006-12-10 00:01 -------- d-------- C:\Documents and Settings\Michelle Lookadoo\Application Data\Adobe 2006-12-09 23:57 -------- d-------- C:\Program Files\Adobe 2006-12-06 09:38 -------- d-------- C:\Program Files\Lexmark X1100 Series 2006-11-19 23:16 -------- d-------- C:\Program Files\Internet Explorer 2006-11-04 14:14 1245696 --a------ C:\WINDOWS\SYSTEM32\msxml4.dll 2006-10-28 18:46 -------- d--h----- C:\Program Files\InstallShield Installation Information 2006-10-28 18:44 -------- d-------- C:\Program Files\iPod 2006-10-13 07:35 142336 --a------ C:\WINDOWS\SYSTEM32\nwprovau.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\run] "uninstal"="regsvr32 /u /s image.dll" [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\run\Disabled] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "AIM"="C:\\PROGRA~1\\AIM\\aim.exe -cnetwait.odl" "Weather"="C:\\Program Files\\AWS\\WeatherBug\\Weather.exe 1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\run] "SM1BG"="C:\\WINDOWS\\SM1BG.EXE" "Dit"="Dit.exe" "Lexmark X1100 Series"="\"C:\\Program Files\\Lexmark X1100 Series\\lxbkbmgr.exe\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\run\Disabled] "MMTray"="C:\\Program Files\\MUSICMATCH\\MUSICMATCH Jukebox\\mm_tray.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000005 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00 ,34,03,00,00,e4,02,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00 ,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff ,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23 ,00,00,00,a4,00,00,00,9a,00,\ 00,00,01,00,00,00 [HKEY_USERS\.default\software\microsoft\windows\cur rentversion\run] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" [HKEY_USERS\.default\software\microsoft\windows\cur rentversion\runonce] "POSTRBT"="C:\\Program Files\\Norton Internet Security\\Norton AntiVirus\\Navw32.exe /REMEDIATE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runon ce] "POSTRBT"="C:\\Program Files\\Norton Internet Security\\Norton AntiVirus\\Navw32.exe /REMEDIATE" [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\policies\system] "NoDispAppearancePage"=dword:00000000 "NoColorChoice"=dword:00000000 "NoSizeChoice"=dword:00000000 "NoDispBackgroundPage"=dword:00000000 "NoDispScrSavPage"=dword:00000000 "NoDispCPL"=dword:00000000 "NoVisualStyleChoice"=dword:00000000 "NoDispSettingsPage"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "NoActiveDesktop"=dword:00000000 "NoSaveSettings"=dword:00000000 "ClassicShell"=dword:00000000 "NoThemesTab"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 "DisableTaskMgr"=dword:00000000 [HKEY_USERS\.default\software\microsoft\windows\cur rentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\polic ies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 7.0 Tray Icon.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\America Online 7.0 Tray Icon.lnk" "backup"="C:\\WINDOWS\\pss\\America Online 7.0 Tray Icon.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\AMERIC~1.0\\aoltray.e xe -check" "item"="America Online 7.0 Tray Icon" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Digital Line Detect.lnk" "backup"="C:\\WINDOWS\\pss\\Digital Line Detect.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\DIGITA~1\\DLG.exe " "item"="Digital Line Detect" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^GStartup.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\GStartup.lnk" "backup"="C:\\WINDOWS\\pss\\GStartup.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\COMMON~1\\GMT\\GMT.ex e /startup" "item"="GStartup" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 2000 Series.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\hp psc 2000 Series.lnk" "backup"="C:\\WINDOWS\\pss\\hp psc 2000 Series.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\HEWLET~1\\DIGITA~1\\bin\\ hpobnz08.exe " "item"="hp psc 2000 Series" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\KODAK Software Updater.lnk" "backup"="C:\\WINDOWS\\pss\\KODAK Software Updater.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\KODAK\\KODAKS~1\\7288971\ \Program\\BACKWE~1.EXE " "item"="KODAK Software Updater" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Microsoft Office.lnk" "backup"="C:\\WINDOWS\\pss\\Microsoft Office.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\MICROS~2\\Office10\\OSA.E XE -b -l" "item"="Microsoft Office" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^officejet 6100.