Hi
Have been getting problems with these popups on the laptop for a few months now (popups in internet explorer with the title on each popup prefixed "CID") but have gradually got worse to the point where something needs to be done
Have went through all 5 steps in the guide. Only thing I'm having a problem with though is updating Windows XP. I seem to have Service Pack 2 installed but something is preventing me from enabling automatic updates.
Any help that can br provided would be much appreciated
HJT log is pasted below and have also attached extra.txt and the log from Activescan.
Thanks
Barry
HJT Log
Deckard's System Scanner v20071014.68
Run by Barry on 2008-07-29 17:10:59
Computer is in Normal Mode.
--------------------------------------------------------------------------------
-- System Restore --------------------------------------------------------------
Successfully created a Deckard's System Scanner Restore Point.
-- Last 5 Restore Point(s) --
64: 2008-07-29 16:11:08 UTC - RP379 - Deckard's System Scanner Restore Point
63: 2008-07-29 12:53:34 UTC - RP378 - System Checkpoint
62: 2008-07-28 11:01:53 UTC - RP377 - System Checkpoint
61: 2008-07-26 20:42:59 UTC - RP376 - System Checkpoint
60: 2008-07-24 09:26:10 UTC - RP375 - System Checkpoint
-- First Restore Point --
1: 2008-07-22 19:21:08 UTC - RP316 - Removed FaceFactory 2
Backed up registry hives.
Performed disk cleanup.
-- HijackThis (run as Barry.exe) -----------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:18:13, on 29/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Kontiki\KService.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\system32\DSentry.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\WINDOWS\vsnpstd.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Kontiki\KHost.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Barry\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Barry.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.euro.dell.com/countries/u...en/default.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.blueyonder.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.euro.dell.com/countries/u...en/default.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.euro.dell.com/countries/u...en/default.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
http://localhost/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: {dd952e69-51b7-d34b-5f94-0dc0f3e28184} - {48182e3f-0cd0-49f5-b43d-7b1596e259dd} - C:\WINDOWS\system32\gygvfm.dll
O2 - BHO: (no name) - {514A5C49-0C7D-42c3-A71B-38864A269B7A} - C:\WINDOWS\system32\goopvytk.dll
O2 - BHO: (no name) - {8D742974-DEA8-40F2-9008-9BAA973C958D} - C:\WINDOWS\system32\yayvWnMd.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {B8A0E326-AE24-4C4F-AF25-EB32B6497342} - C:\WINDOWS\system32\byXNdaaB.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\system32\DSentry.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Windows Media Connect 2] "C:\Program Files\Windows Media Connect 2\WMCCFG.exe" /StartQuiet
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [4oD] "C:\Program Files\Kontiki\KHost.exe" -all
O4 - HKLM\..\Run: [Boob Idle Software Acid] C:\Documents and Settings\All Users\Application Data\Part Long Boob Idle\boob plan.exe
O4 - HKLM\..\Run: [bc6cadc8] rundll32.exe "C:\WINDOWS\system32\sfhjuyjw.dll",b
O4 - HKLM\..\Run: [BMbf5f9e54] Rundll32.exe "C:\WINDOWS\system32\kwddvyqa.dll",s
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
O4 - HKCU\..\Run: [2book] C:\DOCUME~1\Barry\APPLIC~1\INTERC~1\Vcthe.exe
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Add to Windows &Live Favorites -
http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Ladbrokes Poker - {C2A80015-C447-4dc4-82DD-AED83D6ED57E} - C:\Program Files\ladbrokesMPP\MPPoker.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} (Bebo Uploader Control) -
http://www.bebo.com/files/BeboUploader.5.1.4.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) -
http://acs.pandasoftware.com/actives.../as2stubie.cab
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) -
http://update.videoegg.com/Install/W...gPublisher.exe
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -
http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) -
http://messenger.zone.msn.com/binary...r.cab56986.cab
O20 - Winlogon Notify: yayvWnMd - C:\WINDOWS\SYSTEM32\yayvWnMd.dll
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
--
End of file - 10882 bytes
-- File Associations -----------------------------------------------------------
All associations okay.
