ccarbo Posted May 26, 2008 ID:18835 Share Posted May 26, 2008 Here are the logs as directed on this site.PandaScan;***********************************************************************************************************************************************************************************ANALYSIS: 2008-05-25 16:45:49PROTECTIONS: 1MALWARE: 2SUSPECTS: 0;***********************************************************************************************************************************************************************************PROTECTIONSDescription Version Active Updated;===================================================================================================================================================================================AVG Anti-Virus Free 8.0 Yes Yes;===================================================================================================================================================================================MALWAREId Description Type Active Severity Disinfectable Disinfected Location;===================================================================================================================================================================================00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Documents and Settings\user\Cookies\user@go[2].txt00289207 Application/FunWeb HackTools No 0 Yes No C:\Program Files\MSN Messenger\msimg32.dll;===================================================================================================================================================================================SUSPECTSSent Location z;===================================================================================================================================================================================;===================================================================================================================================================================================VULNERABILITIESId Severity Description z;===================================================================================================================================================================================;===================================================================================================================================================================================MALware log.Malwarebytes' Anti-Malware 1.12Database version: 786Scan type: Quick ScanObjects scanned: 47416Time elapsed: 11 minute(s), 49 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 29Registry Values Infected: 3Registry Data Items Infected: 0Folders Infected: 3Files Infected: 413Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:HKEY_CLASSES_ROOT\asapcom.asapenvelope (Adware.Hotbar) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\asapcom.asapenvelope.1 (Adware.Hotbar) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\CLSID\{286e500c-ef0a-4aa3-a94d-e495f653ef4b} (Adware.Hotbar) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\asapcom.asapmessage (Adware.Hotbar) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\asapcom.asapmessage.1 (Adware.Hotbar) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\CLSID\{319260ab-be0c-4025-8569-7a27ed2faab9} (Adware.Hotbar) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\asapcom.asapclass (Adware.Hotbar) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\asapcom.asapclass.1 (Adware.Hotbar) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\CLSID\{8ac5bc54-b13b-4642-99f9-0baa2d116184} (Adware.Hotbar) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\asapcom.asapmain (Adware.Hotbar) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\asapcom.asapmain.1 (Adware.Hotbar) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\CLSID\{9809a6b4-70b1-4bb2-b3b5-b415763a534e} (Adware.Hotbar) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\asapcom.asaprecipients (Adware.Hotbar) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\asapcom.asaprecipients.1 (Adware.Hotbar) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\CLSID\{d5178f77-c5e6-4e8f-9787-48b5d7eccce8} (Adware.Hotbar) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\Interface\{21447c90-6ec1-4fc1-9379-bd515008aedb} (Adware.Hotbar) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\Interface\{32c97a37-e2b8-4097-9330-5f3e1125e181} (Adware.Hotbar) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\Interface\{b0c3de1b-e3ff-4dd0-9229-f452cf9c678e} (Adware.Hotbar) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\Interface\{d2d94732-a74d-433c-98f7-9ed740e82ae9} (Adware.Hotbar) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\Interface\{dfd5d79b-ef2f-4a51-9821-5b469f05262e} (Adware.Hotbar) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\Typelib\{bce2e826-d0f5-41c8-97be-28a6f540ceeb} (Adware.Hotbar) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\Interface\{8ad9ad05-36be-4e40-ba62-5422eb0d02fb} (Adware.Shopping.Report) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\Interface\{aebf09e2-0c15-43c8-99bf-928c645d98a0} (Adware.Shopping.Report) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\Interface\{d8560ac2-21b5-4c1a-bdd4-bd12bc83b082} (Adware.Shopping.Report) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\Typelib\{cdca70d8-c6a6-49ee-9bed-7429d6c477a2} (Adware.Shopping.Report) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\Typelib\{d136987f-e1c4-4ccc-a220-893df03ec5df} (Adware.Shopping.Report) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\Typelib\{e343edfc-1e6c-4cb5-aa29-e9c922641c80} (Adware.Shopping.Report) -> Quarantined and deleted successfully.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\Software\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully.Registry Values Infected:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange\Client\Extensions\Spam Blocker for MS Outlook (Adware.Hotbar) -> Quarantined and deleted successfully.Registry Data Items Infected:(No malicious items detected)Folders Infected:C:\Program Files\RegistrySmart (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Registry Backups (Rogue.RegistrySmart) -> Quarantined and deleted successfully.Files Infected:C:\Program Files\RegistrySmart\unins000.dat (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\unins000.exe (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_11_18_43_50.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_11_18_43_54.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_11_19_47_55.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_12_14_54_58.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_12_20_17_43.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_12_21_33_57.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_13_08_47_15.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_13_15_43_14.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_13_20_01_03.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_14_17_00_56.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_14_20_20_55.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_15_15_09_28.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_16_16_32_31.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_16_21_53_42.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_17_12_35_46.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_18_00_16_53.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_18_13_47_44.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_19_22_32_10.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_20_09_10_03.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_20_17_54_14.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_21_12_57_07.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_23_09_50_19.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_24_17_15_16.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_24_17_34_06.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_24_21_38_53.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_25_13_14_21.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_25_18_40_05.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_25_22_21_47.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_26_10_01_58.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_26_15_50_10.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_27_11_10_36.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_27_18_21_06.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_28_17_51_40.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_29_17_45_48.