|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
07-14-2005, 05:32 AM
|
#1 (permalink) |
|
Registered User
Join Date: Aug 2004
Posts: 12
OS: XP Pro
|
Midtown Madness! Virus
Hi,
I was hit by something new, because neither Norton Antivirus 2005 nor Pc Cillin Online Scan knew it. Most of my program files now have a description which says (Midtown Madness Excutable) and most of the program logos have changed to a yellow Volkswagen Beetle !!! the programs of course are not working. I have Win XP Pro with SP2, Norton Internet Security 2005 plus SpySweeper 4.0 all installed and updated to the latest Here is my last HiJcakThis Log: Logfile of HijackThis v1.98.2 Scan saved at 01:31:14 PM, on 14/07/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\ctfmon.exe C:\Downloads\HiJack\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/?.intl=us R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://mail.yahoo.com/?.intl=us R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:4001 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [Opware12] "C:\Program Files\ScanSoft\OmniPagePro12.0\Opware12.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_08\bin\jusched.exe O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.usr" /startintray O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Executive Software\Diskeeper\DkIcon.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: HPAiODevice(hp officejet g series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet g series\Bin\hpoavn07.exe O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU) O12 - Plugin for .exe: C:\Program Files\Opera7\PLUGINS\NPGetRt1.dll O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O12 - Plugin for .zip: C:\Program Files\Opera7\PLUGINS\NPGetRt1.dll O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com...45/yacscom.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = acts.com O17 - HKLM\Software\..\Telephony: DomainName = acts.com O17 - HKLM\System\CCS\Services\Tcpip\..\{D139BD2F-F6D6-4B4F-B2D5-36175FCC54B3}: Domain = acts O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = acts.com O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = acts.com O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = acts.com |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
07-14-2005, 09:04 PM
|
#2 (permalink) |
|
Manager Emeritus - Security Center, Expert Analyst, Moderator - Security Team; Rangemaster, TSF Academy & Supporter
Join Date: Sep 2004
Location: Carmichaels, PA-USA
Posts: 6,963
OS: Windows 7
  |
Hi and Welcome to TSF
Before attacking an adware/spyware problem with hijackthis make sure you have already run ad-aware SE with VX2 add-on cleaner, Spybot Search & Destroy (with updated database) and CWShredder as these programs will clean a lot of the crap out first. All links to programs are in my signature. Please go to at least two of these sites and run an online Virus Scan. Be sure to have the AutoFix box(es) checked. http://housecall.trendmicro.com/ http://www3.ca.com/virusinfo/virusscan.aspx http://www.pandasoftware.com/actives..._principal.htm http://www.bitdefender.com/scan/license.php http://us.mcafee.com/root/mfs/default.asp http://security.symantec.com/sscv6/d...d=ie&venid=sym http://www3.ca.com/virusinfo/virusscan.aspx Then UPDATE your version of hijackthis and post a new log!
__________________
We Are The BORG Spyware KILLER and Adware Destroyer!
   Spyware/Adware Removal Tools Hijackthis Ad-aware SE Spybot Search&Destroy SpywareBlaster CWShredder |
|
|
|
|
07-16-2005, 06:14 AM
|
#3 (permalink) |
|
Registered User
Join Date: Aug 2004
Posts: 12
OS: XP Pro
|
I have used all of the online virus scanners you have recommended and afterwards scanned my system with the suggested adware and spyware removal tools and my problem still exist.!!! (I am sure that something new has hit me !!!)
Can I send you one of my infected files as a specimen?? I have updated my HijackThis program and here is the latest log: Logfile of HijackThis v1.99.1 Scan saved at 02:56:56 PM, on 16/07/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\Downloads\AdWare All\HiJack\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/?.intl=us R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://mail.yahoo.com/?.intl=us R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:4001 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [Opware12] "C:\Program Files\ScanSoft\OmniPagePro12.0\Opware12.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_08\bin\jusched.exe O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.usr" /startintray O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Executive Software\Diskeeper\DkIcon.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: HPAiODevice(hp officejet g series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet g series\Bin\hpoavn07.exe O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU) O12 - Plugin for .exe: C:\Program Files\Opera7\PLUGINS\NPGetRt1.dll O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O12 - Plugin for .zip: C:\Program Files\Opera7\PLUGINS\NPGetRt1.dll O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com...45/yacscom.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/v...fo/webscan.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = acts.com O17 - HKLM\Software\..\Telephony: DomainName = acts.com O17 - HKLM\System\CCS\Services\Tcpip\..\{D139BD2F-F6D6-4B4F-B2D5-36175FCC54B3}: Domain = acts O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = acts.com O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = acts.com O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = acts.com O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE O23 - Service: Symantec Event Manager (ccEvtMgr) - Angel Studios - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Network Proxy (ccProxy) - Angel Studios - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Angel Studios - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Angel Studios - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe O23 - Service: Office Source Engine (ose) - Angel Studios - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Angel Studios - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Angel Studios - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Angel Studios - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe O23 - Service: Symantec Core LC - Angel Studios - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe |
|
|
|
|
07-16-2005, 08:30 PM
|
#4 (permalink) |
|
Manager Emeritus - Security Center, Expert Analyst, Moderator - Security Team; Rangemaster, TSF Academy & Supporter
Join Date: Sep 2004
Location: Carmichaels, PA-USA
Posts: 6,963
OS: Windows 7
|
You can zip it up and attach it your next post. I see nothing showing in your log and have NOT heard of a trojan/virus/worm like your describing. This sounds like you have an issue with your EXE icons being assigned to that icon from Midtown Madness.
I do what you to post the following logs.... Download: StartDreck Unzip to its own folder and start the program: Press 'Config' Press 'Mark All' UN-Check the 'NT-Services & NT-Kernel...' boxes only: Press 'Ok' Press 'Save' and select the location to save the log file (default is the same folder as the application) Post the log in this thread.. Download Silent runners.Vbs http://www.silentrunners.org/ 1. Make sure you have any script blocking software disabled 2. Run the program. It will take a few minutes to complete. 3. Once complete it will produce a log named “StartupPrograms” with Your user and date in the filename. Open that txt file and posts it contents in your next post.
__________________
We Are The BORG Spyware KILLER and Adware Destroyer!
Spyware/Adware Removal Tools Hijackthis Ad-aware SE Spybot Search&Destroy SpywareBlaster CWShredder |
|
|
|
|
07-17-2005, 02:45 AM
|
#5 (permalink) |
|
Registered User
Join Date: Aug 2004
Posts: 12
OS: XP Pro
|
I have attached one of the infected apps (Windows Media Player 10) in Sample.zip
