hijackthis log report [CLOSED]

Hi peterc38,

Welcome to Geeks to Go!

My name is Stamper19 and I will be helping you with your Malware problem. During the course of our interactions please be sure to follow all instructions carefully, and ask questions if you are unsure of how to proceed at any point.

----------------------------------------------------------------

Please download Deckard's System Scanner (DSS) to your Desktop.

• Close all applications and windows.
• Double-click on DSS.exe to run it, and follow the prompts.
• The scan may take a minute. When the scan is complete, two text files will open - Main.txt and Extra.txt

Extra Note: When running DSS, some firewalls may warn that sigcheck.exe is trying to access the internet - please ensure that you allow sigcheck.exe permission to do so. Also, it may happen that your Antivirus flags DSS as suspicious. Please allow the Deckard's System Scanner to run and don't let your Antivirus delete it. (In this case, it may be better to temporary disable your Antivirus)

Post the main.txt and extra.txt from the C:\Deckard\System Scanner folder into your next reply.

----------------------------------------------------------------

Information to include in your next post:

• main.txt and extra.txt from DSS

Hi Stamper19.

Thank you very much for your help. I performed scan per your instruction, see results below, thanks

Deckard's System Scanner v20070905.67
Run by Peter on 2007-10-09 17:06:15
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- Last 5 Restore Point(s) --
26: 2007-10-09 04:00:03 UTC - RP83 - Scheduled Checkpoint
25: 2007-10-07 23:01:42 UTC - RP82 - Installed DirectX
24: 2007-10-07 22:50:22 UTC - RP80 - Installed Medieval II Total War
23: 2007-10-07 22:46:10 UTC - RP78 - Configured Far Cry
22: 2007-10-07 19:08:21 UTC - RP76 - Scheduled Checkpoint


-- First Restore Point --
1: 2007-09-26 00:42:37 UTC - RP49 - Scheduled Checkpoint


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as Peter.exe) -----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:07:26 PM, on 10/9/2007
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\sttray.exe
C:\Program Files\McAfee\MSK\mskagent.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exe
C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
C:\Windows\System32\spool\drivers\w32x86\3\E_FATICEA.EXE
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Windows Mail\WinMail.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\Users\Peter\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CPMN704Y\dss[1].exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Peter.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.c...h...TP&M=GM5478
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.c...h...TP&M=GM5478
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gateway.c...h...TP&M=GM5478
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\google\BAE.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NMSSupport] "C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" /startup
O4 - HKLM\..\Run: [CCUTRAYICON] C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [EPSON Stylus CX8400 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICEA.EXE /FU "C:\Windows\TEMP\E_S39AD.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-2053935830-905597749-1116634679-1000\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'IUSR_NMPR')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O23 - Service: McAfee Application Installer Cleanup (0305721191930858) (0305721191930858mcinstcleanup) - Unknown owner - C:\Windows\TEMP30572~1.EXE (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Intel® Alert Service (AlertService) - Intel® Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: Intel® DHTrace Controller (DHTRACE) - Intel® Corporation - C:\Program Files\Common Files\Intel\IntelDH\bin\DHTraceController.exe
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: Intel® Software Services Manager (ISSM) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: Intel® Viiv™ Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: Intel® Application Tracker (MCLServiceATL) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Intel® NMSCore (NMSCore) - Intel® Corporation - C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Intel® Quality Manager (QualityManager) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exe
O23 - Service: Intel® Remoting Service (Remote UI Service) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 10107 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R3 Afc (PPdus ASPI Shell) - c:\windows\system32\drivers\afc.sys <Not Verified; Arcsoft, Inc.; Arcsoft® ASPI Shell>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 DQLWinService - "c:\program files\common files\intel\inteldh\nms\adpplugins\dqlwinservice.exe" <Not Verified; ; DQLWinSe Application>
R2 STacSV (SigmaTel Audio Service) - c:\program files\sigmatel\c-major audio\wdm\stacsv.exe <Not Verified; SigmaTel, Inc.; C-Major Audio>

S2 0305721191930858mcinstcleanup (McAfee Application Installer Cleanup (0305721191930858)) - c:\windows\temp30572~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service (file missing)


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Scheduled Tasks -------------------------------------------------------------

2007-08-10 01:08:56 368 --a------ C:\Windows\Tasks\McQcTask.job
2007-08-10 01:08:56 366 --a------ C:\Windows\Tasks\McDefragTask.job