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\officejet 6100.lnk" "backup"="C:\\WINDOWS\\pss\\officejet 6100.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\HEWLET~1\\DIGITA~1\\bin\\ hposol08.exe " "item"="officejet 6100" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="" "hkey"="HKLM" "command"="" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="DirectCD" "hkey"="HKLM" "command"="\"C:\\Program Files\\Roxio\\Easy CD Creator 5\\DirectCD\\DirectCD.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="aim" "hkey"="HKCU" "command"="C:\\PROGRA~1\\AIM\\aim.exe -cnetwait.odl" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AltnetPointsManager] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="Points Manager" "hkey"="HKLM" "command"="C:\\Program Files\\Altnet\\Points Manager\\Points Manager.exe -s " "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CARPService] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="carpserv" "hkey"="HKLM" "command"="carpserv.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CMESys] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="CMESys" "hkey"="HKLM" "command"="\"C:\\Program Files\\Common Files\\CMEII\\CMESys.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CookiePatrol] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="CookiePatrol" "hkey"="HKLM" "command"="C:\\PROGRA~1\\PESTPA~1\\CookiePatrol.ex e" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DadApp] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="dadapp" "hkey"="HKLM" "command"="C:\\Program Files\\Dell\\AccessDirect\\dadapp.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="DSAgnt" "hkey"="HKCU" "command"="\"C:\\Program Files\\Dell Support\\DSAgnt.exe\" /startup" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X73 Button Manager] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="AcBtnMgr_X73" "hkey"="HKLM" "command"="C:\\PROGRA~1\\LEXMAR~1\\AcBtnMgr_X73.ex e" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X73 Button Monitor] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="ACMonitor_X73" "hkey"="HKLM" "command"="C:\\PROGRA~1\\LEXMAR~1\\ACMonitor_X73.e xe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MediaLoads Installer] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="dw" "hkey"="HKLM" "command"="\"C:\\Program Files\\DownloadWare\\dw.exe\" /H" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="Money Express" "hkey"="HKCU" "command"="\"C:\\Program Files\\Microsoft Money\\System\\Money Express.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyStartUp10.0] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="Activation" "hkey"="HKLM" "command"="\"C:\\Program Files\\Microsoft Money\\System\\Activation.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="msmsgs" "hkey"="HKCU" "command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NAV Agent] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="navapw32" "hkey"="HKLM" "command"="C:\\PROGRA~1\\NORTON~1\\navapw32.ex e" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\New.net Startup] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="NEWDOT~1" "hkey"="HKLM" "command"="rundll32 C:\\PROGRA~1\\NEWDOT~1\\NEWDOT~1.DLL,NewDotNetStar tup" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="NvCpl" "hkey"="HKLM" "command"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="nwiz" "hkey"="HKLM" "command"="nwiz.exe /installquiet" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P2P Networking] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="P2P Networking" "hkey"="HKLM" "command"="C:\\WINDOWS\\System32\\P2P Networking\\P2P Networking.exe /AUTOSTART" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PestPatrol Control Center] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="PPControl" "hkey"="HKLM" "command"="C:\\PROGRA~1\\PESTPA~1\\PPControl.e xe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlaxoUpdate] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="InstallStub" "hkey"="HKCU" "command"="C:\\Program Files\\Plaxo\\2.4.1.5\\InstallStub.exe -a" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PPMemCheck] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="PPMemCheck" "hkey"="HKLM" "command"="C:\\PROGRA~1\\PESTPA~1\\PPMemCheck. exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PrinTray] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="printray" "hkey"="HKLM" "command"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\ W32X86\\3\\printray.