please help something is causing my pc to crash, not sure it just keep hangin up til i have to reboot

Maurice Naggar · March 12, 2010

You said

Oh I almost forgot when I was doing the comb_fix . It had a prompt that said,( would I like to update
combofix) . I stated no , I hope this was the correct way to do this ?

YES that was the right thing. Thanks.

Better, Nancy. That is much better. I need for you to do a similar set so we can remove 1 more file.

Turn off AVG antivirus as you did before

Start notepad and copy/paste the text in the codebox below into it:

http://forums.malwarebytes.org/index.php?showtopic=42520

Collect::
C:\WINDOWS\System32\C28E54603C.sys
C:\Documents and Settings\All Users\Application Data\C28E54603C.sys

Save this as CFScript.txt on your Desktop. You WILL be prompted that the file already Exists, and are you sure you want to Overwrite ! Reply Yes and save and close the file. And Exit Notepad.

Refering to the picture above, drag CFScript.txt and drop into Combo-Fix.exe (the red lion icon on your Desktop)

When finished, it shall produce a log for you.

Post that log in your next reply.

**Note**

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

Ensure you are connected to the internet and click OK on the message box.
A browser will open.
Simply follow the instructions to copy/paste/send the requested file.

===========

Note::

If Combofix fails to upload anything please do the following:

Go to Start > My Computer > C:\

Then Navigate to C:\Qoobox\Quarantine\[4]-Submit_Date_Time.zip

Click Here to upload the submit.zip please.

Reply with copy of the new C:\Combofix.txt

Turn AVG antivirus back on.

nevadagirl · March 12, 2010

How do i turn this off an what is this ?

It comes up saying :

Precalence reporter avgcmgr.exe is trying to connect to mmi.explabs.net [38.103.37.243] using remote port 80 [HTTP-World Wide Web]. Do you want to allow this program to access the network ?"

File Version : 9.0.0.711

File Description : Prevalence reporter (avgcmgr.exe)

File Path : C:\Program Files\AVG\AVG9\avgcmgr.exe

Process ID : 0x1D8 (Heximal) 472 (Decimal)

Connection origin : local initiated

Protocol : TCP

Local Address : 192.168.1.11

Local Port : 2019

Remote Name : mmi.explabs.net

Remote Address : 38.103.37.243

Remote Port : 80 (HTTP - World Wide Web)

Ethernet packet details:

Ethernet II (Packet Length: 76)

Destination: 00-50-7f-0d-01-cf

Source: 00-0b-6a-83-bb-a4

Type: IP (0x0800)

Internet Protocol

Version: 4

Header Length: 20 bytes

Flags:

.1.. = Don't fragment: Set

..0. = More fragments: Not set

Fragment offset:0

Time to live: 128

Protocol: 0x6 (TCP - Transmission Control Protocol)

Header checksum: 0xff2e (Correct)

Source: 192.168.1.11

Destination: 38.103.37.243

Transmission Control Protocol (TCP)

Source port: 2019

Destination port: 80

Sequence number: 3403913266

Acknowledgment number: 0

Header length: 28

Flags:

0... .... = Congestion Window Reduce (CWR): Not set

.0.. .... = ECN-Echo: Not set

..0. .... = Urgent: Not set

...0 .... = Acknowledgment: Not set

.... 0... = Push: Not set

.... .0.. = Reset: Not set

.... ..1. = Syn: Set

.... ...0 = Fin: Not set

Checksum: 0xc909 (Correct)

Data (0 Bytes)

Binary dump of the packet:

0000: 00 50 7F 0D 01 CF 00 0B : 6A 83 BB A4 08 00 45 00 | .P......j.....E.

0010: 00 30 BD BB 40 00 80 06 : 2E FF C0 A8 01 0B 26 67 | .0..@.........&g

0020: 25 F3 07 E3 00 50 CA E3 : 98 32 00 00 00 00 70 02 | %....P...2....p.

0030: FF FF 09 C9 00 00 02 04 : 05 B4 01 01 04 02 44 46 | ..............DF

0040: 4A 43 4E 44 4A 44 42 44 : 47 44 42 44 | JCNDJDBDGDBD

nevadagirl · March 12, 2010

Here the next one for you an whats concerning me is I still have two iexplores in my windows taskmanger .

Again thanks for all your help youve been awesome

ComboFix 10-03-10.08 - Nancy 03/12/2010 1:17.3.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1535.965 [GMT -6:00]

Running from: c:\documents and settings\Nancy\Desktop\Combo-Fix.exe

Command switches used :: c:\documents and settings\Nancy\Desktop\CFScript.txt

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FW: Sygate Personal Firewall *disabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}

file zipped: c:\documents and settings\All Users\Application Data\C28E54603C.sys

file zipped: c:\windows\System32\C28E54603C.sys

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\C28E54603C.sys

c:\windows\System32\C28E54603C.sys

.

((((((((((((((((((((((((( Files Created from 2010-02-12 to 2010-03-12 )))))))))))))))))))))))))))))))

.