-- Files created between 2007-09-09 and 2007-10-09 -----------------------------

2007-10-07 18:50:28 0 d-------- C:\Program Files\SEGA
2007-10-07 16:36:49 0 d-------- C:\Users\All Users\SiteAdvisor
2007-10-07 16:36:49 0 d-------- C:\Program Files\SiteAdvisor
2007-10-02 19:47:42 0 d-------- C:\Program Files\Trend Micro
2007-10-01 20:49:28 0 d-------- C:\Program Files\Lavasoft
2007-10-01 20:49:25 0 d-------- C:\Users\All Users\Lavasoft
2007-10-01 20:48:47 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-09-30 20:23:07 0 d-------- C:\Users\All Users\Spybot - Search & Destroy
2007-09-30 03:00:49 0 d-------- C:\Program Files\MSXML 4.0
2007-09-29 14:07:55 0 d-------- C:\Program Files\Ubisoft
2007-09-29 13:42:48 0 dr------- C:\Users\Anne\Searches
2007-09-29 13:42:36 0 dr------- C:\Users\Anne\Contacts
2007-09-29 13:42:28 0 d--hs---- C:\Users\Anne\Templates <TEMPLA~1>
2007-09-29 13:42:28 0 d--hs---- C:\Users\Anne\Start Menu <STARTM~1>
2007-09-29 13:42:28 0 d--hs---- C:\Users\Anne\SendTo
2007-09-29 13:42:28 0 d--hs---- C:\Users\Anne\Recent
2007-09-29 13:42:28 0 d--hs---- C:\Users\Anne\PrintHood <PRINTH~1>
2007-09-29 13:42:28 0 d--hs---- C:\Users\Anne\NetHood
2007-09-29 13:42:28 0 d--hs---- C:\Users\Anne\My Documents <MYDOCU~1>
2007-09-29 13:42:28 0 d--hs---- C:\Users\Anne\Local Settings <LOCALS~1>
2007-09-29 13:42:28 0 d--hs---- C:\Users\Anne\Cookies
2007-09-29 13:42:28 0 d--hs---- C:\Users\Anne\Application Data <APPLIC~1>
2007-09-29 13:42:27 0 dr------- C:\Users\Anne\Videos
2007-09-29 13:42:27 0 dr------- C:\Users\Anne\Saved Games <SAVEDG~1>
2007-09-29 13:42:27 0 dr------- C:\Users\Anne\Pictures
2007-09-29 13:42:27 1048576 --ahs---- C:\Users\Anne\NTUSER.DAT
2007-09-29 13:42:27 0 dr------- C:\Users\Anne\Music
2007-09-29 13:42:27 0 dr------- C:\Users\Anne\Links
2007-09-29 13:42:27 0 dr------- C:\Users\Anne\Favorites <FAVORI~1>
2007-09-29 13:42:27 0 dr------- C:\Users\Anne\Downloads <DOWNLO~1>
2007-09-29 13:42:27 0 dr------- C:\Users\Anne\Documents <DOCUME~1>
2007-09-29 13:42:27 0 dr------- C:\Users\Anne\Desktop
2007-09-29 13:42:27 0 d--h----- C:\Users\Anne\AppData
2007-09-29 13:01:29 0 d-------- C:\EPSONREG
2007-09-29 12:59:27 11776 --a------ C:\Windows\system32\drivers\afc.sys <Not Verified; Arcsoft, Inc.; Arcsoft® ASPI Shell>
2007-09-29 12:59:26 0 d-------- C:\Program Files\Common Files\ArcSoft
2007-09-29 12:59:24 212480 --a------ C:\Windows\PCDLIB32.DLL <Not Verified; Eastman Kodak; Kodak Photo CD Access Developer Toolkit>
2007-09-29 12:59:20 126976 --a------ C:\Windows\system32\PhotoImpression Slideshow.scr <Not Verified; ArcSoft Inc.; PhotoImpression Slideshow>
2007-09-29 12:59:08 0 d-------- C:\Program Files\ArcSoft
2007-09-29 12:59:05 0 d-------- C:\Windows\system32\PhotoImpression Slideshow
2007-09-29 12:59:01 0 d-------- C:\Users\All Users\EPSON
2007-09-29 12:52:04 73220 --a------ C:\Windows\system32\EPPICPrinterDB.dat
2007-09-29 12:52:04 1140 --a------ C:\Windows\system32\EPPICPresetData_PT.dat
2007-09-29 12:52:04 1130 --a------ C:\Windows\system32\EPPICPresetData_FR.dat
2007-09-29 12:52:04 1137 --a------ C:\Windows\system32\EPPICPresetData_ES.dat
2007-09-29 12:52:04 1104 --a------ C:\Windows\system32\EPPICPresetData_EN.dat
2007-09-29 12:52:04 1130 --a------ C:\Windows\system32\EPPICPresetData_CF.dat
2007-09-29 12:52:04 1140 --a------ C:\Windows\system32\EPPICPresetData_BP.dat
2007-09-29 12:52:04 4943 --a------ C:\Windows\system32\EPPICPattern6.dat
2007-09-29 12:52:04 15670 --a------ C:\Windows\system32\EPPICPattern5.dat
2007-09-29 12:52:04 10673 --a------ C:\Windows\system32\EPPICPattern4.dat
2007-09-29 12:52:04 21021 --a------ C:\Windows\system32\EPPICPattern3.dat
2007-09-29 12:52:04 13280 --a------ C:\Windows\system32\EPPICPattern2.dat
2007-09-29 12:52:04 31053 --a------ C:\Windows\system32\EPPICPattern131.dat
2007-09-29 12:52:04 27417 --a------ C:\Windows\system32\EPPICPattern121.dat
2007-09-29 12:52:04 29114 --a------ C:\Windows\system32\EPPICPattern1.dat
2007-09-29 12:49:48 0 d-------- C:\Program Files\epson
2007-09-28 21:41:51 0 d-------- C:\Windows\nvtmpinst
2007-09-25 20:11:16 0 dr------- C:\Users\Peter\Searches
2007-09-25 20:11:03 0 dr------- C:\Users\Peter\Contacts
2007-09-25 20:10:27 0 d--hs---- C:\Users\Peter\Templates <TEMPLA~1>
2007-09-25 20:10:27 0 d--hs---- C:\Users\Peter\Start Menu <STARTM~1>
2007-09-25 20:10:27 0 d--hs---- C:\Users\Peter\SendTo
2007-09-25 20:10:27 0 d--hs---- C:\Users\Peter\Recent
2007-09-25 20:10:27 0 d--hs---- C:\Users\Peter\Local Settings <LOCALS~1>
2007-09-25 20:10:26 0 dr------- C:\Users\Peter\Videos
2007-09-25 20:10:26 0 dr------- C:\Users\Peter\Saved Games <SAVEDG~1>
2007-09-25 20:10:26 0 d--hs---- C:\Users\Peter\PrintHood <PRINTH~1>
2007-09-25 20:10:26 0 dr------- C:\Users\Peter\Pictures
2007-09-25 20:10:26 2097152 --ahs---- C:\Users\Peter\NTUSER.DAT
2007-09-25 20:10:26 0 d--hs---- C:\Users\Peter\NetHood
2007-09-25 20:10:26 0 d--hs---- C:\Users\Peter\My Documents <MYDOCU~1>
2007-09-25 20:10:26 0 dr------- C:\Users\Peter\Music
2007-09-25 20:10:26 0 dr------- C:\Users\Peter\Links
2007-09-25 20:10:26 0 dr------- C:\Users\Peter\Favorites <FAVORI~1>
2007-09-25 20:10:26 0 dr------- C:\Users\Peter\Downloads <DOWNLO~1>
2007-09-25 20:10:26 0 dr------- C:\Users\Peter\Documents <DOCUME~1>
2007-09-25 20:10:26 0 dr------- C:\Users\Peter\Desktop
2007-09-25 20:10:26 0 d--hs---- C:\Users\Peter\Cookies
2007-09-25 20:10:26 0 d--hs---- C:\Users\Peter\Application Data <APPLIC~1>
2007-09-25 20:10:26 0 d--h----- C:\Users\Peter\AppData
2007-09-25 20:06:59 0 d--hs---- C:\Users\Default\Templates <TEMPLA~1>
2007-09-25 20:06:59 0 d--hs---- C:\Users\Default\Start Menu <STARTM~1>
2007-09-25 20:06:59 0 d--hs---- C:\Users\Default\SendTo
2007-09-25 20:06:59 0 d--hs---- C:\Users\Default\Recent
2007-09-25 20:06:59 0 d--hs---- C:\Users\Default\PrintHood <PRINTH~1>
2007-09-25 20:06:59 0 d--hs---- C:\Users\Default\NetHood
2007-09-25 20:06:59 0 d--hs---- C:\Users\Default\Local Settings <LOCALS~1>
2007-09-25 20:06:59 0 d--hs---- C:\Users\Default\Cookies
2007-09-25 20:06:59 0 d--hs---- C:\Users\All Users\Templates <TEMPLA~1>
2007-09-25 20:06:59 0 d--hs---- C:\Users\All Users\Start Menu <STARTM~1>
2007-09-25 20:06:59 0 d--hs---- C:\Users\All Users\Favorites <FAVORI~1>
2007-09-25 20:06:59 0 d--hs---- C:\Users\All Users\Documents <DOCUME~1>
2007-09-25 20:06:59 0 d--hs---- C:\Users\All Users\Desktop
2007-09-25 20:06:59 0 d--hs---- C:\Users\All Users\Application Data <APPLIC~1>
2007-09-25 20:06:59 0 d--hs---- C:\Documents and Settings
2007-09-25 20:06:58 0 d--hs---- C:\Users\Default\My Documents <MYDOCU~1>
2007-09-25 20:06:58 0 d--hs---- C:\Users\Default\Application Data <APPLIC~1>