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PromulGate] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="PgMonitr" "hkey"="HKLM" "command"="\"C:\\Program Files\\DelFin\\PromulGate\\PgMonitr.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="qttask" "hkey"="HKLM" "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="RealPlay" "hkey"="HKLM" "command"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="hpgs2wnd" "hkey"="HKLM" "command"="C:\\Program Files\\Hewlett-Packard\\HP Share-to-Web\\hpgs2wnd.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyBlocs] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="SpyBlocs" "hkey"="HKLM" "command"="C:\\Program Files\\SpyBlocs\\SpyBlocs.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="SynTPEnh" "hkey"="HKLM" "command"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="SynTPLpr" "hkey"="HKLM" "command"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updmgr] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="updmgr" "hkey"="HKLM" "command"="C:\\Program Files\\Common files\\updmgr\\updmgr.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="ViewMgr" "hkey"="HKLM" "command"="C:\\Program Files\\Viewpoint\\Viewpoint Manager\\ViewMgr.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Weather] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run" "item"="Weather" "hkey"="HKCU" "command"="C:\\PROGRA~1\\AWS\\WEATHE~1\\Weather.EX E 1" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "SBService"=dword:00000002 "NVSvc"=dword:00000002 "navapsvc"=dword:00000002 "LexBceS"=dword:00000002 "Dcfssvc"=dword:00000002 [HKEY_LOCAL_MACHINE\system\currentcontrolset\contro l\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Completion time: 06-12-15 10:50:44.46 C:\ComboFix.txt ... 06-12-15 10:50 |
HJT Log:
Logfile of HijackThis v1.99.1 Scan saved at 1:48:57 PM, on 12/18/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\cisvc.exe C:\WINDOWS\system32\oodag.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\SM1BG.EXE C:\WINDOWS\Dit.exe C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe C:\WINDOWS\DitExp.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe C:\WINDOWS\system32\carpserv.exe C:\Program Files\Dell\AccessDirect\dadapp.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\PROGRA~1\AWS\WEATHE~1\Weather.EXE C:\Program Files\Dell\AccessDirect\DadTray.exe C:\Program Files\Plaxo\2.11.1.5\PlaxoHelper.exe C:\Program Files\Dell Support\DSAgnt.exe C:\PROGRA~1\AIM\aim.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\palmOne\Hotsync.exe C:\WINDOWS\system32\cidaemon.exe C:\Documents and Settings\Michelle Lookadoo\Desktop\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowws.cc/hp.htm?id=31403 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.att.net R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by AT&T WorldNet R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = localhost O1 - Hosts: 66.98.136.25 auto.search.msn.es O1 - Hosts: 66.98.136.25 pagead2.googlesyndication.com O1 - Hosts: 66.98.136.25 auto.search.msn.es O1 - Hosts: 66.98.136.25 pagead2.googlesyndication.com O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE O4 - HKLM\..\Run: [Dit] Dit.exe O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printra y.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Lexmark X73 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe O4 - HKLM\..\Run: [Lexmark X73 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe O4 - HKLM\..\Run: [CARPService] carpserv.exe O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [uninstal] regsvr32 /u /s image.dll O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.EXE 1 O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.11.1.5\PlaxoHelper.exe -a O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: winlogin.exe O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU) O14 - IERESET.INF: START_PAGE_URL=http://www.att.net O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab O20 - AppInit_DLLs: mlvnmu72v5t913ll.dll.dll.dll.dll.dll.dll.dll.dll.d ll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll .dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.d ll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll .dll.dll.dll.dll.dll.dll.dll.dll.dll O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe |
"Silent Runners.vbs", revision 49, http://www.silentrunners.org/
Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run \ {++} "uninstal" = "regsvr32 /u /s image.dll" [MS] "Weather" = "C:\PROGRA~1\AWS\WEATHE~1\Weather.EXE 1" ["AWS Convergence Technologies, Inc."] "PlaxoUpdate" = "C:\Program Files\Plaxo\2.11.1.5\PlaxoHelper.exe -a" ["Plaxo, Inc."] "DellSupport" = ""C:\Program Files\Dell Support\DSAgnt.exe" /startup" ["Gteko Ltd."] "AIM" = "C:\PROGRA~1\AIM\aim.exe -cnetwait.odl" ["America Online, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Run \ {++} "SM1BG" = "C:\WINDOWS\SM1BG.EXE" ["Cypress Semiconductor"] "Dit" = "Dit.exe" [null data] "Lexmark X1100 Series" = ""C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"" ["Lexmark International, Inc."] "SynTPLpr" = "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" ["Synaptics, Inc."] "SynTPEnh" = "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" ["Synaptics, Inc."] "PrinTray" = "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printr ay.exe" ["Lexmark"] "nwiz" = "nwiz.exe /installquiet" ["NVIDIA Corporation"] "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup" [MS] "Lexmark X73 Button Monitor" = "C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe" [file not found] "Lexmark X73 Button Manager" = "C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe" [file not found] "CARPService" = "carpserv.exe" ["Conexant Systems"] "NAV Agent" = "C:\PROGRA~1\NORTON~1\navapw32.exe" [file not found] "DadApp" = "C:\Program Files\Dell\AccessDirect\dadapp.exe" [null data] "AdaptecDirectCD" = ""C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"" ["Roxio"] "MSConfig" = "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig .exe /auto" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] HKLM\Software\Microsoft\Windows\CurrentVersion\She ll Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension" -> {HKLM...CLSID} = "Display Panning CPL Extension" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Outlook File Icon Extension" \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS] "{5E44E225-A408-11CF-B581-008029601108}" = "Adaptec DirectCD Shell Extension" -> {HKLM...CLSID} = "Adaptec DirectCD Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\Roxio\EASYCD~1\DirectCD\Shellex.d ll" ["Roxio"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes" -> {HKLM...CLSID} = "iTunes" \InProcServer32\(Default) = "C:\Program Files\iTunes\iTunesMiniPlayer.dll" ["Apple Computer, Inc."] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\ <<!>> "AppInit_DLLs" = "mlvnmu72v5t913ll.dll.dll.dll.dll.dll.dll.dll.dll. dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dl l.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll. dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dl l.dll.dll.dll.dll.dll.dll.dll.dll.dll" [file not found] HKLM\System\CurrentControlSet\Control\Session Manager\ <<!>> "BootExecute" = "autocheck autochk *"|"OODBS" ["O&O Software GmbH"] HKLM\Software\Classes\Folder\shellex\ColumnHandler s\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] Group Policies {policy setting}: -------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\Explorer\ "NoActiveDesktop" = (REG_DWORD) hex:0x00000000 {Disable Active Desktop} "NoSaveSettings" = (REG_DWORD) hex:0x00000000 {Don't save settings at exit} "ClassicShell" = (REG_DWORD) hex:0x00000000 {Enable Classic Shell / Turn on Classic Shell} "NoThemesTab" = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System\ "NoDispAppearancePage" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoColorChoice" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoSizeChoice" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoDispBackgroundPage" = (REG_DWORD) hex:0x00000000 {Hide Desktop tab} "NoDispScrSavPage" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoDispCPL" = (REG_DWORD) hex:0x00000000 {Remove Display in Control Panel} "NoVisualStyleChoice" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoDispSettingsPage" = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Pol icies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Devices: Allow undock without having to log on} "DisableTaskMgr" = (REG_DWORD) hex:0x00000000 {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Exp lorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Loca l Settings\Application Data\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Michelle Lookadoo\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp" Startup items in "Michelle Lookadoo" & "All Users" startup folders: ------------------------------------------------------------------- C:\Documents and Settings\All Users\Start Menu\Programs\Startup "Adobe Reader Speed Launch" -> shortcut to: "C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"] "Adobe Reader Synchronizer" -> shortcut to: "C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe" [null data] "Digital Line Detect" -> shortcut to: "C:\Program Files\Digital Line Detect\DLG.exe" ["BVRP Software"] "HotSync Manager" -> shortcut to: "C:\Program Files\palmOne\Hotsync.exe -logon" ["PalmSource, Inc"] "Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l" [MS] <<!