Win32:Delf-IWD trojan horse [RESOLVED]
Started by
CompooterDummy
, Apr 02 2008 11:09 AM
#1
Posted 02 April 2008 - 11:09 AM
#2
Posted 02 April 2008 - 04:18 PM
Hello
Please download ComboFix from Here or Here to your Desktop.
**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
Please download ComboFix from Here or Here to your Desktop.
**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
- Please, never rename Combofix unless instructed.
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
-----------------------------------------------------------
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
-----------------------------------------------------------
- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
-----------------------------------------------------------
- Double click on combofix.exe & follow the prompts.
- When finished, it will produce a report for you.
- Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
#3
Posted 03 April 2008 - 09:15 AM
Please forgive my ignorance but what is a "Hijack This" log and how do I find and/or create one? Once I have it, do I post here with this thread or under the "Hijack This" log forum?
#4
Posted 03 April 2008 - 10:41 AM
Sorry my mistake
Just go and run ComboFix for now
Just go and run ComboFix for now
#5
Posted 03 April 2008 - 12:14 PM
OK. I ran combofix. I hope I didn't mess anything up. Here's everything that happened:
First run: After starting the run I got this message: "The procedure entry point ?ExitProgram@Program@@SGXK@Z could not be located in the dynamic link library ulib.dll. I clicked OK on the message and the program began running giving me the disclaimers. I clicked OK and the computer restarted.
Second Run: After starting the run I got the same message above. After clicking OK I got the disclaimers and clicked OK and the program began running showing me deleted files and a messages about stages which ran stage 1 through 7. Then the computer reset.
I wasn't sure if it had done its thing so I ran it one more time and everything that happened on the second happened again except no files were deleted.
Hope I didn't screw anything up. What now?
First run: After starting the run I got this message: "The procedure entry point ?ExitProgram@Program@@SGXK@Z could not be located in the dynamic link library ulib.dll. I clicked OK on the message and the program began running giving me the disclaimers. I clicked OK and the computer restarted.
Second Run: After starting the run I got the same message above. After clicking OK I got the disclaimers and clicked OK and the program began running showing me deleted files and a messages about stages which ran stage 1 through 7. Then the computer reset.
I wasn't sure if it had done its thing so I ran it one more time and everything that happened on the second happened again except no files were deleted.
Hope I didn't screw anything up. What now?
#6
Posted 03 April 2008 - 12:23 PM
Can you post the ComboFix log ?
It should be in the folder C:\ComboFix
It should be in the folder C:\ComboFix
#7
Posted 03 April 2008 - 01:49 PM
I found this in a combofix text file:
ComboFix 08-04-02.1 - Jo Ann Christinese 2008-04-03 11:58:08.2 - NTFSx86
Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.129 [GMT -7:00]
Running from: C:\Documents and Settings\Jo Ann Christinese\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
Is this what you're looking for?
I don't see anything called a fix log.
ComboFix 08-04-02.1 - Jo Ann Christinese 2008-04-03 11:58:08.2 - NTFSx86
Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.129 [GMT -7:00]
Running from: C:\Documents and Settings\Jo Ann Christinese\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
Is this what you're looking for?
I don't see anything called a fix log.
#8
Posted 03 April 2008 - 02:08 PM
Was that all there was ?
Do this if so
Please download Deckard's System Scanner (DSS) and save it to your Desktop.
Do this if so
Please download Deckard's System Scanner (DSS) and save it to your Desktop.
- Close all other windows before proceeding.
- Double-click on dss.exe and follow the prompts.
- If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
- When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.
#9
Posted 03 April 2008 - 03:14 PM
here's the main.txt file:
Deckard's System Scanner v20071014.68
Run by Jo Ann Christinese on 2008-04-03 15:01:19
Computer is in Normal Mode.
--------------------------------------------------------------------------------
Backed up registry hives.
Performed disk cleanup.
Total Physical Memory: 255 MiB (256 MiB recommended).
-- HijackThis (run as Jo Ann Christinese.exe) ----------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:05, on 2008-04-03
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\perfs.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\sm56hlpr.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\PeoplePC\ISP6500\Browser\Bartshel.exe
C:\PROGRA~1\PeoplePC\ISP6500\Browser\PPShared.exe
C:\WINNT\system32\wuauclt.exe
C:\Documents and Settings\Jo Ann Christinese\Desktop\dss.exe
C:\Program Files\PeoplePC\ISP6500\Browser\Bartshel.exe
C:\Program Files\PeoplePC Accelerated\PeoplePC.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Jo Ann Christinese.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.peoplepc.com/search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.peoplepc.com/websearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://home.peoplepc.com/search
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
O2 - BHO: EarthLink BHO Guard - {00000000-0000-0000-0000-000000000002} - C:\Program Files\PeoplePC\Toolbar\ScamGrd.dll
O2 - BHO: EarthLink ScamBlocker V3 - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\PeoplePC\Toolbar\ScamGrd.dll
O2 - BHO: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - c:\program files\peoplepc\toolbar\ppctoolbar.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - c:\program files\peoplepc\toolbar\ppctoolbar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [Bart Station] C:\Program Files\PeoplePC\ISP6500\BIN\PPCOLink.exe -STATION
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O8 - Extra context menu item: Refresh Pa&ge with Full Quality - C:\Program Files\PeoplePC Accelerated\pac-page.html
O8 - Extra context menu item: Refresh Pi&cture with Full Quality - C:\Program Files\PeoplePC Accelerated\pac-image.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1207048643546
O17 - HKLM\System\CCS\Services\Tcpip\..\{CCEE0E6D-41E2-4091-892A-314B23E8F5C6}: NameServer = 209.244.0.3 209.244.0.4
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINNT\system32\perfs.exe
O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINNT\system32\routing.exe (file missing)
--
End of file - 4117 bytes
-- File Associations -----------------------------------------------------------
All associations okay.
-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------
S3 WINIO - d:\winio.sys (file missing)
-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------
R2 perfmons (perfmons Service) - c:\winnt\system32\perfs.exe
S2 Routing (Routing Service) - c:\winnt\system32\routing.exe (file missing)
-- Device Manager: Disabled ----------------------------------------------------
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: 3Com 3C920 Integrated Fast Ethernet Controller (3C905C-TX Compatible)
Device ID: PCI\VEN_10B7&DEV_9200&SUBSYS_00B41028&REV_78\4&B80044F&0&60F0
Manufacturer: 3Com
Name: 3Com 3C920 Integrated Fast Ethernet Controller (3C905C-TX Compatible)
PNP Device ID: PCI\VEN_10B7&DEV_9200&SUBSYS_00B41028&REV_78\4&B80044F&0&60F0
Service: EL90BC
-- Files created between 2008-03-03 and 2008-04-03 -----------------------------
2008-04-03 15:05:06 0 d-------- C:\Program Files\Trend Micro
2008-04-03 14:45:44 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_1f0.dat
2008-04-03 11:53:12 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_30c.dat
2008-04-03 11:48:56 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_1f8.dat
2008-04-03 11:47:08 68096 --a------ C:\WINNT\system32\zip.exe
2008-04-03 11:47:08 98816 --a------ C:\WINNT\system32\sed.exe
2008-04-03 11:47:08 80412 --a------ C:\WINNT\system32\grep.exe
2008-04-03 11:47:08 73728 --a------ C:\WINNT\system32\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-04-03 08:36:47 0 d-------- C:\Program Files\Common Files\InstallShield
2008-04-02 15:48:01 171021 --a------ C:\yoyo1043_ajdfnukh.exe
2008-04-02 15:47:34 53 --a------ C:\1.vbs
2008-04-02 15:47:34 175 --a------ C:\1.bat
2008-04-02 15:44:56 219594 --a------ C:\WINNT\IireFoxUpdater.exe
2008-04-02 14:28:38 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_1ec.dat
2008-04-02 11:13:13 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Adobe
2008-04-01 20:53:14 0 d-------- C:\WINNT\PreInstall
2008-04-01 20:17:01 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Help
2008-04-01 19:20:39 0 d-------- C:\Program Files\Alwil Software
2008-04-01 16:33:21 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Macromedia
2008-04-01 16:09:02 0 d-------- C:\Program Files\PeoplePC Accelerated
2008-04-01 16:04:01 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\ScamBlocker
2008-04-01 15:59:52 0 d-------- C:\Program Files\Common Files\PeoplePC
2008-04-01 15:59:51 67584 -----n--- C:\WINNT\system32\unPPC.exe <Not Verified; PeoplePC; PeoplePC unPPC>
2008-04-01 15:59:51 28672 -----n--- C:\WINNT\system32\RegHero.exe <Not Verified; ; RegHero Module>
2008-04-01 15:59:51 18432 -----n--- C:\WINNT\system32\PPCInfo.exe <Not Verified; PeoplePC, Inc.; PPCInfo Module>
2008-04-01 15:59:51 0 d-------- C:\Program Files\PeoplePC
2008-04-01 15:59:47 0 d-------- C:\WINNT\system32\Macromed
2008-04-01 07:48:02 306688 --a------ C:\WINNT\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller>
2008-04-01 07:47:47 0 d-------- C:\Dell
2008-04-01 06:52:52 0 d-------- C:\WINNT\winsxs
2008-04-01 06:52:51 0 d-------- C:\WINNT\PCHEALTH
2008-04-01 06:50:12 0 d-------- C:\WINNT\system32\URTTemp
2008-04-01 06:07:18 57344 --a------ C:\WINNT\uneng.exe <Not Verified; Roxio; Roxio Update Wizard>
2008-04-01 06:07:18 0 d-------- C:\Program Files\Common Files\Adaptec Shared
2008-04-01 06:07:10 225280 --a------ C:\WINNT\system32\wmpdxm.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Player>
2008-04-01 06:07:10 106496 --a------ C:\WINNT\system32\wmpasf.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Player>
2008-04-01 06:07:01 52224 --a------ C:\WINNT\system32\mspmsnsv.dll <Not Verified; Microsoft Corporation; Windows Media Device Manager>
2008-04-01 06:06:57 997888 --a------ C:\WINNT\system32\wmvdmoe2.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2008-04-01 06:06:57 892416 --a------ C:\WINNT\system32\wmspdmoe.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2008-04-01 06:06:57 1111040 --a------ C:\WINNT\system32\wmsdmoe2.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2008-04-01 06:01:20 0 d-------- C:\WINNT\Motorola
2008-04-01 05:52:34 1222656 --a------ C:\WINNT\system32\quartz.dll
2008-04-01 05:52:33 524800 --a------ C:\WINNT\system32\qedit.dll
2008-04-01 05:52:33 194560 --a------ C:\WINNT\system32\mswebdvd.dll <Not Verified; Microsoft Corporation; DirectShow>
2008-04-01 05:52:33 1769472 --a------ C:\WINNT\system32\dxdiagn.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:33 1689600 --a------ C:\WINNT\system32\d3d9.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:33 1179648 --a------ C:\WINNT\system32\d3d8.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 68096 --a------ C:\WINNT\system32\dsdmoprp.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 203264 --a------ C:\WINNT\system32\dpvoice.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 16896 --a------ C:\WINNT\system32\dpnsvr.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 377856 --a------ C:\WINNT\system32\dpnet.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 166400 --a------ C:\WINNT\system32\dinput8.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 386048 --a------ C:\WINNT\system32\diactfrm.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 733184 --a------ C:\WINNT\system32\qedwipes.dll
2008-04-01 05:52:30 13312 --a------ C:\WINNT\system32\msdmo.dll
2008-04-01 05:52:30 18944 --a------ C:\WINNT\system32\encapi.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 1189888 --a------ C:\WINNT\system32\dx8vb.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 18432 --a------ C:\WINNT\system32\dswave.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 186880 --a------ C:\WINNT\system32\dsdmo.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 112128 --a------ C:\WINNT\system32\dpvvox.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 80896 --a------ C:\WINNT\system32\dpvsetup.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 19968 --a------ C:\WINNT\system32\dpvacm.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 3072 --a------ C:\WINNT\system32\dpnlobby.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 68096 --a------ C:\WINNT\system32\dpnhupnp.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 32768 --a------ C:\WINNT\system32\dpnhpast.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 3072 --a------ C:\WINNT\system32\dpnaddr.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 76800 --a------ C:\WINNT\system32\dmscript.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 44032 --a------ C:\WINNT\system32\dimap.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 7168 --a------ C:\WINNT\system32\d3d8thk.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:50:03 0 d-------- C:\WINNT\system32\directx