-- Find3M Report ---------------------------------------------------------------

2007-10-09 16:47:49 0 d-------- C:\Users\Peter\AppData\Roaming\SiteAdvisor
2007-10-09 07:54:17 0 d-------- C:\Program Files\McAfee
2007-10-07 18:50:28 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-10-07 14:31:04 0 d-------- C:\Program Files\Google
2007-10-01 20:48:47 0 d-------- C:\Program Files\Common Files
2007-10-01 17:30:39 0 d-------- C:\Users\Peter\AppData\Roaming\Adobe
2007-09-30 03:20:23 174 --ahs---- C:\Program Files\desktop.ini
2007-09-30 03:16:55 0 d-------- C:\Program Files\Windows Calendar
2007-09-30 03:16:52 0 d-------- C:\Program Files\Windows Mail
2007-09-29 17:06:30 0 d-------- C:\Users\Peter\AppData\Roaming\Google
2007-09-29 13:01:34 0 d-------- C:\Users\Peter\AppData\Roaming\Leadertech
2007-09-29 12:59:30 0 d-------- C:\Users\Peter\AppData\Roaming\ArcSoft
2007-09-29 12:52:02 0 d-------- C:\Users\Peter\AppData\Roaming\InstallShield
2007-09-29 12:28:30 0 d-------- C:\Users\Peter\AppData\Roaming\Macromedia
2007-09-25 20:23:04 0 d-------- C:\Users\Peter\AppData\Roaming\SampleView
2007-09-25 20:11:29 0 d-------- C:\Users\Peter\AppData\Roaming\GTek
2007-09-25 20:11:04 0 d-------- C:\Users\Peter\AppData\Roaming\Identities
2007-08-10 01:06:54 0 d-------- C:\Program Files\Windows Defender
2007-08-09 23:28:10 0 d-------- C:\Program Files\Common Files\McAfee
2007-08-09 23:27:34 0 d-------- C:\Program Files\McAfee.com
2007-08-09 23:27:26 0 d-------- C:\Program Files\BigFix
2007-08-09 23:27:21 0 d-------- C:\Program Files\Napster
2007-08-09 23:27:13 0 d-------- C:\Program Files\Common Files\Napster Shared
2007-08-09 23:26:39 0 d-------- C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
2007-08-09 23:26:24 0 d-------- C:\Program Files\NetZero
2007-08-09 23:26:17 0 d-------- C:\Program Files\Microsoft Works
2007-08-09 23:25:45 0 d-------- C:\Program Files\Microsoft Money 2006
2007-08-09 23:25:45 0 d-------- C:\Program Files\Acceller
2007-08-09 23:25:31 0 d-------- C:\Program Files\AOL 9.0
2007-08-09 23:25:27 0 d-------- C:\Program Files\Java
2007-08-09 23:25:19 0 d-------- C:\Program Files\Common Files\Java
2007-08-09 23:25:10 0 d-------- C:\Program Files\Microsoft Digital Image 2006
2007-08-09 23:25:06 4 --a------ C:\Windows\Pix11.dat
2007-08-09 23:24:27 0 d-------- C:\Program Files\CyberLink
2007-08-09 23:24:22 0 d-------- C:\Program Files\Common Files\InstallShield
2007-08-09 23:23:30 0 d-------- C:\Program Files\Microsoft.NET
2007-08-09 23:21:54 0 d-------- C:\Program Files\Common Files\Adobe
2007-08-09 23:21:42 0 d-------- C:\Program Files\MSN Encarta Plus
2007-08-09 23:21:21 0 d-------- C:\Program Files\Gateway
2007-08-09 23:21:14 0 d-------- C:\Program Files\Gateway Games
2007-08-09 23:19:01 0 d-------- C:\Program Files\SigmaTel
2007-08-09 23:18:17 0 d-------- C:\Program Files\Intel
2007-08-09 23:17:52 0 d-------- C:\Program Files\Digital Media Reader
2007-08-09 23:16:49 0 d-------- C:\Program Files\Common Files\Intel
2007-08-09 23:14:02 0 d-------- C:\Program Files\AVerMedia
2007-08-09 23:12:31 0 d-------- C:\Program Files\CONEXANT


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [08/09/2007 11:30 PM]
"NMSSupport"="C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" [04/06/2007 05:07 PM]
"CCUTRAYICON"="C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe" [04/06/2007 05:11 PM]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [03/21/2007 04:00 PM]
"SigmatelSysTrayApp"="sttray.exe" [02/28/2007 10:56 PM C:\Windows\sttray.exe]
"MskAgentexe"="C:\Program Files\McAfee\MSK\MskAgent.exe" [01/17/2007 08:30 PM]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [04/26/2007 04:17 AM]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [04/26/2007 04:17 AM]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [04/26/2007 04:17 AM]
"MSConfig"="C:\Windows\system32\msconfig.exe" [11/02/2006 05:45 AM]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [02/08/2007 10:39 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WindowsWelcomeCenter"="oobefldr.dll,ShowWelcomeCenter" []
"EPSON Stylus CX8400 Series"="C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICEA.exe" [02/15/2007 06:00 AM]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [11/02/2006 08:36 AM]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [08/31/2007 04:46 PM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"Launcher"=%WINDIR%\SMINST\launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"=2 (0x2)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]
@="IEEE 1394 Bus host controllers"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]
@="SBP2 IEEE 1394 Devices"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]
@="SecurityDevices"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BigFix]
c:\program files\Bigfix\bigfix.exe /atstartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NapsterShell]
C:\Program Files\Napster\napster.exe /systray

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc EMDMgmt TabletInputService wlansvc WPDBusEnum


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a8e52714-4af0-11dc-a5ea-806e6f6e6963}]
AutoRun\command- E:\Launch.exe


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
C:\Windows\system32\unregmp2.exe /ShowWMP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
%SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI



-- Hosts -----------------------------------------------------------------------

127.0.0.1 hityou.com
127.0.0.1 www.hityou.com
127.0.0.1 180searchassistant.com
127.0.0.1 www.180searchassistant.com
127.0.0.1 180solutions.com
127.0.0.1 www.180solutions.com
127.0.0.1 bis.180solutions.com
127.0.0.1 config.180solutions.com
127.0.0.1 cts.180solutions.com
127.0.0.1 downloads.180solutions.com

6621 more entries in hosts file.


