Lin C Posted November 8, 2009 ID:155294 Share Posted November 8, 2009 I am not very computer literate, but do my best, yesterday my computer crashed, and i had the blue screen.. ARGH, when trying to restart, it will now show the "windows" screen and then flash a blue screen and go back to the enter in safe mode, last know good config menu. I was not able to get back in the computer using any of those, so i pressed F8 and am in my system, but only by using the "debugging mode" I checked my windows update, and i did not have the XP Service Pack 3 installed, so i tried to install that, but it states that it can not install due to the file, ATAPI.SYS being in use, i tried closing every program, and still received the same error, I do have Daemon tools but it is not on my add/remove programs, and when i go to its file and try to unistall it will go about halfway through the process then stop. I am not sure if this is an issue with the other issues or not, it appears i have some pretty nasty stuff, i did run the Malwarebytes, and will attach the log, i see quite a few things on it, i did clear all infections, and am now running the scan for a 2nd time to see if it has removed the problems, anyway, here is the Original Malwarebytes log and the hijackthis log ran after cleaning the 1st time with MalwarebytesMalwarebytes' Anti-Malware 1.41Database version: 3120Windows 5.1.2600 Service Pack 211/8/2009 5:16:54 PMmbam-log-2009-11-08 (17-16-44)2Scan type: Full Scan (C:\|D:\|)Objects scanned: 228727Time elapsed: 1 hour(s), 10 minute(s), 30 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 11Registry Values Infected: 2Registry Data Items Infected: 0Folders Infected: 12Files Infected: 100Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:HKEY_CURRENT_USER\SOFTWARE\AvScan (Trojan.FakeAlert) -> No action taken.HKEY_CURRENT_USER\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> No action taken.HKEY_CURRENT_USER\SOFTWARE\gvtl (Malware.Trace) -> No action taken.HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> No action taken.HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> No action taken.HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> No action taken.HKEY_LOCAL_MACHINE\SOFTWARE\FunWebProducts (Adware.MyWebSearch) -> No action taken.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> No action taken.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> No action taken.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Gamevance (Adware.Gamevance) -> No action taken.HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> No action taken.Registry Values Infected:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\(default) (Adware.Hotbar) -> No action taken.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> No action taken.Registry Data Items Infected:(No malicious items detected)Folders Infected:C:\Documents and Settings\Owner.family\Application Data\FunWebProducts (Adware.MyWebSearch) -> No action taken.C:\Documents and Settings\Owner.family\Application Data\FunWebProducts\Data (Adware.MyWebSearch) -> No action taken.C:\Documents and Settings\Owner.family\Application Data\FunWebProducts\Data\Owner (Adware.MyWebSearch) -> No action taken.C:\Program Files\FunWebProducts (Adware.MyWebSearch) -> No action taken.C:\Program Files\FunWebProducts\ScreenSaver (Adware.MyWebSearch) -> No action taken.C:\Program Files\FunWebProducts\ScreenSaver\Images (Adware.MyWebSearch) -> No action taken.C:\Program Files\FunWebProducts\Shared (Adware.MyWebSearch) -> No action taken.C:\Program Files\MyWebSearch (Adware.MyWebSearch) -> No action taken.C:\Program Files\MyWebSearch\bar (Adware.MyWebSearch) -> No action taken.C:\Program Files\MyWebSearch\bar\History (Adware.MyWebSearch) -> No action taken.C:\Program Files\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> No action taken.C:\WINDOWS\system32\twain32 (Backdoor.Bot) -> No action taken.Files Infected:C:\Documents and Settings\Owner.family\Local Settings\Temp\trt.exe (Rootkit.TDSS) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP128\A0016616.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP128\A0016634.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP128\A0016617.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP128\A0016620.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP128\A0016624.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP128\A0016626.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP128\A0016630.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP128\A0016631.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP128\A0016633.EXE (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP128\A0016635.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP128\A0016636.EXE (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP128\A0016637.EXE (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP128\A0016638.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP128\A0016640.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP128\A0016641.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP128\A0016642.EXE (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP128\A0016643.EXE (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP128\A0016644.EXE (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP128\A0016645.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP128\A0016646.EXE (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP128\A0016647.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP148\A0018583.dll (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP158\A0019037.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP158\A0019012.dll (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP158\A0019013.