2008-04-01 05:23:05 641378 ---h----- C:\WINNT\ShellIconCache
2008-04-01 05:15:48 0 d-------- C:\WINNT\system32\Windows Media
2008-04-01 05:15:14 0 d--h---c- C:\WINNT\$NtUpdateRollupPackUninstall$
2008-04-01 05:15:11 0 d-------- C:\WINNT\msiinst.tmp
2008-04-01 05:13:44 0 d--h---c- C:\WINNT\$SQLUninstallMDAC25SP3-KB927779-x86-ENU$
2008-04-01 05:11:56 0 d-------- C:\WINNT\mui
2008-04-01 05:09:36 171280 --a------ C:\WINNT\system32\jit.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:36 139536 --a------ C:\WINNT\system32\javaee.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:36 313856 --a------ C:\WINNT\system32\dx3j.dll <Not Verified; Microsoft Corporation; Microsoft® DirectX for Java>
2008-04-01 05:09:36 46352 --a------ C:\WINNT\setdebug.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:36 6550 --a------ C:\WINNT\jautoexp.dat
2008-04-01 05:09:31 113 --a------ C:\WINNT\system32\zonedon.reg
2008-04-01 05:09:31 113 --a------ C:\WINNT\system32\zonedoff.reg
2008-04-01 05:09:31 171792 --a------ C:\WINNT\system32\wjview.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:31 286992 --a------ C:\WINNT\system32\vmhelper.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:30 21264 --a------ C:\WINNT\system32\msjdbc10.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:30 947472 --a------ C:\WINNT\system32\msjava.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 154384 --a------ C:\WINNT\system32\msawt.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 172304 --a------ C:\WINNT\system32\jview.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 15120 --a------ C:\WINNT\system32\jdbgmgr.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 404752 --a------ C:\WINNT\system32\javart.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 63248 --a------ C:\WINNT\system32\javaprxy.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 187152 --a------ C:\WINNT\system32\javacypt.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:27 49424 --a------ C:\WINNT\system32\clspack.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 04:49:32 0 d-------- C:\WINNT\RegisteredPackages
2008-04-01 04:47:46 0 d--h----- C:\WINNT\msdownld.tmp
2008-04-01 04:47:42 0 d-------- C:\WINNT\Windows Update Setup Files
2008-04-01 04:44:00 0 d-------- C:\WINNT\system32\Microsoft
2008-04-01 04:40:51 0 d-------- C:\WINNT\system32\ie_de
2008-04-01 04:40:51 0 d-------- C:\WINNT\system32\CertSrv
2008-04-01 04:40:51 0 d-------- C:\WINNT\ServicePackFiles
2008-04-01 04:19:29 0 d-------- C:\WINNT\system32\BITS
2008-04-01 04:17:31 0 d-------- C:\WINNT\SoftwareDistribution
2008-04-01 04:04:55 0 d-------- C:\WINNT\system32\NtmsData
2008-04-01 04:04:39 0 d--hs---- C:\WINNT\Installer
2008-04-01 04:04:39 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Identities
2008-04-01 04:04:34 0 d--h----- C:\WINNT\system32\GroupPolicy
2008-04-01 04:04:33 0 d--hs---- C:\WINNT\CSC
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\Templates
2008-04-01 04:04:33 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Start Menu
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\SendTo
2008-04-01 04:04:33 0 dr-h----- C:\Documents and Settings\Jo Ann Christinese\Recent
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\PrintHood
2008-04-01 04:04:33 536576 --ah----- C:\Documents and Settings\Jo Ann Christinese\NTUSER.DAT
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\NetHood
2008-04-01 04:04:33 0 d-------- C:\Documents and Settings\Jo Ann Christinese\My Documents
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\Local Settings
2008-04-01 04:04:33 0 dr------- C:\Documents and Settings\Jo Ann Christinese\Favorites
2008-04-01 04:04:33 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Desktop
2008-04-01 04:04:33 0 d---s---- C:\Documents and Settings\Jo Ann Christinese\Cookies
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\Application Data
2008-04-01 04:04:14 0 d--hs---- C:\System Volume Information
2008-04-01 03:48:47 0 d-------- C:\WINNT\system32\rpcproxy
2008-04-01 03:48:47 0 d-------- C:\WINNT\system32\rocket
2008-04-01 03:48:47 0 d-------- C:\WINNT\system32\inetsrv
2008-04-01 03:48:47 0 d-------- C:\WINNT\mww32
2008-04-01 03:48:47 0 d-------- C:\WINNT\ime
2008-04-01 03:48:47 0 d-------- C:\Program Files\microsoft frontpage
2008-04-01 03:48:17 122880 ---h----- C:\Documents and Settings\Default User\NTUSER.DAT
2008-04-01 03:47:51 0 -rahs---- C:\MSDOS.SYS
2008-04-01 03:47:51 0 -rahs---- C:\IO.SYS
2008-04-01 03:47:51 0 ---h----- C:\CONFIG.SYS
2008-04-01 03:47:51 0 ---h----- C:\AUTOEXEC.BAT
2008-04-01 03:47:06 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft
2008-04-01 03:46:53 0 d--hs---- C:\Documents and Settings\All Users\DRM
2008-04-01 03:46:49 0 dr------- C:\WINNT\Offline Web Pages
2008-04-01 03:46:49 0 d---s---- C:\WINNT\Downloaded Program Files
2008-04-01 03:46:29 0 d-a-s---- C:\WINNT\Tasks
2008-04-01 03:45:55 15012 --a------ C:\WINNT\system32\emptyregdb.dat
2008-04-01 03:45:25 0 d-------- C:\WINNT\Registration
2008-04-01 03:45:10 0 d-------- C:\WINNT\system32\DTCLog
2008-04-01 03:45:05 0 d-ah----- C:\Program Files\WindowsUpdate
2008-04-01 03:44:36 0 d-------- C:\Program Files\Accessories
2008-04-01 03:44:27 0 d-------- C:\Program Files\Windows NT
2008-04-01 03:44:23 0 d-------- C:\WINNT\system32\Com
2008-04-01 03:36:14 0 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-03-31 20:04:29 0 d-a------ C:\Program Files\Common Files\ODBC
2008-03-31 20:04:26 0 d-a------ C:\WINNT\Speech
2008-03-31 20:04:24 0 dra------ C:\Program Files
2008-03-31 20:04:24 0 d-a------ C:\Program Files\Common Files
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Templates
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\Start Menu
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\SendTo
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Recent
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\PrintHood
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\NetHood
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\My Documents
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Local Settings
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\Favorites
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\Desktop
2008-03-31 20:04:11 0 d---s---- C:\Documents and Settings\Default User\Cookies
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Application Data
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\All Users\Templates
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\All Users\Start Menu
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\All Users\Favorites
2008-03-31 20:04:11 0 d-a------ C:\Documents and Settings\All Users\Documents
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\All Users\Desktop
2008-03-31 20:04:11 0 d-ah----- C:\Documents and Settings\All Users\Application Data
2008-03-31 20:03:56 0 d-a------ C:\WINNT\system32\CatRoot
2008-03-31 20:03:43 0 d-a------ C:\Documents and Settings
2008-03-31 20:00:18 0 d-a------ C:\WINNT
2008-03-31 20:00:18 0 d---s---- C:\WINNT\Web
2008-03-31 20:00:18 0 d-a------ C:\WINNT\twain_32
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\wins
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\wbem
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\spool
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\ShellExt
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\Setup
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\ras
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\os2
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\npp
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\mui
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\ias
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\export
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\drivers
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\drivers\etc
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\drivers\disdn
2008-03-31 20:00:18 0 drahs--c- C:\WINNT\system32\dllcache
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\dhcp
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\config
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system
2008-03-31 20:00:18 0 d-a------ C:\WINNT\security
2008-03-31 20:00:18 0 d-a------ C:\WINNT\repair
2008-03-31 20:00:18 0 d-a------ C:\WINNT\msapps
2008-03-31 20:00:18 0 d-a------ C:\WINNT\msagent
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Media
2008-03-31 20:00:18 0 d-a------ C:\WINNT\java
2008-03-31 20:00:18 0 d--h----- C:\WINNT\inf
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Help
2008-03-31 20:00:18 0 dra-s---- C:\WINNT\Fonts
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Driver Cache
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Debug
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Cursors
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Connection Wizard
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Config
2008-03-31 20:00:18 0 d-a------ C:\WINNT\AppPatch
2008-03-31 20:00:18 0 d-a------ C:\WINNT\addins
-- Find3M Report ---------------------------------------------------------------
Nothing modified in this timespan.
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A8FB8EB3-183B-4598-924D-86F0E5E37085}]
08-04-02 08:39 237056 --a------ c:\program files\peoplepc\toolbar\ppctoolbar.dll
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{A8FB8EB3-183B-4598-924D-86F0E5E37085}"= c:\program files\peoplepc\toolbar\ppctoolbar.dll [08-04-02 08:39 237056]
[-HKEY_CLASSES_ROOT\CLSID\{A8FB8EB3-183B-4598-924D-86F0E5E37085}]
[HKEY_CLASSES_ROOT\PeoplePC.Toolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{994D628D-4D22-4DB9-B6DB-F7D9F1635817}]
[HKEY_CLASSES_ROOT\PeoplePC.Toolbar]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [03-06-19 12:05 C:\WINNT\system32\mobsync.exe]
"SMSERIAL"="sm56hlpr.exe" [03-10-07 19:15 C:\WINNT\sm56hlpr.exe]
"Bart Station"="C:\Program Files\PeoplePC\ISP6500\BIN\PPCOLink.exe" [07-03-12 15:11 ]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [08-03-29 11:37 ]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"disableregistrytools"=0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"
-- End of Deckard's System Scanner: finished at 2008-04-03 15:07:51 ------------
here's the extra.txt file:
Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------
-- System Information ----------------------------------------------------------
Microsoft Windows 2000 Professional (build 2195) SP 4.0
Architecture: X86; Language: English
CPU 0: Intel Pentium III processor
Percentage of Memory in Use: 62%
Physical Memory (total/avail): 254.23 MiB / 95.28 MiB
Pagefile Memory (total/avail): 617.03 MiB / 427.06 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1944.39 MiB
A: is Removable (No Media)
C: is Fixed (NTFS) - 37.27 GiB total, 34.68 GiB free.
D: is CDROM (CDFS)
\\.\PHYSICALDRIVE0 - QUANTUM FIREBALLP AS40.0 - 37.28 GiB - 1 partition
\PARTITION0 (bootable) - Installable File System - 37.27 GiB - C:
-- Security Center -------------------------------------------------------------
Thanks!
Deckard's System Scanner v20071014.68
Run by Jo Ann Christinese on 2008-04-03 15:01:19
Computer is in Normal Mode.
--------------------------------------------------------------------------------
Backed up registry hives.
Performed disk cleanup.
Total Physical Memory: 255 MiB (256 MiB recommended).
-- HijackThis (run as Jo Ann Christinese.exe) ----------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:05, on 2008-04-03
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\perfs.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\sm56hlpr.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\PeoplePC\ISP6500\Browser\Bartshel.exe
C:\PROGRA~1\PeoplePC\ISP6500\Browser\PPShared.exe
C:\WINNT\system32\wuauclt.exe
C:\Documents and Settings\Jo Ann Christinese\Desktop\dss.exe
C:\Program Files\PeoplePC\ISP6500\Browser\Bartshel.exe
C:\Program Files\PeoplePC Accelerated\PeoplePC.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Jo Ann Christinese.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.peoplepc.com/search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.peoplepc.com/websearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://home.peoplepc.com/search
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
O2 - BHO: EarthLink BHO Guard - {00000000-0000-0000-0000-000000000002} - C:\Program Files\PeoplePC\Toolbar\ScamGrd.dll
O2 - BHO: EarthLink ScamBlocker V3 - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\PeoplePC\Toolbar\ScamGrd.dll
O2 - BHO: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - c:\program files\peoplepc\toolbar\ppctoolbar.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - c:\program files\peoplepc\toolbar\ppctoolbar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [Bart Station] C:\Program Files\PeoplePC\ISP6500\BIN\PPCOLink.exe -STATION
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O8 - Extra context menu item: Refresh Pa&ge with Full Quality - C:\Program Files\PeoplePC Accelerated\pac-page.html
O8 - Extra context menu item: Refresh Pi&cture with Full Quality - C:\Program Files\PeoplePC Accelerated\pac-image.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1207048643546
O17 - HKLM\System\CCS\Services\Tcpip\..\{CCEE0E6D-41E2-4091-892A-314B23E8F5C6}: NameServer = 209.244.0.3 209.244.0.4
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINNT\system32\perfs.exe
O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINNT\system32\routing.exe (file missing)
--
End of file - 4117 bytes
-- File Associations -----------------------------------------------------------
All associations okay.