-- End of Deckard's System Scanner: finished at 2007-10-09 17:09:14 ------------

Deckard's System Scanner v20070905.67
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft® Windows Vista™ Home Premium (build 6000)
Architecture: X86; Language: English

CPU 0: Intel® Core™2 Quad CPU @ 2.40GHz
Percentage of Memory in Use: 46%
Physical Memory (total/avail): 2029.23 MiB / 1093.88 MiB
Pagefile Memory (total/avail): 4277.02 MiB / 3239.55 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1929.23 MiB

C: is Fixed (NTFS) - 455.46 GiB total, 397.97 GiB free.
D: is Fixed (NTFS) - 10.3 GiB total, 4.42 GiB free.
E: is CDROM (UDF)
F: is Removable (No Media)
G: is Removable (No Media)
H: is Removable (No Media)
I: is Removable (No Media)
J: is Removable (No Media)

\\.\PHYSICALDRIVE0 - ST3500630AS - 465.76 GiB - 2 partitions
\PARTITION0 - Installable File System - 10.3 GiB - D:
\PARTITION1 (bootable) - Installable File System - 455.46 GiB - C:

\\.\PHYSICALDRIVE1 - EPSON Stylus Storage USB Device

\\.\PHYSICALDRIVE3 - Generic USB CF Reader USB Device

\\.\PHYSICALDRIVE5 - Generic USB MS Reader USB Device

\\.\PHYSICALDRIVE2 - Generic USB SD Reader USB Device

\\.\PHYSICALDRIVE4 - Generic USB SM Reader USB Device



-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is disabled.

FW: McAfee Personal Firewall v (McAfee)
AV: McAfee VirusScan v (McAfee)
AS: McAfee VirusScan v (McAfee)
AS: Spybot - Search and Destroy v1.0.0.4 (Safer Networking Ltd.) Outdated
AS: Windows Defender v1.1.1505.0 (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Peter\AppData\Roaming
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=PETER-PC
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Peter
LOCALAPPDATA=C:\Users\Peter\AppData\Local
LOGONSERVER=\\PETER-PC
NUMBER_OF_PROCESSORS=4
OS=Windows_NT
Path=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 15 Stepping 7, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0f07
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
PROMPT=$P$G
PUBLIC=C:\Users\Public
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\Peter\AppData\Local\Temp
TMP=C:\Users\Peter\AppData\Local\Temp
USERDOMAIN=Peter-PC
USERNAME=Peter
USERPROFILE=C:\Users\Peter
windir=C:\Windows


-- User Profiles ---------------------------------------------------------------

IUSR_NMPR
Peter
Anne


-- Add/Remove Programs ---------------------------------------------------------

Activation Assistant for the 2007 Microsoft Office suites --> "C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}\Microsoft Office Activation Assistant.exe" REMOVE=TRUE MODIFY=FALSE
Ad-Aware 2007 --> MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Adobe Flash Player 9 ActiveX --> C:\Windows\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
Adobe Reader 8 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A80000000002}
ArcSoft PhotoImpression 6 --> C:\Program Files\InstallShield Installation Information\{D03E7B00-CA85-4684-9321-1888873C34BD}\Setup.exe -runfromtemp -l0x0009 -removeonly
ArcSoft Print Creations --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0D6D96F4-0CAF-4522-B05F-70A88EDECDFD}\Setup.exe" -l0x9
AVerMedia M791 PCIe Combo NTSC/ATSC 6.104.0.5 --> C:\Program Files\AVerMedia\AVerMedia M791 PCIe Combo NTSC_ATSC\uninst.exe
Bejeweled 2 Deluxe --> "C:\Program Files\Gateway Games\Bejeweled 2 Deluxe\Uninstall.exe"
BigFix --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{34FF0741-EC67-4C05-AC2A-6D257123DF2E}\setup.exe" -l0x9 -uninst -f"C:\Program Files\BigFix\Uninst.isu" -c"C:\Program Files\BigFix\Lib\UninstallHelper.dll"
Blackhawk Striker 2 --> "C:\Program Files\Gateway Games\Blackhawk Striker 2\Uninstall.exe"
Blasterball 3 --> "C:\Program Files\Gateway Games\Blasterball 3\Uninstall.exe"
Browser Address Error Redirector --> regsvr32 /u /s "c:\google\BAE.dll"
Digital Media Reader --> C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{BE2CC4A5-2128-4EA2-941D-14F7A6A1AB61} /l1033
Diner Dash - Flo on the Go --> "C:\Program Files\Gateway Games\Diner Dash - Flo on the Go\Uninstall.exe"
EPSON CX8400 User's Guide --> C:\Program Files\epson\guide\cx8400_e\uninstall.exe
EPSON Printer Software --> C:\Windows\system32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /R
EPSON Scan --> C:\Program Files\epson\escndv\setup\setup.exe /r
EPSON Stylus CX8400 Series Scanner Driver Update --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{24ADC0E4-8D3E-40C4-9106-F2DE5E9112F1}\Setup.exe" -l0x9
EPSON Web-To-Page --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}\Setup.exe" -l0x9 -anything
Family Feud 2 --> "C:\Program Files\Gateway Games\Family Feud 2\Uninstall.exe"
FATE --> "C:\Program Files\Gateway Games\FATE\Uninstall.exe"
Gateway Connect --> MsiExec.exe /I{EE5EEDAF-F932-462B-A2CB-EEBDF819D5F5}
Gateway Game Console --> "C:\Program Files\Gateway Games\Gateway Game Console\Uninstall.exe"
Gateway Recovery Center Installer --> MsiExec.exe /X{7F3BCF8A-8E02-4659-AF25-F9AB66BD6718}
HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Intel® Management Engine Interface --> C:\Windows\system32\heciudlg.exe -uninstall
Intel® Matrix Storage Manager --> C:\Windows\System32\Imsmudlg.exe
Intel® PRO Network Connections Drivers --> Prounstl.exe
Intel® Viiv™ Software --> MsiExec.exe /X{0DAA5653-60D4-44C1-AD10-EC7D4FA4D820} /qb!
Java™ SE Runtime Environment 6 Update 1 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
Linkit_eBay --> MsiExec.exe /I{91B3BEC8-748B-4912-82ED-29D38E140B2A}
McAfee SecurityCenter --> C:\Program Files\McAfee\MSC\mcuninst.exe
McAfee SiteAdvisor --> C:\Program Files\SiteAdvisor\6172\uninstall.exe
Medieval II Total War --> C:\Program Files\InstallShield Installation Information\{C0698BDA-0D29-40EE-8570-A31106DF9AB1}\Setup.exe -runfromtemp -l0x0009 -removeonly
Microsoft Digital Image Starter Edition 2006 --> "C:\Program Files\Common Files\Microsoft Shared\Picture It!\RmvSuite.exe" ADDREMOVE=1 SKU=TRIAL VERSION=12
Microsoft Money 2006 --> "C:\Program Files\Microsoft Money 2006\MNYCoreFiles\Setup\uninst.exe" /s:120
Microsoft Office Excel MUI (English) 2007 --> MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Home and Student 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL
Microsoft Office Home and Student 2007 --> MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE}
Microsoft Office OneNote MUI (English) 2007 --> MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007 --> MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007 --> MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007 --> MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007 --> MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007 --> MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007 --> MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007 --> MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Works --> MsiExec.exe /I{6D52C408-B09A-4520-9B18-475B81D393F1}
MSXML 4.0 SP2 (KB936181) --> MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
Napster --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BBBCAE4B-B416-4182-A6F2-438180894A81}\setup.exe" -l0x9 -removeonly
Napster Burn Engine --> MsiExec.exe /I{8DCE550C-CA43-4E82-92DF-FFC4A48F5BE1}
NVIDIA Drivers --> C:\Windows\system32\NVUNINST.EXE UninstallGUI
Penguins! --> "C:\Program Files\Gateway Games\Penguins!\Uninstall.exe"
Polar Bowler --> "C:\Program Files\Gateway Games\Polar Bowler\Uninstall.exe"
Polar Golfer --> "C:\Program Files\Gateway Games\Polar Golfer\Uninstall.exe"
Power2Go 5.0 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{40BF1E83-20EB-11D8-97C5-0009C5020658}\Setup.exe" -uninstall
SigmaTel Audio --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\101\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}\setup.exe" -l0x9 -remove -removeonly
Soft Data Fax Modem with SmartCP --> C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_14F1&DEV_2F40&SUBSYS_200014F1\HXFSETUP.EXE -U -IPDBRYCMzK.inf
Spybot - Search & Destroy --> "C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Tradewinds --> "C:\Program Files\Gateway Games\Tradewinds\Uninstall.exe"