Below is the StartDreck log: StartDreck (build 2.1.7 public stable) - 2005-07-17 @ 10:55:07 (GMT +03:00) Platform: Windows XP (Win NT 5.1.2600 Service Pack 2) Internet Explorer: 6.0.2900.2180 Logged in as mmahmoud at MAMOUN »Registry »Run Keys »Current User »Run *CTFMON.EXE=C:\WINDOWS\system32\ctfmon.exe »RunOnce »Default User »Run *CTFMON.EXE=C:\WINDOWS\System32\CTFMON.EXE »RunOnce *Printing Migration=rundll32.exe C:\WINDOWS\System32\spool\migrate.dll,ProcessWin9xNetworkPrinters »Local Machine »Run *SystemTray=SysTray.Exe *IgfxTray=C:\WINDOWS\System32\igfxtray.exe *HotKeysCmds=C:\WINDOWS\System32\hkcmd.exe *Opware12="C:\Program Files\ScanSoft\OmniPagePro12.0\Opware12.exe" *TkBellExe="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot *RoxioEngineUtility="C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" *dla=C:\WINDOWS\system32\dla\tfswctrl.exe *UpdateManager="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r *ccApp="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" *Symantec NetDriver Monitor=C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer *SunJavaUpdateSched=C:\Program Files\Java\j2re1.4.2_08\bin\jusched.exe *SpySweeper="C:\Program Files\Webroot\Spy Sweeper\SpySweeper.usr" /startintray *DiskeeperSystray="C:\Program Files\Executive Software\Diskeeper\DkIcon.exe" +OptionalComponents +MSFS *Installed=1 +MAPI *NoChange=1 *Installed=1 +MAPI *NoChange=1 *Installed=1 »RunOnce »RunServices »RunServicesOnce »RunOnceEx »RunServicesOnceEx »File Associations (CR) +.bat *batfile="%1" %* +.com *comfile="%1" %* +.disabled *SpybotSD.DisabledFile="C:\Program Files\Spybot - Search & Destroy\blindman.exe" "%1" +.exe *exefile="%1" %* +.hta *htafile=C:\WINDOWS\System32\mshta.exe "%1" %* +.htm *htmlfile="C:\Program Files\Internet Explorer\iexplore.exe" -nohome +.html *htmlfile="C:\Program Files\Internet Explorer\iexplore.exe" -nohome +.js *JSFile=%SystemRoot%\System32\WScript.exe "%1" %* +.jse *JSEFile=%SystemRoot%\System32\WScript.exe "%1" %* +.pif *piffile="%1" %* +.reg *regfile=regedit.exe "%1" +.scr *AutoCADScriptFile="C:\WINDOWS\notepad.exe" "%1" +.txt *txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1 +.vbs *VBSFile=%SystemRoot%\System32\WScript.exe "%1" %* +.vbe *VBEFile=%SystemRoot%\System32\WScript.exe "%1" %* +.wsh *WSHFile=%SystemRoot%\System32\WScript.exe "%1" %* +.wsf *WSFFile=%SystemRoot%\System32\WScript.exe "%1" %* +.lnk `lnkfile= [key or value does not exist] »Active Setup (LM) +Internet Explorer/>{26923b43-4d38-484f-9b9e-de460746276c} *StubPath=%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE +Browser Customizations/>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS *StubPath=RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP +Outlook Express/>{881dd1c5-3dcf-431b-b061-f3f88e8be88a} *StubPath=%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE +Themes Setup/{2C7339CF-2B09-4501-B3F3-F3508C9228ED} *StubPath=%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll +Microsoft Outlook Express 6/{44BBA840-CC51-11CF-AAFA-00AA00B6015C} *StubPath="%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install +NetMeeting 3.01/{44BBA842-CC51-11CF-AAFA-00AA00B6015B} *StubPath=rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT +Internet Explorer/{4b218e3e-bc98-4770-93d3-2731b9329278} *StubPath=%SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection MarketplaceLinkInstall 896 %systemroot%\inf\ie.inf +Windows Messenger 4.7/{5945c046-1e7d-11d1-bc44-00c04fd912be} *StubPath=rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser +Microsoft Windows Media Player/{6BF52A52-394A-11d3-B153-00C04F79FAA6} *StubPath=rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub +Address Book 6/{7790769C-0471-11d2-AF11-00C04FA35D02} *StubPath="%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install +Windows Desktop Update/{89820200-ECBD-11cf-8B85-00AA005B4340} *StubPath=regsvr32.exe /s /n /i:U shell32.dll +Internet Explorer 6/{89820200-ECBD-11cf-8B85-00AA005B4383} *StubPath=%SystemRoot%\system32\ie4uinit.exe +Windows Desktop Update/{89820200-ECBD-11cf-8B85-00AA005B4395} *StubPath=regsvr32.exe /s /n /i:U shell32.dll +Fax/{8b15971b-5355-4c82-8c07-7e181ea07608} *StubPath=rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser +CRLUpdate/{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11} *StubPath=C:\WINDOWS\SYSTEM32\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl +Power Policy Settings/{CA0A4247-44BE-11d1-A005-00805F8ABE06} *StubPath=RunDLL setupx.dll,InstallHinfSection PowerCfg.user 0 powercfg.inf »Browser Helper Objects (LM) *AcroIEHelper.AcroIEHlprObj.1/{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} `InprocServer32=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll *Msie2gr.bho2gr.1/{31FF080D-12A3-439A-A2EF-4BA95A3148E8} `InprocServer32=C:\Program Files\GetRight\xx2gr.dll *{53707962-6F74-2D53-2644-206D7942484F} `InprocServer32=C:\Program Files\Spybot - Search & Destroy\SDHelper.dll *DriveLetterAccess/{5CA3D70E-1895-11CF-8E15-001234567890} `InprocServer32=C:\WINDOWS\system32\dla\tfswshx.dll *Nisbho.CNisExtBho.1/{9ECB9560-04F9-4bbc-943D-298DDF1699E1} `InprocServer32=C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll *Navbho.CNavExtBho.1/{BDF3E430-B101-42AD-A544-FADC6B084872} `InprocServer32=C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll »Internet Explorer »Current User *Local Page=c:\windows\system32\blank.htm *Search Bar= *Search Page= *Start Page=http://mail.yahoo.com/?.intl=us *CustomizeSearch=http://ie.search.msn.com/{sub_rfc1766}/srchasst/srchcust.htm *SearchAssistant= +SearchUrl *provider= *=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch »Default User *Local Page=C:\WINDOWS\SYSTEM\blank.htm *Search Page=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch *Start Page=http://mail.yahoo.com/?.intl=us +SearchUrl *provider= »Local Machine *Default_Page_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome *Default_Search_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch *Local Page=C:\WINDOWS\SYSTEM32\blank.htm *Search Bar= *Search Page=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch *Start Page=http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home *CustomizeSearch=http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm *SearchAssistant=http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm »ShellServiceObjectDelayLoad (LM) *PostBootReminder={7849596a-48ea-486e-8937-a2a3009f31a9} `InprocServer32=%SystemRoot%\system32\SHELL32.dll *CDBurn={fbeb8a05-beee-4442-804e-409d6c4515e9} `InprocServer32=%SystemRoot%\system32\SHELL32.dll *WebCheck={E6FB5E20-DE35-11CF-9C87-00AA005127ED} `InprocServer32=%SystemRoot%\System32\webcheck.dll *SysTray={35CEC8A3-2BE6-11D2-8773-92E220524153} `InprocServer32=C:\WINDOWS\System32\stobject.dll *UPnPMonitor={e57ce738-33e8-4c51-8354-bb4de9d215d1} `InprocServer32=C:\WINDOWS\system32\upnpui.dll »Special NT Values »Current User *Load= *Run= *Programs=com exe bat pif cmd *SHELL= »Default User *Load= *Run= *Programs=com exe bat pif cmd *SHELL= »Local Machine *AppInit_DLLs= *SHELL=Explorer.exe *Userinit=C:\WINDOWS\system32\userinit.exe, »Files »Autostart Folders »Current User *C:\Documents and Settings\mmahmoud.ACTS\Start Menu\Programs\Startup\desktop.ini »Default User *C:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\Startup\desktop.ini »Local Machine *C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini *C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HPAiODevice(hp officejet g series) - 1.lnk *C:\Documents and Settings\All Users\Start Menu\Programs\Startup\GetRight - Tray Icon.lnk *C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk »INI-Files »WIN.INI\[windows] *LOAD= *RUN= »SYSTEM.INI\[boot] *SHELL=Explorer.exe »Text Files *C:\boot.ini `[boot loader] `timeout=5 `default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS `[operating systems] `multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn *C:\msdos.sys `[Paths] `WinDir=C:\WINDOWS `WinBootDir=C:\WINDOWS `HostWinBootDrv=C `[Options] `BootMulti=1 `BootGUI=1 `AutoScan=1 `WinVer=4.90.3000 `; `;The following lines are required for compatibility with other programs. `;Do not remove them (MSDOS.SYS needs to be >1024 bytes). `;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxa `;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxb `;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxc `;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxd `;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxe `;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxf `;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxg `;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxh `;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxi `;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxj `;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxk `;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxl `;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxm `;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxn `;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxo `;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxp `;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxq `;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxr `;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxs *C:\config.sys *C:\WINDOWS\system32\config.nt `dos=high, umb `device=%SystemRoot%\system32\himem.sys `files=40 *C:\WINDOWS\wininit.ini `[rename] `C:\WINDOWS\system32\dsktrf.dll=C:\DOCUME~1\MMAHMO~1.ACT\LOCALS~1\Temp\WIN41.tmp `NUL=C:\WINDOWS\polall1r.exe `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= *C:\WINDOWS\winstart.bat `@C:\WINDOWS\tmpcpyis.bat *C:\WINDOWS\system32\drivers\etc\hosts `127.0.0.1 localhost »Program Files *C:\ntldr *C:\ntdetect.com *C:\io.sys *C:\WINDOWS\system32\win.com *C:\WINDOWS\explorer.exe »%PATH% Companion Files +C:\WINDOWS\system32\hh.exe *C:\WINDOWS\hh.exe +C:\WINDOWS\system32\java.exe *C:\WINDOWS\java.exe +C:\WINDOWS\system32\javaw.exe *C:\WINDOWS\javaw.exe +C:\WINDOWS\system32\setver.exe *C:\WINDOWS\SETVER.EXE +C:\WINDOWS\system32\taskman.exe *C:\WINDOWS\TASKMAN.EXE +C:\WINDOWS\system32\winhlp32.exe *C:\WINDOWS\winhlp32.exe +C:\WINDOWS\system32\dfrgfat.exe *C:\Program Files\Executive Software\Diskeeper\DfrgFAT.exe +C:\WINDOWS\system32\dfrgntfs.exe *C:\Program Files\Executive Software\Diskeeper\DfrgNTFS.exe +C:\WINDOWS\system32\winmine.exe *C:\WINDOWS\Winmine.exe +C:\WINDOWS\system32\sol.exe *C:\WINDOWS\Sol.exe +C:\WINDOWS\system32\notepad.exe *C:\WINDOWS\Notepad.exe +C:\WINDOWS\system32\slrundll.exe *C:\WINDOWS\slrundll.exe +C:\PROGRA~1\COMMON~1\AUTODE~1\WSCommCntr1.exe *C:\Program Files\Common Files\Autodesk Shared\WSCommCntr1.exe +C:\PROGRA~1\COMMON~1\AUTODE~1\AcHelp.exe *C:\Program Files\Common Files\Autodesk Shared\AcHelp.exe +C:\PROGRA~1\COMMON~1\AUTODE~1\mtstack16.exe *C:\Program Files\Common Files\Autodesk Shared\mtstack16.exe +C:\PROGRA~1\COMMON~1\AUTODE~1\PLU.exe *C:\Program Files\Common Files\Autodesk Shared\PLU.exe »System/Drivers »Running Processes +0=<idle> +4=<system> +360=\SystemRoot\System32\smss.exe *C:\WINDOWS\system32\ntdll.dll +476=\??