-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------
S3 WINIO - d:\winio.sys (file missing)
-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------
R2 perfmons (perfmons Service) - c:\winnt\system32\perfs.exe
S2 Routing (Routing Service) - c:\winnt\system32\routing.exe (file missing)
-- Device Manager: Disabled ----------------------------------------------------
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: 3Com 3C920 Integrated Fast Ethernet Controller (3C905C-TX Compatible)
Device ID: PCI\VEN_10B7&DEV_9200&SUBSYS_00B41028&REV_78\4&B80044F&0&60F0
Manufacturer: 3Com
Name: 3Com 3C920 Integrated Fast Ethernet Controller (3C905C-TX Compatible)
PNP Device ID: PCI\VEN_10B7&DEV_9200&SUBSYS_00B41028&REV_78\4&B80044F&0&60F0
Service: EL90BC
-- Files created between 2008-03-03 and 2008-04-03 -----------------------------
2008-04-03 15:05:06 0 d-------- C:\Program Files\Trend Micro
2008-04-03 14:45:44 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_1f0.dat
2008-04-03 11:53:12 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_30c.dat
2008-04-03 11:48:56 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_1f8.dat
2008-04-03 11:47:08 68096 --a------ C:\WINNT\system32\zip.exe
2008-04-03 11:47:08 98816 --a------ C:\WINNT\system32\sed.exe
2008-04-03 11:47:08 80412 --a------ C:\WINNT\system32\grep.exe
2008-04-03 11:47:08 73728 --a------ C:\WINNT\system32\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-04-03 08:36:47 0 d-------- C:\Program Files\Common Files\InstallShield
2008-04-02 15:48:01 171021 --a------ C:\yoyo1043_ajdfnukh.exe
2008-04-02 15:47:34 53 --a------ C:\1.vbs
2008-04-02 15:47:34 175 --a------ C:\1.bat
2008-04-02 15:44:56 219594 --a------ C:\WINNT\IireFoxUpdater.exe
2008-04-02 14:28:38 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_1ec.dat
2008-04-02 11:13:13 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Adobe
2008-04-01 20:53:14 0 d-------- C:\WINNT\PreInstall
2008-04-01 20:17:01 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Help
2008-04-01 19:20:39 0 d-------- C:\Program Files\Alwil Software
2008-04-01 16:33:21 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Macromedia
2008-04-01 16:09:02 0 d-------- C:\Program Files\PeoplePC Accelerated
2008-04-01 16:04:01 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\ScamBlocker
2008-04-01 15:59:52 0 d-------- C:\Program Files\Common Files\PeoplePC
2008-04-01 15:59:51 67584 -----n--- C:\WINNT\system32\unPPC.exe <Not Verified; PeoplePC; PeoplePC unPPC>
2008-04-01 15:59:51 28672 -----n--- C:\WINNT\system32\RegHero.exe <Not Verified; ; RegHero Module>
2008-04-01 15:59:51 18432 -----n--- C:\WINNT\system32\PPCInfo.exe <Not Verified; PeoplePC, Inc.; PPCInfo Module>
2008-04-01 15:59:51 0 d-------- C:\Program Files\PeoplePC
2008-04-01 15:59:47 0 d-------- C:\WINNT\system32\Macromed
2008-04-01 07:48:02 306688 --a------ C:\WINNT\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller>
2008-04-01 07:47:47 0 d-------- C:\Dell
2008-04-01 06:52:52 0 d-------- C:\WINNT\winsxs
2008-04-01 06:52:51 0 d-------- C:\WINNT\PCHEALTH
2008-04-01 06:50:12 0 d-------- C:\WINNT\system32\URTTemp
2008-04-01 06:07:18 57344 --a------ C:\WINNT\uneng.exe <Not Verified; Roxio; Roxio Update Wizard>
2008-04-01 06:07:18 0 d-------- C:\Program Files\Common Files\Adaptec Shared
2008-04-01 06:07:10 225280 --a------ C:\WINNT\system32\wmpdxm.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Player>
2008-04-01 06:07:10 106496 --a------ C:\WINNT\system32\wmpasf.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Player>
2008-04-01 06:07:01 52224 --a------ C:\WINNT\system32\mspmsnsv.dll <Not Verified; Microsoft Corporation; Windows Media Device Manager>
2008-04-01 06:06:57 997888 --a------ C:\WINNT\system32\wmvdmoe2.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2008-04-01 06:06:57 892416 --a------ C:\WINNT\system32\wmspdmoe.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2008-04-01 06:06:57 1111040 --a------ C:\WINNT\system32\wmsdmoe2.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2008-04-01 06:01:20 0 d-------- C:\WINNT\Motorola
2008-04-01 05:52:34 1222656 --a------ C:\WINNT\system32\quartz.dll
2008-04-01 05:52:33 524800 --a------ C:\WINNT\system32\qedit.dll
2008-04-01 05:52:33 194560 --a------ C:\WINNT\system32\mswebdvd.dll <Not Verified; Microsoft Corporation; DirectShow>
2008-04-01 05:52:33 1769472 --a------ C:\WINNT\system32\dxdiagn.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:33 1689600 --a------ C:\WINNT\system32\d3d9.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:33 1179648 --a------ C:\WINNT\system32\d3d8.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 68096 --a------ C:\WINNT\system32\dsdmoprp.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 203264 --a------ C:\WINNT\system32\dpvoice.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 16896 --a------ C:\WINNT\system32\dpnsvr.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 377856 --a------ C:\WINNT\system32\dpnet.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 166400 --a------ C:\WINNT\system32\dinput8.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 386048 --a------ C:\WINNT\system32\diactfrm.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 733184 --a------ C:\WINNT\system32\qedwipes.dll
2008-04-01 05:52:30 13312 --a------ C:\WINNT\system32\msdmo.dll
2008-04-01 05:52:30 18944 --a------ C:\WINNT\system32\encapi.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 1189888 --a------ C:\WINNT\system32\dx8vb.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 18432 --a------ C:\WINNT\system32\dswave.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 186880 --a------ C:\WINNT\system32\dsdmo.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 112128 --a------ C:\WINNT\system32\dpvvox.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 80896 --a------ C:\WINNT\system32\dpvsetup.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 19968 --a------ C:\WINNT\system32\dpvacm.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 3072 --a------ C:\WINNT\system32\dpnlobby.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 68096 --a------ C:\WINNT\system32\dpnhupnp.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 32768 --a------ C:\WINNT\system32\dpnhpast.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 3072 --a------ C:\WINNT\system32\dpnaddr.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 76800 --a------ C:\WINNT\system32\dmscript.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 44032 --a------ C:\WINNT\system32\dimap.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 7168 --a------ C:\WINNT\system32\d3d8thk.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:50:03 0 d-------- C:\WINNT\system32\directx
2008-04-01 05:23:05 641378 ---h----- C:\WINNT\ShellIconCache
2008-04-01 05:15:48 0 d-------- C:\WINNT\system32\Windows Media
2008-04-01 05:15:14 0 d--h---c- C:\WINNT\$NtUpdateRollupPackUninstall$
2008-04-01 05:15:11 0 d-------- C:\WINNT\msiinst.tmp
2008-04-01 05:13:44 0 d--h---c- C:\WINNT\$SQLUninstallMDAC25SP3-KB927779-x86-ENU$
2008-04-01 05:11:56 0 d-------- C:\WINNT\mui
2008-04-01 05:09:36 171280 --a------ C:\WINNT\system32\jit.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:36 139536 --a------ C:\WINNT\system32\javaee.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:36 313856 --a------ C:\WINNT\system32\dx3j.dll <Not Verified; Microsoft Corporation; Microsoft® DirectX for Java>
2008-04-01 05:09:36 46352 --a------ C:\WINNT\setdebug.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:36 6550 --a------ C:\WINNT\jautoexp.dat
2008-04-01 05:09:31 113 --a------ C:\WINNT\system32\zonedon.reg
2008-04-01 05:09:31 113 --a------ C:\WINNT\system32\zonedoff.reg
2008-04-01 05:09:31 171792 --a------ C:\WINNT\system32\wjview.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:31 286992 --a------ C:\WINNT\system32\vmhelper.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:30 21264 --a------ C:\WINNT\system32\msjdbc10.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:30 947472 --a------ C:\WINNT\system32\msjava.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 154384 --a------ C:\WINNT\system32\msawt.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 172304 --a------ C:\WINNT\system32\jview.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 15120 --a------ C:\WINNT\system32\jdbgmgr.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 404752 --a------ C:\WINNT\system32\javart.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 63248 --a------ C:\WINNT\system32\javaprxy.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 187152 --a------ C:\WINNT\system32\javacypt.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:27 49424 --a------ C:\WINNT\system32\clspack.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 04:49:32 0 d-------- C:\WINNT\RegisteredPackages
2008-04-01 04:47:46 0 d--h----- C:\WINNT\msdownld.tmp
2008-04-01 04:47:42 0 d-------- C:\WINNT\Windows Update Setup Files
2008-04-01 04:44:00 0 d-------- C:\WINNT\system32\Microsoft
2008-04-01 04:40:51 0 d-------- C:\WINNT\system32\ie_de
2008-04-01 04:40:51 0 d-------- C:\WINNT\system32\CertSrv
2008-04-01 04:40:51 0 d-------- C:\WINNT\ServicePackFiles
2008-04-01 04:19:29 0 d-------- C:\WINNT\system32\BITS
2008-04-01 04:17:31 0 d-------- C:\WINNT\SoftwareDistribution
2008-04-01 04:04:55 0 d-------- C:\WINNT\system32\NtmsData
2008-04-01 04:04:39 0 d--hs---- C:\WINNT\Installer
2008-04-01 04:04:39 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Identities
2008-04-01 04:04:34 0 d--h----- C:\WINNT\system32\GroupPolicy
2008-04-01 04:04:33 0 d--hs---- C:\WINNT\CSC
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\Templates
2008-04-01 04:04:33 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Start Menu
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\SendTo
2008-04-01 04:04:33 0 dr-h----- C:\Documents and Settings\Jo Ann Christinese\Recent
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\PrintHood
2008-04-01 04:04:33 536576 --ah----- C:\Documents and Settings\Jo Ann Christinese\NTUSER.DAT
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\NetHood
2008-04-01 04:04:33 0 d-------- C:\Documents and Settings\Jo Ann Christinese\My Documents
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\Local Settings
2008-04-01 04:04:33 0 dr------- C:\Documents and Settings\Jo Ann Christinese\Favorites
2008-04-01 04:04:33 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Desktop
2008-04-01 04:04:33 0 d---s---- C:\Documents and Settings\Jo Ann Christinese\Cookies
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\Application Data
2008-04-01 04:04:14 0 d--hs---- C:\System Volume Information
2008-04-01 03:48:47 0 d-------- C:\WINNT\system32\rpcproxy
2008-04-01 03:48:47 0 d-------- C:\WINNT\system32\rocket
2008-04-01 03:48:47 0 d-------- C:\WINNT\system32\inetsrv
2008-04-01 03:48:47 0 d-------- C:\WINNT\mww32
2008-04-01 03:48:47 0 d-------- C:\WINNT\ime
2008-04-01 03:48:47 0 d-------- C:\Program Files\microsoft frontpage
2008-04-01 03:48:17 122880 ---h----- C:\Documents and Settings\Default User\NTUSER.DAT
2008-04-01 03:47:51 0 -rahs---- C:\MSDOS.SYS
2008-04-01 03:47:51 0 -rahs---- C:\IO.SYS
2008-04-01 03:47:51 0 ---h----- C:\CONFIG.SYS
2008-04-01 03:47:51 0 ---h----- C:\AUTOEXEC.BAT
2008-04-01 03:47:06 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft
2008-04-01 03:46:53 0 d--hs---- C:\Documents and Settings\All Users\DRM
2008-04-01 03:46:49 0 dr------- C:\WINNT\Offline Web Pages
2008-04-01 03:46:49 0 d---s---- C:\WINNT\Downloaded Program Files
2008-04-01 03:46:29 0 d-a-s---- C:\WINNT\Tasks
2008-04-01 03:45:55 15012 --a------ C:\WINNT\system32\emptyregdb.dat
2008-04-01 03:45:25 0 d-------- C:\WINNT\Registration
2008-04-01 03:45:10 0 d-------- C:\WINNT\system32\DTCLog
2008-04-01 03:45:05 0 d-ah----- C:\Program Files\WindowsUpdate
2008-04-01 03:44:36 0 d-------- C:\Program Files\Accessories
2008-04-01 03:44:27 0 d-------- C:\Program Files\Windows NT
2008-04-01 03:44:23 0 d-------- C:\WINNT\system32\Com
2008-04-01 03:36:14 0 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-03-31 20:04:29 0 d-a------ C:\Program Files\Common Files\ODBC
2008-03-31 20:04:26 0 d-a------ C:\WINNT\Speech
2008-03-31 20:04:24 0 dra------ C:\Program Files
2008-03-31 20:04:24 0 d-a------ C:\Program Files\Common Files
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Templates
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\Start Menu
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\SendTo
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Recent
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\PrintHood
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\NetHood
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\My Documents
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Local Settings
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\Favorites
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\Desktop
2008-03-31 20:04:11 0 d---s---- C:\Documents and Settings\Default User\Cookies
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Application Data
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\All Users\Templates
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\All Users\Start Menu
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\All Users\Favorites
2008-03-31 20:04:11 0 d-a------ C:\Documents and Settings\All Users\Documents
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\All Users\Desktop
2008-03-31 20:04:11 0 d-ah----- C:\Documents and Settings\All Users\Application Data
2008-03-31 20:03:56 0 d-a------ C:\WINNT\system32\CatRoot
2008-03-31 20:03:43 0 d-a------ C:\Documents and Settings
2008-03-31 20:00:18 0 d-a------ C:\WINNT
2008-03-31 20:00:18 0 d---s---- C:\WINNT\Web
2008-03-31 20:00:18 0 d-a------ C:\WINNT\twain_32
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\wins
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\wbem
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\spool
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\ShellExt
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\Setup
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\ras
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\os2
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\npp
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\mui
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\ias
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\export
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\drivers
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\drivers\etc
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\drivers\disdn
2008-03-31 20:00:18 0 drahs--c- C:\WINNT\system32\dllcache
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\dhcp
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\config
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system
2008-03-31 20:00:18 0 d-a------ C:\WINNT\security
2008-03-31 20:00:18 0 d-a------ C:\WINNT\repair
2008-03-31 20:00:18 0 d-a------ C:\WINNT\msapps
2008-03-31 20:00:18 0 d-a------ C:\WINNT\msagent
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Media
2008-03-31 20:00:18 0 d-a------ C:\WINNT\java
2008-03-31 20:00:18 0 d--h----- C:\WINNT\inf
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Help
2008-03-31 20:00:18 0 dra-s---- C:\WINNT\Fonts
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Driver Cache
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Debug
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Cursors
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Connection Wizard
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Config
2008-03-31 20:00:18 0 d-a------ C:\WINNT\AppPatch
2008-03-31 20:00:18 0 d-a------ C:\WINNT\addins
-- Find3M Report ---------------------------------------------------------------
Nothing modified in this timespan.