-- Application Event Log -------------------------------------------------------

Event Record #/Type12459 / Success
Event Submitted/Written: 10/09/2007 07:21:22 AM
Event ID/Source: 5617 / WinMgmt
Event Description:


Event Record #/Type12458 / Success
Event Submitted/Written: 10/09/2007 07:21:21 AM
Event ID/Source: 5615 / WinMgmt
Event Description:


Event Record #/Type12446 / Success
Event Submitted/Written: 10/09/2007 07:21:02 AM
Event ID/Source: 902 / Software Licensing Service
Event Description:
The Software Licensing service has started.

Event Record #/Type10169 / Error
Event Submitted/Written: 10/07/2007 07:02:20 PM
Event ID/Source: 8193 / System Restore
Event Description:
Failed to create restore point on volume (Process = E:\directx9\DXSETUP.exe /silent; Descripton = ?; Hr = 0x80070057).

Event Record #/Type10166 / Error
Event Submitted/Written: 10/07/2007 07:01:42 PM
Event ID/Source: 8194 / VSS
Event Description:
Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005.
This is often caused by incorrect security settings in either the writer or requestor process.


Operation:
Gathering Writer Data

Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {362ead23-a0c8-449b-a90f-7ceb64a75180}



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type6146 / Warning
Event Submitted/Written: 10/09/2007 05:07:43 PM
Event ID/Source: 3004 / WinDefend
Event Description:
%Peter-PC27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %Peter-PC27 can't undo changes that you allow.

For more information please see the following:
%Peter-PC275

Scan ID: {5141989A-2A10-481E-9946-090043047705}

User: Peter-PC\Peter

Name: %Peter-PC271

ID: %Peter-PC272

Severity ID: %Peter-PC273

Category ID: %Peter-PC274

Path Found: %Peter-PC276

Alert Type: %Peter-PC278

Detection Type: 1.1.1505.02

Event Record #/Type6145 / Warning
Event Submitted/Written: 10/09/2007 05:07:43 PM
Event ID/Source: 3004 / WinDefend
Event Description:
%Peter-PC27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %Peter-PC27 can't undo changes that you allow.

For more information please see the following:
%Peter-PC275

Scan ID: {D3A48599-F0F4-443E-B7EB-8528B6B2A617}

User: Peter-PC\Peter

Name: %Peter-PC271

ID: %Peter-PC272

Severity ID: %Peter-PC273

Category ID: %Peter-PC274

Path Found: %Peter-PC276

Alert Type: %Peter-PC278

Detection Type: 1.1.1505.02

Event Record #/Type6144 / Warning
Event Submitted/Written: 10/09/2007 05:07:43 PM
Event ID/Source: 3004 / WinDefend
Event Description:
%Peter-PC27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %Peter-PC27 can't undo changes that you allow.

For more information please see the following:
%Peter-PC275

Scan ID: {1AAFD576-C789-445B-9ADF-3F4C44833C21}

User: Peter-PC\Peter

Name: %Peter-PC271

ID: %Peter-PC272

Severity ID: %Peter-PC273

Category ID: %Peter-PC274

Path Found: %Peter-PC276

Alert Type: %Peter-PC278

Detection Type: 1.1.1505.02

Event Record #/Type6143 / Warning
Event Submitted/Written: 10/09/2007 05:07:40 PM
Event ID/Source: 3004 / WinDefend
Event Description:
%Peter-PC27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %Peter-PC27 can't undo changes that you allow.

For more information please see the following:
%Peter-PC275

Scan ID: {5A0248F1-FF81-4035-B826-9130AD0430D0}

User: Peter-PC\Peter

Name: %Peter-PC271

ID: %Peter-PC272

Severity ID: %Peter-PC273

Category ID: %Peter-PC274

Path Found: %Peter-PC276

Alert Type: %Peter-PC278

Detection Type: 1.1.1505.02

Event Record #/Type6142 / Warning
Event Submitted/Written: 10/09/2007 05:07:40 PM
Event ID/Source: 3004 / WinDefend
Event Description:
%Peter-PC27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %Peter-PC27 can't undo changes that you allow.