\C:\WINDOWS\system32\csrss.exe *C:\WINDOWS\system32\ntdll.dll *C:\WINDOWS\system32\CSRSRV.dll *C:\WINDOWS\system32\basesrv.dll *C:\WINDOWS\system32\winsrv.dll *C:\WINDOWS\system32\GDI32.dll *C:\WINDOWS\system32\KERNEL32.dll *C:\WINDOWS\system32\USER32.dll *C:\WINDOWS\system32\LPK.DLL *C:\WINDOWS\system32\USP10.dll *C:\WINDOWS\system32\msvcrt.dll *C:\WINDOWS\system32\ADVAPI32.dll *C:\WINDOWS\system32\RPCRT4.dll *C:\WINDOWS\system32\sxs.dll *C:\WINDOWS\system32\Apphelp.dll *C:\WINDOWS\system32\VERSION.dll +500=\??\C:\WINDOWS\system32\winlogon.exe *C:\WINDOWS\system32\ntdll.dll *C:\WINDOWS\system32\kernel32.dll *C:\WINDOWS\system32\ADVAPI32.dll *C:\WINDOWS\system32\RPCRT4.dll *C:\WINDOWS\system32\AUTHZ.dll *C:\WINDOWS\system32\msvcrt.dll *C:\WINDOWS\system32\CRYPT32.dll *C:\WINDOWS\system32\USER32.dll *C:\WINDOWS\system32\GDI32.dll *C:\WINDOWS\system32\MSASN1.dll *C:\WINDOWS\system32\NDdeApi.dll *C:\WINDOWS\system32\PROFMAP.dll *C:\WINDOWS\system32\NETAPI32.dll *C:\WINDOWS\system32\USERENV.dll *C:\WINDOWS\system32\PSAPI.DLL *C:\WINDOWS\system32\REGAPI.dll *C:\WINDOWS\system32\Secur32.dll *C:\WINDOWS\system32\SETUPAPI.dll *C:\WINDOWS\system32\VERSION.dll *C:\WINDOWS\system32\WINSTA.dll *C:\WINDOWS\system32\WINTRUST.dll *C:\WINDOWS\system32\IMAGEHLP.dll *C:\WINDOWS\system32\WS2_32.dll *C:\WINDOWS\system32\WS2HELP.dll *C:\WINDOWS\system32\LPK.DLL *C:\WINDOWS\system32\USP10.dll *C:\WINDOWS\system32\MSGINA.dll *C:\WINDOWS\system32\SHELL32.dll *C:\WINDOWS\system32\SHLWAPI.dll *C:\WINDOWS\system32\COMCTL32.dll *C:\WINDOWS\system32\ODBC32.dll *C:\WINDOWS\system32\comdlg32.dll *C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll *C:\WINDOWS\system32\odbcint.dll *C:\WINDOWS\system32\SHSVCS.dll *C:\WINDOWS\system32\sfc.dll *C:\WINDOWS\system32\sfc_os.dll *C:\WINDOWS\system32\ole32.dll *C:\WINDOWS\system32\Apphelp.dll *C:\WINDOWS\system32\WINSCARD.DLL *C:\WINDOWS\system32\WTSAPI32.dll *C:\WINDOWS\system32\WINMM.dll *C:\WINDOWS\system32\serwvdrv.dll *C:\WINDOWS\system32\umdmxfrm.dll *C:\WINDOWS\system32\cscdll.dll *C:\WINDOWS\system32\WlNotify.dll *C:\WINDOWS\system32\WINSPOOL.DRV *C:\WINDOWS\system32\MPR.dll *C:\WINDOWS\system32\rsaenh.dll *C:\WINDOWS\system32\UxTheme.dll *C:\WINDOWS\system32\msv1_0.dll *C:\WINDOWS\system32\iphlpapi.dll *C:\WINDOWS\system32\SAMLIB.dll *C:\WINDOWS\system32\cscui.dll *C:\WINDOWS\system32\xpsp2res.dll *C:\WINDOWS\system32\msacm32.drv *C:\WINDOWS\system32\MSACM32.dll *C:\WINDOWS\system32\NTMARTA.DLL *C:\WINDOWS\system32\WLDAP32.dll *C:\WINDOWS\system32\l3codecp.acm *C:\WINDOWS\system32\imaadp32.acm *C:\WINDOWS\system32\msadp32.acm *C:\WINDOWS\system32\msg711.acm *C:\WINDOWS\system32\msgsm32.acm *C:\WINDOWS\system32\tssoft32.acm *C:\WINDOWS\system32\tsd32.dll *C:\WINDOWS\system32\msg723.acm *C:\WINDOWS\system32\msaud32.acm *C:\WINDOWS\system32\sl_anet.acm *C:\WINDOWS\System32\l3codeca.acm *C:\WINDOWS\System32\iac25_32.ax *C:\WINDOWS\system32\lhacm.acm *C:\WINDOWS\system32\COMRes.dll *C:\WINDOWS\system32\OLEAUT32.dll *C:\WINDOWS\system32\CLBCATQ.DLL +544=C:\WINDOWS\system32\services.exe *C:\WINDOWS\system32\ntdll.dll *C:\WINDOWS\system32\kernel32.dll *C:\WINDOWS\system32\msvcrt.dll *C:\WINDOWS\system32\ADVAPI32.dll *C:\WINDOWS\system32\RPCRT4.dll *C:\WINDOWS\system32\USER32.dll *C:\WINDOWS\system32\GDI32.dll *C:\WINDOWS\system32\USERENV.dll *C:\WINDOWS\system32\SCESRV.dll *C:\WINDOWS\system32\AUTHZ.dll *C:\WINDOWS\system32\umpnpmgr.dll *C:\WINDOWS\system32\WINSTA.dll *C:\WINDOWS\system32\NETAPI32.dll *C:\WINDOWS\system32\NCObjAPI.DLL *C:\WINDOWS\system32\MSVCP60.dll *C:\WINDOWS\system32\ShimEng.dll *C:\WINDOWS\AppPatch\AcGenral.DLL *C:\WINDOWS\system32\WINMM.dll *C:\WINDOWS\system32\ole32.dll *C:\WINDOWS\system32\OLEAUT32.dll *C:\WINDOWS\system32\MSACM32.dll *C:\WINDOWS\system32\VERSION.dll *C:\WINDOWS\system32\SHELL32.dll *C:\WINDOWS\system32\SHLWAPI.dll *C:\WINDOWS\system32\UxTheme.dll *C:\WINDOWS\system32\LPK.DLL *C:\WINDOWS\system32\USP10.dll *C:\WINDOWS\system32\serwvdrv.dll *C:\WINDOWS\system32\umdmxfrm.dll *C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll *C:\WINDOWS\system32\comctl32.dll *C:\WINDOWS\system32\secur32.dll *C:\WINDOWS\system32\Apphelp.dll *C:\WINDOWS\system32\eventlog.dll *C:\WINDOWS\system32\WS2_32.dll *C:\WINDOWS\system32\WS2HELP.dll *C:\WINDOWS\system32\PSAPI.DLL *C:\WINDOWS\system32\wtsapi32.dll +556=C:\WINDOWS\system32\lsass.exe *C:\WINDOWS\system32\ntdll.dll *C:\WINDOWS\system32\kernel32.dll *C:\WINDOWS\system32\ADVAPI32.dll *C:\WINDOWS\system32\RPCRT4.dll *C:\WINDOWS\system32\LSASRV.dll *C:\WINDOWS\system32\MPR.dll *C:\WINDOWS\system32\USER32.dll *C:\WINDOWS\system32\GDI32.dll *C:\WINDOWS\system32\MSASN1.dll *C:\WINDOWS\system32\msvcrt.dll *C:\WINDOWS\system32\NETAPI32.dll *C:\WINDOWS\system32\NTDSAPI.dll *C:\WINDOWS\system32\DNSAPI.dll *C:\WINDOWS\system32\WS2_32.dll *C:\WINDOWS\system32\WS2HELP.dll *C:\WINDOWS\system32\WLDAP32.dll *C:\WINDOWS\system32\Secur32.dll *C:\WINDOWS\system32\SAMLIB.dll *C:\WINDOWS\system32\SAMSRV.dll *C:\WINDOWS\system32\cryptdll.dll *C:\WINDOWS\system32\ShimEng.dll *C:\WINDOWS\AppPatch\AcGenral.DLL *C:\WINDOWS\system32\WINMM.dll *C:\WINDOWS\system32\ole32.dll *C:\WINDOWS\system32\OLEAUT32.dll *C:\WINDOWS\system32\MSACM32.dll *C:\WINDOWS\system32\VERSION.dll *C:\WINDOWS\system32\SHELL32.dll *C:\WINDOWS\system32\SHLWAPI.dll *C:\WINDOWS\system32\USERENV.dll *C:\WINDOWS\system32\UxTheme.dll *C:\WINDOWS\system32\LPK.DLL *C:\WINDOWS\system32\USP10.dll *C:\WINDOWS\system32\serwvdrv.dll *C:\WINDOWS\system32\umdmxfrm.dll *C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll *C:\WINDOWS\system32\comctl32.dll *C:\WINDOWS\system32\msprivs.dll *C:\WINDOWS\system32\kerberos.dll *C:\WINDOWS\system32\msv1_0.dll *C:\WINDOWS\system32\iphlpapi.dll *C:\WINDOWS\system32\netlogon.dll *C:\WINDOWS\system32\w32time.dll *C:\WINDOWS\system32\MSVCP60.dll *C:\WINDOWS\system32\schannel.dll *C:\WINDOWS\system32\CRYPT32.dll *C:\WINDOWS\system32\wdigest.dll *C:\WINDOWS\system32\rsaenh.dll *C:\WINDOWS\system32\scecli.dll *C:\WINDOWS\system32\SETUPAPI.dll *C:\WINDOWS\system32\mswsock.dll *C:\WINDOWS\system32\hnetcfg.dll *C:\WINDOWS\System32\wshtcpip.dll *C:\WINDOWS\system32\dssenh.dll +696=C:\WINDOWS\system32\svchost.exe *C:\WINDOWS\system32\ntdll.dll *C:\WINDOWS\system32\kernel32.dll *C:\WINDOWS\system32\ADVAPI32.dll *C:\WINDOWS\system32\RPCRT4.dll *C:\WINDOWS\system32\ShimEng.dll *C:\WINDOWS\AppPatch\AcGenral.DLL *C:\WINDOWS\system32\USER32.dll *C:\WINDOWS\system32\GDI32.dll *C:\WINDOWS\system32\WINMM.dll *C:\WINDOWS\system32\ole32.dll *C:\WINDOWS\system32\msvcrt.dll *C:\WINDOWS\system32\OLEAUT32.dll *C:\WINDOWS\system32\MSACM32.dll *C:\WINDOWS\system32\VERSION.dll *C:\WINDOWS\system32\SHELL32.dll *C:\WINDOWS\system32\SHLWAPI.dll *C:\WINDOWS\system32\USERENV.dll *C:\WINDOWS\system32\UxTheme.dll *C:\WINDOWS\system32\LPK.DLL *C:\WINDOWS\system32\USP10.dll *C:\WINDOWS\system32\serwvdrv.dll *C:\WINDOWS\system32\umdmxfrm.dll *C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll *C:\WINDOWS\system32\comctl32.dll *C:\WINDOWS\system32\NTMARTA.DLL *C:\WINDOWS\system32\WLDAP32.dll *C:\WINDOWS\system32\SAMLIB.dll *c:\windows\system32\rpcss.dll *c:\windows\system32\Secur32.dll *c:\windows\system32\WS2_32.dll *c:\windows\system32\WS2HELP.dll *C:\WINDOWS\system32\xpsp2res.dll *c:\windows\system32\termsrv.dll *c:\windows\system32\ICAAPI.dll *c:\windows\system32\SETUPAPI.dll *C:\WINDOWS\system32\WINTRUST.dll *C:\WINDOWS\system32\CRYPT32.dll *C:\WINDOWS\system32\MSASN1.dll *C:\WINDOWS\system32\IMAGEHLP.dll *c:\windows\system32\AUTHZ.dll *c:\windows\system32\mstlsapi.dll *c:\windows\system32\ACTIVEDS.dll *c:\windows\system32\adsldpc.dll *C:\WINDOWS\system32\NETAPI32.dll *c:\windows\system32\ATL.DLL *C:\WINDOWS\system32\REGAPI.dll *C:\WINDOWS\system32\rsaenh.dll *C:\WINDOWS\system32\CLBCATQ.DLL *C:\WINDOWS\system32\COMRes.dll *C:\WINDOWS\system32\Apphelp.dll +752=C:\WINDOWS\system32\svchost.exe *C:\WINDOWS\system32\ntdll.dll *C:\WINDOWS\system32\kernel32.dll *C:\WINDOWS\system32\ADVAPI32.dll *C:\WINDOWS\system32\RPCRT4.dll *C:\WINDOWS\system32\ShimEng.dll *C:\WINDOWS\AppPatch\AcGenral.DLL *C:\WINDOWS\system32\USER32.dll *C:\WINDOWS\system32\GDI32.dll *C:\WINDOWS\system32\WINMM.dll *C:\WINDOWS\system32\ole32.dll *C:\WINDOWS\system32\msvcrt.dll *C:\WINDOWS\system32\OLEAUT32.dll *C:\WINDOWS\system32\MSACM32.dll *C:\WINDOWS\system32\VERSION.dll *C:\WINDOWS\system32\SHELL32.dll *C:\WINDOWS\system32\SHLWAPI.dll *C:\WINDOWS\system32\USERENV.dll *C:\WINDOWS\system32\UxTheme.dll *C:\WINDOWS\system32\LPK.DLL *C:\WINDOWS\system32\USP10.dll *C:\WINDOWS\system32\serwvdrv.dll *C:\WINDOWS\system32\umdmxfrm.dll *C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll *C:\WINDOWS\system32\comctl32.dll *c:\windows\system32\rpcss.dll *c:\windows\system32\Secur32.dll *c:\windows\system32\WS2_32.dll *c:\windows\system32\WS2HELP.dll *C:\WINDOWS\system32\xpsp2res.dll *C:\WINDOWS\system32\rsaenh.dll *C:\WINDOWS\system32\mswsock.dll *C:\WINDOWS\system32\hnetcfg.dll *C:\WINDOWS\System32\wshtcpip.dll *C:\WINDOWS\system32\DNSAPI.dll *C:\WINDOWS\system32\iphlpapi.dll *C:\WINDOWS\System32\winrnr.dll *C:\WINDOWS\system32\WLDAP32.dll *C:\WINDOWS\system32\rasadhlp.dll *C:\WINDOWS\system32\CLBCATQ.DLL *C:\WINDOWS\system32\COMRes.dll +836=C:\WINDOWS\System32\svchost.exe *C:\WINDOWS\system32\ntdll.dll *C:\WINDOWS\system32\kernel32.dll *C:\WINDOWS\system32\ADVAPI32.dll *C:\WINDOWS\system32\RPCRT4.dll *C:\WINDOWS\System32\ShimEng.dll *C:\WINDOWS\AppPatch\AcGenral.DLL *C:\WINDOWS\system32\USER32.dll *C:\WINDOWS\system32\GDI32.dll *C:\WINDOWS\System32\WINMM.dll *C:\WINDOWS\system32\ole32.dll *C:\WINDOWS\system32\msvcrt.dll *C:\WINDOWS\system32\OLEAUT32.dll *C:\WINDOWS\System32\MSACM32.dll *C:\WINDOWS\system32\VERSION.dll *C:\WINDOWS\system32\SHELL32.dll *C:\WINDOWS\system32\SHLWAPI.dll *C:\WINDOWS\system32\USERENV.dll *C:\WINDOWS\System32\UxTheme.dll *C:\WINDOWS\System32\LPK.DLL *C:\WINDOWS\System32\USP10.dll *C:\WINDOWS\System32\serwvdrv.dll *C:\WINDOWS\System32\umdmxfrm.dll *C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll *C:\WINDOWS\system32\comctl32.dll *C:\WINDOWS\System32\NTMARTA.DLL *C:\WINDOWS\system32\WLDAP32.dll *C:\WINDOWS\System32\SAMLIB.dll *C:\WINDOWS\System32\xpsp2res.dll *c:\windows\system32\dhcpcsvc.dll *c:\windows\system32\DNSAPI.dll *c:\windows\system32\WS2_32.dll *c:\windows\system32\WS2HELP.dll *c:\windows\system32\iphlpapi.dll *c:\windows\system32\Secur32.dll *C:\WINDOWS\system32\mswsock.dll *C:\WINDOWS\System32\hnetcfg.dll *C:\WINDOWS\System32\wshtcpip.dll *c:\windows\system32\wzcsvc.dll *c:\windows\system32\rtutils.dll *c:\windows\system32\WMI.dll *C:\WINDOWS\system32\CRYPT32.dll *C:\WINDOWS\system32\MSASN1.dll *c:\windows\system32\WTSAPI32.dll *c:\windows\system32\WINSTA.dll *C:\WINDOWS\system32\NETAPI32.dll *c:\windows\system32\ESENT.dll *c:\windows\system32\ATL.DLL *C:\WINDOWS\System32\rsaenh.dll *C:\WINDOWS\System32\SETUPAPI.DLL *C:\WINDOWS\System32\rastls.dll *C:\WINDOWS\system32\CRYPTUI.dll *C:\WINDOWS\system32\WINTRUST.dll *C:\WINDOWS\system32\IMAGEHLP.dll *C:\WINDOWS\system32\WININET.dll *C:\WINDOWS\System32\MPRAPI.dll *C:\WINDOWS\System32\ACTIVEDS.dll *C:\WINDOWS\System32\adsldpc.dll *C:\WINDOWS\System32\RASAPI32.dll *C:\WINDOWS\System32\rasman.dll *C:\WINDOWS\System32\TAPI32.dll *C:\WINDOWS\System32\SCHANNEL.dll *C:\WINDOWS\System32\WinSCard.dll *C:\WINDOWS\System32\raschap.dll *C:\WINDOWS\system32\msv1_0.dll *c:\windows\system32\wkssvc.dll *c:\windows\system32\NTDSAPI.dll *c:\windows\system32\cryptsvc.dll *c:\windows\system32\certcli.dll *c:\windows\system32\srsvc.dll *c:\windows\system32\POWRPROF.dll *c:\windows\system32\netman.dll *c:\windows\system32\netshell.dll *c:\windows\system32\credui.dll *c:\windows\system32\WZCSAPI.DLL *c:\windows\system32\srvsvc.dll *C:\WINDOWS\System32\CLBCATQ.DLL *C:\WINDOWS\System32\COMRes.dll *c:\windows\pchealth\helpctr\binaries\pchsvc.dll *c:\windows\system32\dmserver.dll *C:\WINDOWS\System32\winspool.drv *c:\windows\system32\wbem\wmisvc.dll *C:\WINDOWS\system32\VSSAPI.DLL *c:\windows\system32\browser.dll *c:\windows\system32\ipnathlp.dll *c:\windows\system32\AUTHZ.dll *C:\WINDOWS\System32\wbem\wbemcomn.dll *C:\WINDOWS\system32\WBEM\wbemcore.dll *C:\WINDOWS\System32\MSVCP60.dll *C:\WINDOWS\system32\WBEM\esscli.dll *C:\WINDOWS\system32\WBEM\FastProx.dll *C:\WINDOWS\System32\wbem\wbemsvc.dll *C:\WINDOWS\System32\wbem\wmiutils.dll *C:\WINDOWS\System32\wbem\repdrvfs.dll *C:\WINDOWS\System32\wbem\wmiprvsd.dll *C:\WINDOWS\system32\NCObjAPI.DLL *C:\WINDOWS\System32\wbem\wbemess.dll *C:\WINDOWS\System32\netcfgx.dll *C:\WINDOWS\System32\CLUSAPI.dll *C:\WINDOWS\System32\rasmans.dll *C:\WINDOWS\System32\Sens.dll *C:\WINDOWS\System32\WINIPSEC.DLL *C:\WINDOWS\system32\Apphelp.dll *C:\WINDOWS\System32\msi.dll *C:\WINDOWS\System32\SXS.DLL *C:\WINDOWS\System32\wbem\ncprov.dll +876=C:\WINDOWS\System32\svchost.exe *C:\WINDOWS\system32\ntdll.dll *C:\WINDOWS\system32\kernel32.dll *C:\WINDOWS\system32\ADVAPI32.dll *C:\WINDOWS\system32\RPCRT4.dll *C:\WINDOWS\System32\ShimEng.dll *C:\WINDOWS\AppPatch\AcGenral.DLL *C:\WINDOWS\system32\USER32.dll *C:\WINDOWS\system32\GDI32.dll *C:\WINDOWS\System32\WINMM.dll *C:\WINDOWS\system32\ole32.dll *C:\WINDOWS\system32\msvcrt.dll *C:\WINDOWS\system32\OLEAUT32.dll *C:\WINDOWS\System32\MSACM32.dll *C:\WINDOWS\system32\VERSION.dll *C:\WINDOWS\system32\SHELL32.dll *C:\WINDOWS\system32\SHLWAPI.dll *C:\WINDOWS\system32\USERENV.dll *C:\WINDOWS\System32\UxTheme.dll *C:\WINDOWS\System32\LPK.DLL *C:\WINDOWS\System32\USP10.dll *C:\WINDOWS\System32\serwvdrv.dll *C:\WINDOWS\System32\umdmxfrm.dll *C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll *C:\WINDOWS\system32\comctl32.dll *c:\windows\system32\dnsrslvr.dll *c:\windows\system32\DNSAPI.dll *c:\windows\system32\WS2_32.dll *c:\windows\system32\WS2HELP.dll *c:\windows\system32\iphlpapi.dll *C:\WINDOWS\system32\mswsock.dll *C:\WINDOWS\System32\hnetcfg.dll *C:\WINDOWS\System32\wshtcpip.dll +972=C:\WINDOWS\System32\svchost.exe *C:\WINDOWS\system32\ntdll.dll *C:\WINDOWS\system32\kernel32.dll *C:\WINDOWS\system32\ADVAPI32.dll *C:\WINDOWS\system32\RPCRT4.dll *C:\WINDOWS\System32\ShimEng.dll *C:\WINDOWS\AppPatch\AcGenral.DLL *C:\WINDOWS\system32\USER32.dll *C:\WINDOWS\system32\GDI32.dll *C:\WINDOWS\System32\WINMM.dll *C:\WINDOWS\system32\ole32.dll *C:\WINDOWS\system32\msvcrt.dll *C:\WINDOWS\system32\OLEAUT32.dll *C:\WINDOWS\System32\MSACM32.dll *C:\WINDOWS\system32\VERSION.dll *C:\WINDOWS\system32\SHELL32.dll *C:\WINDOWS\system32\SHLWAPI.dll *C:\WINDOWS\system32\USERENV.dll *C:\WINDOWS\System32\UxTheme.dll *C:\WINDOWS\System32\LPK.DLL *C:\WINDOWS\System32\USP10.dll *C:\WINDOWS\System32\serwvdrv.dll *C:\WINDOWS\System32\umdmxfrm.dll *C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll *C:\WINDOWS\system32\comctl32.dll *C:\WINDOWS\System32\NTMARTA.DLL *C:\WINDOWS\system32\WLDAP32.dll *C:\WINDOWS\System32\SAMLIB.dll *C:\WINDOWS\System32\xpsp2res.dll *c:\windows\system32\lmhsvc.dll *c:\windows\system32\iphlpapi.dll *c:\windows\system32\WS2_32.dll *c:\windows\system32\WS2HELP.dll +1208=C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe *C:\WINDOWS\system32\ntdll.dll *C:\WINDOWS\system32\kernel32.dll *C:\WINDOWS\system32\user32.dll *C:\WINDOWS\system32\GDI32.dll *C:\WINDOWS\system32\advapi32.dll *C:\WINDOWS\system32\RPCRT4.dll *C:\WINDOWS\system32\oleaut32.dll *C:\WINDOWS\system32\msvcrt.dll *C:\WINDOWS\system32\ole32.dll *C:\WINDOWS\system32\mpr.dll *C:\WINDOWS\system32\version.dll *C:\WINDOWS\system32\comctl32.dll *C:\WINDOWS\system32\wininet.dll *C:\WINDOWS\system32\CRYPT32.dll *C:\WINDOWS\system32\MSASN1.dll *C:\WINDOWS\system32\SHLWAPI.dll *C:\WINDOWS\system32\shell32.dll *C:\WINDOWS\system32\comdlg32.dll *C:\WINDOWS\system32\wsock32.dll *C:\WINDOWS\system32\WS2_32.dll *C:\WINDOWS\system32\WS2HELP.dll *C:\WINDOWS\system32\iphlpapi.dll *C:\WINDOWS\system32\IMAGEHLP.DLL *C:\WINDOWS\system32\LPK.DLL *C:\WINDOWS\system32\USP10.dll *C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll *C:\WINDOWS\system32\xpsp2res.dll *C:\WINDOWS\system32\olepro32.dll *C:\WINDOWS\system32\vdmdbg.dll *C:\WINDOWS\system32\wtsapi32.dll *C:\WINDOWS\system32\WINSTA.dll *C:\WINDOWS\system32\NETAPI32.dll *C:\WINDOWS\system32\NTMARTA.DLL *C:\WINDOWS\system32\WLDAP32.dll *C:\WINDOWS\system32\SAMLIB.dll *C:\WINDOWS\system32\SETUPAPI.dll *C:\WINDOWS\system32\SXS.DLL *C:\WINDOWS\system32\CLBCATQ.DLL *C:\WINDOWS\system32\COMRes.dll +1844=C:\WINDOWS\Explorer.EXE *C:\WINDOWS\system32\ntdll.dll *C:\WINDOWS\system32\kernel32.dll *C:\WINDOWS\system32\msvcrt.dll *C:\WINDOWS\system32\ADVAPI32.dll *C:\WINDOWS\system32\RPCRT4.dll *C:\WINDOWS\system32\GDI32.dll *C:\WINDOWS\system32\USER32.dll *C:\WINDOWS\system32\SHLWAPI.dll *C:\WINDOWS\system32\SHELL32.dll *C:\WINDOWS\system32\ole32.dll *C:\WINDOWS\system32\OLEAUT32.dll *C:\WINDOWS\system32\BROWSEUI.dll *C:\WINDOWS\system32\SHDOCVW.dll *C:\WINDOWS\system32\CRYPT32.dll *C:\WINDOWS\system32\MSASN1.dll *C:\WINDOWS\system32\CRYPTUI.dll *C:\WINDOWS\system32\WINTRUST.dll *C:\WINDOWS\system32\IMAGEHLP.dll *C:\WINDOWS\system32\NETAPI32.dll *C:\WINDOWS\system32\WININET.dll *C:\WINDOWS\system32\WLDAP32.dll *C:\WINDOWS\system32\VERSION.dll *C:\WINDOWS\system32\UxTheme.dll *C:\WINDOWS\system32\ShimEng.dll *C:\WINDOWS\AppPatch\AcGenral.DLL *C:\WINDOWS\system32\WINMM.dll *C:\WINDOWS\system32\MSACM32.dll *C:\WINDOWS\system32\USERENV.dll *C:\WINDOWS\system32\LPK.DLL *C:\WINDOWS\system32\USP10.dll *C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll *C:\WINDOWS\system32\comctl32.dll *C:\WINDOWS\system32\serwvdrv.dll *C:\WINDOWS\system32\umdmxfrm.dll *C:\WINDOWS\system32\appHelp.dll *C:\WINDOWS\system32\CLBCATQ.DLL *C:\WINDOWS\system32\COMRes.dll *C:\WINDOWS\system32\AcSignIcon.dll *C:\WINDOWS\system32\WINSPOOL.DRV *C:\WINDOWS\system32\OLEACC.dll *C:\WINDOWS\system32\MSVCP60.dll *C:\WINDOWS\System32\cscui.dll *C:\WINDOWS\System32\CSCDLL.dll *C:\WINDOWS\System32\themeui.dll *C:\WINDOWS\System32\Secur32.dll *C:\WINDOWS\System32\MSIMG32.dll *C:\WINDOWS\system32\xpsp2res.dll *C:\WINDOWS\System32\msutb.dll *C:\WINDOWS\System32\MSCTF.dll *C:\WINDOWS\system32\LINKINFO.dll *C:\WINDOWS\system32\ntshrui.dll *C:\WINDOWS\system32\ATL.DLL *C:\WINDOWS\system32\msi.dll *C:\WINDOWS\system32\WINSTA.dll *C:\WINDOWS\SYSTEM32\DOCPROP2.DLL *C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll *C:\WINDOWS\System32\igfxpph.dll *C:\WINDOWS\System32\hccutils.DLL *C:\WINDOWS\system32\igfxres.dll *C:\WINDOWS\System32\igfxsrvc.dll *C:\WINDOWS\System32\igfxdev.dll *C:\WINDOWS\system32\NTMARTA.DLL *C:\WINDOWS\system32\SAMLIB.dll *C:\WINDOWS\system32\urlmon.dll *C:\WINDOWS\system32\rsaenh.dll *C:\WINDOWS\system32\MPR.dll *C:\WINDOWS\System32\ntlanman.dll *C:\WINDOWS\System32\NETUI0.dll *C:\WINDOWS\System32\NETUI1.dll *C:\WINDOWS\System32\NETRAP.dll *C:\WINDOWS\System32\drprov.dll *C:\WINDOWS\System32\davclnt.dll *C:\WINDOWS\system32\mslbui.dll *C:\WINDOWS\system32\SXS.DLL *C:\WINDOWS\system32\shdoclc.dll *C:\WINDOWS\system32\browselc.dll *C:\Program Files\Microsoft Office\Office10\msohev.dll *C:\WINDOWS\system32\MLANG.dll *C:\WINDOWS\system32\SETUPAPI.dll *C:\WINDOWS\system32\msacm32.drv *C:\WINDOWS\system32\l3codecp.acm *C:\WINDOWS\system32\imaadp32.acm *C:\WINDOWS\system32\msadp32.acm *C:\WINDOWS\system32\msg711.acm *C:\WINDOWS\system32\msgsm32.acm *C:\WINDOWS\system32\tssoft32.acm *C:\WINDOWS\system32\tsd32.dll *C:\WINDOWS\system32\msg723.acm *C:\WINDOWS\system32\msaud32.acm *C:\WINDOWS\system32\sl_anet.acm *C:\WINDOWS\System32\l3codeca.acm *C:\WINDOWS\System32\iac25_32.ax *C:\WINDOWS\system32\lhacm.acm *C:\PROGRA~1\WINZIP\WZSHLSTB.DLL *C:\WINDOWS\system32\ACTXPRXY.DLL +1960=C:\WINDOWS\system32\ctfmon.exe *C:\WINDOWS\system32\ntdll.dll *C:\WINDOWS\system32\kernel32.dll *C:\WINDOWS\system32\msvcrt.dll *C:\WINDOWS\system32\ADVAPI32.dll *C:\WINDOWS\system32\RPCRT4.dll *C:\WINDOWS\system32\USER32.dll *C:\WINDOWS\system32\GDI32.dll *C:\WINDOWS\system32\MSCTF.dll *C:\WINDOWS\system32\MSUTB.dll *C:\WINDOWS\system32\ShimEng.dll *C:\WINDOWS\AppPatch\AcGenral.DLL *C:\WINDOWS\system32\WINMM.dll *C:\WINDOWS\system32\ole32.dll *C:\WINDOWS\system32\OLEAUT32.dll *C:\WINDOWS\system32\MSACM32.dll *C:\WINDOWS\system32\VERSION.dll *C:\WINDOWS\system32\SHELL32.dll *C:\WINDOWS\system32\SHLWAPI.dll *C:\WINDOWS\system32\USERENV.dll *C:\WINDOWS\system32\UxTheme.dll *C:\WINDOWS\system32\LPK.DLL *C:\WINDOWS\system32\USP10.dll *C:\WINDOWS\system32\serwvdrv.dll *C:\WINDOWS\system32\umdmxfrm.dll *C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll +2004=C:\Program Files\Internet Explorer\iexplore.exe *C:\WINDOWS\system32\ntdll.dll *C:\WINDOWS\system32\kernel32.dll *C:\WINDOWS\system32\msvcrt.dll *C:\WINDOWS\system32\USER32.dll *C:\WINDOWS\system32\GDI32.dll *C:\WINDOWS\system32\SHLWAPI.dll *C:\WINDOWS\system32\ADVAPI32.dll *C:\WINDOWS\system32\RPCRT4.dll *C:\WINDOWS\system32\SHDOCVW.dll *C:\WINDOWS\system32\CRYPT32.dll *C:\WINDOWS\system32\MSASN1.dll *C:\WINDOWS\system32\CRYPTUI.dll *C:\WINDOWS\system32\WINTRUST.dll *C:\WINDOWS\system32\IMAGEHLP.dll *C:\WINDOWS\system32\OLEAUT32.dll *C:\WINDOWS\system32\ole32.dll *C:\WINDOWS\system32\NETAPI32.dll *C:\WINDOWS\system32\WININET.dll *C:\WINDOWS\system32\WLDAP32.dll *C:\WINDOWS\system32\VERSION.dll *C:\WINDOWS\system32\LPK.DLL *C:\WINDOWS\system32\USP10.dll *C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll *C:\WINDOWS\system32\SHELL32.dll *C:\WINDOWS\system32\comctl32.dll *C:\WINDOWS\system32\MSCTF.dll *C:\WINDOWS\system32\BROWSEUI.dll *C:\WINDOWS\system32\browselc.dll *C:\WINDOWS\system32\appHelp.dll *C:\WINDOWS\system32\CLBCATQ.DLL *C:\WINDOWS\system32\COMRes.dll *C:\WINDOWS\system32\UxTheme.dll *C:\WINDOWS\system32\AcSignIcon.dll *C:\WINDOWS\system32\WINSPOOL.DRV *C:\WINDOWS\system32\OLEACC.dll *C:\WINDOWS\system32\MSVCP60.dll *C:\WINDOWS\System32\cscui.dll *C:\WINDOWS\System32\CSCDLL.dll *C:\WINDOWS\system32\SETUPAPI.dll *C:\WINDOWS\system32\USERENV.dll *C:\WINDOWS\system32\urlmon.dll *C:\WINDOWS\system32\Secur32.dll *C:\WINDOWS\system32\shdoclc.dll *C:\WINDOWS\system32\xpsp2res.dll *C:\WINDOWS\system32\mlang.dll *C:\WINDOWS\system32\wsock32.dll *C:\WINDOWS\system32\WS2_32.dll *C:\WINDOWS\system32\WS2HELP.dll *C:\WINDOWS\system32\mswsock.dll *C:\WINDOWS\system32\hnetcfg.dll *C:\WINDOWS\System32\wshtcpip.dll *C:\WINDOWS\system32\RASAPI32.DLL *C:\WINDOWS\system32\rasman.dll *C:\WINDOWS\system32\TAPI32.dll *C:\WINDOWS\system32\rtutils.dll *C:\WINDOWS\system32\WINMM.dll *C:\WINDOWS\system32\serwvdrv.dll *C:\WINDOWS\system32\umdmxfrm.dll *C:\WINDOWS\system32\DNSAPI.dll *C:\WINDOWS\System32\winrnr.dll *C:\WINDOWS\system32\rasadhlp.dll *C:\WINDOWS\system32\msi.dll *C:\WINDOWS\system32\SXS.DLL *C:\WINDOWS\system32\mslbui.dll *C:\WINDOWS\System32\mshtml.dll *C:\WINDOWS\System32\msls31.dll *C:\WINDOWS\System32\msimtf.dll *C:\WINDOWS\ime\sptip.dll *C:\WINDOWS\IME\SPGRMR.DLL *C:\Program Files\Common Files\Microsoft Shared\INK\SKCHUI.DLL *C:\Program Files\Microsoft Office\Office10\msohev.dll *C:\Program Files\Common Files\Symantec Shared\Script Blocking\scrauth.dll *C:\WINDOWS\system32\MSVCP71.dll *C:\WINDOWS\system32\MSVCR71.dll *C:\Program Files\Common Files\Symantec Shared\Script Blocking\ScrBlock.dll *C:\Program Files\Common Files\Symantec Shared\ccL30.dll *C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll *C:\WINDOWS\system32\rsaenh.dll *c:\windows\system32\jscript.dll *C:\WINDOWS\System32\mshtmled.dll *C:\WINDOWS\system32\msacm32.drv *C:\WINDOWS\system32\MSACM32.dll *C:\WINDOWS\system32\l3codecp.acm *C:\WINDOWS\system32\imaadp32.acm *C:\WINDOWS\system32\msadp32.acm *C:\WINDOWS\system32\msg711.acm *C:\WINDOWS\system32\msgsm32.acm *C:\WINDOWS\system32\tssoft32.acm *C:\WINDOWS\system32\tsd32.dll *C:\WINDOWS\system32\msg723.acm *C:\WINDOWS\system32\msaud32.acm *C:\WINDOWS\system32\sl_anet.acm *C:\WINDOWS\System32\l3codeca.acm *C:\WINDOWS\System32\iac25_32.ax *C:\WINDOWS\system32\lhacm.acm *c:\windows\system32\vbscript.dll *C:\WINDOWS\system32\MFC42.DLL *C:\WINDOWS\system32\MFC42LOC.DLL *C:\WINDOWS\system32\comdlg32.dll *C:\WINDOWS\System32\ddrawex.dll *C:\WINDOWS\System32\DDRAW.dll *C:\WINDOWS\System32\DCIMAN32.dll *C:\WINDOWS\system32\MPR.dll *C:\WINDOWS\System32\ntlanman.dll *C:\WINDOWS\System32\NETUI0.dll *C:\WINDOWS\System32\NETUI1.dll *C:\WINDOWS\System32\NETRAP.dll *C:\WINDOWS\System32\SAMLIB.dll *C:\WINDOWS\System32\drprov.dll *C:\WINDOWS\System32\davclnt.dll *C:\WINDOWS\system32\schannel.dll *C:\WINDOWS\system32\dssenh.dll *C:\WINDOWS\system32\cryptnet.dll *C:\WINDOWS\system32\WINHTTP.dll *C:\WINDOWS\system32\SensApi.dll *C:\WINDOWS\System32\dxtrans.dll *C:\WINDOWS\System32\ATL.DLL *C:\WINDOWS\system32\ACTXPRXY.DLL *C:\WINDOWS\system32\plugin.ocx *C:\WINDOWS\system32\MSRATING.dll *C:\WINDOWS\system32\msratelc.dll *C:\WINDOWS\system32\ntshrui.dll *C:\WINDOWS\system32\LINKINFO.dll *C:\WINDOWS\System32\mydocs.dll *C:\WINDOWS\system32\wuapi.dll *C:\WINDOWS\system32\sfc_os.dll +692=C:\Downloads\AdWare All\Start\StartDreck.exe *C:\WINDOWS\system32\ntdll.dll *C:\WINDOWS\system32\kernel32.dll *C:\Downloads\AdWare All\Start\VB40032.DLL *C:\WINDOWS\system32\ADVAPI32.dll *C:\WINDOWS\system32\RPCRT4.dll *C:\WINDOWS\system32\GDI32.dll *C:\WINDOWS\system32\USER32.dll *C:\WINDOWS\system32\MSVCRT20.dll *C:\WINDOWS\system32\ole32.dll *C:\WINDOWS\system32\msvcrt.dll *C:\WINDOWS\system32\OLEAUT32.dll *C:\WINDOWS\system32\OLEPRO32.DLL *C:\WINDOWS\system32\LPK.DLL *C:\WINDOWS\system32\USP10.dll *C:\Downloads\AdWare All\Start\VB4DE32.DLL *C:\WINDOWS\system32\MSCTF.dll *C:\WINDOWS\system32\CLBCATQ.DLL *C:\WINDOWS\system32\COMRes.dll *C:\WINDOWS\system32\VERSION.dll *C:\WINDOWS\system32\mslbui.dll *C:\Downloads\AdWare All\Start\PSAPI.DLL »VMM32Files (LM) »%System%\VMM32 »%System%\IOSUBSYS »Application specific »MS Office 97/8.0 STARTUP-PATH »Current User »Default User »Local Machine »ICQ NetDetect »Current User »Default User [b]and this is the Silent Runners Log:[/B] "Silent Runners.vbs", revision 39, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "SystemTray" = "SysTray.Exe" [MS] "IgfxTray" = "C:\WINDOWS\System32\igfxtray.exe" ["Intel Corporation"] "HotKeysCmds" = "C:\WINDOWS\System32\hkcmd.exe" ["Intel Corporation"] "Opware12" = ""C:\Program Files\ScanSoft\OmniPagePro12.0\Opware12.exe"" ["ScanSoft, Inc."] "TkBellExe" = ""C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot" ["Angel Studios"] "RoxioEngineUtility" = ""C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"" ["Roxio"] "dla" = "C:\WINDOWS\system32\dla\tfswctrl.exe" ["Sonic Solutions"] "UpdateManager" = ""C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r" ["Angel Studios"] "ccApp" = ""C:\Program Files\Common Files\Symantec Shared\ccApp.exe"" ["Symantec Corporation"] "Symantec NetDriver Monitor" = "C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer" ["Symantec Corporation"] "SunJavaUpdateSched" = "C:\Program Files\Java\j2re1.4.2_08\bin\jusched.exe" [null data] "SpySweeper" = ""C:\Program Files\Webroot\Spy Sweeper\SpySweeper.usr" /startintray" ["Webroot Software, Inc."] "DiskeeperSystray" = ""C:\Program Files\Executive Software\Diskeeper\DkIcon.exe"" ["Executive Software International, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID] -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {31FF080D-12A3-439A-A2EF-4BA95A3148E8}\(Default) = "*b" (unwriteable string) -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\GetRight\xx2gr.dll" ["Headlight Software, Inc."] {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided) -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"] {5CA3D70E-1895-11CF-8E15-001234567890}\(Default) = "*b" (unwriteable string) -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\dla\tfswshx.dll" ["Sonic Solutions"] {9ECB9560-04F9-4bbc-943D-298DDF1699E1}\(Default) = "Norton Internet Security" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"] {BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "NAV