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A8FB8EB3-183B-4598-924D-86F0E5E37085}]
08-04-02 08:39 237056 --a------ c:\program files\peoplepc\toolbar\ppctoolbar.dll
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{A8FB8EB3-183B-4598-924D-86F0E5E37085}"= c:\program files\peoplepc\toolbar\ppctoolbar.dll [08-04-02 08:39 237056]
[-HKEY_CLASSES_ROOT\CLSID\{A8FB8EB3-183B-4598-924D-86F0E5E37085}]
[HKEY_CLASSES_ROOT\PeoplePC.Toolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{994D628D-4D22-4DB9-B6DB-F7D9F1635817}]
[HKEY_CLASSES_ROOT\PeoplePC.Toolbar]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [03-06-19 12:05 C:\WINNT\system32\mobsync.exe]
"SMSERIAL"="sm56hlpr.exe" [03-10-07 19:15 C:\WINNT\sm56hlpr.exe]
"Bart Station"="C:\Program Files\PeoplePC\ISP6500\BIN\PPCOLink.exe" [07-03-12 15:11 ]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [08-03-29 11:37 ]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"disableregistrytools"=0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"
-- End of Deckard's System Scanner: finished at 2008-04-03 15:07:51 ------------
here's the extra.txt file:
Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------
-- System Information ----------------------------------------------------------
Microsoft Windows 2000 Professional (build 2195) SP 4.0
Architecture: X86; Language: English
CPU 0: Intel Pentium III processor
Percentage of Memory in Use: 62%
Physical Memory (total/avail): 254.23 MiB / 95.28 MiB
Pagefile Memory (total/avail): 617.03 MiB / 427.06 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1944.39 MiB
A: is Removable (No Media)
C: is Fixed (NTFS) - 37.27 GiB total, 34.68 GiB free.
D: is CDROM (CDFS)
\\.\PHYSICALDRIVE0 - QUANTUM FIREBALLP AS40.0 - 37.28 GiB - 1 partition
\PARTITION0 (bootable) - Installable File System - 37.27 GiB - C:
-- Security Center -------------------------------------------------------------
Thanks!
#10
Posted 03 April 2008 - 03:24 PM
Hello
1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINNT\system32\perfs.exe
O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINNT\system32\routing.exe (file missing)
2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.
Open Notepad and Copy (Control+C) and Paste (Control+V) the following code into the Notepad window.
Click on 'File' then 'Save As'
In the Save in drop down box select Desktop
In the File name box type in FixService.bat
In the Save as type drop down box select All Files
Close Notepad.
Now, find FixService.bat on your Desktop and Double click it
A window will open and close, do not be concerned this is normal.
Reboot and post a new DSS log
1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINNT\system32\perfs.exe
O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINNT\system32\routing.exe (file missing)
2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.
Open Notepad and Copy (Control+C) and Paste (Control+V) the following code into the Notepad window.
@echo off sc stop perfmons sc delete perfmons sc stop Routing sc delete Routing del C:\yoyo1043_ajdfnukh.exe del C:\1.vbs del C:\1.bat del C:\WINNT\IireFoxUpdater.exe del C:\WINNT\system32\perfs.exe del C:\WINNT\web\related.htm del FixService.bat
Click on 'File' then 'Save As'
In the Save in drop down box select Desktop
In the File name box type in FixService.bat
In the Save as type drop down box select All Files
Close Notepad.
Now, find FixService.bat on your Desktop and Double click it
A window will open and close, do not be concerned this is normal.
Reboot and post a new DSS log
#11
Posted 03 April 2008 - 04:11 PM
Is this the dss log you're looking for?
main.txt:
Deckard's System Scanner v20071014.68
Run by Jo Ann Christinese on 2008-04-03 16:00:37
Computer is in Normal Mode.
--------------------------------------------------------------------------------
Total Physical Memory: 255 MiB (256 MiB recommended).
-- HijackThis (run as Jo Ann Christinese.exe) ----------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:00, on 2008-04-03
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\perfs.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINNT\sm56hlpr.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\PeoplePC\ISP6500\Browser\Bartshel.exe
C:\PROGRA~1\PeoplePC\ISP6500\Browser\PPShared.exe
C:\Documents and Settings\Jo Ann Christinese\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\JOANNC~1.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.peoplepc.com/search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.peoplepc.com/websearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://home.peoplepc.com/search
O2 - BHO: EarthLink BHO Guard - {00000000-0000-0000-0000-000000000002} - C:\Program Files\PeoplePC\Toolbar\ScamGrd.dll
O2 - BHO: EarthLink ScamBlocker V3 - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\PeoplePC\Toolbar\ScamGrd.dll
O2 - BHO: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - c:\program files\peoplepc\toolbar\ppctoolbar.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - c:\program files\peoplepc\toolbar\ppctoolbar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [Bart Station] C:\Program Files\PeoplePC\ISP6500\BIN\PPCOLink.exe -STATION
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1207048643546
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINNT\system32\perfs.exe
O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINNT\system32\routing.exe (file missing)
--
End of file - 3399 bytes
-- Files created between 2008-03-03 and 2008-04-03 -----------------------------
2008-04-03 15:59:42 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_1f0.dat
2008-04-03 15:05:06 0 d-------- C:\Program Files\Trend Micro
2008-04-03 11:53:12 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_30c.dat
2008-04-03 11:48:56 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_1f8.dat
2008-04-03 11:47:08 68096 --a------ C:\WINNT\system32\zip.exe
2008-04-03 11:47:08 98816 --a------ C:\WINNT\system32\sed.exe
2008-04-03 11:47:08 80412 --a------ C:\WINNT\system32\grep.exe
2008-04-03 11:47:08 73728 --a------ C:\WINNT\system32\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-04-03 08:36:47 0 d-------- C:\Program Files\Common Files\InstallShield
2008-04-02 14:28:38 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_1ec.dat
2008-04-02 11:13:13 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Adobe
2008-04-01 20:53:14 0 d-------- C:\WINNT\PreInstall
2008-04-01 20:17:01 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Help
2008-04-01 19:20:39 0 d-------- C:\Program Files\Alwil Software
2008-04-01 16:33:21 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Macromedia
2008-04-01 16:09:02 0 d-------- C:\Program Files\PeoplePC Accelerated
2008-04-01 16:04:01 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\ScamBlocker
2008-04-01 15:59:52 0 d-------- C:\Program Files\Common Files\PeoplePC
2008-04-01 15:59:51 67584 -----n--- C:\WINNT\system32\unPPC.exe <Not Verified; PeoplePC; PeoplePC unPPC>
2008-04-01 15:59:51 28672 -----n--- C:\WINNT\system32\RegHero.exe <Not Verified; ; RegHero Module>
2008-04-01 15:59:51 18432 -----n--- C:\WINNT\system32\PPCInfo.exe <Not Verified; PeoplePC, Inc.; PPCInfo Module>
2008-04-01 15:59:51 0 d-------- C:\Program Files\PeoplePC
2008-04-01 15:59:47 0 d-------- C:\WINNT\system32\Macromed
2008-04-01 07:48:02 306688 --a------ C:\WINNT\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller>
2008-04-01 07:47:47 0 d-------- C:\Dell
2008-04-01 06:52:52 0 d-------- C:\WINNT\winsxs
2008-04-01 06:52:51 0 d-------- C:\WINNT\PCHEALTH
2008-04-01 06:50:12 0 d-------- C:\WINNT\system32\URTTemp
2008-04-01 06:07:18 57344 --a------ C:\WINNT\uneng.exe <Not Verified; Roxio; Roxio Update Wizard>
2008-04-01 06:07:18 0 d-------- C:\Program Files\Common Files\Adaptec Shared
2008-04-01 06:07:10 225280 --a------ C:\WINNT\system32\wmpdxm.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Player>
2008-04-01 06:07:10 106496 --a------ C:\WINNT\system32\wmpasf.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Player>
2008-04-01 06:07:01 52224 --a------ C:\WINNT\system32\mspmsnsv.dll <Not Verified; Microsoft Corporation; Windows Media Device Manager>
2008-04-01 06:06:57 997888 --a------ C:\WINNT\system32\wmvdmoe2.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2008-04-01 06:06:57 892416 --a------ C:\WINNT\system32\wmspdmoe.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2008-04-01 06:06:57 1111040 --a------ C:\WINNT\system32\wmsdmoe2.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2008-04-01 06:01:20 0 d-------- C:\WINNT\Motorola
2008-04-01 05:52:34 1222656 --a------ C:\WINNT\system32\quartz.dll
2008-04-01 05:52:33 524800 --a------ C:\WINNT\system32\qedit.dll
2008-04-01 05:52:33 194560 --a------ C:\WINNT\system32\mswebdvd.dll <Not Verified; Microsoft Corporation; DirectShow>
2008-04-01 05:52:33 1769472 --a------ C:\WINNT\system32\dxdiagn.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:33 1689600 --a------ C:\WINNT\system32\d3d9.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:33 1179648 --a------ C:\WINNT\system32\d3d8.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 68096 --a------ C:\WINNT\system32\dsdmoprp.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 203264 --a------ C:\WINNT\system32\dpvoice.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 16896 --a------ C:\WINNT\system32\dpnsvr.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 377856 --a------ C:\WINNT\system32\dpnet.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 166400 --a------ C:\WINNT\system32\dinput8.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 386048 --a------ C:\WINNT\system32\diactfrm.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 733184 --a------ C:\WINNT\system32\qedwipes.dll
2008-04-01 05:52:30 13312 --a------ C:\WINNT\system32\msdmo.dll
2008-04-01 05:52:30 18944 --a------ C:\WINNT\system32\encapi.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 1189888 --a------ C:\WINNT\system32\dx8vb.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 18432 --a------ C:\WINNT\system32\dswave.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 186880 --a------ C:\WINNT\system32\dsdmo.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 112128 --a------ C:\WINNT\system32\dpvvox.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 80896 --a------ C:\WINNT\system32\dpvsetup.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 19968 --a------ C:\WINNT\system32\dpvacm.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 3072 --a------ C:\WINNT\system32\dpnlobby.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 68096 --a------ C:\WINNT\system32\dpnhupnp.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 32768 --a------ C:\WINNT\system32\dpnhpast.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 3072 --a------ C:\WINNT\system32\dpnaddr.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 76800 --a------ C:\WINNT\system32\dmscript.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 44032 --a------ C:\WINNT\system32\dimap.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 7168 --a------ C:\WINNT\system32\d3d8thk.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:50:03 0 d-------- C:\WINNT\system32\directx
2008-04-01 05:23:05 641594 ---h----- C:\WINNT\ShellIconCache
2008-04-01 05:15:48 0 d-------- C:\WINNT\system32\Windows Media
2008-04-01 05:15:14 0 d--h---c- C:\WINNT\$NtUpdateRollupPackUninstall$
2008-04-01 05:15:11 0 d-------- C:\WINNT\msiinst.tmp
2008-04-01 05:13:44 0 d--h---c- C:\WINNT\$SQLUninstallMDAC25SP3-KB927779-x86-ENU$
2008-04-01 05:11:56 0 d-------- C:\WINNT\mui
2008-04-01 05:09:36 171280 --a------ C:\WINNT\system32\jit.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:36 139536 --a------ C:\WINNT\system32\javaee.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:36 313856 --a------ C:\WINNT\system32\dx3j.dll <Not Verified; Microsoft Corporation; Microsoft® DirectX for Java>
2008-04-01 05:09:36 46352 --a------ C:\WINNT\setdebug.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:36 6550 --a------ C:\WINNT\jautoexp.dat
2008-04-01 05:09:31 113 --a------ C:\WINNT\system32\zonedon.reg
2008-04-01 05:09:31 113 --a------ C:\WINNT\system32\zonedoff.reg
2008-04-01 05:09:31 171792 --a------ C:\WINNT\system32\wjview.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:31 286992 --a------ C:\WINNT\system32\vmhelper.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:30 21264 --a------ C:\WINNT\system32\msjdbc10.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:30 947472 --a------ C:\WINNT\system32\msjava.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 154384 --a------ C:\WINNT\system32\msawt.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 172304 --a------ C:\WINNT\system32\jview.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 15120 --a------ C:\WINNT\system32\jdbgmgr.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 404752 --a------ C:\WINNT\system32\javart.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 63248 --a------ C:\WINNT\system32\javaprxy.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 187152 --a------ C:\WINNT\system32\javacypt.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:27 49424 --a------ C:\WINNT\system32\clspack.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 04:49:32 0 d-------- C:\WINNT\RegisteredPackages
2008-04-01 04:47:46 0 d--h----- C:\WINNT\msdownld.tmp
2008-04-01 04:47:42 0 d-------- C:\WINNT\Windows Update Setup Files
2008-04-01 04:44:00 0 d-------- C:\WINNT\system32\Microsoft
2008-04-01 04:40:51 0 d-------- C:\WINNT\system32\ie_de
2008-04-01 04:40:51 0 d-------- C:\WINNT\system32\CertSrv
2008-04-01 04:40:51 0 d-------- C:\WINNT\ServicePackFiles
2008-04-01 04:19:29 0 d-------- C:\WINNT\system32\BITS
2008-04-01 04:17:31 0 d-------- C:\WINNT\SoftwareDistribution
2008-04-01 04:04:55 0 d-------- C:\WINNT\system32\NtmsData
2008-04-01 04:04:39 0 d--hs---- C:\WINNT\Installer