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_29_23_33_04.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_30_08_44_02.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_30_15_18_30.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_30_16_03_48.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_30_16_10_06.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_11_30_16_14_54.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_01_11_15_04.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_02_11_08_39.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_02_15_00_52.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_03_08_09_49.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_03_16_44_20.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_03_21_07_42.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_03_23_28_36.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_04_16_50_08.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_04_22_10_34.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_04_22_16_35.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_04_22_18_28.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_04_23_12_49.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_05_19_57_17.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_06_18_18_40.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_07_16_14_40.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_08_00_35_47.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_08_10_00_45.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_09_15_01_43.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_10_16_38_40.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_11_10_40_32.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_11_22_29_44.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_12_16_29_49.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_12_19_14_28.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_12_19_16_55.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_13_09_09_00.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_13_21_57_29.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_15_00_36_17.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_15_01_34_01.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_15_09_23_16.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_16_09_49_47.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_17_14_54_51.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_18_01_14_28.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_18_13_39_30.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_19_08_09_33.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_19_19_16_23.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_20_13_51_17.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_20_19_02_33.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_20_19_50_05.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_20_21_32_12.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_21_15_30_28.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_22_08_26_22.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_22_09_42_30.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_22_16_21_16.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_22_19_52_17.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_23_08_31_43.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_24_00_16_05.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_24_09_19_52.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_24_17_08_55.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_25_10_47_51.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_25_21_37_34.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_26_07_26_46.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_26_07_35_25.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_26_09_58_26.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_26_10_03_46.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_26_10_07_39.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_26_18_07_54.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_27_10_43_41.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_27_14_27_46.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_27_22_01_28.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_27_23_32_11.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_28_11_27_32.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_29_17_00_39.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_30_16_02_18.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_30_23_42_35.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2007_12_31_14_14_49.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_01_01_34_42.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_01_11_02_18.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_02_10_02_52.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_02_20_56_06.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_03_11_54_41.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_03_15_12_06.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_03_20_40_44.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_04_10_20_55.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_05_12_52_41.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_05_17_47_02.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_05_22_26_51.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_06_10_29_20.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_06_21_10_09.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_07_09_54_18.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_07_10_29_33.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_08_14_45_04.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_08_15_31_45.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_08_15_42_17.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_08_15_58_15.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_08_17_51_30.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_08_18_24_41.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_08_19_09_14.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_09_08_44_33.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_09_21_01_29.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_10_09_12_04.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_11_10_09_48.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_11_11_36_37.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_11_23_52_56.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_12_00_29_35.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_12_09_11_53.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_12_09_22_22.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_12_23_51_38.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_13_08_34_50.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_13_11_18_22.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_13_13_37_19.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_14_10_32_34.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_14_15_39_32.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_14_19_47_39.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_15_11_00_48.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_15_22_58_32.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_16_09_54_40.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_16_11_23_39.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_16_13_08_01.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_17_09_33_35.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_17_20_51_50.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_18_08_21_21.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_18_09_38_49.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_18_22_47_07.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_19_08_24_49.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_20_09_39_14.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_20_22_23_16.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_21_09_47_35.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_21_16_23_16.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_22_09_44_32.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_22_16_44_52.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_22_19_52_12.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_23_17_48_08.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_23_20_33_06.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_24_10_44_09.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_24_10_47_41.