-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------
R1 APPDRV - c:\windows\system32\drivers\appdrv.sys <Not Verified; Dell Inc; Application Driver>
R1 MPFIREWL - c:\windows\system32\drivers\mpfirewall.sys <Not Verified; McAfee; McAfee Personal Firewall>
R1 omci (OMCI WDM Device Driver) - c:\windows\system32\drivers\omci.sys <Not Verified; Dell Inc; OMCI Driver>
R2 AegisP (AEGIS Protocol (IEEE 802.1x) v3.1.0.1) - c:\windows\system32\drivers\aegisp.sys <Not Verified; Meetinghouse Data Communications; AEGIS Client 3.1.0.1>
R2 s24trans (WLAN Transport) - c:\windows\system32\drivers\s24trans.sys <Not Verified; Intel Corporation; Intel Wireless LAN Packet Driver>
-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------
R2 RegSrvc - c:\program files\intel\wireless\bin\regsrvc.exe <Not Verified; Intel Corporation; RegSrvc Module>
R2 WLANKEEPER - c:\program files\intel\wireless\bin\wlkeeper.exe <Not Verified; Intel® Corporation; SSOFSet Service>
-- Device Manager: Disabled ----------------------------------------------------
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: 1394 Net Adapter
Device ID: V1394\NIC1394\34EBC030394FC000
Manufacturer: Microsoft
Name: 1394 Net Adapter
PNP Device ID: V1394\NIC1394\34EBC030394FC000
Service: NIC1394
-- Scheduled Tasks -------------------------------------------------------------
2008-07-29 17:00:00 262 --ah----- C:\WINDOWS\Tasks\AD2286C9919D370D.job
2008-07-29 17:00:00 270 --ah----- C:\WINDOWS\Tasks\AA4230499185A3D1.job
2008-07-29 17:00:00 262 --ah----- C:\WINDOWS\Tasks\A0F8D7AF918B4E53.job
2008-07-29 16:43:09 350 --a------ C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (LAPTOP-Barry).job
2008-07-29 16:00:00 366 --a------ C:\WINDOWS\Tasks\HPpromotions journeysoftware.job
-- Files created between 2008-06-29 and 2008-07-29 -----------------------------
2008-07-29 17:16:41 0 d-------- C:\Program Files\Trend Micro
2008-07-29 14:12:20 0 d-------- C:\ie-spyad_zo
2008-07-29 14:05:58 0 d-------- C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-29 14:05:49 0 d-------- C:\Program Files\SpywareBlaster
2008-07-29 11:16:00 0 --a------ C:\WINDOWS\nsreg.dat
2008-07-29 11:15:48 0 d-------- C:\Documents and Settings\Barry\Application Data\Mozilla
2008-07-29 11:13:01 83456 --a------ C:\WINDOWS\system32\sfhjuyjw.dll
2008-07-29 11:10:14 40960 --a------ C:\WINDOWS\system32\ktjlicfh.dll
2008-07-29 11:08:44 105472 --a------ C:\WINDOWS\system32\gygvfm.dll
2008-07-29 11:08:41 105472 --a------ C:\WINDOWS\system32\pweoictw.dll
2008-07-29 11:05:15 91648 --a------ C:\WINDOWS\system32\kwddvyqa.dll
2008-07-29 11:05:09 92160 --a------ C:\WINDOWS\system32\goopvytk.dll
2008-07-29 10:42:28 26112 --a------ C:\WINDOWS\system32\awtqoLbB.dll
2008-07-29 10:42:27 26112 --a------ C:\WINDOWS\system32\wvUmmMdA.dll
2008-07-28 21:11:19 105472 --a------ C:\WINDOWS\system32\ejfgqb.dll
2008-07-28 21:11:17 105472 --a------ C:\WINDOWS\system32\luwbphfq.dll
2008-07-28 21:08:17 40960 --a------ C:\WINDOWS\system32\xiwwkeqa.dll
2008-07-28 21:02:31 92160 --a------ C:\WINDOWS\system32\ysvidhmn.dll
2008-07-28 21:02:19 91648 --a------ C:\WINDOWS\system32\cfhwiwnq.dll
2008-07-27 23:11:09 40960 --a------ C:\WINDOWS\system32\pyyamdfr.dll
2008-07-27 21:00:47 105472 --a------ C:\WINDOWS\system32\duxfdq.dll
2008-07-27 21:00:46 105472 --a------ C:\WINDOWS\system32\grmbvtqw.dll
2008-07-27 21:00:37 92160 --a------ C:\WINDOWS\system32\odxhbkut.dll
2008-07-27 21:00:26 91648 --a------ C:\WINDOWS\system32\cshrvrbf.dll