For more information please see the following:
%Peter-PC275

Scan ID: {BD7D177E-F361-4034-844D-76A2833EC132}

User: Peter-PC\Peter

Name: %Peter-PC271

ID: %Peter-PC272

Severity ID: %Peter-PC273

Category ID: %Peter-PC274

Path Found: %Peter-PC276

Alert Type: %Peter-PC278

Detection Type: 1.1.1505.02



-- End of Deckard's System Scanner: finished at 2007-10-09 17:09:14 ------------

Hi peterc38,

I dont see anything in your log that is indicative of malware. Can you describe some of the symptoms that lead you to believe you are infected?

Thanks,
Stamper

Hi Stamper,

1.)Sometimes I type in a URL and i am directed to a different page

2.)When I tried to download anti-spyware programs, i.e. spybot, etc. I had difficulty doing so. I was told page unavailable or was sent to a different site, ( I am no tech wiz, but I had read this is possibly indicative of malware, etc.)

3.) There is a lot of crap in my registry and I have no idea where it came from, files with names like coolwebsearch, braincodec, casinotowin.net, etc.

Hi peterc38,

Thanks for info - it was definately helpful. I did have some indication of the garbage that you mentioned in your registry. I suspects its related to your Hosts file - we will try to get that cleaned up now. We will also try to do an online virus scan.

Just a word up front - many of the tools we typically employ do not work well with Windows Vista. So, if I ask you to run a tool and it doesnt work dont be terribly surprised. Although I have a good idea of what will work, there might be one or two Im not sure about. If that does happen just let me know and I will suggest an alternate method to accomplish what we want to do - there is always more than one way to get something done

----------------------------------------------------------------

Download the HostsXpert 3.7 - Hosts File Manager

• Unzip HostsXpert 3.7 - Hosts File Manager to a convenient folder such as C:\HostsXpert
• Click HostsXpert.exe to Run HostsXpert 3.7 - Hosts File Manager from its new home
• Click "Make Hosts Writable?" in the upper right corner (If available).
• Click Restore Microsoft's Hosts file and then click OK.
• Click the X to exit the program.
• Note: If you were using a custom Hosts file you will need to replace any of those entries yourself.

----------------------------------------------------------------

Run an online virus scan with Panda's TotalScan

Follow the instructions here and run the Full scan. This will take approximately and hour. Save and reports or output the scan provides and include it in your next post.

----------------------------------------------------------------

Please re-run Deckard's System Scanner (DSS).

• Close all applications and windows.
• Double-click on DSS.exe to run it, and follow the prompts.
• The scan may take a minute. When the scan is complete, a text file will open - Main.txt

Extra Note: When running DSS, some firewalls may warn that sigcheck.exe is trying to access the internet - please ensure that you allow sigcheck.exe permission to do so. Also, it may happen that your Antivirus flags DSS as suspicious. Please allow the Deckard's System Scanner to run and don't let your Antivirus delete it. (In this case, it may be better to temporary disable your Antivirus)

Post the main.txt from the C:\Deckard\System Scanner folder into your next reply.

----------------------------------------------------------------

Information to include in your next post:

• Any log or information from the TotalScan
• main.txt from DSS

Hi again Stamper

Thanks for helping me

Please see below result from Panda totalscan and main.txt from DSS



NALYSIS: 2007-10-10 20:23:26
PROTECTIONS: 1
MALWARE: 4
SUSPECTS: 0
;*******************************************************************************
********************************************************************************
******************
PROTECTIONS
Description Version Active Updated
;===============================================================================
================================================================================
==================
McAfee VirusScan Yes Yes
;===============================================================================
================================================================================
==================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===============================================================================
================================================================================
==================
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Cookies\Low\anne@doubleclick[1].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Users\Peter\AppData\Roaming\Microsoft\Windows\Cookies\Low\peter@atdmt[2].txt
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Cookies\Low\anne@advertising[2].txt
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
;===============================================================================
================================================================================
==================
SUSPECTS
Location
;===============================================================================
================================================================================
==================
;===============================================================================
================================================================================
==================



Deckard's System Scanner v20070905.67
Run by Peter on 2007-10-10 20:26:12
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as Peter.exe) -----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:26:23 PM, on 10/10/2007
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\sttray.exe
C:\Program Files\McAfee\MSK\mskagent.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exe
C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
C:\Windows\System32\spool\drivers\w32x86\3\E_FATICEA.EXE
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Mail\WinMail.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\Program Files\Spyware Doctor\sdtrayapp.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Users\Peter\AppData\Local\Temp\Temporary Internet Files\Content.IE5\LV1A88Q9\dss[1].exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Peter.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.c...h...TP&M=GM5478
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.c...h...TP&M=GM5478
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gateway.c...h...TP&M=GM5478
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\google\BAE.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NMSSupport] "C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" /startup
O4 - HKLM\..\Run: [CCUTRAYICON] C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [EPSON Stylus CX8400 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICEA.EXE /FU "C:\Windows\TEMP\E_S39AD.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-2053935830-905597749-1116634679-1000\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'IUSR_NMPR')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - http://www.nanoscan....s/ascstubie.cab
O23 - Service: McAfee Application Installer Cleanup (0057521191993498) (0057521191993498mcinstcleanup) - McAfee, Inc. - C:\Windows\TEMP5752~1.EXE
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Intel® Alert Service (AlertService) - Intel® Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: Intel® DHTrace Controller (DHTRACE) - Intel® Corporation - C:\Program Files\Common Files\Intel\IntelDH\bin\DHTraceController.exe
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: Intel® Software Services Manager (ISSM) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: Intel® Viiv™ Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: Intel® Application Tracker (MCLServiceATL) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Intel® NMSCore (NMSCore) - Intel® Corporation - C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Intel® Quality Manager (QualityManager) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exe
O23 - Service: Intel® Remoting Service (Remote UI Service) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 10492 bytes