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_24_18_35_38.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_25_08_48_36.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_25_13_28_59.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_26_09_24_36.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_26_16_43_16.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_26_20_52_00.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_27_08_36_47.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_27_12_53_31.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_27_20_44_29.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_28_17_21_51.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_29_10_00_40.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_29_10_12_50.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_30_10_12_44.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_30_14_09_42.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_30_18_09_51.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_31_05_41_24.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_31_07_17_56.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_31_17_31_08.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_31_21_03_31.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_01_31_23_50_04.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_01_15_58_09.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_01_16_24_03.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_02_11_21_28.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_02_11_25_54.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_02_11_39_42.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_02_22_18_31.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_03_08_18_12.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_04_16_04_11.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_04_22_10_23.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_05_11_52_15.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_05_23_22_20.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_06_08_37_22.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_06_18_28_58.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_07_09_29_22.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_07_16_36_02.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_07_22_18_01.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_08_17_09_28.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_09_08_01_22.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_09_10_46_49.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_10_10_33_20.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_10_18_20_53.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_10_21_27_20.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_11_17_09_50.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_12_11_46_47.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_12_17_14_10.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_13_15_18_48.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_14_10_04_18.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_14_10_44_58.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_14_18_38_06.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_16_09_01_27.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_16_10_08_56.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_16_12_49_44.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_17_00_10_09.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_17_10_44_33.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_17_17_54_42.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_17_19_39_24.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_18_07_52_21.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_19_07_46_13.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_19_20_38_05.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_20_07_44_48.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_20_15_47_17.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_20_18_42_05.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_21_07_37_18.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_21_22_41_52.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_22_11_04_31.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_22_19_46_47.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_23_08_46_55.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_24_00_36_19.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_24_08_36_43.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_25_07_45_56.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_25_07_59_01.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_25_17_04_46.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_25_20_56_49.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_25_21_42_45.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_26_10_21_58.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_26_16_40_56.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_27_07_53_42.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_27_17_29_12.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_29_07_20_48.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_29_14_58_43.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_02_29_15_16_52.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_02_18_04_38.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_02_19_22_58.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_03_15_24_57.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_03_18_22_13.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_04_16_12_48.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_04_22_28_05.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_05_17_13_18.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_06_00_15_22.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_06_07_39_35.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_07_21_34_58.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_08_12_42_22.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_08_22_34_22.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_08_22_41_01.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_09_08_56_25.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_10_22_02_00.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_10_22_12_09.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_10_23_22_38.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_11_09_33_32.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_11_17_07_58.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_12_09_08_58.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_12_17_40_34.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_12_17_44_24.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_13_10_57_31.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_13_17_55_43.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_13_19_08_07.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_16_15_42_50.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_16_19_11_14.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_17_10_08_11.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_18_08_00_33.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_18_23_42_12.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_18_23_47_02.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_19_10_20_46.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_19_16_04_08.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_19_21_28_05.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_19_21_40_02.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_19_23_52_06.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_20_08_55_51.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_20_12_07_36.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_20_17_47_43.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_20_22_57_02.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_21_07_32_23.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_21_10_49_13.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_23_18_25_32.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_24_07_56_02.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_24_18_54_15.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_25_14_43_13.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_25_17_11_30.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_26_07_28_00.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_26_18_06_02.