2010-03-09 06:03 . 2010-03-09 10:25 -------- d-----w- c:\program files\Fiona Finch and the Finest Flowers

2010-03-09 06:00 . 2010-03-09 06:01 -------- d-----w- c:\program files\Shaman Odyssey Tropic Adventure

2010-03-08 08:20 . 2010-03-08 08:20 -------- d-----w- c:\documents and settings\Nancy\Application Data\AVG9

2010-03-06 14:45 . 2010-03-06 15:04 -------- d-----w- c:\program files\ERUNT

2010-03-05 22:03 . 2010-03-05 22:03 -------- d-----w- c:\documents and settings\Nancy\Application Data\Malwarebytes

2010-03-05 22:03 . 2010-01-07 22:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-03-05 22:03 . 2010-03-05 22:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-03-05 22:03 . 2010-03-05 22:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-03-05 22:03 . 2010-01-07 22:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-03-05 05:35 . 2010-03-05 05:35 -------- d-----w- c:\program files\Security Task Manager

2010-03-05 02:44 . 2010-03-05 02:44 316 ----a-w- c:\documents and settings\All Users\Application Data\SecTaskMan\icn_0D756077321A70C3E844C138CE981581.dll

2010-03-05 02:44 . 2010-03-05 02:44 2054 ----a-w- c:\documents and settings\All Users\Application Data\SecTaskMan\icn_0F8F8F82872CA4545970643B44AA1D88.dll

2010-03-05 02:44 . 2010-03-05 02:44 146 ----a-w- c:\documents and settings\All Users\Application Data\SecTaskMan\icn_0CAED145D3F56E547BBC49CE3F9B7684.dll

2010-03-05 02:44 . 2010-03-05 02:44 10 ----a-w- c:\documents and settings\All Users\Application Data\SecTaskMan\icn_0DC1503A46F231838AD88BCDDC8E8F7C.dll

2010-02-27 16:52 . 2010-03-04 04:59 -------- d-----w- c:\documents and settings\Nancy\Application Data\Faerie Solitaire

2010-02-27 13:32 . 2010-02-27 13:46 -------- d-----w- c:\program files\Faerie Solitaire

2010-02-27 13:03 . 2010-02-27 13:45 -------- d-----w- c:\program files\Alices Tea Cup Madness

2010-02-25 11:23 . 2010-02-25 11:24 -------- d-----w- c:\program files\Cake Mania 3

2010-02-21 06:45 . 2010-02-21 06:45 -------- d-----w- c:\documents and settings\All Users\Application Data\BigFishGamesCache

2010-02-19 23:18 . 2010-02-20 00:29 -------- d-----w- C:\Downloads

2010-02-19 04:12 . 2010-03-07 00:27 -------- d-----w- c:\program files\IEPro

2010-02-19 04:11 . 2010-02-19 05:51 -------- d-----w- c:\documents and settings\Nancy\Application Data\IEPro

2010-02-18 06:29 . 2010-03-09 14:21 -------- d-----w- c:\documents and settings\Nancy\Application Data\4shared Desktop

2010-02-18 06:22 . 2010-02-18 06:22 -------- d-----w- c:\program files\4shared Desktop

2010-02-14 05:57 . 2010-03-11 04:50 -------- d-----w- c:\program files\Farm Mania 2

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-03-07 00:25 . 2009-10-03 17:59 -------- d-----w- c:\program files\Airport Mania

2010-03-05 09:40 . 2007-12-24 01:06 -------- d-----w- c:\documents and settings\All Users\Application Data\SecTaskMan

2010-03-05 08:55 . 2006-09-25 02:47 -------- d-----w- c:\program files\Trend Micro

2010-03-03 14:20 . 2006-08-18 10:40 8404 --sha-w- c:\windows\system32\KGyGaAvL.sys

2010-02-27 13:46 . 2006-12-16 14:53 -------- d-----w- c:\documents and settings\All Users\Application Data\PlayFirst

2010-02-27 13:46 . 2006-08-28 16:47 -------- d-----w- c:\documents and settings\Nancy\Application Data\PlayFirst

2010-02-22 06:10 . 2009-12-28 02:13 -------- d-----w- c:\program files\Build It! Miami Beach Resort

2010-02-21 09:25 . 2009-09-03 02:06 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2010-02-21 06:35 . 2009-06-21 00:51 -------- d-----w- c:\program files\Alawar

2010-02-21 06:32 . 2009-11-21 01:47 -------- d-----w- c:\documents and settings\Nancy\Application Data\Skype

2010-02-21 06:03 . 2009-11-21 01:50 -------- d-----w- c:\documents and settings\Nancy\Application Data\skypePM

2010-02-19 19:15 . 2008-12-22 17:20 -------- d-----w- c:\documents and settings\Nancy\Application Data\dvdcss

2010-02-14 05:23 . 2006-07-29 02:36 -------- d-----w- c:\program files\Common Files\Adobe

2010-02-11 04:21 . 2009-06-21 00:51 -------- d-----w- c:\documents and settings\All Users\Application Data\AlawarWrapper

2010-02-10 09:56 . 2009-02-26 13:53 -------- d-----w- c:\documents and settings\Nancy\Application Data\EleFun Games

2010-02-08 07:55 . 2006-07-29 21:59 -------- d-----w- c:\program files\QuickTime

2010-02-08 07:54 . 2010-02-05 05:46 -------- d-----w- c:\program files\Apple Software Update

2010-02-08 07:54 . 2010-02-08 07:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple

2010-02-08 07:54 . 2010-02-04 20:38 -------- d-----w- c:\program files\Passport to Paradise

2010-02-08 07:53 . 2007-02-23 23:30 -------- d-----w- c:\program files\IncrediMail

2010-02-08 07:53 . 2006-07-30 04:56 -------- d-----w- c:\program files\Microsoft ActiveSync

2010-02-08 07:53 . 2009-01-24 13:13 -------- d-----w- c:\program files\Microsoft Silverlight