-- Files created between 2007-09-10 and 2007-10-10 -----------------------------

2007-10-10 18:53:34 0 d-------- C:\Program Files\Panda Security
2007-10-09 20:04:17 0 d-a------ C:\Users\All Users\TEMP
2007-10-09 20:03:58 0 d-------- C:\Program Files\Spyware Doctor
2007-10-07 18:50:28 0 d-------- C:\Program Files\SEGA
2007-10-07 16:36:49 0 d-------- C:\Users\All Users\SiteAdvisor
2007-10-07 16:36:49 0 d-------- C:\Program Files\SiteAdvisor
2007-10-02 19:47:42 0 d-------- C:\Program Files\Trend Micro
2007-10-01 20:49:28 0 d-------- C:\Program Files\Lavasoft
2007-10-01 20:49:25 0 d-------- C:\Users\All Users\Lavasoft
2007-10-01 20:48:47 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-09-30 20:23:07 0 d-------- C:\Users\All Users\Spybot - Search & Destroy
2007-09-30 03:00:49 0 d-------- C:\Program Files\MSXML 4.0
2007-09-29 14:07:55 0 d-------- C:\Program Files\Ubisoft
2007-09-29 13:42:48 0 dr------- C:\Users\Anne\Searches
2007-09-29 13:42:36 0 dr------- C:\Users\Anne\Contacts
2007-09-29 13:42:28 0 d--hs---- C:\Users\Anne\Templates <TEMPLA~1>
2007-09-29 13:42:28 0 d--hs---- C:\Users\Anne\Start Menu <STARTM~1>
2007-09-29 13:42:28 0 d--hs---- C:\Users\Anne\SendTo
2007-09-29 13:42:28 0 d--hs---- C:\Users\Anne\Recent
2007-09-29 13:42:28 0 d--hs---- C:\Users\Anne\PrintHood <PRINTH~1>
2007-09-29 13:42:28 0 d--hs---- C:\Users\Anne\NetHood
2007-09-29 13:42:28 0 d--hs---- C:\Users\Anne\My Documents <MYDOCU~1>
2007-09-29 13:42:28 0 d--hs---- C:\Users\Anne\Local Settings <LOCALS~1>
2007-09-29 13:42:28 0 d--hs---- C:\Users\Anne\Cookies
2007-09-29 13:42:28 0 d--hs---- C:\Users\Anne\Application Data <APPLIC~1>
2007-09-29 13:42:27 0 dr------- C:\Users\Anne\Videos
2007-09-29 13:42:27 0 dr------- C:\Users\Anne\Saved Games <SAVEDG~1>
2007-09-29 13:42:27 0 dr------- C:\Users\Anne\Pictures
2007-09-29 13:42:27 1048576 --ahs---- C:\Users\Anne\NTUSER.DAT
2007-09-29 13:42:27 0 dr------- C:\Users\Anne\Music
2007-09-29 13:42:27 0 dr------- C:\Users\Anne\Links
2007-09-29 13:42:27 0 dr------- C:\Users\Anne\Favorites <FAVORI~1>
2007-09-29 13:42:27 0 dr------- C:\Users\Anne\Downloads <DOWNLO~1>
2007-09-29 13:42:27 0 dr------- C:\Users\Anne\Documents <DOCUME~1>
2007-09-29 13:42:27 0 dr------- C:\Users\Anne\Desktop
2007-09-29 13:42:27 0 d--h----- C:\Users\Anne\AppData
2007-09-29 13:01:29 0 d-------- C:\EPSONREG
2007-09-29 12:59:27 11776 --a------ C:\Windows\system32\drivers\afc.sys <Not Verified; Arcsoft, Inc.; Arcsoft® ASPI Shell>
2007-09-29 12:59:26 0 d-------- C:\Program Files\Common Files\ArcSoft
2007-09-29 12:59:24 212480 --a------ C:\Windows\PCDLIB32.DLL <Not Verified; Eastman Kodak; Kodak Photo CD Access Developer Toolkit>
2007-09-29 12:59:20 126976 --a------ C:\Windows\system32\PhotoImpression Slideshow.scr <Not Verified; ArcSoft Inc.; PhotoImpression Slideshow>
2007-09-29 12:59:08 0 d-------- C:\Program Files\ArcSoft
2007-09-29 12:59:05 0 d-------- C:\Windows\system32\PhotoImpression Slideshow
2007-09-29 12:59:01 0 d-------- C:\Users\All Users\EPSON
2007-09-29 12:52:04 73220 --a------ C:\Windows\system32\EPPICPrinterDB.dat
2007-09-29 12:52:04 1140 --a------ C:\Windows\system32\EPPICPresetData_PT.dat
2007-09-29 12:52:04 1130 --a------ C:\Windows\system32\EPPICPresetData_FR.dat
2007-09-29 12:52:04 1137 --a------ C:\Windows\system32\EPPICPresetData_ES.dat
2007-09-29 12:52:04 1104 --a------ C:\Windows\system32\EPPICPresetData_EN.dat
2007-09-29 12:52:04 1130 --a------ C:\Windows\system32\EPPICPresetData_CF.dat
2007-09-29 12:52:04 1140 --a------ C:\Windows\system32\EPPICPresetData_BP.dat
2007-09-29 12:52:04 4943 --a------ C:\Windows\system32\EPPICPattern6.dat
2007-09-29 12:52:04 15670 --a------ C:\Windows\system32\EPPICPattern5.dat
2007-09-29 12:52:04 10673 --a------ C:\Windows\system32\EPPICPattern4.dat
2007-09-29 12:52:04 21021 --a------ C:\Windows\system32\EPPICPattern3.dat
2007-09-29 12:52:04 13280 --a------ C:\Windows\system32\EPPICPattern2.dat
2007-09-29 12:52:04 31053 --a------ C:\Windows\system32\EPPICPattern131.dat
2007-09-29 12:52:04 27417 --a------ C:\Windows\system32\EPPICPattern121.dat
2007-09-29 12:52:04 29114 --a------ C:\Windows\system32\EPPICPattern1.dat
2007-09-29 12:49:48 0 d-------- C:\Program Files\epson
2007-09-28 21:41:51 0 d-------- C:\Windows\nvtmpinst
2007-09-25 20:11:16 0 dr------- C:\Users\Peter\Searches
2007-09-25 20:11:03 0 dr------- C:\Users\Peter\Contacts
2007-09-25 20:10:27 0 d--hs---- C:\Users\Peter\Templates <TEMPLA~1>
2007-09-25 20:10:27 0 d--hs---- C:\Users\Peter\Start Menu <STARTM~1>
2007-09-25 20:10:27 0 d--hs---- C:\Users\Peter\SendTo
2007-09-25 20:10:27 0 d--hs---- C:\Users\Peter\Recent
2007-09-25 20:10:27 0 d--hs---- C:\Users\Peter\Local Settings <LOCALS~1>
2007-09-25 20:10:26 0 dr------- C:\Users\Peter\Videos
2007-09-25 20:10:26 0 dr------- C:\Users\Peter\Saved Games <SAVEDG~1>
2007-09-25 20:10:26 0 d--hs---- C:\Users\Peter\PrintHood <PRINTH~1>
2007-09-25 20:10:26 0 dr------- C:\Users\Peter\Pictures
2007-09-25 20:10:26 2097152 --ahs---- C:\Users\Peter\NTUSER.DAT
2007-09-25 20:10:26 0 d--hs---- C:\Users\Peter\NetHood
2007-09-25 20:10:26 0 d--hs---- C:\Users\Peter\My Documents <MYDOCU~1>
2007-09-25 20:10:26 0 dr------- C:\Users\Peter\Music
2007-09-25 20:10:26 0 dr------- C:\Users\Peter\Links
2007-09-25 20:10:26 0 dr------- C:\Users\Peter\Favorites <FAVORI~1>
2007-09-25 20:10:26 0 dr------- C:\Users\Peter\Downloads <DOWNLO~1>
2007-09-25 20:10:26 0 dr------- C:\Users\Peter\Documents <DOCUME~1>
2007-09-25 20:10:26 0 dr------- C:\Users\Peter\Desktop
2007-09-25 20:10:26 0 d--hs---- C:\Users\Peter\Cookies
2007-09-25 20:10:26 0 d--hs---- C:\Users\Peter\Application Data <APPLIC~1>
2007-09-25 20:10:26 0 d--h----- C:\Users\Peter\AppData
2007-09-25 20:06:59 0 d--hs---- C:\Users\Default\Templates <TEMPLA~1>
2007-09-25 20:06:59 0 d--hs---- C:\Users\Default\Start Menu <STARTM~1>
2007-09-25 20:06:59 0 d--hs---- C:\Users\Default\SendTo
2007-09-25 20:06:59 0 d--hs---- C:\Users\Default\Recent
2007-09-25 20:06:59 0 d--hs---- C:\Users\Default\PrintHood <PRINTH~1>
2007-09-25 20:06:59 0 d--hs---- C:\Users\Default\NetHood
2007-09-25 20:06:59 0 d--hs---- C:\Users\Default\Local Settings <LOCALS~1>
2007-09-25 20:06:59 0 d--hs---- C:\Users\Default\Cookies
2007-09-25 20:06:59 0 d--hs---- C:\Users\All Users\Templates <TEMPLA~1>
2007-09-25 20:06:59 0 d--hs---- C:\Users\All Users\Start Menu <STARTM~1>
2007-09-25 20:06:59 0 d--hs---- C:\Users\All Users\Favorites <FAVORI~1>
2007-09-25 20:06:59 0 d--hs---- C:\Users\All Users\Documents <DOCUME~1>
2007-09-25 20:06:59 0 d--hs---- C:\Users\All Users\Desktop
2007-09-25 20:06:59 0 d--hs---- C:\Users\All Users\Application Data <APPLIC~1>
2007-09-25 20:06:59 0 d--hs---- C:\Documents and Settings
2007-09-25 20:06:58 0 d--hs---- C:\Users\Default\My Documents <MYDOCU~1>
2007-09-25 20:06:58 0 d--hs---- C:\Users\Default\Application Data <APPLIC~1>