2008-04-01 04:04:39 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Identities
2008-04-01 04:04:34 0 d--h----- C:\WINNT\system32\GroupPolicy
2008-04-01 04:04:33 0 d--hs---- C:\WINNT\CSC
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\Templates
2008-04-01 04:04:33 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Start Menu
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\SendTo
2008-04-01 04:04:33 0 dr-h----- C:\Documents and Settings\Jo Ann Christinese\Recent
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\PrintHood
2008-04-01 04:04:33 536576 --ah----- C:\Documents and Settings\Jo Ann Christinese\NTUSER.DAT
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\NetHood
2008-04-01 04:04:33 0 d-------- C:\Documents and Settings\Jo Ann Christinese\My Documents
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\Local Settings
2008-04-01 04:04:33 0 dr------- C:\Documents and Settings\Jo Ann Christinese\Favorites
2008-04-01 04:04:33 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Desktop
2008-04-01 04:04:33 0 d---s---- C:\Documents and Settings\Jo Ann Christinese\Cookies
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\Application Data
2008-04-01 04:04:14 0 d--hs---- C:\System Volume Information
2008-04-01 03:48:47 0 d-------- C:\WINNT\system32\rpcproxy
2008-04-01 03:48:47 0 d-------- C:\WINNT\system32\rocket
2008-04-01 03:48:47 0 d-------- C:\WINNT\system32\inetsrv
2008-04-01 03:48:47 0 d-------- C:\WINNT\mww32
2008-04-01 03:48:47 0 d-------- C:\WINNT\ime
2008-04-01 03:48:47 0 d-------- C:\Program Files\microsoft frontpage
2008-04-01 03:48:17 122880 ---h----- C:\Documents and Settings\Default User\NTUSER.DAT
2008-04-01 03:47:51 0 -rahs---- C:\MSDOS.SYS
2008-04-01 03:47:51 0 -rahs---- C:\IO.SYS
2008-04-01 03:47:51 0 ---h----- C:\CONFIG.SYS
2008-04-01 03:47:51 0 ---h----- C:\AUTOEXEC.BAT
2008-04-01 03:47:06 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft
2008-04-01 03:46:53 0 d--hs---- C:\Documents and Settings\All Users\DRM
2008-04-01 03:46:49 0 dr------- C:\WINNT\Offline Web Pages
2008-04-01 03:46:49 0 d---s---- C:\WINNT\Downloaded Program Files
2008-04-01 03:46:29 0 d-a-s---- C:\WINNT\Tasks
2008-04-01 03:45:55 15012 --a------ C:\WINNT\system32\emptyregdb.dat
2008-04-01 03:45:25 0 d-------- C:\WINNT\Registration
2008-04-01 03:45:10 0 d-------- C:\WINNT\system32\DTCLog
2008-04-01 03:45:05 0 d-ah----- C:\Program Files\WindowsUpdate
2008-04-01 03:44:36 0 d-------- C:\Program Files\Accessories
2008-04-01 03:44:27 0 d-------- C:\Program Files\Windows NT
2008-04-01 03:44:23 0 d-------- C:\WINNT\system32\Com
2008-04-01 03:36:14 0 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-03-31 20:04:29 0 d-a------ C:\Program Files\Common Files\ODBC
2008-03-31 20:04:26 0 d-a------ C:\WINNT\Speech
2008-03-31 20:04:24 0 dra------ C:\Program Files
2008-03-31 20:04:24 0 d-a------ C:\Program Files\Common Files
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Templates
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\Start Menu
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\SendTo
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Recent
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\PrintHood
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\NetHood
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\My Documents
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Local Settings
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\Favorites
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\Desktop
2008-03-31 20:04:11 0 d---s---- C:\Documents and Settings\Default User\Cookies
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Application Data
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\All Users\Templates
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\All Users\Start Menu
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\All Users\Favorites
2008-03-31 20:04:11 0 d-a------ C:\Documents and Settings\All Users\Documents
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\All Users\Desktop
2008-03-31 20:04:11 0 d-ah----- C:\Documents and Settings\All Users\Application Data
2008-03-31 20:03:56 0 d-a------ C:\WINNT\system32\CatRoot
2008-03-31 20:03:43 0 d-a------ C:\Documents and Settings
2008-03-31 20:00:18 0 d-a------ C:\WINNT
2008-03-31 20:00:18 0 d---s---- C:\WINNT\Web
2008-03-31 20:00:18 0 d-a------ C:\WINNT\twain_32
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\wins
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\wbem
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\spool
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\ShellExt
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\Setup
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\ras
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\os2
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\npp
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\mui
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\ias
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\export
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\drivers
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\drivers\etc
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\drivers\disdn
2008-03-31 20:00:18 0 drahs--c- C:\WINNT\system32\dllcache
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\dhcp
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\config
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system
2008-03-31 20:00:18 0 d-a------ C:\WINNT\security
2008-03-31 20:00:18 0 d-a------ C:\WINNT\repair
2008-03-31 20:00:18 0 d-a------ C:\WINNT\msapps
2008-03-31 20:00:18 0 d-a------ C:\WINNT\msagent
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Media
2008-03-31 20:00:18 0 d-a------ C:\WINNT\java
2008-03-31 20:00:18 0 d--h----- C:\WINNT\inf
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Help
2008-03-31 20:00:18 0 dra-s---- C:\WINNT\Fonts
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Driver Cache
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Debug
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Cursors
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Connection Wizard
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Config
2008-03-31 20:00:18 0 d-a------ C:\WINNT\AppPatch
2008-03-31 20:00:18 0 d-a------ C:\WINNT\addins
-- Find3M Report ---------------------------------------------------------------
Nothing modified in this timespan.
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A8FB8EB3-183B-4598-924D-86F0E5E37085}]
08-04-02 08:39 237056 --a------ c:\program files\peoplepc\toolbar\ppctoolbar.dll
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{A8FB8EB3-183B-4598-924D-86F0E5E37085}"= c:\program files\peoplepc\toolbar\ppctoolbar.dll [08-04-02 08:39 237056]
[-HKEY_CLASSES_ROOT\CLSID\{A8FB8EB3-183B-4598-924D-86F0E5E37085}]
[HKEY_CLASSES_ROOT\PeoplePC.Toolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{994D628D-4D22-4DB9-B6DB-F7D9F1635817}]
[HKEY_CLASSES_ROOT\PeoplePC.Toolbar]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [03-06-19 12:05 C:\WINNT\system32\mobsync.exe]
"SMSERIAL"="sm56hlpr.exe" [03-10-07 19:15 C:\WINNT\sm56hlpr.exe]
"Bart Station"="C:\Program Files\PeoplePC\ISP6500\BIN\PPCOLink.exe" [07-03-12 15:11 ]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [08-03-29 11:37 ]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"disableregistrytools"=0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"
-- End of Deckard's System Scanner: finished at 2008-04-03 16:03:10 ------------
main.txt:
Deckard's System Scanner v20071014.68
Run by Jo Ann Christinese on 2008-04-03 16:00:37
Computer is in Normal Mode.
--------------------------------------------------------------------------------
Total Physical Memory: 255 MiB (256 MiB recommended).
-- HijackThis (run as Jo Ann Christinese.exe) ----------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:00, on 2008-04-03
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\perfs.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINNT\sm56hlpr.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\PeoplePC\ISP6500\Browser\Bartshel.exe
C:\PROGRA~1\PeoplePC\ISP6500\Browser\PPShared.exe
C:\Documents and Settings\Jo Ann Christinese\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\JOANNC~1.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.peoplepc.com/search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.peoplepc.com/websearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://home.peoplepc.com/search
O2 - BHO: EarthLink BHO Guard - {00000000-0000-0000-0000-000000000002} - C:\Program Files\PeoplePC\Toolbar\ScamGrd.dll
O2 - BHO: EarthLink ScamBlocker V3 - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\PeoplePC\Toolbar\ScamGrd.dll
O2 - BHO: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - c:\program files\peoplepc\toolbar\ppctoolbar.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - c:\program files\peoplepc\toolbar\ppctoolbar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [Bart Station] C:\Program Files\PeoplePC\ISP6500\BIN\PPCOLink.exe -STATION
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1207048643546
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINNT\system32\perfs.exe
O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINNT\system32\routing.exe (file missing)
--
End of file - 3399 bytes
-- Files created between 2008-03-03 and 2008-04-03 -----------------------------
2008-04-03 15:59:42 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_1f0.dat
2008-04-03 15:05:06 0 d-------- C:\Program Files\Trend Micro
2008-04-03 11:53:12 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_30c.dat
2008-04-03 11:48:56 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_1f8.dat
2008-04-03 11:47:08 68096 --a------ C:\WINNT\system32\zip.exe
2008-04-03 11:47:08 98816 --a------ C:\WINNT\system32\sed.exe
2008-04-03 11:47:08 80412 --a------ C:\WINNT\system32\grep.exe
2008-04-03 11:47:08 73728 --a------ C:\WINNT\system32\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-04-03 08:36:47 0 d-------- C:\Program Files\Common Files\InstallShield
2008-04-02 14:28:38 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_1ec.dat
2008-04-02 11:13:13 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Adobe
2008-04-01 20:53:14 0 d-------- C:\WINNT\PreInstall
2008-04-01 20:17:01 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Help
2008-04-01 19:20:39 0 d-------- C:\Program Files\Alwil Software
2008-04-01 16:33:21 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Macromedia
2008-04-01 16:09:02 0 d-------- C:\Program Files\PeoplePC Accelerated
2008-04-01 16:04:01 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\ScamBlocker
2008-04-01 15:59:52 0 d-------- C:\Program Files\Common Files\PeoplePC
2008-04-01 15:59:51 67584 -----n--- C:\WINNT\system32\unPPC.exe <Not Verified; PeoplePC; PeoplePC unPPC>
2008-04-01 15:59:51 28672 -----n--- C:\WINNT\system32\RegHero.exe <Not Verified; ; RegHero Module>
2008-04-01 15:59:51 18432 -----n--- C:\WINNT\system32\PPCInfo.exe <Not Verified; PeoplePC, Inc.; PPCInfo Module>
2008-04-01 15:59:51 0 d-------- C:\Program Files\PeoplePC
2008-04-01 15:59:47 0 d-------- C:\WINNT\system32\Macromed
2008-04-01 07:48:02 306688 --a------ C:\WINNT\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller>
2008-04-01 07:47:47 0 d-------- C:\Dell
2008-04-01 06:52:52 0 d-------- C:\WINNT\winsxs
2008-04-01 06:52:51 0 d-------- C:\WINNT\PCHEALTH
2008-04-01 06:50:12 0 d-------- C:\WINNT\system32\URTTemp
2008-04-01 06:07:18 57344 --a------ C:\WINNT\uneng.exe <Not Verified; Roxio; Roxio Update Wizard>
2008-04-01 06:07:18 0 d-------- C:\Program Files\Common Files\Adaptec Shared
2008-04-01 06:07:10 225280 --a------ C:\WINNT\system32\wmpdxm.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Player>
2008-04-01 06:07:10 106496 --a------ C:\WINNT\system32\wmpasf.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Player>
2008-04-01 06:07:01 52224 --a------ C:\WINNT\system32\mspmsnsv.dll <Not Verified; Microsoft Corporation; Windows Media Device Manager>
2008-04-01 06:06:57 997888 --a------ C:\WINNT\system32\wmvdmoe2.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2008-04-01 06:06:57 892416 --a------ C:\WINNT\system32\wmspdmoe.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2008-04-01 06:06:57 1111040 --a------ C:\WINNT\system32\wmsdmoe2.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2008-04-01 06:01:20 0 d-------- C:\WINNT\Motorola
2008-04-01 05:52:34 1222656 --a------ C:\WINNT\system32\quartz.dll
2008-04-01 05:52:33 524800 --a------ C:\WINNT\system32\qedit.dll
2008-04-01 05:52:33 194560 --a------ C:\WINNT\system32\mswebdvd.dll <Not Verified; Microsoft Corporation; DirectShow>
2008-04-01 05:52:33 1769472 --a------ C:\WINNT\system32\dxdiagn.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:33 1689600 --a------ C:\WINNT\system32\d3d9.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:33 1179648 --a------ C:\WINNT\system32\d3d8.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 68096 --a------ C:\WINNT\system32\dsdmoprp.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 203264 --a------ C:\WINNT\system32\dpvoice.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 16896 --a------ C:\WINNT\system32\dpnsvr.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 377856 --a------ C:\WINNT\system32\dpnet.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 166400 --a------ C:\WINNT\system32\dinput8.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 386048 --a------ C:\WINNT\system32\diactfrm.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 733184 --a------ C:\WINNT\system32\qedwipes.dll
2008-04-01 05:52:30 13312 --a------ C:\WINNT\system32\msdmo.dll