2010-02-08 05:54 . 2007-06-23 05:11 -------- d-----w- c:\program files\Winter Wonderland

2010-02-07 12:54 . 2009-11-02 06:10 -------- d-----w- c:\program files\Sallys Quick Clips

2010-02-07 12:54 . 2009-04-03 19:28 -------- d-----w- c:\program files\Success Story

2010-02-07 12:54 . 2009-09-20 04:49 -------- d-----w- c:\program files\Tradewinds Classic

2010-02-07 12:54 . 2009-02-26 02:03 -------- d-----w- c:\program files\Turtix Rescue Adventure

2010-02-07 12:54 . 2009-03-06 05:01 -------- d-----w- c:\program files\Vanilla and Chocolate

2010-02-07 12:54 . 2009-09-27 04:37 -------- d-----w- c:\program files\Tradewinds Caravans

2010-02-05 06:04 . 2010-02-05 06:04 68064 ---ha-w- c:\windows\system32\mlfcache.dat

2010-02-05 06:00 . 2006-08-15 01:21 -------- d-----w- c:\documents and settings\Nancy\Application Data\Apple Computer

2010-02-05 05:48 . 2010-02-05 05:48 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}

2010-02-05 05:48 . 2010-02-05 05:45 -------- d-----w- c:\program files\Common Files\Apple

2010-02-04 20:48 . 2010-02-04 20:48 -------- d-----w- c:\documents and settings\Nancy\Application Data\Boomzap

2010-02-03 10:51 . 2006-08-03 18:47 10 ----a-w- c:\windows\popcinfo.dat

2010-02-03 03:43 . 2010-02-03 03:43 -------- d-----w- c:\documents and settings\All Users\Application Data\IM

2010-02-03 03:32 . 2010-02-03 03:32 -------- d-----w- c:\documents and settings\All Users\Application Data\IncrediMail

2010-01-29 04:35 . 2006-07-11 15:06 -------- d-----w- c:\program files\Common Files\Java

2010-01-29 04:35 . 2010-01-29 04:35 503808 ----a-w- c:\documents and settings\Nancy\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-24ef6161-n\msvcp71.dll

2010-01-29 04:35 . 2010-01-29 04:35 499712 ----a-w- c:\documents and settings\Nancy\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-24ef6161-n\jmc.dll

2010-01-29 04:35 . 2010-01-29 04:35 348160 ----a-w- c:\documents and settings\Nancy\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-24ef6161-n\msvcr71.dll

2010-01-29 04:35 . 2010-01-29 04:35 61440 ----a-w- c:\documents and settings\Nancy\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-66f90d48-n\decora-sse.dll

2010-01-29 04:35 . 2010-01-29 04:35 12800 ----a-w- c:\documents and settings\Nancy\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-66f90d48-n\decora-d3d.dll

2010-01-29 04:35 . 2006-07-11 15:07 -------- d-----w- c:\program files\Java

2010-01-06 20:07 . 2010-01-06 20:07 143264 ----a-w- c:\documents and settings\All Users\Application Data\BigFishGamesCache\Upgrade\stub\cake-shop-2_s1_l1_gF5309T1L1_d796566250.exe

2009-12-21 19:14 . 2004-08-04 12:00 916480 ----a-w- c:\windows\system32\wininet(2)(2).dll

2009-12-21 19:14 . 2004-08-04 12:00 916480 ------w- c:\windows\system32\wininet.dll

2009-12-21 19:14 . 2004-08-04 12:00 1208832 ----a-w- c:\windows\system32\urlmon(2)(2).dll

2009-12-21 19:14 . 2006-10-17 18:57 1985536 ----a-w- c:\windows\system32\iertutil(2)(2).dll

2009-12-21 19:14 . 2006-11-08 04:03 11070464 ----a-w- c:\windows\system32\ieframe(3)(2).dll

2009-12-17 23:14 . 2009-02-27 02:43 411368 ----a-w- c:\windows\system32\deploytk.dll

2009-12-15 18:14 . 2009-12-15 18:14 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2009-12-15 18:14 . 2009-12-15 18:14 12464 ----a-w- c:\windows\system32\avgrsstx.dll

2009-12-15 18:14 . 2009-12-15 18:14 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2009-12-15 18:14 . 2009-12-15 18:14 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2009-02-02 11:34 . 2008-11-12 02:18 13824 --sha-w- c:\program files\Thumbs.db

2007-01-27 10:59 . 2007-01-27 10:59 6144 --sha-w- c:\program files\Common Files\Thumbs.db

.

((((((((((((((((((((((((((((( SnapShot@2010-03-10_11.53.59 )))))))))))))))))))))))))))))))))))))))))

.

+ 2010-03-12 00:02 . 2010-03-12 00:02 16384 c:\windows\Temp\Perflib_Perfdata_228.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"4shared Desktop"="c:\program files\4shared Desktop\desktop.exe" [2009-12-07 3632640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SmcService"="c:\progra~1\Sygate\SPF\smc.exe" [2004-10-16 2577632]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"LVCOMS"="c:\program files\Common Files\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 127022]

"JMAP5289"="c:\program files\ULI5289\JMAP5289.exe" [2004-07-19 28672]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2009-12-18 40368]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

"4shared Update"="c:\program files\4shared Desktop\checkUpdate.exe" [2009-09-29 1337344]

c:\documents and settings\Nancy\Start Menu\Programs\Startup\

Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2009-12-15 18:14 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk

backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]

2006-08-01 22:35 67112 ----a-w- c:\program files\AIM\aim.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ALi5289]