-- Find3M Report ---------------------------------------------------------------

2007-10-10 18:37:18 0 d-------- C:\Users\Peter\AppData\Roaming\SiteAdvisor
2007-10-09 20:03:58 0 d-------- C:\Users\Peter\AppData\Roaming\PC Tools
2007-10-09 07:54:17 0 d-------- C:\Program Files\McAfee
2007-10-07 18:50:28 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-10-07 14:31:04 0 d-------- C:\Program Files\Google
2007-10-01 20:48:47 0 d-------- C:\Program Files\Common Files
2007-10-01 17:30:39 0 d-------- C:\Users\Peter\AppData\Roaming\Adobe
2007-09-30 03:20:23 174 --ahs---- C:\Program Files\desktop.ini
2007-09-30 03:16:55 0 d-------- C:\Program Files\Windows Calendar
2007-09-30 03:16:52 0 d-------- C:\Program Files\Windows Mail
2007-09-29 17:06:30 0 d-------- C:\Users\Peter\AppData\Roaming\Google
2007-09-29 13:01:34 0 d-------- C:\Users\Peter\AppData\Roaming\Leadertech
2007-09-29 12:59:30 0 d-------- C:\Users\Peter\AppData\Roaming\ArcSoft
2007-09-29 12:52:02 0 d-------- C:\Users\Peter\AppData\Roaming\InstallShield
2007-09-29 12:28:30 0 d-------- C:\Users\Peter\AppData\Roaming\Macromedia
2007-09-25 20:23:04 0 d-------- C:\Users\Peter\AppData\Roaming\SampleView
2007-09-25 20:11:29 0 d-------- C:\Users\Peter\AppData\Roaming\GTek
2007-09-25 20:11:04 0 d-------- C:\Users\Peter\AppData\Roaming\Identities
2007-08-10 01:06:54 0 d-------- C:\Program Files\Windows Defender
2007-08-09 23:25:06 4 --a------ C:\Windows\Pix11.dat


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [08/09/2007 11:30 PM]
"NMSSupport"="C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" [04/06/2007 05:07 PM]
"CCUTRAYICON"="C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe" [04/06/2007 05:11 PM]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [03/21/2007 04:00 PM]
"SigmatelSysTrayApp"="sttray.exe" [02/28/2007 10:56 PM C:\Windows\sttray.exe]
"MskAgentexe"="C:\Program Files\McAfee\MSK\MskAgent.exe" [01/17/2007 08:30 PM]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [04/26/2007 04:17 AM]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [04/26/2007 04:17 AM]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [04/26/2007 04:17 AM]
"MSConfig"="C:\Windows\system32\msconfig.exe" [11/02/2006 05:45 AM]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [02/08/2007 10:39 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WindowsWelcomeCenter"="oobefldr.dll,ShowWelcomeCenter" []
"EPSON Stylus CX8400 Series"="C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICEA.exe" [02/15/2007 06:00 AM]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [11/02/2006 08:36 AM]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [08/31/2007 04:46 PM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"Launcher"=%WINDIR%\SMINST\launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"=2 (0x2)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]
@="IEEE 1394 Bus host controllers"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]
@="SBP2 IEEE 1394 Devices"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]
@="SecurityDevices"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BigFix]
c:\program files\Bigfix\bigfix.exe /atstartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NapsterShell]
C:\Program Files\Napster\napster.exe /systray

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc EMDMgmt TabletInputService wlansvc WPDBusEnum


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a8e52714-4af0-11dc-a5ea-806e6f6e6963}]
AutoRun\command- E:\Launch.exe

*Newly Created Service* - IKFILESEC
*Newly Created Service* - IKSYSFLT
*Newly Created Service* - IKSYSSEC
*Newly Created Service* - MCHINJDRV

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
C:\Windows\system32\unregmp2.exe /ShowWMP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
%SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI



-- End of Deckard's System Scanner: finished at 2007-10-10 20:26:52 ------------

Hi peterc38,

Good job getting all of that done. It looks like your Host file is all cleared up. The TotalScan didnt turn up any nasties, just a few cookies that are of no concern. Can you update me on if your still experiencing the same problems?

Stamper

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.