Helper" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension" -> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext" -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{5b4dae26-b807-11d0-9815-00c04fd91972}" = "Menu Band" -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\SHELL32.dll" [MS] "{8278F931-2A3E-11d2-838F-00C04FD918D0}" = "Tracking Shell Menu" -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\SHELL32.dll" [MS] "{E13EF4E4-D2F2-11d0-9816-00C04FD91972}" = "Menu Site" -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\SHELL32.dll" [MS] "{ECD4FC4F-521C-11D0-B792-00A0C90312E1}" = "Menu Desk Bar" -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\SHELL32.dll" [MS] "{D82BE2B0-5764-11D0-A96E-00C04FD705A2}" = "IShellFolderBand" -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\SHELL32.dll" [MS] "{0E5CBF21-D15F-11d0-8301-00AA005B4383}" = "&Links" -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\SHELL32.dll" [MS] "{7487cd30-f71a-11d0-9ea7-00805f714772}" = "Thumbnail Image" -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\SHELL32.dll" [MS] "{450D8FBA-AD25-11D0-98A8-0800361B1103}" = "MyDocs Folder" -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\SHELL32.dll" [MS] "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."] "{63AFBDFB-5EF8-4791-AF79-9A3C0DE48974}" = "EditPlus Context Menu Handler" -> {CLSID}\InProcServer32\(Default) = "C:\PROGRAM FILES\EDITPLUS 2\EPPSHELL.DLL" [null data] "{e57ce731-33e8-4c51-8354-bb4de9d215d1}" = "Universal Plug and Play Devices" -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\upnpui.dll" [MS] "{36A21736-36C2-4C11-8ACB-D4136F2B57BD}" = "AutoCAD Digital Signatures Icon Overlay Handler" -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\AcSignIcon.dll" ["Autodesk"] "{AC1DB655-4F9A-4c39-8AD2-A65324A4C446}" = "Autodesk Drawing Preview" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Common Files\Autodesk Shared\Thumbnail\AcThumbnail16.dll" ["Autodesk"] "{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices" -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS] "{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu" -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS] "{5CA3D70E-1895-11CF-8E15-001234567890}" = "DriveLetterAccess" -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\dla\tfswshx.dll" ["Sonic Solutions"] "{DEE12703-6333-4D4E-8F34-738C4DCC2E04}" = "RecordNow! SendToExt" -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\Sonic\Sonic Solutions Product CD\RecordNow!\shlext.dll" [null data] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS] "{506F4668-F13E-4AA1-BB04-B43203AB3CC0}" = "{506F4668-F13E-4AA1-BB04-B43203AB3CC0}" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Visio11\VISSHE.DLL" [null data] "{D66DC78C-4F61-447F-942B-3FB6980118CF}" = "{D66DC78C-4F61-447F-942B-3FB6980118CF}" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Visio11\VISSHE.DLL" [null data] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ INFECTION WARNING! igfxcui\DLLName = "igfxsrvc.dll" ["Intel Corporation"] HKLM\Software\Classes\PROTOCOLS\Filter\ INFECTION WARNING! text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ EditPlus\(Default) = "{63AFBDFB-5EF8-4791-AF79-9A3C0DE48974}" -> {CLSID}\InProcServer32\(Default) = "C:\PROGRAM FILES\EDITPLUS 2\EPPSHELL.DLL" [null data] Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\mmahmoud.ACTS\Local Settings\Application Data\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Startup items in "mmahmoud" & "All Users" startup folders: ---------------------------------------------------------- C:\Documents and Settings\All Users\Start Menu\Programs\Startup "HPAiODevice(hp officejet g series) - 1" -> shortcut to: "C:\Program Files\Hewlett-Packard\AiO\hp officejet g series\Bin\hpoavn07.exe -DeviceID 1083656765" ["Angel Studios"] "GetRight - Tray Icon" -> shortcut to: "C:\Program Files\GetRight\getright.exe" ["Headlight Software, Inc."] "Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l" ["Angel Studios"] Enabled Scheduled Tasks: ------------------------ "Tune-up Application Start" -> launches: "walign" [file not found] "PCHealth Scheduler for Data Collection" -> launches: "C:\WINDOWS\PCHEALTH\SUPPORT\PCHSCHD.EXE -c" [file not found] "1-Click Maintenance" -> launches: "C:\Program Files\TuneUp Utilities 2004\SystemOptimizer.exe /schedulestart" [file not found] "Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Angel Studios"] "Norton AntiVirus - Scan my computer - mmahmoud" -> launches: "C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exe /task:"C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Tasks\mycomp.sca"" ["Symantec Corporation"] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 22 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ "{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" [from CLSID] -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}" = "Norton Internet Security" [from CLSID] -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"] "{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" [from CLSID] -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}" = "Norton Internet Security" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"] "{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] Explorer Bars Dormant Explorer Bars in "View, Explorer Bar" menu HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\ = "&Research" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{08B0E5C0-4FCB-11CF-AAA5-00401C608501}" -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\msjava.dll" [MS] {85D1F590-48F4-11D9-9669-0800200C9A66}\ "MenuText" = "Uninstall BitDefender Online Scanner v8" "Exec" = "%windir%\bdoscandel.exe" [null data] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Research" {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96}\ "ButtonText" = "Yahoo! Messenger" "MenuText" = "Yahoo! Messenger" "Exec" = "C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE" ["Yahoo! Inc."] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" ["Angel Studios"] Miscellaneous IE Hijack Points ------------------------------ HKLM\Software\Microsoft\Internet Explorer\AboutURLs\ Missing lines (compared with English-language version): HIJACK WARNING! "TuneUp" = "file://C|/Documents and Settings/All Users/Application Data/TuneUp Software/Common/base.css" [file not found] All Non-Disabled Services (Display Name, Service Name, Path {Service DLL}): --------------------------------------------------------------------------- ASP.NET State Service, aspnet_state, "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe" [MS] C-DillaCdaC11BA, C-DillaCdaC11BA, "C:\WINDOWS\system32\drivers\CDAC11BA.EXE" ["Macrovision"] Diskeeper, Diskeeper, ""C:\Program Files\Executive Software\Diskeeper\DkService.exe"" ["Executive Software International, Inc."] Fax, Fax, "C:\WINDOWS\system32\fxssvc.exe" [MS] HTTP SSL, HTTPFilter, "C:\WINDOWS\System32\svchost.exe -k HTTPFilter" {"C:\WINDOWS\System32\w3ssl.dll" [MS]} ISSvc, ISSVC, ""C:\Program Files\Norton Internet Security\ISSVC.exe"" ["Symantec Corporation"] Logical Disk Manager Administrative Service, dmadmin, "C:\WINDOWS\System32\dmadmin.exe /com" ["Microsoft Corp., Veritas Software"] Network Provisioning Service, xmlprov, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\xmlprov.dll" [MS]} Norton AntiVirus Auto-Protect Service, navapsvc, ""C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe"" ["Symantec Corporation"] Office Source Engine, ose, ""C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"" ["Angel Studios"] Portable Media Serial Number Service, WmdmPmSN, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\system32\MsPMSNSv.dll" [MS]} SAVScan, SAVScan, ""C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe"" ["Symantec Corporation"] ScriptBlocking Service, SBService, "C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe" ["Angel Studios"] Symantec Core LC, Symantec Core LC, "C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe" ["Angel Studios"] Symantec Event Manager, ccEvtMgr, ""C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"" ["Angel Studios"] Symantec Network Drivers Service, SNDSrvc, ""C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"" ["Angel Studios"] Symantec Network Proxy, ccProxy, ""C:\Program Files\Common Files\Symantec Shared\ccProxy.exe"" ["Angel Studios"] Symantec Password Validation, ccPwdSvc, ""C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe"" ["Angel Studios"] Symantec Settings Manager, ccSetMgr, ""C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"" ["Angel Studios"] Symantec SPBBCSvc, SPBBCSvc, ""C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe"" ["Angel Studios"] Webroot Spy Sweeper Engine, svcWRSSSDK, "C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe" ["Webroot Software, Inc."] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] WMDM PMSP Service, WMDM PMSP Service, "C:\WINDOWS\system32\MsPMSPSv.exe" [MS] WMI Performance Adapter, WmiApSrv, "C:\WINDOWS\System32\wbem\wmiapsrv.exe" [MS] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 95 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 33 seconds. ---------- (total run time: 179 seconds) |
|
|
|
|
07-17-2005, 06:56 PM
|
#6 (permalink) |
|
Manager Emeritus - Security Center, Expert Analyst, Moderator - Security Team; Rangemaster, TSF Academy & Supporter
Join Date: Sep 2004
Location: Carmichaels, PA-USA
Posts: 6,963
OS: Windows 7
|
Ok..lets try this....