2008-04-01 05:52:30 18944 --a------ C:\WINNT\system32\encapi.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 1189888 --a------ C:\WINNT\system32\dx8vb.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 18432 --a------ C:\WINNT\system32\dswave.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 186880 --a------ C:\WINNT\system32\dsdmo.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 112128 --a------ C:\WINNT\system32\dpvvox.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 80896 --a------ C:\WINNT\system32\dpvsetup.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 19968 --a------ C:\WINNT\system32\dpvacm.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 3072 --a------ C:\WINNT\system32\dpnlobby.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 68096 --a------ C:\WINNT\system32\dpnhupnp.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 32768 --a------ C:\WINNT\system32\dpnhpast.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 3072 --a------ C:\WINNT\system32\dpnaddr.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 76800 --a------ C:\WINNT\system32\dmscript.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 44032 --a------ C:\WINNT\system32\dimap.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 7168 --a------ C:\WINNT\system32\d3d8thk.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:50:03 0 d-------- C:\WINNT\system32\directx
2008-04-01 05:23:05 641594 ---h----- C:\WINNT\ShellIconCache
2008-04-01 05:15:48 0 d-------- C:\WINNT\system32\Windows Media
2008-04-01 05:15:14 0 d--h---c- C:\WINNT\$NtUpdateRollupPackUninstall$
2008-04-01 05:15:11 0 d-------- C:\WINNT\msiinst.tmp
2008-04-01 05:13:44 0 d--h---c- C:\WINNT\$SQLUninstallMDAC25SP3-KB927779-x86-ENU$
2008-04-01 05:11:56 0 d-------- C:\WINNT\mui
2008-04-01 05:09:36 171280 --a------ C:\WINNT\system32\jit.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:36 139536 --a------ C:\WINNT\system32\javaee.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:36 313856 --a------ C:\WINNT\system32\dx3j.dll <Not Verified; Microsoft Corporation; Microsoft® DirectX for Java>
2008-04-01 05:09:36 46352 --a------ C:\WINNT\setdebug.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:36 6550 --a------ C:\WINNT\jautoexp.dat
2008-04-01 05:09:31 113 --a------ C:\WINNT\system32\zonedon.reg
2008-04-01 05:09:31 113 --a------ C:\WINNT\system32\zonedoff.reg
2008-04-01 05:09:31 171792 --a------ C:\WINNT\system32\wjview.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:31 286992 --a------ C:\WINNT\system32\vmhelper.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:30 21264 --a------ C:\WINNT\system32\msjdbc10.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:30 947472 --a------ C:\WINNT\system32\msjava.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 154384 --a------ C:\WINNT\system32\msawt.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 172304 --a------ C:\WINNT\system32\jview.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 15120 --a------ C:\WINNT\system32\jdbgmgr.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 404752 --a------ C:\WINNT\system32\javart.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 63248 --a------ C:\WINNT\system32\javaprxy.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 187152 --a------ C:\WINNT\system32\javacypt.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:27 49424 --a------ C:\WINNT\system32\clspack.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 04:49:32 0 d-------- C:\WINNT\RegisteredPackages
2008-04-01 04:47:46 0 d--h----- C:\WINNT\msdownld.tmp
2008-04-01 04:47:42 0 d-------- C:\WINNT\Windows Update Setup Files
2008-04-01 04:44:00 0 d-------- C:\WINNT\system32\Microsoft
2008-04-01 04:40:51 0 d-------- C:\WINNT\system32\ie_de
2008-04-01 04:40:51 0 d-------- C:\WINNT\system32\CertSrv
2008-04-01 04:40:51 0 d-------- C:\WINNT\ServicePackFiles
2008-04-01 04:19:29 0 d-------- C:\WINNT\system32\BITS
2008-04-01 04:17:31 0 d-------- C:\WINNT\SoftwareDistribution
2008-04-01 04:04:55 0 d-------- C:\WINNT\system32\NtmsData
2008-04-01 04:04:39 0 d--hs---- C:\WINNT\Installer
2008-04-01 04:04:39 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Identities
2008-04-01 04:04:34 0 d--h----- C:\WINNT\system32\GroupPolicy
2008-04-01 04:04:33 0 d--hs---- C:\WINNT\CSC
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\Templates
2008-04-01 04:04:33 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Start Menu
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\SendTo
2008-04-01 04:04:33 0 dr-h----- C:\Documents and Settings\Jo Ann Christinese\Recent
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\PrintHood
2008-04-01 04:04:33 536576 --ah----- C:\Documents and Settings\Jo Ann Christinese\NTUSER.DAT
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\NetHood
2008-04-01 04:04:33 0 d-------- C:\Documents and Settings\Jo Ann Christinese\My Documents
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\Local Settings
2008-04-01 04:04:33 0 dr------- C:\Documents and Settings\Jo Ann Christinese\Favorites
2008-04-01 04:04:33 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Desktop
2008-04-01 04:04:33 0 d---s---- C:\Documents and Settings\Jo Ann Christinese\Cookies
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\Application Data
2008-04-01 04:04:14 0 d--hs---- C:\System Volume Information
2008-04-01 03:48:47 0 d-------- C:\WINNT\system32\rpcproxy
2008-04-01 03:48:47 0 d-------- C:\WINNT\system32\rocket
2008-04-01 03:48:47 0 d-------- C:\WINNT\system32\inetsrv
2008-04-01 03:48:47 0 d-------- C:\WINNT\mww32
2008-04-01 03:48:47 0 d-------- C:\WINNT\ime
2008-04-01 03:48:47 0 d-------- C:\Program Files\microsoft frontpage
2008-04-01 03:48:17 122880 ---h----- C:\Documents and Settings\Default User\NTUSER.DAT
2008-04-01 03:47:51 0 -rahs---- C:\MSDOS.SYS
2008-04-01 03:47:51 0 -rahs---- C:\IO.SYS
2008-04-01 03:47:51 0 ---h----- C:\CONFIG.SYS
2008-04-01 03:47:51 0 ---h----- C:\AUTOEXEC.BAT
2008-04-01 03:47:06 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft
2008-04-01 03:46:53 0 d--hs---- C:\Documents and Settings\All Users\DRM
2008-04-01 03:46:49 0 dr------- C:\WINNT\Offline Web Pages
2008-04-01 03:46:49 0 d---s---- C:\WINNT\Downloaded Program Files
2008-04-01 03:46:29 0 d-a-s---- C:\WINNT\Tasks
2008-04-01 03:45:55 15012 --a------ C:\WINNT\system32\emptyregdb.dat
2008-04-01 03:45:25 0 d-------- C:\WINNT\Registration
2008-04-01 03:45:10 0 d-------- C:\WINNT\system32\DTCLog
2008-04-01 03:45:05 0 d-ah----- C:\Program Files\WindowsUpdate
2008-04-01 03:44:36 0 d-------- C:\Program Files\Accessories
2008-04-01 03:44:27 0 d-------- C:\Program Files\Windows NT
2008-04-01 03:44:23 0 d-------- C:\WINNT\system32\Com
2008-04-01 03:36:14 0 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-03-31 20:04:29 0 d-a------ C:\Program Files\Common Files\ODBC
2008-03-31 20:04:26 0 d-a------ C:\WINNT\Speech
2008-03-31 20:04:24 0 dra------ C:\Program Files
2008-03-31 20:04:24 0 d-a------ C:\Program Files\Common Files
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Templates
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\Start Menu
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\SendTo
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Recent
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\PrintHood
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\NetHood
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\My Documents
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Local Settings
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\Favorites
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\Desktop
2008-03-31 20:04:11 0 d---s---- C:\Documents and Settings\Default User\Cookies
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Application Data
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\All Users\Templates
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\All Users\Start Menu
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\All Users\Favorites
2008-03-31 20:04:11 0 d-a------ C:\Documents and Settings\All Users\Documents
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\All Users\Desktop
2008-03-31 20:04:11 0 d-ah----- C:\Documents and Settings\All Users\Application Data
2008-03-31 20:03:56 0 d-a------ C:\WINNT\system32\CatRoot
2008-03-31 20:03:43 0 d-a------ C:\Documents and Settings
2008-03-31 20:00:18 0 d-a------ C:\WINNT
2008-03-31 20:00:18 0 d---s---- C:\WINNT\Web
2008-03-31 20:00:18 0 d-a------ C:\WINNT\twain_32
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\wins
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\wbem
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\spool
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\ShellExt
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\Setup
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\ras
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\os2
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\npp
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\mui
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\ias
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\export
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\drivers
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\drivers\etc
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\drivers\disdn
2008-03-31 20:00:18 0 drahs--c- C:\WINNT\system32\dllcache
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\dhcp
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\config
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system
2008-03-31 20:00:18 0 d-a------ C:\WINNT\security
2008-03-31 20:00:18 0 d-a------ C:\WINNT\repair
2008-03-31 20:00:18 0 d-a------ C:\WINNT\msapps
2008-03-31 20:00:18 0 d-a------ C:\WINNT\msagent
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Media
2008-03-31 20:00:18 0 d-a------ C:\WINNT\java
2008-03-31 20:00:18 0 d--h----- C:\WINNT\inf
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Help
2008-03-31 20:00:18 0 dra-s---- C:\WINNT\Fonts
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Driver Cache
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Debug
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Cursors
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Connection Wizard
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Config
2008-03-31 20:00:18 0 d-a------ C:\WINNT\AppPatch
2008-03-31 20:00:18 0 d-a------ C:\WINNT\addins
-- Find3M Report ---------------------------------------------------------------
Nothing modified in this timespan.
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A8FB8EB3-183B-4598-924D-86F0E5E37085}]
08-04-02 08:39 237056 --a------ c:\program files\peoplepc\toolbar\ppctoolbar.dll
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{A8FB8EB3-183B-4598-924D-86F0E5E37085}"= c:\program files\peoplepc\toolbar\ppctoolbar.dll [08-04-02 08:39 237056]
[-HKEY_CLASSES_ROOT\CLSID\{A8FB8EB3-183B-4598-924D-86F0E5E37085}]
[HKEY_CLASSES_ROOT\PeoplePC.Toolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{994D628D-4D22-4DB9-B6DB-F7D9F1635817}]
[HKEY_CLASSES_ROOT\PeoplePC.Toolbar]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [03-06-19 12:05 C:\WINNT\system32\mobsync.exe]
"SMSERIAL"="sm56hlpr.exe" [03-10-07 19:15 C:\WINNT\sm56hlpr.exe]
"Bart Station"="C:\Program Files\PeoplePC\ISP6500\BIN\PPCOLink.exe" [07-03-12 15:11 ]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [08-03-29 11:37 ]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"disableregistrytools"=0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"
-- End of Deckard's System Scanner: finished at 2008-04-03 16:03:10 ------------
#12
Posted 03 April 2008 - 04:16 PM
Hello
1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):
O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINNT\system32\perfs.exe
O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINNT\system32\routing.exe (file missing)
2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.
Please download the OTMoveIt2 by OldTimer.
Reboot and post a new DSS log
1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):
O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINNT\system32\perfs.exe
O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINNT\system32\routing.exe (file missing)
2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.
Please download the OTMoveIt2 by OldTimer.
- Save it to your desktop.
- Please double-click OTMoveIt2.exe to run it.
- Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
[kill explorer] C:\WINNT\system32\perfs.exe HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\perfmons HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Routing purity [start explorer]
- Return to OTMoveIt2, right click in the "Paste List of Files/Folders to be Moved" window (under the light blue bar) and choose Paste.
- Click the red Moveit! button.
- Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
- Close OTMoveIt2
Reboot and post a new DSS log
#13
Posted 03 April 2008 - 05:19 PM
here's what i got in the window under the green bar:
File/Folder kill explorer] not found.
C:\WINNT\system32\perfs.exe moved successfully.
File/Folder HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\perfmons not found.
File/Folder HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Routing not found.
< purity >
Explorer started successfully
OTMoveIt2 by OldTimer - Version 1.0.4.0 log created on 04032008_170833
thanks.
File/Folder kill explorer] not found.
C:\WINNT\system32\perfs.exe moved successfully.
File/Folder HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\perfmons not found.
File/Folder HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Routing not found.
< purity >
Explorer started successfully
OTMoveIt2 by OldTimer - Version 1.0.4.0 log created on 04032008_170833
thanks.
#14
Posted 03 April 2008 - 06:31 PM
Post a new DSS log
#15
Posted 03 April 2008 - 07:13 PM
Oops! sorry 'bout that. Here's the dss dump:
Deckard's System Scanner v20071014.68
Run by Jo Ann Christinese on 2008-04-03 19:01:17
Computer is in Normal Mode.
--------------------------------------------------------------------------------
Total Physical Memory: 255 MiB (256 MiB recommended).