2008-07-27 13:55:02 40960 --a------ C:\WINDOWS\system32\euhlrquq.dll
2008-07-27 11:59:18 105472 --a------ C:\WINDOWS\system32\ayuizi.dll
2008-07-27 11:59:17 105472 --a------ C:\WINDOWS\system32\aagvtmir.dll
2008-07-27 11:59:00 91648 --a------ C:\WINDOWS\system32\ysnphmkt.dll
2008-07-27 11:58:52 92160 --a------ C:\WINDOWS\system32\yrokyinv.dll
2008-07-27 11:03:10 105472 --a------ C:\WINDOWS\system32\mjhyja.dll
2008-07-27 11:03:09 105472 --a------ C:\WINDOWS\system32\mihfqolh.dll
2008-07-26 17:49:45 40960 --a------ C:\WINDOWS\system32\trcfgame.dll
2008-07-26 10:43:47 105472 --a------ C:\WINDOWS\system32\sjruom.dll
2008-07-26 10:43:45 105472 --a------ C:\WINDOWS\system32\vqqpobwn.dll
2008-07-26 10:41:18 91648 --a------ C:\WINDOWS\system32\qwbcoltb.dll
2008-07-26 10:41:10 92160 --a------ C:\WINDOWS\system32\cpduddxs.dll
2008-07-24 15:22:01 0 d-------- C:\Documents and Settings\Tammy\Application Data\Microgaming
2008-07-24 10:34:30 0 d-------- C:\Program Files\inter copy
2008-07-23 20:44:29 25920 --a------ C:\WINDOWS\system32\lJAtQiIa.dll
2008-07-23 20:44:28 25920 --a------ C:\WINDOWS\system32\geBrrspo.dll
2008-07-22 20:20:57 511166 --ahs---- C:\WINDOWS\system32\BaadNXyb.ini2
2008-07-22 20:20:48 314752 --a------ C:\WINDOWS\system32\byXNdaaB.dll
2008-07-22 20:15:38 25936 --a------ C:\WINDOWS\system32\urqQgfCr.dll
2008-07-22 20:15:37 25936 --a------ C:\WINDOWS\system32\yayvWnMd.dll
-- Find3M Report ---------------------------------------------------------------
2008-07-29 14:01:53 0 d-------- C:\Documents and Settings\Barry\Application Data\inter copy
2008-07-23 18:52:33 0 d-------- C:\Program Files\Messenger Plus! Live
2008-07-23 18:52:32 0 d-------- C:\Program Files\MSN Messenger
2008-07-02 12:22:04 0 d-------- C:\Program Files\ladbrokesMPP
2008-06-25 21:48:07 0 d-------- C:\Program Files\Kontiki
2008-06-18 23:31:35 22886 --a------ C:\Program Files\uninstal.log
2008-06-18 23:31:00 0 d-a------ C:\Program Files\virtual_garden
2008-06-18 23:27:34 0 d-------- C:\Documents and Settings\Barry\Application Data\Adobe
2008-06-03 21:18:05 0 d-------- C:\Program Files\Full Tilt Poker
2008-06-01 22:14:59 0 d-------- C:\Documents and Settings\Barry\Application Data\Help
2008-06-01 20:24:00 0 d-------- C:\Program Files\Focus Multimedia Ltd
2008-05-29 00:17:53 0 d-------- C:\Program Files\Windows Media Connect 2
2008-05-29 00:07:05 0 d-------- C:\Program Files\Channel4
2008-05-18 12:50:15 737280 --a------ C:\WINDOWS\iun6002.exe <Not Verified; Indigo Rose Corporation; Setup Factory 6.0 Runtime Module>
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{48182e3f-0cd0-49f5-b43d-7b1596e259dd}]
29/07/2008 11:08 105472 --a------ C:\WINDOWS\system32\gygvfm.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{514A5C49-0C7D-42c3-A71B-38864A269B7A}]
29/07/2008 11:05 92160 --a------ C:\WINDOWS\system32\goopvytk.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8D742974-DEA8-40F2-9008-9BAA973C958D}]
22/07/2008 20:15 25936 --a------ C:\WINDOWS\system32\yayvWnMd.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B8A0E326-AE24-4C4F-AF25-EB32B6497342}]
22/07/2008 20:20 314752 --a------ C:\WINDOWS\system32\byXNdaaB.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [20/08/2004 15:55]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [20/08/2004 15:51]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [13/09/2004 11:33]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [19/11/2003 17:48]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [07/10/2004 19:44]
"@"="" []