Do you have or had the game Midtown Madness? Download this registry fix.. http://www.dougknox.com/xp/fileassoc/xp_exe_fix.zip Unzip the reg file inside to your desktop. Then double click it..and allow it to merge. Download and install CleanUp! but do not run it yet. *NOTE* Cleanup deletes EVERYTHING out of temp/temporary folders and does not make backups Download, install, and update Ewido Security Suite
After the updates are installed, exit Ewido Reboot into Safe Mode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight Safe Mode, then hit enter. Now navigate to the following file..C:\WINDOWS\wininit.ini Open it with wordpad and remove these entrys.. `C:\WINDOWS\system32\dsktrf.dll=C:\DOCUME~1\MMAHMO ~1.ACT\LOCALS~1\Temp\WIN41.tmp `NUL=C:\WINDOWS\polall1r.exe `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= `NUL= Save the file when done. C:\WINDOWS\system32\dsktrf.dll <--delete that file C:\WINDOWS\polall1r.exe <--delete that file Run Ewido:
Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu). Set the program up as follows: *Click "Options..." *Move the arrow down to "Custom CleanUp!" *Put a check next to the following:
Press the CleanUp! button to start the program. Reboot/logoff when prompted. Reboot to normal mode. Post that Ewido log and another startdreck log. I also need you to zip up and attach the following files to your next post. C:\WINDOWS\winstart.bat C:\WINDOWS\tmpcpyis.bat
__________________
We Are The BORG Spyware KILLER and Adware Destroyer!
Spyware/Adware Removal Tools Hijackthis Ad-aware SE Spybot Search&Destroy SpywareBlaster CWShredder |
|
|
|
|
07-18-2005, 06:38 AM
|
#7 (permalink) |
|
Registered User
Join Date: Aug 2004
Posts: 12
OS: XP Pro
|
Followed your instructions exactly.
Below is the Ewido file: --------------------------------------------------------- ewido security suite - Scan report --------------------------------------------------------- + Created on: 03:05:54 PM, 18/07/2005 + Report-Checksum: 156B885B + Scan result: HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Spyware.WebRebates : Cleaned with backup HKU\S-1-5-21-1993962763-616249376-725345543-500\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{000020DD-C72E-4113-AF77-DD56626C6C42} -> Spyware.TwainTech : Cleaned with backup HKU\S-1-5-21-1993962763-616249376-725345543-500\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0000607D-D204-42C7-8E46-216055BF9918} -> Spyware.TwainTech : Cleaned with backup HKU\S-1-5-21-1993962763-616249376-725345543-500\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{002EB272-2590-4693-B166-FBD5D9B6FEA6} -> Spyware.MultiMPP : Cleaned with backup HKU\S-1-5-21-1993962763-616249376-725345543-500\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00D6A7E7-4A97-456F-848A-3B75BF7554D7} -> Spyware.KeenValue : Cleaned with backup HKU\S-1-5-21-1993962763-616249376-725345543-500\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{086CEFD5-A88D-4981-8915-D51F04360ED1} -> Spyware.TrafficHog : Cleaned with backup C:\Documents and Settings\mmahmoud.ACTS\Cookies\mmahmoud@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup C:\Documents and Settings\mmahmoud.ACTS\Cookies\mmahmoud@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup D:\Download\NIS 2005\Norton.Internet.Security.2005.Pro.Incl.Keygen-SSG.rar/kgnis.exe -> TrojanDropper.Delf.fd : Error during cleaning D:\Download\NIS 2005\Setup\KEY GENERATOR.EXE -> TrojanDropper.Delf.fd : Cleaned with backup D:\Download\NIS 2005\Cracks\Symantec Norton 2005 Key Generators ( antivirus, ghost, internet security, partitionmagic, systemworks ).rar/Symantec Norton 2005 Key Generators ( antivirus, ghost, internet security, partitionmagic, systemworks )\Symantec Norton Internet Security 2005 Key Generator\KEY GENERATOR.EXE -> TrojanDropper.Delf.fd : Error during cleaning D:\Download\NIS 2005\Cracks\Symantec Norton 2005 Key Generators ( antivirus, ghost, internet security, partitionmagic, systemworks )\Symantec Norton Internet Security 2005 Key Generator\KEY GENERATOR.EXE -> TrojanDropper.Delf.fd : Cleaned with backup D:\Download\NSW 2005\NORTON 2005 - SystemWorks + Internet Security + Ghost 9.0 + GoBack + ALL KEYGENS.rar/NORTON 2005 - SystemWorks + Internet Security + Ghost 9.0 + GoBack + ALL KEYGENS\Norton Internet Security 2005\KEY-GENERATOR NIS 2005\NIS 2005 - Keygen SSG.exe -> TrojanDropper.Delf.fd : Error during cleaning D:\Download\NSW 2005\NORTON 2005 - SystemWorks + Internet Security + Ghost 9.0 + GoBack + ALL KEYGENS.rar/NORTON 2005 - SystemWorks + Internet Security + Ghost 9.0 + GoBack + ALL KEYGENS\NORTON KEY-GENERATORS\KeyGens Norton 2005\NIS 2005 - Keygen SSG.exe -> TrojanDropper.Delf.fd : Error during cleaning D:\Hana Backup\Program Files\Altnet\Download Manager\asm.exe -> Spyware.Altnet : Cleaned with backup D:\Hana Backup\Program Files\Altnet\Download Manager\altnetuninstall.exe -> Spyware.Altnet : Cleaned with backup D:\Hana Backup\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL -> Spyware.MyWebSearch : Cleaned with backup D:\Hana Backup\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL -> Spyware.MyWebSearch : Cleaned with backup D:\Hana Backup\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE -> Spyware.MyWebSearch : Cleaned with backup D:\Hana Backup\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL -> Spyware.MyWebSearch : Cleaned with backup D:\Download DXB\Visio\KeyGen\VISIO 2002 KEY GENERATOR.exe -> Trojan.Agent.a : Cleaned with backup ::Report End And StartDreck Log: StartDreck (build 2.1.7 public stable) - 2005-07-18 @ 15:21:29 (GMT +03:00) Platform: Windows XP (Win NT 5.1.2600 Service Pack 2) Internet Explorer: 6.0.2900.2180 Logged in as mmahmoud at MAMOUN »Registry »Run Keys »Current User »Run *CTFMON.EXE=C:\WINDOWS\system32\ctfmon.exe »RunOnce »Default User »Run *CTFMON.EXE=C:\WINDOWS\System32\CTFMON.EXE »RunOnce *Printing Migration=rundll32.exe C:\WINDOWS\System32\spool\migrate.dll,ProcessWin9xNetworkPrinters »Local Machine »Run *SystemTray=SysTray.Exe *IgfxTray=C:\WINDOWS\System32\igfxtray.exe *HotKeysCmds=C:\WINDOWS\System32\hkcmd.exe *Opware12="C:\Program Files\ScanSoft\OmniPagePro12.0\Opware12.exe" *TkBellExe="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot *RoxioEngineUtility="C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" *dla=C:\WINDOWS\system32\dla\tfswctrl.exe *UpdateManager="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r *ccApp="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" *Symantec NetDriver Monitor=C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer *SunJavaUpdateSched=C:\Program Files\Java\j2re1.4.2_08\bin\jusched.exe *SpySweeper="C:\Program Files\Webroot\Spy Sweeper\SpySweeper.usr" /startintray *DiskeeperSystray="C:\Program Files\Executive Software\Diskeeper\DkIcon.exe" +OptionalComponents +MSFS *Installed=1 +MAPI *NoChange=1 *Installed=1 +MAPI *NoChange=1 *Installed=1 »RunOnce »RunServices »RunServicesOnce »RunOnceEx »RunServicesOnceEx »File Associations (CR) +.bat *batfile="%1" %* +.com *comfile="%1" %* +.disabled *SpybotSD.DisabledFile="C:\Program Files\Spybot - Search & Destroy\blindman.exe" "%1" +.exe *exefile="%1" %* +.hta *htafile=C:\WINDOWS\System32\mshta.exe "%1" %* +.htm *htmlfile="C:\Program Files\Internet Explorer\iexplore.exe" -nohome +.html *htmlfile="C:\Program Files\Internet Explorer\iexplore.exe" -nohome +.js *JSFile=%SystemRoot%\System32\WScript.exe "%1" %* +.jse *JSEFile=%SystemRoot%\System32\WScript.exe "%1" %* +.pif *piffile="%1" %* +.reg *regfile=regedit.exe "%1" +.scr *AutoCADScriptFile="C:\WINDOWS\notepad.exe" "%1" +.txt *txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1 +.vbs *VBSFile=%SystemRoot%\System32\WScript.exe "%1" %* +.vbe *VBEFile=%SystemRoot%\System32\WScript.exe "%1" %* +.wsh *WSHFile=%SystemRoot%\System32\WScript.exe "%1" %* +.wsf *WSFFile=%SystemRoot%\System32\WScript.exe "%1" %* +.lnk `lnkfile= [key or value does not exist] »Browser Helper Objects (LM) *AcroIEHelper.AcroIEHlprObj.1/{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} `InprocServer32=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll *Msie2gr.bho2gr.1/{31FF080D-12A3-439A-A2EF-4BA95A3148E8} `InprocServer32=C:\Program Files\GetRight\xx2gr.dll *{53707962-6F74-2D53-2644-206D7942484F} `InprocServer32=C:\Program Files\Spybot - Search & Destroy\SDHelper.dll *DriveLetterAccess/{5CA3D70E-1895-11CF-8E15-001234567890} `InprocServer32=C:\WINDOWS\system32\dla\tfswshx.dll *Nisbho.CNisExtBho.1/{9ECB9560-04F9-4bbc-943D-298DDF1699E1} `InprocServer32=C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll *Navbho.CNavExtBho.1/{BDF3E430-B101-42AD-A544-FADC6B084872} `InprocServer32=C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll »Files »Autostart Folders »Current User *C:\Documents and Settings\mmahmoud.ACTS\Start Menu\Programs\Startup\desktop.ini »Default User *C:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\Startup\desktop.ini »Local Machine *C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini *C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk »INI-Files »WIN.INI\[windows] *LOAD= *RUN= »SYSTEM.INI\[boot] *SHELL=Explorer.exe »Text Files *C:\boot.ini *C:\msdos.sys *C:\config.sys *C:\WINDOWS\system32\config.nt *C:\WINDOWS\wininit.ini *C:\WINDOWS\winstart.bat *C:\WINDOWS\system32\drivers\etc\hosts »System/Drivers »Running Processes +0=<idle> +4=<system> +412=\SystemRoot\System32\smss.exe +568=\??