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_26_21_41_13.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_27_20_53_13.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_28_07_47_49.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_28_14_25_18.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_28_14_57_30.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_28_17_27_09.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_28_20_31_30.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_29_00_40_52.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_29_09_19_59.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_29_09_57_50.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_30_00_50_21.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_30_09_12_43.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_30_13_30_07.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_30_22_19_00.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_31_07_49_18.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_31_14_04_25.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_31_16_03_27.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_03_31_22_33_30.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_01_09_13_08.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_01_16_28_28.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_02_15_39_54.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_02_20_00_14.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_03_07_48_23.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_03_18_59_19.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_04_12_31_53.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_04_17_16_37.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_05_10_27_21.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_06_15_23_22.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_06_16_24_54.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_07_15_58_11.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_09_15_23_13.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_09_20_14_34.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_10_09_19_35.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_10_17_51_58.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_11_15_45_09.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_12_10_16_06.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_13_08_08_13.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_13_13_05_55.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_13_16_19_29.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_14_11_51_35.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_14_19_20_49.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_16_21_28_59.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_17_08_06_06.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_18_11_03_33.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_18_17_22_24.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_19_18_36_38.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_20_11_08_59.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_20_18_45_59.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_21_12_03_48.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_22_01_52_35.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_22_09_08_40.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_22_15_34_00.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_22_20_39_18.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_22_20_51_35.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_23_16_52_53.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_24_15_10_56.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_25_08_57_04.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_25_20_04_40.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_26_08_32_45.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_26_08_35_38.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_27_07_11_58.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_27_10_44_54.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_27_20_37_44.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_29_08_43_07.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_30_09_36_42.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_30_17_23_00.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_04_30_18_58_44.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_01_07_33_54.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_02_06_16_27.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_03_06_53_30.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_03_16_30_05.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_04_07_51_42.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_04_16_06_14.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_05_16_14_32.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_06_14_47_54.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_07_08_35_17.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_07_12_32_49.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_08_09_17_56.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_09_13_33_07.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_11_09_31_21.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_11_12_41_34.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_11_17_47_09.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_11_19_02_05.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_12_10_16_13.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_12_20_44_16.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_13_16_42_40.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_14_07_42_26.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_14_20_36_52.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_15_06_35_32.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_16_10_00_19.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_16_17_40_50.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_17_10_05_48.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_17_17_45_49.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_17_23_07_25.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_18_07_59_50.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_18_14_16_25.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_19_07_27_50.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_19_14_04_24.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_19_22_02_06.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_20_07_25_11.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_20_20_20_36.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_21_07_45_12.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_22_07_56_35.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_22_15_02_52.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_23_10_13_21.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_24_08_59_10.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_24_10_07_59.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_24_11_08_06.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_24_15_02_36.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_24_15_07_28.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Log\log_2008_05_25_16_56_20.eklog (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Registry Backups\2006-11-25_11-31-55.reg (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Registry Backups\2006-11-25_11-34-09.reg (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Registry Backups\2007-09-16_19-18-20.reg (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Registry Backups\2007-09-18_15-16-40.reg (Rogue.RegistrySmart) -> Quarantined and deleted successfully.C:\Program Files\RegistrySmart\Registry Backups\2007-11-11_19-42-10.reg (Rogue.RegistrySmart) -> Quarantined and deleted successfully.HJT logLogfile of Trend Micro HijackThis v2.0.2Scan saved at 7:54:00 PM, on 5/25/2008Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16640)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Windows Defender\MsMpEng.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\SOUNDMAN.EXEC:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exeC:\Program Files\Canon\Memory Card Utility\iP6600D\PDUiP6600DMon.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\PROGRA~1\AVG\AVG8\avgwdsvc.exeC:\Program Files\Windows Defender\MSASCui.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Java\jre1.6.0_05\bin\jusched.exeC:\Program Files\QuickTime\QTTask.exeC:\Program Files\iTunes\iTunesHelper.exeC:\PROGRA~1\AVG\AVG8\avgtray.