2004-07-24 09:13 405504 ------w- c:\program files\ULI5289\ALi5289.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel File Shell Monitor]

2007-10-31 01:52 16200 ----a-w- c:\program files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechGalleryRepair]

2002-12-11 00:32 155648 ----a-w- c:\program files\Logitech\ImageStudio\ISStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechImageStudioTray]

2002-12-11 00:31 61440 ----a-w- c:\program files\Logitech\ImageStudio\LogiTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]

2009-05-27 02:06 4351216 ----a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]

2004-07-23 08:27 68096 ----a-w- c:\windows\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VeohPlugin]

2009-02-06 20:44 3572984 ----a-w- c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"EapHost"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"SiteAdvisor"=c:\program files\SiteAdvisor\5020\SiteAdv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Java\\jre1.5.0_07\\bin\\javaw.exe"=

"c:\\Program Files\\AIM\\aim.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"c:\\Program Files\\IncrediMail\\bin\\IMApp.exe"=

"c:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=

"c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=

"c:\\Program Files\\IncrediMail\\bin\\ImLc.exe"=

"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager

"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager

"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

"c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"=

"c:\\Program Files\\IncrediMail\\bin\\ImPackr.exe"=

"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 aliidex;aliidex;c:\windows\system32\drivers\aliidex.sys [7/10/2006 4:06 PM 7040]

R0 aliperf;aliperf;c:\windows\system32\drivers\aliperf.sys [7/10/2006 4:06 PM 7168]

R0 m5289;m5289;c:\windows\system32\drivers\m5289.sys [1/11/2005 9:50 AM 49101]

R0 sonypvl2;sonypvl2;c:\windows\system32\drivers\sonypvl2.sys [9/4/2006 5:16 PM 19478]

R0 uliagpkx;ULi AGP Bus Filter Driver;c:\windows\system32\drivers\AGPKX.SYS [7/10/2006 3:53 PM 44928]

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [12/15/2009 12:14 PM 333192]

R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [12/15/2009 12:14 PM 360584]

R1 sonypvf2;sonypvf2;c:\windows\system32\drivers\sonypvf2.sys [9/4/2006 5:16 PM 635017]

R1 sonypvt2;sonypvt2;c:\windows\system32\drivers\sonypvt2.sys [9/4/2006 5:16 PM 431236]

R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [12/15/2009 12:13 PM 285392]

R2 Viewpoint Service;Viewpoint Service;c:\program files\Viewpoint\Common\ViewpointService.exe [4/23/2009 8:01 AM 30152]

R3 JM5289;JM5289;\??\c:\documents and settings\Nancy\JM5289.sys --> c:\documents and settings\Nancy\JM5289.sys [?]

R3 PID_0900_V;Logitech ClickSmart 310(PID_0900_V);c:\windows\system32\drivers\LV551AV.sys [3/1/2009 11:04 PM 220079]

R3 ULI5261;ULi Based Ethernet NT Driver;c:\windows\system32\drivers\ULILAN.SYS [7/10/2006 3:55 PM 29696]

S1 sonypvd2;sonypvd2;c:\windows\system32\drivers\sonypvd2.sys [9/4/2006 5:16 PM 64093]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.yahoo.com/

uInternet Connection Wizard,ShellNext = iexplore

uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s

IE: &Add animation to IncrediMail Style Box - c:\program files\IncrediMail\bin\resources\WebMenuImg.htm

IE: &Download all 4shared files - c:\program files\4shared Desktop\down_all.htm

IE: &Download using 4shared Desktop - c:\program files\4shared Desktop\down_link.htm

Trusted Zone: ebay.com\search

Trusted Zone: liveops.com\callcenter

Trusted Zone: liveops.com\www

Trusted Zone: liveops.com \callcenter

Trusted Zone: proflowers.com\homeadmin

Trusted Zone: proflowers.com\www

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

DPF: {D8EE8DC0-F193-11D0-B1E5-08005A885319} - hxxps://calltaking2.workathomeagent.net/walldata/curVersion/hostexpress.cab

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-03-12 01:22

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vsdatant]

"ImagePath"=""

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-861567501-1897051121-725345543-1004\Software\Microsoft\Windows Mobile Disc\S*a*m*s*u*n*g* *B*l*a*c*k*J*a*c*k*"!\CriticalAppInstall\ActiveSync]

"Name"="ActiveSync"

"DisplayName"="Microsoft ActiveSync"

"Param1"="ActiveSync"

"Param2"=""

"Type"="wellknown"

"Order"=dword:00000000

"State"=dword:0000000b

[HKEY_USERS\S-1-5-21-861567501-1897051121-725345543-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

"??"=hex:89,61,5a,b1,c4,a6,35,3a,a1,af,96,14,de,12,56,6e,c7,e1,9e,68,35,97,25,

7b,1e,17,b9,20,62,61,49,15,ac,c2,d7,e1,64,ba,60,c7,bd,04,17,74,ce,ba,c8,fe,\

"??"=hex:e5,85,7e,b7,90,ab,d1,ac,28,b9,66,ef,9b,f4,3e,0d

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(748)

c:\windows\system32\Ati2evxx.dll

.

Completion time: 2010-03-12 01:24:43

ComboFix-quarantined-files.txt 2010-03-12 07:24

ComboFix2.txt 2010-03-12 00:24

ComboFix3.txt 2010-03-10 11:56

Pre-Run: 33,028,739,072 bytes free

Post-Run: 33,089,900,544 bytes free

- - End Of File - - D97C7F66AA13BA2A2798C2A3627A345E

Upload was successful

Maurice Naggar · March 12, 2010

Hello Nancy,

You've done well with the Combofix runs. :lol: It removed the files as I intended.