\C:\WINDOWS\system32\csrss.exe +592=\??\C:\WINDOWS\system32\winlogon.exe +636=C:\WINDOWS\system32\services.exe +648=C:\WINDOWS\system32\lsass.exe +816=C:\WINDOWS\system32\svchost.exe +884=C:\WINDOWS\system32\svchost.exe +948=C:\WINDOWS\System32\svchost.exe +1020=C:\WINDOWS\System32\svchost.exe +1096=C:\WINDOWS\System32\svchost.exe +1684=C:\WINDOWS\Explorer.EXE +1864=C:\WINDOWS\system32\spoolsv.exe +164=C:\WINDOWS\system32\drivers\CDAC11BA.EXE +192=C:\Program Files\Executive Software\Diskeeper\DkService.exe +212=C:\Program Files\ewido\security suite\ewidoctrl.exe +232=C:\Program Files\ewido\security suite\ewidoguard.exe +444=C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe +1220=C:\WINDOWS\System32\svchost.exe +1264=C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe +1676=C:\WINDOWS\system32\wdfmgr.exe +1696=C:\WINDOWS\system32\MsPMSPSv.exe +1596=C:\WINDOWS\System32\hkcmd.exe +1396=C:\Program Files\ScanSoft\OmniPagePro12.0\Opware12.exe +968=C:\WINDOWS\System32\alg.exe +1976=C:\WINDOWS\system32\dla\tfswctrl.exe +2100=C:\Program Files\Common Files\Symantec Shared\ccApp.exe +2184=C:\Program Files\Java\j2re1.4.2_08\bin\jusched.exe +2480=C:\WINDOWS\system32\ctfmon.exe +2624=C:\WINDOWS\System32\svchost.exe +3016=C:\WINDOWS\system32\wuauclt.exe +3772=C:\PROGRA~1\MICROS~1\OFFICE\EXCEL.EXE +3816=C:\Downloads\AdWare All\Start\StartDreck.exe »NT Services *Alerter Alerter - disabled *Application Layer Gateway Service ALG running on demand *Application Management AppMgmt running on demand *ASP.NET State Service aspnet_state - on demand *Windows Audio AudioSrv running auto *Background Intelligent Transfer Service BITS - on demand *Computer Browser Browser running auto *C-DillaCdaC11BA C-DillaCdaC11BA running auto *Symantec Event Manager ccEvtMgr - auto *Symantec Network Proxy ccProxy - auto *Symantec Password Validation ccPwdSvc - on demand *Symantec Settings Manager ccSetMgr - auto *Indexing Service CiSvc - on demand *ClipBook ClipSrv - disabled *COM+ System Application COMSysApp - on demand *Cryptographic Services CryptSvc running auto *DCOM Server Process Launcher DcomLaunch running auto *DHCP Client Dhcp running auto *Diskeeper Diskeeper running auto *Logical Disk Manager Administrative Service dmadmin - on demand *Logical Disk Manager dmserver running auto *DNS Client Dnscache running auto *Error Reporting Service ERSvc running auto *Event Log Eventlog running auto *COM+ Event System EventSystem running on demand *ewido security suite control ewido security suite running auto *ewido security suite guard ewido security suite running auto *Fast User Switching Compatibility FastUserSwitchingCom - on demand *Fax Fax - auto *Help and Support helpsvc running auto *Human Interface Device Access HidServ - disabled *HTTP SSL HTTPFilter running on demand *IMAPI CD-Burning COM Service ImapiService - on demand *Infrared Monitor Irmon running auto *ISSVC ISSVC - auto *Server LanmanServer running auto *Workstation LanmanWorkstation running auto *TCP/IP NetBIOS Helper LmHosts running auto *Messenger Messenger - disabled *NetMeeting Remote Desktop Sharing mnmsrvc - on demand *Distributed Transaction Coordinator MSDTC - on demand *Windows Installer MSIServer - on demand *Norton AntiVirus Auto-Protect Service navapsvc running auto *Network DDE NetDDE - disabled *Network DDE DSDM NetDDEdsdm - disabled *Net Logon Netlogon running auto *Network Connections Netman running on demand *Network Location Awareness (NLA) Nla running on demand *NT LM Security Support Provider NtLmSsp - on demand *Removable Storage NtmsSvc - on demand *Office Source Engine ose - on demand *Plug and Play PlugPlay running auto *IPSEC Services PolicyAgent running auto *Protected Storage ProtectedStorage running auto *Remote Access Auto Connection Manager RasAuto - on demand *Remote Access Connection Manager RasMan running on demand *Remote Desktop Help Session Manager RDSessMgr - on demand *Routing and Remote Access RemoteAccess - disabled *Remote Registry RemoteRegistry running auto *Remote Procedure Call (RPC) Locator RpcLocator - on demand *Remote Procedure Call (RPC) RpcSs running auto *QoS RSVP RSVP - on demand *Security Accounts Manager SamSs running auto *SAVScan SAVScan - on demand *ScriptBlocking Service SBService - auto *Smart Card SCardSvr - on demand *Task Scheduler Schedule running auto *Secondary Logon seclogon running auto *System Event Notification SENS running auto *Windows Firewall/Internet Connection Sharing (I SharedAccess running auto `CS) *Shell Hardware Detection ShellHWDetection running auto *Symantec Network Drivers Service SNDSrvc - auto *Symantec SPBBCSvc SPBBCSvc - auto *Print Spooler Spooler running auto *System Restore Service srservice - auto *SSDP Discovery Service SSDPSRV running on demand *Windows Image Acquisition (WIA) stisvc running auto *Webroot Spy Sweeper Engine svcWRSSSDK running auto *MS Software Shadow Copy Provider SwPrv - on demand *Symantec Core LC Symantec Core LC - auto *Performance Logs and Alerts SysmonLog - on demand *Telephony TapiSrv running on demand *Terminal Services TermService running on demand *Themes Themes running auto *Telnet TlntSvr - disabled *Distributed Link Tracking Client TrkWks running auto *Windows User Mode Driver Framework UMWdf running auto *Universal Plug and Play Device Host upnphost - on demand *Uninterruptible Power Supply UPS - on demand *Volume Shadow Copy VSS - on demand *Windows Time W32Time running auto *WebClient WebClient running auto *Windows Management Instrumentation winmgmt running auto *WMDM PMSP Service WMDM PMSP Service running auto *Portable Media Serial Number Service WmdmPmSN - on demand *Windows Management Instrumentation Driver Exten Wmi - on demand `sions *WMI Performance Adapter WmiApSrv - on demand *Security Center wscsvc - auto *Automatic Updates wuauserv running auto *Wireless Zero Configuration WZCSVC running auto *Network Provisioning Service xmlprov - on demand »Application specific |
|
|
|
|
07-18-2005, 08:19 PM
|
#8 (permalink) |
|
Manager Emeritus - Security Center, Expert Analyst, Moderator - Security Team; Rangemaster, TSF Academy & Supporter
Join Date: Sep 2004
Location: Carmichaels, PA-USA
Posts: 6,963
OS: Windows 7
|
Did the registry file...fix your icon issue? Also..you didn't tell me if you had/have the game Midtown Madness??
I see your a "Cracker". Be aware most of these cracks contain virus/trojans/adware and this is were you are getting it from. Download KillBox http://www.bleepingcomputer.com/file...re/KillBox.zip Reboot into safe mode. Open add/remove programs and remove these IF they are listed... Altnet MyWebSearch D:\Hana Backup\Program Files\MyWebSearch <--delete that folder D:\Hana Backup\Program Files\Altnet <--delete that folder Run KILL box. Paste the following locations into KILL BOX one at a time. Checkmark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion…say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot. D:\Download\NIS 2005\Norton.Internet.Security.2005.Pro.Incl.Keygen -SSG.rar/kgnis.exe D:\Download DXB\Visio\KeyGen\VISIO 2002 KEY GENERATOR.exe C:\WINDOWS\winstart.bat C:\WINDOWS\tmpcpyis.bat Once you reboot...... Please run an online scan at http://www.pandasoftware.com/actives..._principal.htm Select the “Autofix/Clean” option and save the activescan log. Then post that log in your next post. Please download Trend Micro™ Anti-Spyware for the Web Utility (by clicking the "Scan and Clean your PC" button).
Reboot your computer. In place of the TrendMicro icon will be a text file called "Antispyware.log", please double-click that log and copy the entire contents and paste them here. I then need you to repeat the same procedure above again... using the TrendMicro tool. I need the log from the second scan/clean...NOT the first...as this will contain what’s left in the system Post both those logs.
__________________
We Are The BORG Spyware KILLER and Adware Destroyer!
Spyware/Adware Removal Tools Hijackthis Ad-aware SE Spybot Search&Destroy SpywareBlaster CWShredder |
|
|
|
|
07-25-2005, 08:55 AM
|
#9 (permalink) |
|
Registered User
Join Date: Aug 2004
Posts: 12
OS: XP Pro
|
Hi,
Actually I gave up and decided to give my pc a new start. I backedup all of docs and imprtant stuff and afterwards I formatted the C drive and reinstalled XP with SP2. All my stuff is now back and the PC is running as fast as I first bought it. Many thanks for your efforts and I really do appreciate what you have done to me |
|
|
|
| Thread Tools | |
|
|