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\PROGRA~1\AVG\AVG8\avgrsx.exeC:\PROGRA~1\AVG\AVG8\avgemc.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\system32\taskmgr.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBRR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBRR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBRR3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dllO2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLLO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dllO2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dllO2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dllO3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLLO4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWndO4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exeO4 - HKLM\..\Run: [PDUiP6600DMon] C:\Program Files\Canon\Memory Card Utility\iP6600D\PDUiP6600DMon.exeO4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hideO4 - HKLM\..\Run: [RegistrySmart] "C:\Program Files\RegistrySmart\RegistrySmart.exe" -bootO4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottimeO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exeO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeO4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htmO8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.htmlO8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.htmlO8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.htmlO8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cabO16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader.cabO16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cabO16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/Facebo...toUploader3.cabO16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1161288176437O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cabO16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cabO16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/Facebo...Uploader4_5.cabO16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cabO16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100O17 - HKLM\System\CCS\Services\Tcpip\..\{B9FA3005-A3E8-435F-9F76-1900AA4ACA6A}: NameServer = 216.165.129.157,216.170.153.146O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dllO20 - AppInit_DLLs: avgrsstx.dllO23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exeO23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exeO23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exeO23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe--End of file - 10119 bytes Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted May 26, 2008 Root Admin ID:18840 Share Posted May 26, 2008 How does the system appear to be running now?Please go into the Control Panel - Add/Remove and uninstall all versions of JAVA. Once the your system is cleaned up you can download the latest version of Java from here. Java Runtime Environment (JRE) 6 Update 6Also remove RegistrySmart which is a Rogue program.Start HiJackThis and do a Scan Only and place a check mark in the following itemsO4 - HKLM\..\Run: [RegistrySmart] "C:\Program Files\RegistrySmart\RegistrySmart.exe" -bootO4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllThen click on "Fix selected"Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.Close all applications and windows.Double-click on dss.exe to run it, and follow the prompts.When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt <-this one will be minimizedCopy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and the extra.txt to your post in your replyWhat DSS will do:create a new System Restore point in Windows XP and Vista.clean your Temporary Files, Downloaded Program Files, and Internet Cache Files, and also empty the Recycle Bin on all drives.check some important areas of your system and produce a report for your analyst to review. DSS automatically runs HijackThis for you, but it will also install and place a shortcut to HijackThis on your desktop if you do not already have HijackThis installed.Notes: The first time that the Deckard scanner is run, the extra.txt is generated in a minimized window. The second time you will not obtain the extra.txt. You must go to Start=>Run and copy the following "%userprofile%\desktop\dss.exe" /config in the line and click OK You will receive a pop-up box with options to check for the Main log and Extra Log and Options.Post back the logs for us to review Link to post Share on other sites More sharing options...
ccarbo Posted May 26, 2008 Author ID:18865 Share Posted May 26, 2008 I will run these, but these logs are for 2 different PCs..... I posted them separate but somehow they are combined. Can you look at the first one? thanks Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted May 26, 2008 Root Admin ID:18879 Share Posted May 26, 2008 I have split out your other post. In the future I would suggest making it clear that you're posting about 2 different computers.Please follow the instructions above for this system. Link to post Share on other sites More sharing options...
ccarbo Posted May 27, 2008 Author ID:18901 Share Posted May 27, 2008 Yeh they were posted separate but this morning they were combined. Anyway, here is the results for this PC.Deckard's System Scanner v20071014.68Run by user on 2008-05-26 21:17:20Computer is in Normal Mode.---------------------------------------------------------------------------------- System Restore --------------------------------------------------------------System Restore is disabled; attempting to re-enable...success.-- Last 1 Restore Point(s) --1: 2008-05-27 02:17:22 UTC - RP601 - System CheckpointBacked up registry hives.Performed disk cleanup.Total Physical Memory: 448 MiB (512 MiB recommended).-- HijackThis (run as user.exe) ------------------------------------------------Logfile of Trend Micro HijackThis v2.0.2Scan saved at 9:18:55 PM, on 5/26/2008Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16640)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\SOUNDMAN.EXEC:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exeC:\Program Files\Canon\Memory Card Utility\iP6600D\PDUiP6600DMon.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\PROGRA~1\AVG\AVG8\avgwdsvc.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\QuickTime\QTTask.exeC:\Program Files\iTunes\iTunesHelper.exeC:\PROGRA~1\AVG\AVG8\avgtray.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\PROGRA~1\AVG\AVG8\avgrsx.exeC:\PROGRA~1\AVG\AVG8\avgemc.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\system32\taskmgr.exeC:\WINDOWS\system32\msiexec.exeC:\Documents and Settings\user\Desktop\dss.exeC:\PROGRA~1\TRENDM~1\HIJACK~1\user.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBRR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBRR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBRR3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dllO2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dllO2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLLO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dllO2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLLO4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWndO4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exeO4 - HKLM\..\Run: [PDUiP6600DMon] C:\Program Files\Canon\Memory Card Utility\iP6600D\PDUiP6600DMon.exeO4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottimeO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exeO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeO4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.htmlO8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.htmlO8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.htmlO8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.htmlO9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cabO16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader.cabO16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cabO16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/Facebo...toUploader3.cabO16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1161288176437O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cabO16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cabO16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/Facebo...Uploader4_5.cabO16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cabO16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100O17 - HKLM\System\CCS\Services\Tcpip\..