How do i turn this off an what is this ?
It comes up saying :
Precalence reporter avgcmgr.exe is trying to connect to mmi.explabs.net [38.103.37.243] using remote port 80 [HTTP-World Wide Web]. Do you want to allow this program to access the network ?"

That is a component of the AVG 9 antivirus program. That is OK to allow it.

You'll need to set the Sygate Personal Firewall such that it gives permissions to AVG 9 without prompting you all the time.

Here the next one for you an whats concerning me is I still have two iexplores in my windows taskmanger .

Humh... we'll need to do more digging around.

You will want to print out or copy these instructions to Notepad for offline reference!

If you are a casual viewer, do NOT try this on your system!

If you are not nevadagirl and have a similar problem, do NOT post here; start your own topic

Do not run or start any other programs while these utilities and tools are in use!

Do NOT run any other tools on your own or do any fixes other than what is listed here.

If you have questions, please ask before you do something on your own.

But it is important that you get going on these following steps.

=

Close any of your open programs that you started while you run these tools.

Step 1

Your system has the latest Java runtime, Java 6 Update 18; but it also has several older ones which need removal.

This is just maintenance & cleanup of older Java runtimes.

Close any programs you may have running - especially your web browser.
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove the older versions of Java. Remove these:
J2SE Runtime Environment 5.0 Update 7
J2SE Runtime Environment 5.0 Update 11
Java 6 Update 3
Java 6 Update 4
Java 6 Update 5
Java 6 Update 6
Java 6 Update 7
Check (highlight) each of them, in turn &
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove these Java versions.

Step 2

Start your MBAM MalwareBytes' Anti-Malware.

Click the Settings Tab. Make sure all option lines have a checkmark.

Next, Click the Update tab. Press the "Check for Updates" button.

At -this time- of posting, the current definitions are # 3858 and the latest program version is 1.44

When done, click the Scanner tab.

Select & Do a FULL Scan.

When the scan is complete, click OK, then Show Results to view the results.

Make sure that everything is checked, and click Remove Selected.

When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.

The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.

Depending on how many files your system has, it may take an hour or possibly a bit more to finish.

Have plenty of patience. It is well worth the effort and time.

Step 3

Please download DrWeb-CureIt & save it to your desktop. DO NOT perform a scan yet.

Reboot your computer in "SAFE MODE" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with DrWeb-CureIt as follows:

Double-click on cureit.exe to start the program. An "Express Scan of your PC" notice will appear.
Under "Start the Express Scan Now", Click "OK" to start. This is a short scan that will scan the files currently running in memory and when something is found, click the Yes button when it asks you if you want to cure it.
Once the short scan has finished, Click Options > Change settings
Choose the "Scan tab" and UNcheck "Heuristic analysis"
Back at the main window, click "Select drives" (a red dot will show which drives have been chosen)
Then click the "Start/Stop Scanning" button (green arrow on the right) and the scan will start.
When done, a message will be displayed at the bottom advising if any viruses were found.
Click "Yes to all" if it asks if you want to cure/move the file.
When the scan has finished, look if you can see the icon next to the files found. If so, click it, then click the next icon right below and select "Move incurable". (This will move it to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if it can't be cured)
Next, in the Dr.Web CureIt menu on top, click file and choose save report list.
Save the DrWeb.csv report to your desktop.
Exit Dr.Web Cureit when done.
Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)

Step 4

Close all non-essential programs & windows that you have open. And there should be none, since you would have restarted the system fresh in Normal mode.

Go here and download & SAVE Silent Runners.vbs (use IE to download it) to a new folder on your drive and run it.

It generates a log too {name will start with "Startup Programs". It takes a few minutes and it will notify you with a popup when your log is ready (it will be in the new folder you created).

Please post the information back in this thread. If your AV queries the script, allow it to run. It's not malicious. It simply generates a report on your system, and does not do any cleanup.

Reply with copy of the latest MBAM scan log

the DrWeb Cure-It report

the SilentRunners log

nevadagirl · March 14, 2010

Hi Maurice

Well I scan for the malware an everything is fine there . My problem is my pc will not let me boot up in safe mode . I have tired every different way I can , an it will not start up in safe mode is there another way to go into safe mode ? Also does it make any different that I have my hard drives set to rad o so they write at the same time . Just wondering if that might be why. You know Ive never put my pc in safe mode never had a problem till now .Well that about it so please any help with this would be truly appericate any help ..

Thanks Nancy

Maurice Naggar · March 14, 2010

Nancy,

Did you run the DrWeb Cure-it? If so, the results were all clean?

Download to your Desktop FixPolicies.exe, by Bill Castner, MS-MVP, a self-extracting ZIP archive from

>>> here <<<

Double-click FixPolicies.exe.
Click the "Install" button on the bottom toolbar of the box that will open.
The program will create a new Folder called FixPolicies.
Double-click to Open the new Folder, and then double-click the file within: Fix_Policies.cmd.
A black box will briefly appear and then close.
This fix may prove temporary. You can safely run the utility again.

If you did not run DrWeb Cure-it, Turn off AVG antivirus as you did before , and then run DrWeb Cure-it in Normal mode.

Also, I'd like for you to post the latest MBAM scan log and certainly the Silent Runners log too.