-- HijackThis (run as Jo Ann Christinese.exe) ----------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:01, on 2008-04-03
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINNT\sm56hlpr.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\PeoplePC\ISP6500\Browser\Bartshel.exe
C:\PROGRA~1\PeoplePC\ISP6500\Browser\PPShared.exe
C:\Program Files\PeoplePC\ISP6500\Browser\Bartshel.exe
C:\WINNT\system32\wuauclt.exe
C:\Documents and Settings\Jo Ann Christinese\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\JOANNC~1.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.peoplepc.com/search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.peoplepc.com/websearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://home.peoplepc.com/search
O2 - BHO: EarthLink BHO Guard - {00000000-0000-0000-0000-000000000002} - C:\Program Files\PeoplePC\Toolbar\ScamGrd.dll
O2 - BHO: EarthLink ScamBlocker V3 - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\PeoplePC\Toolbar\ScamGrd.dll
O2 - BHO: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - c:\program files\peoplepc\toolbar\ppctoolbar.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - c:\program files\peoplepc\toolbar\ppctoolbar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [Bart Station] C:\Program Files\PeoplePC\ISP6500\BIN\PPCOLink.exe -STATION
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1207048643546
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINNT\system32\perfs.exe (file missing)
O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINNT\system32\routing.exe (file missing)
--
End of file - 3472 bytes
-- Files created between 2008-03-03 and 2008-04-03 -----------------------------
2008-04-03 18:41:34 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_1f4.dat
2008-04-03 15:05:06 0 d-------- C:\Program Files\Trend Micro
2008-04-03 11:53:12 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_30c.dat
2008-04-03 11:48:56 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_1f8.dat
2008-04-03 11:47:08 68096 --a------ C:\WINNT\system32\zip.exe
2008-04-03 11:47:08 98816 --a------ C:\WINNT\system32\sed.exe
2008-04-03 11:47:08 80412 --a------ C:\WINNT\system32\grep.exe
2008-04-03 11:47:08 73728 --a------ C:\WINNT\system32\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-04-03 08:36:47 0 d-------- C:\Program Files\Common Files\InstallShield
2008-04-02 14:28:38 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_1ec.dat
2008-04-02 11:13:13 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Adobe
2008-04-01 20:53:14 0 d-------- C:\WINNT\PreInstall
2008-04-01 20:17:01 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Help
2008-04-01 19:20:39 0 d-------- C:\Program Files\Alwil Software
2008-04-01 16:33:21 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Macromedia
2008-04-01 16:09:02 0 d-------- C:\Program Files\PeoplePC Accelerated
2008-04-01 16:04:01 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\ScamBlocker
2008-04-01 15:59:52 0 d-------- C:\Program Files\Common Files\PeoplePC
2008-04-01 15:59:51 67584 -----n--- C:\WINNT\system32\unPPC.exe <Not Verified; PeoplePC; PeoplePC unPPC>
2008-04-01 15:59:51 28672 -----n--- C:\WINNT\system32\RegHero.exe <Not Verified; ; RegHero Module>
2008-04-01 15:59:51 18432 -----n--- C:\WINNT\system32\PPCInfo.exe <Not Verified; PeoplePC, Inc.; PPCInfo Module>
2008-04-01 15:59:51 0 d-------- C:\Program Files\PeoplePC
2008-04-01 15:59:47 0 d-------- C:\WINNT\system32\Macromed
2008-04-01 07:48:02 306688 --a------ C:\WINNT\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller>
2008-04-01 07:47:47 0 d-------- C:\Dell
2008-04-01 06:52:52 0 d-------- C:\WINNT\winsxs
2008-04-01 06:52:51 0 d-------- C:\WINNT\PCHEALTH
2008-04-01 06:50:12 0 d-------- C:\WINNT\system32\URTTemp
2008-04-01 06:07:18 57344 --a------ C:\WINNT\uneng.exe <Not Verified; Roxio; Roxio Update Wizard>
2008-04-01 06:07:18 0 d-------- C:\Program Files\Common Files\Adaptec Shared
2008-04-01 06:07:10 225280 --a------ C:\WINNT\system32\wmpdxm.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Player>
2008-04-01 06:07:10 106496 --a------ C:\WINNT\system32\wmpasf.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Player>
2008-04-01 06:07:01 52224 --a------ C:\WINNT\system32\mspmsnsv.dll <Not Verified; Microsoft Corporation; Windows Media Device Manager>
2008-04-01 06:06:57 997888 --a------ C:\WINNT\system32\wmvdmoe2.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2008-04-01 06:06:57 892416 --a------ C:\WINNT\system32\wmspdmoe.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2008-04-01 06:06:57 1111040 --a------ C:\WINNT\system32\wmsdmoe2.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2008-04-01 06:01:20 0 d-------- C:\WINNT\Motorola
2008-04-01 05:52:34 1222656 --a------ C:\WINNT\system32\quartz.dll
2008-04-01 05:52:33 524800 --a------ C:\WINNT\system32\qedit.dll
2008-04-01 05:52:33 194560 --a------ C:\WINNT\system32\mswebdvd.dll <Not Verified; Microsoft Corporation; DirectShow>
2008-04-01 05:52:33 1769472 --a------ C:\WINNT\system32\dxdiagn.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:33 1689600 --a------ C:\WINNT\system32\d3d9.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:33 1179648 --a------ C:\WINNT\system32\d3d8.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 68096 --a------ C:\WINNT\system32\dsdmoprp.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 203264 --a------ C:\WINNT\system32\dpvoice.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 16896 --a------ C:\WINNT\system32\dpnsvr.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 377856 --a------ C:\WINNT\system32\dpnet.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 166400 --a------ C:\WINNT\system32\dinput8.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 386048 --a------ C:\WINNT\system32\diactfrm.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 733184 --a------ C:\WINNT\system32\qedwipes.dll
2008-04-01 05:52:30 13312 --a------ C:\WINNT\system32\msdmo.dll
2008-04-01 05:52:30 18944 --a------ C:\WINNT\system32\encapi.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 1189888 --a------ C:\WINNT\system32\dx8vb.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 18432 --a------ C:\WINNT\system32\dswave.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 186880 --a------ C:\WINNT\system32\dsdmo.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 112128 --a------ C:\WINNT\system32\dpvvox.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 80896 --a------ C:\WINNT\system32\dpvsetup.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 19968 --a------ C:\WINNT\system32\dpvacm.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 3072 --a------ C:\WINNT\system32\dpnlobby.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 68096 --a------ C:\WINNT\system32\dpnhupnp.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 32768 --a------ C:\WINNT\system32\dpnhpast.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 3072 --a------ C:\WINNT\system32\dpnaddr.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 76800 --a------ C:\WINNT\system32\dmscript.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 44032 --a------ C:\WINNT\system32\dimap.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 7168 --a------ C:\WINNT\system32\d3d8thk.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:50:03 0 d-------- C:\WINNT\system32\directx
2008-04-01 05:23:05 641684 ---h----- C:\WINNT\ShellIconCache
2008-04-01 05:15:48 0 d-------- C:\WINNT\system32\Windows Media
2008-04-01 05:15:14 0 d--h---c- C:\WINNT\$NtUpdateRollupPackUninstall$
2008-04-01 05:15:11 0 d-------- C:\WINNT\msiinst.tmp
2008-04-01 05:13:44 0 d--h---c- C:\WINNT\$SQLUninstallMDAC25SP3-KB927779-x86-ENU$
2008-04-01 05:11:56 0 d-------- C:\WINNT\mui
2008-04-01 05:09:36 171280 --a------ C:\WINNT\system32\jit.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:36 139536 --a------ C:\WINNT\system32\javaee.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:36 313856 --a------ C:\WINNT\system32\dx3j.dll <Not Verified; Microsoft Corporation; Microsoft® DirectX for Java>
2008-04-01 05:09:36 46352 --a------ C:\WINNT\setdebug.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:36 6550 --a------ C:\WINNT\jautoexp.dat
2008-04-01 05:09:31 113 --a------ C:\WINNT\system32\zonedon.reg
2008-04-01 05:09:31 113 --a------ C:\WINNT\system32\zonedoff.reg
2008-04-01 05:09:31 171792 --a------ C:\WINNT\system32\wjview.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:31 286992 --a------ C:\WINNT\system32\vmhelper.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:30 21264 --a------ C:\WINNT\system32\msjdbc10.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:30 947472 --a------ C:\WINNT\system32\msjava.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 154384 --a------ C:\WINNT\system32\msawt.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 172304 --a------ C:\WINNT\system32\jview.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 15120 --a------ C:\WINNT\system32\jdbgmgr.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 404752 --a------ C:\WINNT\system32\javart.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 63248 --a------ C:\WINNT\system32\javaprxy.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 187152 --a------ C:\WINNT\system32\javacypt.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:27 49424 --a------ C:\WINNT\system32\clspack.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 04:49:32 0 d-------- C:\WINNT\RegisteredPackages
2008-04-01 04:47:46 0 d--h----- C:\WINNT\msdownld.tmp
2008-04-01 04:47:42 0 d-------- C:\WINNT\Windows Update Setup Files
2008-04-01 04:44:00 0 d-------- C:\WINNT\system32\Microsoft
2008-04-01 04:40:51 0 d-------- C:\WINNT\system32\ie_de
2008-04-01 04:40:51 0 d-------- C:\WINNT\system32\CertSrv
2008-04-01 04:40:51 0 d-------- C:\WINNT\ServicePackFiles
2008-04-01 04:19:29 0 d-------- C:\WINNT\system32\BITS
2008-04-01 04:17:31 0 d-------- C:\WINNT\SoftwareDistribution
2008-04-01 04:04:55 0 d-------- C:\WINNT\system32\NtmsData
2008-04-01 04:04:39 0 d--hs---- C:\WINNT\Installer
2008-04-01 04:04:39 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Identities
2008-04-01 04:04:34 0 d--h----- C:\WINNT\system32\GroupPolicy
2008-04-01 04:04:33 0 d--hs---- C:\WINNT\CSC
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\Templates
2008-04-01 04:04:33 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Start Menu
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\SendTo
2008-04-01 04:04:33 0 dr-h----- C:\Documents and Settings\Jo Ann Christinese\Recent
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\PrintHood
2008-04-01 04:04:33 540672 --ah----- C:\Documents and Settings\Jo Ann Christinese\NTUSER.DAT
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\NetHood
2008-04-01 04:04:33 0 d-------- C:\Documents and Settings\Jo Ann Christinese\My Documents
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\Local Settings
2008-04-01 04:04:33 0 dr------- C:\Documents and Settings\Jo Ann Christinese\Favorites
2008-04-01 04:04:33 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Desktop
2008-04-01 04:04:33 0 d---s---- C:\Documents and Settings\Jo Ann Christinese\Cookies
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\Application Data
2008-04-01 04:04:14 0 d--hs---- C:\System Volume Information
2008-04-01 03:48:47 0 d-------- C:\WINNT\system32\rpcproxy
2008-04-01 03:48:47 0 d-------- C:\WINNT\system32\rocket
2008-04-01 03:48:47 0 d-------- C:\WINNT\system32\inetsrv
2008-04-01 03:48:47 0 d-------- C:\WINNT\mww32
2008-04-01 03:48:47 0 d-------- C:\WINNT\ime
2008-04-01 03:48:47 0 d-------- C:\Program Files\microsoft frontpage
2008-04-01 03:48:17 122880 ---h----- C:\Documents and Settings\Default User\NTUSER.DAT
2008-04-01 03:47:51 0 -rahs---- C:\MSDOS.SYS
2008-04-01 03:47:51 0 -rahs---- C:\IO.SYS
2008-04-01 03:47:51 0 ---h----- C:\CONFIG.SYS
2008-04-01 03:47:51 0 ---h----- C:\AUTOEXEC.BAT
2008-04-01 03:47:06 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft
2008-04-01 03:46:53 0 d--hs---- C:\Documents and Settings\All Users\DRM
2008-04-01 03:46:49 0 dr------- C:\WINNT\Offline Web Pages
2008-04-01 03:46:49 0 d---s---- C:\WINNT\Downloaded Program Files
2008-04-01 03:46:29 0 d-a-s---- C:\WINNT\Tasks
2008-04-01 03:45:55 15012 --a------ C:\WINNT\system32\emptyregdb.dat
2008-04-01 03:45:25 0 d-------- C:\WINNT\Registration
2008-04-01 03:45:10 0 d-------- C:\WINNT\system32\DTCLog
2008-04-01 03:45:05 0 d-ah----- C:\Program Files\WindowsUpdate
2008-04-01 03:44:36 0 d-------- C:\Program Files\Accessories
2008-04-01 03:44:27 0 d-------- C:\Program Files\Windows NT
2008-04-01 03:44:23 0 d-------- C:\WINNT\system32\Com
2008-04-01 03:36:14 0 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-03-31 20:04:29 0 d-a------ C:\Program Files\Common Files\ODBC
2008-03-31 20:04:26 0 d-a------ C:\WINNT\Speech
2008-03-31 20:04:24 0 dra------ C:\Program Files
2008-03-31 20:04:24 0 d-a------ C:\Program Files\Common Files
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Templates
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\Start Menu
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\SendTo
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Recent
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\PrintHood
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\NetHood
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\My Documents
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Local Settings
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\Favorites
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\Desktop
2008-03-31 20:04:11 0 d---s---- C:\Documents and Settings\Default User\Cookies
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Application Data
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\All Users\Templates
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\All Users\Start Menu
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\All Users\Favorites
2008-03-31 20:04:11 0 d-a------ C:\Documents and Settings\All Users\Documents
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\All Users\Desktop
2008-03-31 20:04:11 0 d-ah----- C:\Documents and Settings\All Users\Application Data
2008-03-31 20:03:56 0 d-a------ C:\WINNT\system32\CatRoot
2008-03-31 20:03:43 0 d-a------ C:\Documents and Settings
2008-03-31 20:00:18 0 d-a------ C:\WINNT
2008-03-31 20:00:18 0 d---s---- C:\WINNT\Web
2008-03-31 20:00:18 0 d-a------ C:\WINNT\twain_32
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\wins
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\wbem
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\spool
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\ShellExt
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\Setup
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\ras
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\os2
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\npp
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\mui
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\ias
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\export
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\drivers
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\drivers\etc
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\drivers\disdn
2008-03-31 20:00:18 0 drahs--c- C:\WINNT\system32\dllcache
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\dhcp
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\config
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system
2008-03-31 20:00:18 0 d-a------ C:\WINNT\security
2008-03-31 20:00:18 0 d-a------ C:\WINNT\repair
2008-03-31 20:00:18 0 d-a------ C:\WINNT\msapps
2008-03-31 20:00:18 0 d-a------ C:\WINNT\msagent
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Media
2008-03-31 20:00:18 0 d-a------ C:\WINNT\java
2008-03-31 20:00:18 0 d--h----- C:\WINNT\inf
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Help
2008-03-31 20:00:18 0 dra-s---- C:\WINNT\Fonts
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Driver Cache
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Debug
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Cursors
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Connection Wizard
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Config
2008-03-31 20:00:18 0 d-a------ C:\WINNT\AppPatch
2008-03-31 20:00:18 0 d-a------ C:\WINNT\addins
-- Find3M Report ---------------------------------------------------------------
Nothing modified in this timespan.