\{B9FA3005-A3E8-435F-9F76-1900AA4ACA6A}: NameServer = 216.165.129.157,216.170.153.146O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dllO20 - AppInit_DLLs: avgrsstx.dllO23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exeO23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exeO23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exeO23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe--End of file - 9083 bytes-- HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\) -----------backup-20080526-211633-256 O4 - HKLM\..\Run: [RegistrySmart] "C:\Program Files\RegistrySmart\RegistrySmart.exe" -bootbackup-20080526-211633-360 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dllbackup-20080526-211633-580 O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"-- File Associations -----------------------------------------------------------.reg - regfile - shell\open\command - regedit.exe "%1" %*.scr - scrfile - shell\open\command - "%1" %*-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------S3 grmnusb - c:\windows\system32\drivers\grmnusb.sys <Not Verified; GARMIN Corp.; Garmin USB GPS>-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service>S2 CLTNetCnService (Symantec Lic NetConnect service) - "c:\program files\common files\symantec shared\ccsvchst.exe" /h cccommon (file missing)-- Device Manager: Disabled ----------------------------------------------------No disabled devices found.-- Scheduled Tasks -------------------------------------------------------------2008-05-23 17:58:02 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job-- Files created between 2008-04-26 and 2008-05-26 -----------------------------2008-05-26 21:13:11 0 d-------- C:\Program Files\Common Files\Java2008-05-25 19:53:40 0 d-------- C:\Program Files\Trend Micro2008-05-25 19:26:36 0 d-------- C:\Documents and Settings\user\Application Data\Malwarebytes2008-05-25 19:26:30 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes2008-05-25 19:26:29 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware2008-05-25 16:53:04 691545 --a------ C:\WINDOWS\unins000.exe2008-05-25 16:53:04 2549 --a------ C:\WINDOWS\unins000.dat2008-05-25 16:47:35 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy2008-05-25 09:51:19 0 d-------- C:\WINDOWS\system32\drivers\Avg2008-05-25 09:51:18 0 d-------- C:\Documents and Settings\user\Application Data\AVGTOOLBAR2008-05-25 09:51:06 0 d-------- C:\Program Files\AVG2008-05-25 09:51:05 0 d-------- C:\Documents and Settings\All Users\Application Data\avg82008-05-25 08:47:00 0 d-------- C:\Program Files\Panda Security2008-05-11 21:44:14 0 d-------- C:\Documents and Settings\user\Application Data\Move Networks-- Find3M Report ---------------------------------------------------------------2008-05-26 21:13:50 0 d-------- C:\Program Files\Java2008-05-26 21:13:11 0 d-------- C:\Program Files\Common Files2008-05-26 21:06:01 0 d-------- C:\Program Files\Windows Live Toolbar2008-05-25 20:01:21 0 d-------- C:\Documents and Settings\user\Application Data\OpenOffice.org22008-04-18 17:20:39 0 d-------- C:\Program Files\iTunes2008-04-18 17:20:30 0 d-------- C:\Program Files\iPod2008-04-18 17:19:32 0 d-------- C:\Program Files\QuickTime2008-04-18 17:18:07 0 d-------- C:\Program Files\Common Files\Apple2008-04-18 17:11:19 0 d-------- C:\Program Files\Apple Software Update2008-04-14 20:13:41 0 d-------- C:\Documents and Settings\user\Application Data\LimeWire2008-04-03 20:17:23 0 d-------- C:\Program Files\Project64 1.6-- Registry Dump ---------------------------------------------------------------*Note* empty entries & legit default entries are not shown[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}]05/25/2008 09:51 AM 2050816 --a------ C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]"{A057A204-BACC-4D26-9990-79A187E2698E}"= C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [05/25/2008 09:51 AM 2050816][-HKEY_CLASSES_ROOT\CLSID\{A057A204-BACC-4D26-9990-79A187E2698E}][HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Cmaudio"="cmicnfg.cpl" []"SoundMan"="SOUNDMAN.EXE" [12/22/2004 04:09 AM C:\WINDOWS\SOUNDMAN.EXE]"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe" [07/11/2002 07:06 AM]"PDUiP6600DMon"="C:\Program Files\Canon\Memory Card Utility\iP6600D\PDUiP6600DMon.exe" [05/25/2005 09:35 AM]"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 11:16 PM]"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [03/28/2008 11:37 PM]"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [03/30/2008 10:36 AM]"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [05/25/2008 09:51 AM][HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 07:00 AM]"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [05/24/2007 10:51 PM][HKEY_USERS\.default\software\microsoft\windows\currentversion\run]"DWQueuedReporting"="c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]"DisableRegistryTools"=0 (0x0)[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]"NoViewOnDrive"=0 (0x0)[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]"appinit_dlls"=avgrsstx.dll[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]@="Service"[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3283ef02-66d7-11dc-81ee-806d6172696f}]AutoRun\command- D:\setup.exe-- Hosts -----------------------------------------------------------------------127.0.0.1 www.007guard.com127.0.0.1 007guard.com127.0.0.1 008i.com127.0.0.1 www.008k.com127.0.0.1 008k.com127.0.0.1 www.00hq.com127.0.0.1 00hq.com127.0.0.1 010402.com127.0.0.1 www.032439.com127.0.0.1 032439.com8520 more entries in hosts file.-- End of Deckard's System Scanner: finished at 2008-05-26 21:19:46 ------------Deckard's System Scanner v20071014.68Extra logfile - please post this as an attachment with your post.---------------------------------------------------------------------------------- System Information ----------------------------------------------------------Microsoft Windows XP Home Edition (build 2600) SP 2.0Architecture: X86; Language: EnglishCPU 0: AMD Sempron Processor 3100+Percentage of Memory in Use: 67%Physical Memory (total/avail): 447.48 MiB / 144.13 MiBPagefile Memory (total/avail): 1662.91 MiB / 1395 MiBVirtual Memory (total/avail): 2047.88 MiB / 1927.85 MiBA: is Removable (No Media)C: is Fixed (NTFS) - 111.78 GiB total, 96.63 GiB free. D: is CDROM (No Media)\\.\PHYSICALDRIVE0 - WDC WD1200JB-00GVC0 - 111.79 GiB - 1 partition \PARTITION0 (bootable) - Installable File System - 111.78 GiB - C:-- Security Center -------------------------------------------------------------AUOptions is scheduled to auto-install.Windows Internal Firewall is enabled.FirstRunDisabled is set.AV: AVG Anti-Virus Free v8.0 (AVG Technologies)[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019""C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)""%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000""C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1""C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019""C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger""C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)""C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire""C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"="C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE:*:Disabled:Internet Explorer""C:\\Program Files\\SpywareBot\\Quarantine\\24-11-2006-09-20-42\\10010.qit\\LimeWire.exe"="C:\\Program Files\\SpywareBot\\Quarantine\\24-11-2006-09-20-42\\10010.qit\\LimeWire.exe:*:Enabled:LimeWire""%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000""C:\\StubInstaller.exe"="C:\\StubInstaller.exe:*:Enabled:LimeWire swarmed installer""C:\\Documents and Settings\\user\\Application Data\\SpywareBot\\Quarantine\\03-07-2007-11-04-04\\10023.qit\\LimeWire.exe"="C:\\Documents and Settings\\user\\Application Data\\SpywareBot\\Quarantine\\03-07-2007-11-04-04\\10023.qit\\LimeWire.exe:*:Enabled:LimeWire""C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1""C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)""C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes""C:\\Program Files\\AVG\\AVG8\\avgupd.exe"="C:\\Program Files\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe""C:\\Program Files\\AVG\\AVG8\\avgemc.exe"="C:\\Program Files\\AVG\\AVG8\\avgemc.exe:*:Enabled:avgemc.exe"-- Environment Variables -------------------------------------------------------ALLUSERSPROFILE=C:\Documents and Settings\All UsersAPPDATA=C:\Documents and Settings\user\Application DataCLASSPATH=.;C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zipCLIENTNAME=ConsoleCommonProgramFiles=C:\Program Files\Common FilesCOMPUTERNAME=USER-A3ADD89C58ComSpec=C:\WINDOWS\system32\cmd.exeFP_NO_HOST_CHECK=NOHOMEDRIVE=C:HOMEPATH=\Documents