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP158\A0019020.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP158\A0019022.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP158\A0019026.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP158\A0019027.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP158\A0019029.EXE (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP158\A0019030.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP158\A0019031.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP158\A0019032.EXE (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP158\A0019033.EXE (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP158\A0019034.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP158\A0019036.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP158\A0019038.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP158\A0019039.EXE (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP158\A0019040.EXE (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP158\A0019041.EXE (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP158\A0019042.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP158\A0019043.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP158\A0019044.EXE (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP158\A0019045.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP161\A0019105.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP161\A0019106.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP161\A0019108.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP167\A0019382.dll (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP204\A0023649.dll (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP204\A0023650.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP206\A0023739.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP206\A0023740.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP206\A0023741.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP206\A0023742.EXE (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP206\A0023743.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP206\A0023744.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP206\A0023747.DLL (Adware.FunWeb) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP222\A0026540.EXE (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP222\A0026516.scr (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP222\A0026518.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP222\A0026523.SCR (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP222\A0026524.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP222\A0026526.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP222\A0026531.EXE (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP222\A0026532.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP222\A0026533.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP222\A0026534.EXE (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP222\A0026535.EXE (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP222\A0026536.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP222\A0026538.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP222\A0026539.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP222\A0026541.EXE (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP222\A0026542.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP222\A0026543.EXE (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP222\A0026544.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP223\A0026587.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP223\A0026580.dll (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP223\A0026581.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP223\A0026583.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP223\A0026584.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP223\A0026585.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP223\A0026586.EXE (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP223\A0026588.EXE (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP223\A0026589.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP223\A0026590.DLL (Adware.MyWebSearch) -> No action taken.C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP227\A0026636.dll (Adware.MyWebSearch) -> No action taken.C:\WINDOWS\system32\spool\prtprocs\w32x86\1AC6.tmp (Rootkit.TDSS) -> No action taken.C:\WINDOWS\Temp\1AC7.tmp (Rootkit.TDSS) -> No action taken.C:\Documents and Settings\Owner.family\Application Data\FunWebProducts\Data\Owner\avatar.dat (Adware.MyWebSearch) -> No action taken.C:\Documents and Settings\Owner.family\Application Data\FunWebProducts\Data\Owner\outfit.dat (Adware.MyWebSearch) -> No action taken.C:\Documents and Settings\Owner.family\Application Data\FunWebProducts\Data\Owner\register.dat (Adware.MyWebSearch) -> No action taken.C:\Documents and Settings\Owner.family\Application Data\FunWebProducts\Data\Owner\zbucks.dat (Adware.MyWebSearch) -> No action taken.C:\Documents and Settings\Owner.family\Application Data\FunWebProducts\Data\Owner\zevents.dat (Adware.MyWebSearch) -> No action taken.C:\Program Files\MyWebSearch\bar\History\search3 (Adware.MyWebSearch) -> No action taken.C:\Program Files\MyWebSearch\bar\Settings\setting2.htm (Adware.MyWebSearch) -> No action taken.C:\Program Files\MyWebSearch\bar\Settings\settings.dat (Adware.MyWebSearch) -> No action taken.C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> No action taken.C:\WINDOWS\system32\twain32\local.ds (Backdoor.Bot) -> No action taken.C:\WINDOWS\system32\twain32\user.ds (Backdoor.Bot) -> No action taken.hijack thisLogfile of Trend Micro HijackThis v2.0.2Scan saved at 5:44:10 PM, on 11/8/2009Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v8.00 (8.00.6001.18702)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\LEXPPS.EXEC:\WINDOWS\Explorer.EXEC:\WINDOWS\ehome\ehtray.exeC:\Program Files\Digital Media Reader\readericon45G.exeC:\Program Files\QuickTime\QTTask.