As to Safe mode, did you restart & tap & re-tap F8 key & get an Advanced Boot menu, with a list of startup options, including "Safe Mode" and "Safe mode with Networking" ??

btw, the fact that the system is set for RAID makes no difference, one way or another, regarding Safe mode.

nevadagirl · March 15, 2010

Hi Maurice

Sorry it taken so long but my computer is acting crazy . Ive been trying to work an fix this problem it has all at the same time an it not been easy .

Ok here is the Mbam you ask for

Objects scanned: 384494

Time elapsed: 2 hour(s), 35 minute(s), 15 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 5

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Documents and Settings\Nancy\Desktop\keeps\Ref\Ref1\R.A.A-P.C.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Nancy\My Documents\my GAMES\fff_reflex4.0\Reflexive_Game_2009\R.A.A-P.C.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Nancy\My Documents\my GAMES\reflexive 5\R.A.A-P.C.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Nancy\My Documents\my GAMES\reflexive 5\Ref\R.A.A-P.C.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Nancy\My Documents\my GAMES\reflexive 5\Ref\Ref1\R.A.A-P.C.exe (Trojan.Agent) -> Quarantined and deleted successfully.

I got those files with the trojans from 4 shared files online an havent even open them up so I dont think they hurt my pc ,

Also after today I dont no whats going on with it . I tired one more time to put in safe mode ,well actually

about 5 more times with no success.

So I tired to run the dr web it was just about finished an I had fell asleep waiting on it ,

It takes almost 2 hrs to run a scan on my pc cause i do alot of art work an stationery which I saved alot of tubes pictures plugins ex ecx ...

I have a quite alot of space an have only 30 gigs left .

Well anyhow then I tried to scan with dr web but it did not open as you said . It first ask if I would like to update. Which I did not, Wasnt sure because it was saying something about buying it an if I wanted to view the contract it either yes are no so I had to pick yes for it to continue.

Also you said that it would only do an express scan which it said express on the little thing that was tick but ran all of my documents just about everything which took sometimes like i said anyhow

after about two hr i feel asleep an it was almost finished an had not come up with any virus at that time . When I woke up this was waiting on my desk top. There was no file in the folder to tell of what had been done with the virus scan ..............

Your system has recovered from a serious error

c:\DOUCUME~1\Nancy\LOCALS~1\Temp\WERd1b6.dir00\Mini031510-01.dmp

c:\DOUCUME~1\Nancy\LOCALS~1\Temp\WERd1b6.dir00\sysdata.xml

Also right after this happen I had a window open up saying

NT Kerenel System has changed since the last time you used it .This could happen if you have updated it

recently .click detail if you want to see more . Do you want to allow it to access the network ?

Sygate Personal Fiewall 3/15/2010

the executable has changed since the last time you used:

C:\WINDOWS\system32\ntoskrnl.exe

File Version : 5.1.2600.5913

File Description : NT Kernel & System

File Path : C:\WINDOWS\system32\ntoskrnl.exe

Process ID : 0x4 (Heximal) 4 (Decimal)

Connection origin : remote initiated

Protocol : UDP

Local Address : 192.168.1.255

Local Port : 138 (NETBIOS-DGM - Browsing datagram responses of NetBIOS over TCP/IP)

Remote Name :

Remote Address : 192.168.1.10

Remote Port : 138

Ethernet packet details:

Ethernet II (Packet Length: 216)

Destination: ff-ff-ff-ff-ff-ff

Source: 00-e0-b8-7c-4b-41

Type: IP (0x0800)

Internet Protocol

Version: 4

Header Length: 20 bytes

Flags:

.0.. = Don't fragment: Not set

..0. = More fragments: Not set

Fragment offset:0

Time to live: 128

Protocol: 0x11 (UDP - User Datagram Protocol)

Header checksum: 0x5e19 (Correct)

Source: 192.168.1.10

Destination: 192.168.1.255

User Datagram Protocol

Source port: 138

Destination port: 138

Length: 8

Checksum: 0x3569 (Correct)

Data (182 Bytes)

Binary dump of the packet:

0000: FF FF FF FF FF FF 00 E0 : B8 7C 4B 41 08 00 45 00 | .........|KA..E.

0010: 00 CA 9C 6B 00 00 80 11 : 19 5E C0 A8 01 0A C0 A8 | ...k.....^......

0020: 01 FF 00 8A 00 8A 00 B6 : 69 35 11 02 82 04 C0 A8 | ........i5......

0030: 01 0A 00 8A 00 A0 00 00 : 20 45 45 45 42 46 47 45 | ........ EEEBFGE

0040: 4A 45 45 43 4E 44 42 45 : 42 44 4A 44 46 44 4A 44 | JEECNDBEBDJDFDJD

0050: 42 44 48 44 47 45 42 41 : 41 00 20 45 4E 46 44 45 | BDHDGEBAA. ENFDE

0060: 49 45 50 45 4E 45 46 43 : 41 43 41 43 41 43 41 43 | IEPENEFCACACACAC

0070: 41 43 41 43 41 43 41 43 : 41 42 4E 00 FF 53 4D 42 | ACACACACABN..SMB

0080: 25 00 00 00 00 00 00 00 : 00 00 00 00 00 00 00 00 | %...............

0090: 00 00 00 00 00 00 00 00 : 00 00 00 00 11 00 00 06 | ................

00A0: 00 00 00 00 00 00 00 00 : 00 E8 03 00 00 00 00 00 | ................

00B0: 00 00 00 06 00 56 00 03 : 00 01 00 01 00 02 00 17 | .....V..........