and Settings\userLOGONSERVER=\\USER-A3ADD89C58NUMBER_OF_PROCESSORS=1OS=Windows_NTPath=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\QuickTime\QTSystem\PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSHPROCESSOR_ARCHITECTURE=x86PROCESSOR_IDENTIFIER=x86 Family 15 Model 44 Stepping 2, AuthenticAMDPROCESSOR_LEVEL=15PROCESSOR_REVISION=2c02ProgramFiles=C:\Program FilesPROMPT=$P$GQTJAVA=C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zipSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WINDOWSTEMP=C:\DOCUME~1\user\LOCALS~1\TempTMP=C:\DOCUME~1\user\LOCALS~1\TempUSERDOMAIN=USER-A3ADD89C58USERNAME=userUSERPROFILE=C:\Documents and Settings\userwindir=C:\WINDOWS-- User Profiles ---------------------------------------------------------------user (admin)-- Add/Remove Programs --------------------------------------------------------- --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.infAd-Aware 2007 --> MsiExec.exe /X{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}Adobe Flash Player 9 ActiveX --> C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDeleteAdobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exeAdobe Reader 8.1.2 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003}Apple Mobile Device Support --> MsiExec.exe /I{44734179-8A79-4DEE-BB08-73037F065543}Apple Software Update --> MsiExec.exe /I{02DFF6B1-1654-411C-8D7B-FD6052EF016F}Athlon 64 Processor Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C151CE54-E7EA-4804-854B-F515368B0798}\setup.exe" -l0x9 AVG Free 8.0 --> C:\Program Files\AVG\AVG8\setup.exe /UNINSTALLC-Media 3D Audio --> C:\WINDOWS\CMIUnInstall.exeC-Media WDM Audio Driver --> C:\WINDOWS\system32\cmirmdrv.exeCanon iP6600D --> C:\WINDOWS\system32\CNMCP7D.exe "-PRINTERNAMECanon iP6600D" "-HELPERDLLC:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP6600D Installer\Inst2\cnmis.dll" "-RCDLLcnmi0409.dll"Canon iP6600D Memory Card Utility --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{86D28491-78AB-445C-A507-6F3FA81D7611}\setup.exe" /PDUUninstallCanon Utilities Easy-PhotoPrint --> C:\Program Files\Canon\Easy-PhotoPrint\uninst.exe uninst.iniCreative Modem Blaster PCI Value DI5652-1 --> C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_14F1&DEV_2702&SUBSYS_200314F1\HXFSETUP.EXE -U -IBDI5652K.INFEasy-WebPrint --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Canon\Easy-WebPrint\Uninst.isu"Garmin City Navigator North America NT v8 --> MsiExec.exe /X{5301C483-40FB-4F94-B56E-D7D5A114D2F6}Garmin WebUpdater --> MsiExec.exe /X{366FFC89-C800-4366-B903-B9C4314109A5}Google Toolbar for Internet Explorer --> regsvr32 /u /s "c:\program files\google\googletoolbar2.dll"Google Video Player --> "C:\Program Files\Google\Google Video Player\Uninstall.exe"HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstallHotfix for Windows Media Format 11 SDK (KB929399) --> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"Hotfix for Windows Media Format SDK (KB902344) --> "C:\WINDOWS\$NtUninstallKB902344$\spuninst\spuninst.exe"hp deskjet 5550 series (Remove only) --> C:\Program Files\hp deskjet 5550 series\hpfiui.exe -c -vdivid=HPF -vpnum=95 -vinstport=LPT1: -vproduct=5550 -huninstallhp print screen utility --> C:\WINDOWS\system32\prnunins.exeiPod for Windows 2005-09-23 --> C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{D4936AAF-FFD0-44A1-A7EA-A2DB41CEB5BC} /l1033 iTunes --> MsiExec.exe /I{585776BC-4BD6-4BD2-A19A-1D6CB44A403B}Java 6 Update 6 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160060}LimeWire 4.14.8 --> "C:\Program Files\LimeWire\uninstall.exe"Malwarebytes' Anti-Malware --> "C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"Microsoft Base Smart Card Cryptographic Service Provider Package --> "C:\WINDOWS\$NtUninstallbasecsp$\spuninst\spuninst.exe"Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}Move Networks Media Player for Internet Explorer --> C:\Documents and Settings\user\Application Data\Move Networks\ie_bin\Uninst.exeMSN --> C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARPOpenOffice.org 2.0 --> MsiExec.exe /I{686BB230-DE5B-44F4-8DB0-4F9BEE7310F7}Panda ActiveScan 2.0 --> C:\Program Files\Panda Security\ActiveScan 2.0\as2uninst.exePocket Tanks v1.3 --> "C:\Program Files\Pocket Tanks\unins000.exe"Project64 1.6 --> MsiExec.exe /X{9559F7CA-5E34-4237-A2D9-D856464AD727}QuickTime --> MsiExec.exe /I{1838C5A2-AB32-4145-85C1-BB9B8DFA24CD}Realtek AC'97 Audio --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" REMOVESecurity Update for CAPICOM (KB931906) --> MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}Security Update for CAPICOM (KB931906) --> MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}Spybot - Search & Destroy --> "C:\Program Files\Spybot - Search & Destroy\unins000.exe"Spybot - Search & Destroy 1.5.2.20 --> "C:\WINDOWS\unins000.exe"VIA Rhine-Family Fast Ethernet Adapter --> Rundll32.exe vuins32.dll,vuins32Ex $Rhine $VIAVIA/S3G Display Driver --> C:\PROGRA~1\VIA\UChromeP\s3minset.exe /u C:\PROGRA~1\VIA\UChromeP\UChromeP.unsWindows Imaging Component --> "C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"Windows Live Messenger --> MsiExec.exe /I{571700F0-DB9D-4B3A-B03D-35A14BB5939F}Windows Live Sign-in Assistant --> MsiExec.exe /I{22B3CC30-77B8-419C-AA4B-F571FDF5D66D}Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"Windows Media Format SDK Hotfix - KB891122 --> "C:\WINDOWS\$NtUninstallKB891122$\spuninst\spuninst.exe"-- Application Event Log -------------------------------------------------------Event Record #/Type23231 / WarningEvent Submitted/Written: 05/25/2008 04:54:55 PMEvent ID/Source: 1524 / UserenvEvent Description:Windows cannot unload your classes registry file - it is still in use by other applications or services. The file will be unloaded when it is no longer in use.Event Record #/Type23225 / WarningEvent Submitted/Written: 05/24/2008 03:06:29 PMEvent ID/Source: 1524 / UserenvEvent Description:Windows cannot unload your classes registry file - it is still in use by other applications or services. The file will be unloaded when it is no longer in use.Event Record #/Type23218 / WarningEvent Submitted/Written: 05/24/2008 00:06:15 PMEvent ID/Source: 1524 / UserenvEvent Description:Windows cannot unload your classes registry file - it is still in use by other applications or services. The file will be unloaded when it is no longer in use.Event Record #/Type23215 / ErrorEvent Submitted/Written: 05/24/2008 11:57:06 AMEvent ID/Source: 1002 / Application HangEvent Description:Hanging application iexplore.exe, version 7.0.6000.16640, hang module hungapp, version 0.0.0.0, hang address 0x00000000.Event Record #/Type23212 / SuccessEvent Submitted/Written: 05/24/2008 11:24:18 AMEvent ID/Source: 12001 / usnjsvcEvent Description:The Messenger Sharing USN Journal Reader service started successfully.-- Security Event Log ----------------------------------------------------------No Errors/Warnings found.-- System Event Log ------------------------------------------------------------Event Record #/Type50286 / ErrorEvent Submitted/Written: 05/26/2008 09:05:46 PMEvent ID/Source: 7023 / Service Control ManagerEvent Description:The Application Management service terminated with the following error: %%126Event Record #/Type50283 / ErrorEvent Submitted/Written: 05/26/2008 09:05:46 PMEvent ID/Source: 7023 / Service Control ManagerEvent Description:The Application Management service terminated with the following error: %%126Event Record #/Type50280 / ErrorEvent Submitted/Written: 05/26/2008 09:05:46 PMEvent ID/Source: 7023 / Service Control ManagerEvent Description:The Application Management service terminated with the following error: %%126Event Record #/Type50277 / ErrorEvent Submitted/Written: 05/26/2008 09:05:45 PMEvent ID/Source: 7023 / Service Control ManagerEvent Description:The Application Management service terminated with the following error: %%126Event Record #/Type50274 / ErrorEvent Submitted/Written: 05/26/2008 09:05:45 PMEvent ID/Source: 7023 / Service Control ManagerEvent Description:The Application Management service terminated with the following error: %%126-- End of Deckard's System Scanner: finished at 2008-05-26 21:19:46 ------------I have split out your other post. In the future I would suggest making it clear that you're posting about 2 different computers.Please follow the instructions above for this system. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted May 27, 2008 Root Admin ID:18905 Share Posted May 27, 2008 On the surface this system appears clean, but there is an indicator that there might be a hidden process running.Please download and run ComboFix and post back that log.how-to-use-combofix Link to post Share on other sites More sharing options...