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Lexmark 1200 Series\lxczbmgr.exeC:\WINDOWS\RTHDCPL.EXEC:\PROGRA~1\AVG\AVG8\avgtray.exeC:\Program Files\Java\jre6\bin\jusched.exeC:\Program Files\Lexmark 1200 Series\lxczbmon.exeC:\Program Files\Unlocker\UnlockerAssistant.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\WINDOWS\arservice.exeC:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exeC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\OpenOffice.org 3\program\soffice.exeC:\Program Files\OpenOffice.org 3\program\soffice.binC:\PROGRA~1\AVG\AVG8\avgwdsvc.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\WINDOWS\eHome\ehRecvr.exeC:\WINDOWS\eHome\ehSched.exeC:\PROGRA~1\AVG\AVG8\avgrsx.exeC:\PROGRA~1\AVG\AVG8\avgnsx.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exeC:\WINDOWS\system32\nvsvc32.exeC:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYSC:\WINDOWS\system32\svchost.exeC:\Program Files\Canon\CAL\CALMAIN.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\system32\dllhost.exeC:\WINDOWS\eHome\ehmsas.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Malwarebytes' Anti-Malware\mbam.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\WINDOWS\system32\rundll32.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = EmptyR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.localR3 - URLSearchHook: DefaultSearchHook Class - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - C:\Program Files\AskSearch\bin\DefaultSearch.dllR3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dllO2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dllO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dllO2 - BHO: McAfee Anti-Phishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dllO2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dllO2 - BHO: Gamevance Text - {BEAC7DC8-E106-4C6A-931E-5A42E7362883} - C:\Program Files\Gamevance\gvtl.dll (file missing)O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dllO2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dllO2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllO2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dllO3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dllO4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exeO4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXEO4 - HKLM\..\Run: [readericon] C:\Program Files\Digital Media Reader\readericon45G.exeO4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exeO4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXEO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exeO4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startupO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottimeO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [VirusScan Online] \mcvsshld.exeO4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUNO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXEO4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXEO4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exeO4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"O4 - HKLM\..\Run: [ErrorWiz] C:\Program Files\ErrorWiz\ErrorWiz.exe /scanO4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscriptO4 - HKLM\..\Run: [unlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"O4 - HKCU\..\Run: [Power2GoExpress] NAO4 - HKCU\..\Run: [Free Download Manager] "C:\Program Files\Free Download Manager\fdm.exe" -autorunO4 - HKCU\..\Run: [software Informer] "C:\Program Files\Software Informer\softinfo.exe" -autorunO4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exeO4 - HKCU\..\Run: [AVScan] C:\Documents and Settings\Owner.family\Application Data\winav.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\RunOnce: [DAEMON Tools Pro 4.35.0306.0088 Setup] "C:\Documents and Settings\Owner.family\My Documents\Downloads\DAEMONToolsPro4350306.exe"O4 - Startup: OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exeO4 - Startup: PowerReg Scheduler.exeO8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htmO8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htmO8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htmO8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htmO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dllO9 - Extra 'Tools' menuitem: McAfee Anti-Phishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {61A54BB0-F380-446F-8727-9AEA23711471} (CPlayFirstWeddingDashControl Object) - http://p.playfirst.com/play/game/weddingda...sh.1.0.0.55.cabO16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - http://ak.imgfarm.com/images/iwon/games/pl...tg.1.0.0.33.cabO18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dllO20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLLO20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dllO23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exeO23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exeO23 - Service: Google Update Service (gupdate1c9c9fbfe9dd2a0) (gupdate1c9c9fbfe9dd2a0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exeO23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exeO23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXEO23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exeO23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS--End of file - 10867 bytes Link to post Share on other sites More sharing options...
Recommended Posts