>> "winlogin.exe" [null data] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Pa rameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Pa rameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" -> {HKLM...CLSID} = "Yahoo! Companion" \InProcServer32\(Default) = "C:\WINDOWS\Downloaded Program Files\ycomp5_1_5_0.dll" ["Yahoo! Inc."] "{40D41A8B-D79B-43D7-99A7-9EE0F344C385}" -> {HKLM...CLSID} = "AIM Search" \InProcServer32\(Default) = "C:\Program Files\AIM Toolbar\AIMBar.dll" ["America Online, Inc"] Explorer Bars HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\ {9404901D-06DA-4B23-A0EE-3EA4F64EC9B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "MoneySide" \InProcServer32\(Default) = "C:\Program Files\Microsoft Money\System\mnyviewer.dll" [MS] HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ {FE54FA40-D68C-11D2-98FA-00C0F0318AFE}\(Default) = (no title provided) -> {HKLM...CLSID} = "Real.com" \InProcServer32\(Default) = "C:\WINDOWS\System32\Shdocvw.dll" [MS] HKLM\Software\Classes\CLSID\{0494D0DE-F8E0-41AD-92A3-14154ECE70AC}\(Default) = "SearchBar Quick View" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\WINDOWS\System32\shdocvw.dll" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKCU\Software\Microsoft\Internet Explorer\Extensions\ {AF6CABAB-61F9-4F12-A198-B7D41EF1CB52}\ "ButtonText" = "WeatherBug" "CLSIDExtension" = "{AF6CABAB-61F9-4f12-A198-B7D41EF1CB52}" "Exec" = "C:\PROGRA~1\AWS\WEATHE~1\Weather.exe" ["AWS Convergence Technologies, Inc."] HKLM\Software\Microsoft\Internet Explorer\Extensions\ {85D1F590-48F4-11D9-9669-0800200C9A66}\ "MenuText" = "Uninstall BitDefender Online Scanner v8" "Exec" = "%windir%\bdoscandel.exe" [null data] {AC9E2541-2814-11D5-BC6D-00B0D0A1DE45}\ "ButtonText" = "AIM" "Exec" = "C:\PROGRA~1\AIM\aim.exe" ["America Online, Inc."] {CD67F990-D8E9-11D2-98FE-00C0F0318AFE}\ "ButtonText" = "Real.com" {E023F504-0C5A-4750-A1E7-A9046DEA8A21}\ "ButtonText" = "MoneySide" "CLSIDExtension" = "{301DA1EE-F65C-4188-A417-9E915CC8FBFA}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Money\System\mnyviewer.dll" [MS] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Miscellaneous IE Hijack Points ------------------------------ C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings") Added lines (compared with English-language version): [Strings]: START_PAGE_URL=http://www.att.net Missing lines (compared with English-language version): [Strings]: 1 line HOSTS file ---------- C:\WINDOWS\System32\drivers\etc\HOSTS maps: 5 domain names to IP addresses, 4 of the IP addresses are *not* localhost! Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ O&O Defrag, O&O Defrag, "C:\WINDOWS\system32\oodag.exe" ["O&O Software GmbH"] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monito rs\ Lexmark Network Port\Driver = "LEXLMPM.DLL" ["Lexmark International, Inc."] ---------- <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 55 seconds, including 10 seconds for message boxes) Again thanks for your time...I also went through and di alot of cleaning up of startups and manual removal of stuff I could find....need to clean registry still but need to go christmas shopping too...:0) Frioden |
If things work well the registry should be left as is, but of course infection needs to be exited from it. The log shows all those items still disabled through msconfig. Did you re-enable them as asked, or perhaps use some other software that has them disabled? If you did not enable them, do so now, reboot, and run the same scan again and post back the logs again please. With them disabled the infection will not get cleaned out.
|
| All times are GMT +1. The time now is 02:19 PM. |
Copyright © Cyber Tech Help. All rights reserved. All other trademarks are the property of their respective owners.