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [30/10/2004 14:59]
"DVDSentry"="C:\WINDOWS\system32\DSentry.exe" [17/07/2002 10:18]
"VSOCheckTask"="C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" [08/07/2005 18:18]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [22/09/2005 18:29]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [11/01/2006 12:05]
"VirusScan Online"="C:\Program Files\McAfee.com\VSO\mcvsshld.exe" [10/08/2005 12:49]
"MPFExe"="C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe" [11/11/2005 17:00]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [28/10/2005 20:48]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [11/05/2005 23:12]
"Windows Media Connect 2"="C:\Program Files\Windows Media Connect 2\WMCCFG.exe" [18/10/2006 21:58]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [21/10/2006 10:01]
"OASClnt"="C:\Program Files\McAfee.com\VSO\oasclnt.exe" [11/08/2005 22:02]
"snpstd"="C:\WINDOWS\vsnpstd.exe" [31/12/2003 16:39]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [13/06/2006 05:20]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [09/08/2004 07:03]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [09/08/2004 07:03]
"4oD"="C:\Program Files\Kontiki\KHost.exe" [23/04/2007 11:23]
"Boob Idle Software Acid"="C:\Documents and Settings\All Users\Application Data\Part Long Boob Idle\boob plan.exe" [29/07/2008 17:14]
"bc6cadc8"="C:\WINDOWS\system32\sfhjuyjw.dll" [29/07/2008 11:13]
"BMbf5f9e54"="C:\WINDOWS\system32\kwddvyqa.dll" [29/07/2008 11:05]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RealPlayer"="C:\Program Files\Real\RealPlayer\realplay.exe" [05/06/2006 19:08]
"2book"="C:\DOCUME~1\Barry\APPLIC~1\INTERC~1\Vcthe.exe" [24/07/2008 10:34]
"kdx"="C:\Program Files\Kontiki\KHost.exe" [23/04/2007 11:23]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [18/10/2006 20:05]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe
C:\Documents and Settings\Barry\Start Menu\Programs\Startup\
DESKTOP.INI [11/08/2004 17:15:06]
Picture Motion Browser Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [30/06/2007 20:03:43]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [15/05/2003 01:19:50]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [14/12/2004 04:44:06]
DESKTOP.INI [11/08/2004 17:15:06]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [12/04/2005 15:05:35]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [17/02/1999 13:05:56]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{8D742974-DEA8-40F2-9008-9BAA973C958D}"= C:\WINDOWS\system32\yayvWnMd.dll [22/07/2008 20:15 25936]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 07/09/2004 16:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\yayvWnMd]
yayvWnMd.dll 22/07/2008 20:15 25936 C:\WINDOWS\SYSTEM32\yayvWnMd.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\byXNdaaB
-- Hosts -----------------------------------------------------------------------
127.0.0.1 bin.errorprotector.com ## added by CiD
127.0.0.1 br.errorsafe.com ## added by CiD
127.0.0.1 br.winantivirus.com ## added by CiD
127.0.0.1 br.winfixer.com ## added by CiD
127.0.0.1 cdn.drivecleaner.com ## added by CiD
127.0.0.1 cdn.errorsafe.com ## added by CiD
127.0.0.1 cdn.winsoftware.com ## added by CiD
127.0.0.1 de.errorsafe.com ## added by CiD
127.0.0.1 de.winantivirus.com ## added by CiD
127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
60 more entries in hosts file.
-- End of Deckard's System Scanner: finished at 2008-07-29 17:20:09 ------------