00C0: 00 5C 4D 41 49 4C 53 4C : 4F 54 5C 42 52 4F 57 53 | .\MAILSLOT\BROWS

<<< this also came up. I was wanting to know why this happen to be there as well ? With all the other information,

<<<<<<<<Should I except this change >>>>>>>

Application has changed since the last time you opened it, process id: 4

Filename: C:\WINDOWS\system32\ntoskrnl.exe

The change was allowed by user

---- Modules changed: 1 ----

C:\WINDOWS\system32\ntoskrnl.exe

---- New modules: 0 ----

00D0: 45 00 09 04 AA 00 00 00 : | E.......

Well thats the update as of now do you want me to try an rescan with dr web ?

Maurice Naggar · March 16, 2010

Hi Nancy,

No, do NOT run DrWeb Cure-It.

I need for you to get and run SilentRunners utility.

Go here and download & SAVE Silent Runners.vbs (use IE to download it) to a new folder on your drive and run it.

It generates a log too {name will start with "Startup Programs". It takes a few minutes and it will notify you with a popup when your log is ready (it will be in the new folder you created).

Please post the information back in this thread. If your AV queries the script, allow it to run. It's not malicious. It simply generates a report on your system, and does not do any cleanup.

Reply with copy of the DrWeb Cure-It report

Next, delete the copy of OTL.exe on your Desktop. I'd like for you to get the latest.

Download OTL by OldTimer to your desktop: http://oldtimer.geekstogo.com/OTL.com

Double-click OTL to start it.

Look at the upper left of window. Press the pink color Quick Scan button.

Have patience while it runs.

It will produce a new log. Save it.

Copy and paste back here a copy of the new OTL.txt

nevadagirl · March 16, 2010

heres the startup program for silent runner

Maurice as far as the dr web , it did not make a file are anything like said it left me with a completely rebooted system an a box sitting there saying my system had recovered from a serious problem, not sure why it did not make a file .

I looked in the folder an there was nothing in it .

So do you want me to try an re run dr web , before i run another otl ?

Please let me know which one you would like me to run first

again thanks for all your time I can not say it enough

"Silent Runners.vbs", revision 60, http://www.silentrunners.org/

Operating System: Windows XP SP3

Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:

---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}

"H/PC Connection Agent" = ""C:\Program Files\Microsoft ActiveSync\wcescomm.exe"" [MS]

"ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}

"SmcService" = "C:\PROGRA~1\Sygate\SPF\smc.exe -startgui" ["Sygate Technologies, Inc."]

"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]

"LVCOMS" = "C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE" ["Logitech Inc."]

"JMAP5289" = "C:\Program Files\ULI5289\JMAP5289.exe" [null data]

"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Inc."]

"Adobe Reader Speed Launcher" = ""C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"" ["Adobe Systems Incorporated"]

"Adobe ARM" = ""C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"" ["Adobe Systems Incorporated"]

"4shared Update" = ""C:\Program Files\4shared Desktop\checkUpdate.exe"" ["New IT Solutions"]

"SunJavaUpdateSched" = ""C:\Program Files\Java\jre6\bin\jusched.exe"" [file not found]

"KernelFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -k"

HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\

>{26923b43-4d38-484f-9b9e-de460746276c}\(Default) = "Internet Explorer"

\StubPath = "C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig" [MS]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)

-> {HKLM...CLSID} = "Adobe PDF Reader Link Helper"

\InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]

{22BF413B-C6D2-4d91-82A9-A0F997BA588C}\(Default) = "Skype add-on (mastermind)"

-> {HKLM...CLSID} = "Skype add-on (mastermind)"

\InProcServer32\(Default) = "C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll" ["Skype Technologies S.A."]

{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\(Default) = "WormRadar.com IESiteBlocker.NavFilter"

-> {HKLM...CLSID} = "AVG Safe Search"

\InProcServer32\(Default) = "C:\Program Files\AVG\AVG9\avgssie.dll" ["AVG Technologies CZ, s.r.o."]

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)

-> {HKLM...CLSID} = "SSVHelper Class"

\InProcServer32\(Default) = "C:\Program Files\Java\jre6\bin\ssv.dll" ["Sun Microsystems, Inc."]

{DBC80044-A445-435b-BC74-9C25C1C588A9}\(Default) = (no title provided)

-> {HKLM...CLSID} = "Java Plug-In 2 SSV Helper"

\InProcServer32\(Default) = "C:\Program Files\Java\jre6\bin\jp2ssv.dll" ["Sun Microsystems, Inc."]

{E7E6F031-17CE-4C07-BC86-EABFE594F69C}\(Default) = "JQSIEStartDetectorImpl"

-> {HKLM...CLSID} = "JQSIEStartDetectorImpl Class"

\InProcServer32\(Default) = "C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll" ["Sun Microsystems, Inc."]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"

-> {HKLM...CLSID} = (no title provided)

\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS]

"{49BF5420-FA7F-11cf-8011-00A0C90A8F78}" = "Mobile Device"

-> {HKLM...CLSID} = "Mobile Device"

\InProcServer32\(Default) = "C:\PROGRA~1\MI3AA1~1\Wcesview.dll" [MS]

"{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler"

-> {HKLM...CLSID} = "Microsoft Office Outlook"

\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS]

"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler"

-> {HKLM...CLSID} = "Outlook File Icon Extension"

\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS]

"{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" = "OpenOffice.org Column Handler"

-> {HKLM...CLSID} = (no title provided)

\InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]

"{087B3AE3-E237-4467-B8DB-5A38AB959AC9}" = "OpenOffice.org Infotip Handler"