ccarbo Posted May 27, 2008 Author ID:18906 Share Posted May 27, 2008 Ok, here's the Combofix log. thanks !!ComboFix 08-05-26.2 - user 2008-05-27 7:03:50.1 - NTFSx86Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.127 [GMT -5:00]Running from: C:\Documents and Settings\user\Desktop\ComboFix.exe * Created a new restore pointWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!.((((((((((((((((((((((((( Files Created from 2008-04-27 to 2008-05-27 ))))))))))))))))))))))))))))))).2008-05-26 21:16 . 2008-05-26 21:16 <DIR> d-------- C:\Deckard2008-05-26 21:13 . 2008-05-26 21:13 <DIR> d-------- C:\Program Files\Common Files\Java2008-05-26 21:13 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl2008-05-25 19:53 . 2008-05-25 19:53 <DIR> d-------- C:\Program Files\Trend Micro2008-05-25 19:26 . 2008-05-25 19:26 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware2008-05-25 19:26 . 2008-05-25 19:26 <DIR> d-------- C:\Documents and Settings\user\Application Data\Malwarebytes2008-05-25 19:26 . 2008-05-25 19:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes2008-05-25 19:26 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys2008-05-25 19:26 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys2008-05-25 16:53 . 2008-05-25 16:50 691,545 --a------ C:\WINDOWS\unins000.exe2008-05-25 16:53 . 2008-05-25 16:53 2,549 --a------ C:\WINDOWS\unins000.dat2008-05-25 16:47 . 2008-05-25 16:55 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy2008-05-25 16:47 . 2008-05-25 16:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy2008-05-25 09:51 . 2008-05-26 16:20 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg2008-05-25 09:51 . 2008-05-25 09:51 <DIR> d-------- C:\Program Files\AVG2008-05-25 09:51 . 2008-05-25 09:56 <DIR> d-------- C:\Documents and Settings\user\Application Data\AVGTOOLBAR2008-05-25 09:51 . 2008-05-25 09:51 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg82008-05-25 09:51 . 2008-05-25 09:51 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys2008-05-25 09:51 . 2008-05-25 09:51 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys2008-05-25 09:51 . 2008-05-25 09:51 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll2008-05-25 08:47 . 2008-05-25 09:43 <DIR> d-------- C:\Program Files\Panda Security2008-05-24 15:03 . 2004-08-03 22:58 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys2008-05-24 15:03 . 2004-08-03 22:58 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys2008-05-24 15:03 . 2001-08-17 13:48 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys2008-05-24 15:03 . 2001-08-17 13:48 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys2008-05-11 21:44 . 2008-05-11 21:44 <DIR> d-------- C:\Documents and Settings\user\Application Data\Move Networks.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2008-05-27 02:13 --------- d-----w C:\Program Files\Java2008-05-27 02:06 --------- d-----w C:\Program Files\Windows Live Toolbar2008-05-26 01:01 --------- d-----w C:\Documents and Settings\user\Application Data\OpenOffice.org22008-05-24 20:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft2008-04-18 22:20 --------- d-----w C:\Program Files\iTunes2008-04-18 22:20 --------- d-----w C:\Program Files\iPod2008-04-18 22:19 --------- d-----w C:\Program Files\QuickTime2008-04-18 22:18 --------- d-----w C:\Program Files\Common Files\Apple2008-04-18 22:11 --------- d-----w C:\Program Files\Apple Software Update2008-04-18 22:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple2008-04-15 01:13 --------- d-----w C:\Documents and Settings\user\Application Data\LimeWire2008-04-04 01:17 --------- d-----w C:\Program Files\Project64 1.62008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll2007-05-26 00:01 71 -c--a-w C:\Program Files\Project64.rdn2007-03-01 22:54 8 -c--a-w C:\Program Files\Project64.cache2001-11-23 17:08 712,704 -c--a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}]2008-05-25 09:51 2050816 --a------ C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]"{A057A204-BACC-4D26-9990-79A187E2698E}"= "C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL" [2008-05-25 09:51 2050816][HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-9990-79a187e2698e}][HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR][HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]"{A057A204-BACC-4D26-9990-79A187E2698E}"= C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [2008-05-25 09:51 2050816][HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-9990-79a187e2698e}][HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR][HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-24 22:51 68856][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Cmaudio"="cmicnfg.cpl" []"SoundMan"="SOUNDMAN.EXE" [2004-12-22 04:09 77824 C:\WINDOWS\SOUNDMAN.EXE]"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe" [2002-07-11 07:06 188416]"PDUiP6600DMon"="C:\Program Files\Canon\Memory Card Utility\iP6600D\PDUiP6600DMon.exe" [2005-05-25 09:35 69632]"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-05-25 09:51 1177368][HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]"DWQueuedReporting"="c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 15:38 39264][HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]"NoViewOnDrive"= 0 (0x0)[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]"AppInit_DLLs"=avgrsstx.dll[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]"DisableMonitoring"=dword:00000001[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]"DisableMonitoring"=dword:00000001[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]"DisableMonitoring"=dword:00000001[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"="%windir%\\Network Diagnostic\\xpnetdiag.exe"="C:\\StubInstaller.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\AVG\\AVG8\\avgupd.exe"="C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-05-25 09:51]R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-05-25 09:51]R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-05-25 09:51]R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-05-25 09:51]S3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2004-12-16 13:36][HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3283ef02-66d7-11dc-81ee-806d6172696f}]\Shell\AutoRun\command - D:\setup.exe*Newly Created Service* - CATCHME.Contents of the 'Scheduled Tasks' folder"2008-05-23 22:58:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"- C:\Program Files\Apple Software Update\SoftwareUpdate.exe.**************************************************************************catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2008-05-27 07:06:23Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes ... scanning hidden autostart entries ...scanning hidden files ... scan completed successfullyhidden files: 0**************************************************************************.Completion time: 2008-05-27 7:08:17ComboFix-quarantined-files.txt 2008-05-27 12:07:56Pre-Run: 103,695,319,040 bytes freePost-Run: 103,882,440,704 bytes free135 --- E O F --- 2008-05-23 15:15:05On the surface this system appears clean, but there is an indicator that there might be a hidden process running.Please download and run ComboFix and post back that log.how-to-use-combofix Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted May 27, 2008 Root Admin ID:18924 Share Posted May 27, 2008 Please click START - RUN and type in combofix /uThis will remove items and entries added by that program.I do not see anything in the logs to indicate that you're still infected. Since you've been through this before, let me just remind you that it would be beneficial for you to take up the offer of going to one of the Anti-Malware schools and learning more about how to both remove and prevent Malware which will help speed up your time spent repairing your customers systems.If there is anything still running on the system that would indicate that it is still infected please let me know, otherwise it appears to be clean now. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted May 29, 2008 Root Admin ID:19012 Share Posted May 29, 2008 Free help is not extended to users that are selling their services for clean up. Post will be closed.Please contact one of the schools and participate in order to become proficient in Malware cleanup and help others. Link to post Share on other sites More sharing options...
Recommended Posts