-> {HKLM...CLSID} = (no title provided)

\InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]

"{63542C48-9552-494A-84F7-73AA6A7C99C1}" = "OpenOffice.org Property Sheet Handler"

-> {HKLM...CLSID} = (no title provided)

\InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]

"{3B092F0C-7696-40E3-A80F-68D74DA84210}" = "OpenOffice.org Thumbnail Viewer"

-> {HKLM...CLSID} = (no title provided)

\InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]

"{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}" = "Microsoft Office Metadata Handler"

-> {HKLM...CLSID} = "Microsoft Office Metadata Handler"

\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS]

"{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}" = "Microsoft Office Thumbnail Handler"

-> {HKLM...CLSID} = "Microsoft Office Thumbnail Handler"

\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS]

"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"

-> {HKLM...CLSID} = "RealOne Player Context Menu Class"

\InProcServer32\(Default) = "C:\Program Files\rpshell.dll" ["RealNetworks, Inc."]

"{B446400D-0030-457b-8F64-422A19605186}" = "Logitech Gallery"

-> {HKLM...CLSID} = "Logitech Gallery"

\InProcServer32\(Default) = "C:\Program Files\Logitech\ImageStudio\NameSpc.dll" ["Logitech Inc."]

"{1B2B8872-CBC3-4d18-9DFC-ADF855549994}" = "Riff icon extension"

-> {HKLM...CLSID} = "RiffIconHandler Class"

\InProcServer32\(Default) = "c:\Program Files\Common Files\Corel\Shared\Icon Handler\RiffSE.dll" ["Corel Corporation"]

"{9E209F16-C917-4DAC-8540-F9BC5E0F98CF}" = "Sketchpad icon extension"

-> {HKLM...CLSID} = "SketchpadIconHandler Class"

\InProcServer32\(Default) = "c:\Program Files\Common Files\Corel\Shared\Icon Handler\SketchpadSE.dll" ["Corel Corp"]

"{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" = "AVG Shell Extension"

-> {HKLM...CLSID} = "AVG Shell Extension Class"

\InProcServer32\(Default) = "C:\Program Files\AVG\AVG9\avgse.dll" ["AVG Technologies CZ, s.r.o."]

"{EBDF1F20-C829-11D1-8233-0020AF3E97A9}" = "4shsared_Desktop"

-> {HKLM...CLSID} = "4shared_Desktop"

\InProcServer32\(Default) = "C:\PROGRA~1\4SHARE~1\CMenu.dll" [null data]

"{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip"

-> {HKLM...CLSID} = "WinZip"

\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP11.0\WZSHLSTB.DLL" ["WinZip Computing LP"]

"{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip"

-> {HKLM...CLSID} = "WinZip"

\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP11.0\WZSHLSTB.DLL" ["WinZip Computing LP"]

"{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip"

-> {HKLM...CLSID} = "WinZip"

\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP11.0\WZSHLSTB.DLL" ["WinZip Computing LP"]

"{E0D79307-84BE-11CE-9641-444553540000}" = "WinZip"

-> {HKLM...CLSID} = "WinZip"

\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP11.0\WZSHLSTB.DLL" ["WinZip Computing LP"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\

"WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

-> {HKLM...CLSID} = "WPDShServiceObj Class"

\InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS]

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\

<<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]

<<!>> avgrsstarter\DLLName = "avgrsstx.dll" ["AVG Technologies CZ, s.r.o."]

HKLM\SOFTWARE\Classes\PROTOCOLS\Filter\

<<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"

-> {HKLM...CLSID} = (no title provided)

\InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]

HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\

<<!>> linkscanner\CLSID = "{F274614C-63F8-47D5-A4D1-FBDDE494F8D1}"

-> {HKLM...CLSID} = "XPLPPFilter Class"

\InProcServer32\(Default) = "C:\Program Files\AVG\AVG9\avgpp.dll" ["AVG Technologies CZ, s.r.o."]

<<!>> ms-itss\CLSID = "{0A9007C0-4076-11D3-8789-0000F8105754}"

-> {HKLM...CLSID} = "Microsoft Infotech Storage Protocol for IE 4.0"

\InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL" [MS]

HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\

4shared_Desktop\(Default) = "{EBDF1F20-C829-11D1-8233-0020AF3E97A9}"

-> {HKLM...CLSID} = "4shared_Desktop"

\InProcServer32\(Default) = "C:\PROGRA~1\4SHARE~1\CMenu.dll" [null data]

AVG9 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"

-> {HKLM...CLSID} = "AVG Shell Extension Class"

\InProcServer32\(Default) = "C:\Program Files\AVG\AVG9\avgse.dll" ["AVG Technologies CZ, s.r.o."]

IMMenuShellExt\(Default) = "{F8984111-38B6-11D5-8725-0050DA2761C4}"

-> {HKLM...CLSID} = "IMMenuShellExt Class"

\InProcServer32\(Default) = "C:\Program Files\IncrediMail\bin\ImShExtU.dll" ["IncrediMail, Ltd."]

________________________________________________________________________________

________

ALSO I DECIDED TO RUN IT WITH IE open cause thats when alot of my stuff goes on so this is a second run

with the ie open looks diffent to .

Also it said to run a second one saying no an then yes at the second window box so I went a head an did that

.

________________________________________________________________________________

_____________

(heres the last scan of SILENT RUNNER IN all the different types of run it said could be run did not which one you wanted so did then all )

"Operating System: Windows XP SP3