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A8FB8EB3-183B-4598-924D-86F0E5E37085}]
08-04-02 08:39 237056 --a------ c:\program files\peoplepc\toolbar\ppctoolbar.dll
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{A8FB8EB3-183B-4598-924D-86F0E5E37085}"= c:\program files\peoplepc\toolbar\ppctoolbar.dll [08-04-02 08:39 237056]
[-HKEY_CLASSES_ROOT\CLSID\{A8FB8EB3-183B-4598-924D-86F0E5E37085}]
[HKEY_CLASSES_ROOT\PeoplePC.Toolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{994D628D-4D22-4DB9-B6DB-F7D9F1635817}]
[HKEY_CLASSES_ROOT\PeoplePC.Toolbar]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [03-06-19 12:05 C:\WINNT\system32\mobsync.exe]
"SMSERIAL"="sm56hlpr.exe" [03-10-07 19:15 C:\WINNT\sm56hlpr.exe]
"Bart Station"="C:\Program Files\PeoplePC\ISP6500\BIN\PPCOLink.exe" [07-03-12 15:11 ]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [08-03-29 11:37 ]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"disableregistrytools"=0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"
-- End of Deckard's System Scanner: finished at 2008-04-03 19:03:46 ------------
Thanks again.
Deckard's System Scanner v20071014.68
Run by Jo Ann Christinese on 2008-04-03 19:01:17
Computer is in Normal Mode.
--------------------------------------------------------------------------------
Total Physical Memory: 255 MiB (256 MiB recommended).
-- HijackThis (run as Jo Ann Christinese.exe) ----------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:01, on 2008-04-03
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINNT\sm56hlpr.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\PeoplePC\ISP6500\Browser\Bartshel.exe
C:\PROGRA~1\PeoplePC\ISP6500\Browser\PPShared.exe
C:\Program Files\PeoplePC\ISP6500\Browser\Bartshel.exe
C:\WINNT\system32\wuauclt.exe
C:\Documents and Settings\Jo Ann Christinese\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\JOANNC~1.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.peoplepc.com/search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.peoplepc.com/websearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://home.peoplepc.com/search
O2 - BHO: EarthLink BHO Guard - {00000000-0000-0000-0000-000000000002} - C:\Program Files\PeoplePC\Toolbar\ScamGrd.dll
O2 - BHO: EarthLink ScamBlocker V3 - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\PeoplePC\Toolbar\ScamGrd.dll
O2 - BHO: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - c:\program files\peoplepc\toolbar\ppctoolbar.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - c:\program files\peoplepc\toolbar\ppctoolbar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [Bart Station] C:\Program Files\PeoplePC\ISP6500\BIN\PPCOLink.exe -STATION
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1207048643546
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINNT\system32\perfs.exe (file missing)
O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINNT\system32\routing.exe (file missing)
--
End of file - 3472 bytes
-- Files created between 2008-03-03 and 2008-04-03 -----------------------------
2008-04-03 18:41:34 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_1f4.dat
2008-04-03 15:05:06 0 d-------- C:\Program Files\Trend Micro
2008-04-03 11:53:12 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_30c.dat
2008-04-03 11:48:56 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_1f8.dat
2008-04-03 11:47:08 68096 --a------ C:\WINNT\system32\zip.exe
2008-04-03 11:47:08 98816 --a------ C:\WINNT\system32\sed.exe
2008-04-03 11:47:08 80412 --a------ C:\WINNT\system32\grep.exe
2008-04-03 11:47:08 73728 --a------ C:\WINNT\system32\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-04-03 08:36:47 0 d-------- C:\Program Files\Common Files\InstallShield
2008-04-02 14:28:38 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_1ec.dat
2008-04-02 11:13:13 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Adobe
2008-04-01 20:53:14 0 d-------- C:\WINNT\PreInstall
2008-04-01 20:17:01 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Help
2008-04-01 19:20:39 0 d-------- C:\Program Files\Alwil Software
2008-04-01 16:33:21 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Macromedia
2008-04-01 16:09:02 0 d-------- C:\Program Files\PeoplePC Accelerated
2008-04-01 16:04:01 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\ScamBlocker
2008-04-01 15:59:52 0 d-------- C:\Program Files\Common Files\PeoplePC
2008-04-01 15:59:51 67584 -----n--- C:\WINNT\system32\unPPC.exe <Not Verified; PeoplePC; PeoplePC unPPC>
2008-04-01 15:59:51 28672 -----n--- C:\WINNT\system32\RegHero.exe <Not Verified; ; RegHero Module>
2008-04-01 15:59:51 18432 -----n--- C:\WINNT\system32\PPCInfo.exe <Not Verified; PeoplePC, Inc.; PPCInfo Module>
2008-04-01 15:59:51 0 d-------- C:\Program Files\PeoplePC
2008-04-01 15:59:47 0 d-------- C:\WINNT\system32\Macromed
2008-04-01 07:48:02 306688 --a------ C:\WINNT\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller>
2008-04-01 07:47:47 0 d-------- C:\Dell
2008-04-01 06:52:52 0 d-------- C:\WINNT\winsxs
2008-04-01 06:52:51 0 d-------- C:\WINNT\PCHEALTH
2008-04-01 06:50:12 0 d-------- C:\WINNT\system32\URTTemp
2008-04-01 06:07:18 57344 --a------ C:\WINNT\uneng.exe <Not Verified; Roxio; Roxio Update Wizard>
2008-04-01 06:07:18 0 d-------- C:\Program Files\Common Files\Adaptec Shared
2008-04-01 06:07:10 225280 --a------ C:\WINNT\system32\wmpdxm.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Player>
2008-04-01 06:07:10 106496 --a------ C:\WINNT\system32\wmpasf.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Player>
2008-04-01 06:07:01 52224 --a------ C:\WINNT\system32\mspmsnsv.dll <Not Verified; Microsoft Corporation; Windows Media Device Manager>
2008-04-01 06:06:57 997888 --a------ C:\WINNT\system32\wmvdmoe2.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2008-04-01 06:06:57 892416 --a------ C:\WINNT\system32\wmspdmoe.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2008-04-01 06:06:57 1111040 --a------ C:\WINNT\system32\wmsdmoe2.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2008-04-01 06:01:20 0 d-------- C:\WINNT\Motorola
2008-04-01 05:52:34 1222656 --a------ C:\WINNT\system32\quartz.dll
2008-04-01 05:52:33 524800 --a------ C:\WINNT\system32\qedit.dll
2008-04-01 05:52:33 194560 --a------ C:\WINNT\system32\mswebdvd.dll <Not Verified; Microsoft Corporation; DirectShow>
2008-04-01 05:52:33 1769472 --a------ C:\WINNT\system32\dxdiagn.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:33 1689600 --a------ C:\WINNT\system32\d3d9.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:33 1179648 --a------ C:\WINNT\system32\d3d8.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 68096 --a------ C:\WINNT\system32\dsdmoprp.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 203264 --a------ C:\WINNT\system32\dpvoice.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 16896 --a------ C:\WINNT\system32\dpnsvr.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 377856 --a------ C:\WINNT\system32\dpnet.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 166400 --a------ C:\WINNT\system32\dinput8.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:32 386048 --a------ C:\WINNT\system32\diactfrm.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 733184 --a------ C:\WINNT\system32\qedwipes.dll
2008-04-01 05:52:30 13312 --a------ C:\WINNT\system32\msdmo.dll
2008-04-01 05:52:30 18944 --a------ C:\WINNT\system32\encapi.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 1189888 --a------ C:\WINNT\system32\dx8vb.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 18432 --a------ C:\WINNT\system32\dswave.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 186880 --a------ C:\WINNT\system32\dsdmo.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 112128 --a------ C:\WINNT\system32\dpvvox.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 80896 --a------ C:\WINNT\system32\dpvsetup.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 19968 --a------ C:\WINNT\system32\dpvacm.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 3072 --a------ C:\WINNT\system32\dpnlobby.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 68096 --a------ C:\WINNT\system32\dpnhupnp.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 32768 --a------ C:\WINNT\system32\dpnhpast.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 3072 --a------ C:\WINNT\system32\dpnaddr.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 76800 --a------ C:\WINNT\system32\dmscript.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 44032 --a------ C:\WINNT\system32\dimap.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:52:30 7168 --a------ C:\WINNT\system32\d3d8thk.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-01 05:50:03 0 d-------- C:\WINNT\system32\directx
2008-04-01 05:23:05 641684 ---h----- C:\WINNT\ShellIconCache
2008-04-01 05:15:48 0 d-------- C:\WINNT\system32\Windows Media
2008-04-01 05:15:14 0 d--h---c- C:\WINNT\$NtUpdateRollupPackUninstall$
2008-04-01 05:15:11 0 d-------- C:\WINNT\msiinst.tmp
2008-04-01 05:13:44 0 d--h---c- C:\WINNT\$SQLUninstallMDAC25SP3-KB927779-x86-ENU$
2008-04-01 05:11:56 0 d-------- C:\WINNT\mui
2008-04-01 05:09:36 171280 --a------ C:\WINNT\system32\jit.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:36 139536 --a------ C:\WINNT\system32\javaee.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:36 313856 --a------ C:\WINNT\system32\dx3j.dll <Not Verified; Microsoft Corporation; Microsoft® DirectX for Java>
2008-04-01 05:09:36 46352 --a------ C:\WINNT\setdebug.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:36 6550 --a------ C:\WINNT\jautoexp.dat
2008-04-01 05:09:31 113 --a------ C:\WINNT\system32\zonedon.reg
2008-04-01 05:09:31 113 --a------ C:\WINNT\system32\zonedoff.reg
2008-04-01 05:09:31 171792 --a------ C:\WINNT\system32\wjview.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:31 286992 --a------ C:\WINNT\system32\vmhelper.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:30 21264 --a------ C:\WINNT\system32\msjdbc10.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:30 947472 --a------ C:\WINNT\system32\msjava.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 154384 --a------ C:\WINNT\system32\msawt.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 172304 --a------ C:\WINNT\system32\jview.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 15120 --a------ C:\WINNT\system32\jdbgmgr.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 404752 --a------ C:\WINNT\system32\javart.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 63248 --a------ C:\WINNT\system32\javaprxy.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:29 187152 --a------ C:\WINNT\system32\javacypt.dll <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 05:09:27 49424 --a------ C:\WINNT\system32\clspack.exe <Not Verified; Microsoft Corporation; Microsoft® Windows ® Operating System>
2008-04-01 04:49:32 0 d-------- C:\WINNT\RegisteredPackages
2008-04-01 04:47:46 0 d--h----- C:\WINNT\msdownld.tmp
2008-04-01 04:47:42 0 d-------- C:\WINNT\Windows Update Setup Files
2008-04-01 04:44:00 0 d-------- C:\WINNT\system32\Microsoft
2008-04-01 04:40:51 0 d-------- C:\WINNT\system32\ie_de
2008-04-01 04:40:51 0 d-------- C:\WINNT\system32\CertSrv
2008-04-01 04:40:51 0 d-------- C:\WINNT\ServicePackFiles
2008-04-01 04:19:29 0 d-------- C:\WINNT\system32\BITS
2008-04-01 04:17:31 0 d-------- C:\WINNT\SoftwareDistribution
2008-04-01 04:04:55 0 d-------- C:\WINNT\system32\NtmsData
2008-04-01 04:04:39 0 d--hs---- C:\WINNT\Installer
2008-04-01 04:04:39 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Application Data\Identities
2008-04-01 04:04:34 0 d--h----- C:\WINNT\system32\GroupPolicy
2008-04-01 04:04:33 0 d--hs---- C:\WINNT\CSC
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\Templates
2008-04-01 04:04:33 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Start Menu
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\SendTo
2008-04-01 04:04:33 0 dr-h----- C:\Documents and Settings\Jo Ann Christinese\Recent
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\PrintHood
2008-04-01 04:04:33 540672 --ah----- C:\Documents and Settings\Jo Ann Christinese\NTUSER.DAT
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\NetHood
2008-04-01 04:04:33 0 d-------- C:\Documents and Settings\Jo Ann Christinese\My Documents
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\Local Settings
2008-04-01 04:04:33 0 dr------- C:\Documents and Settings\Jo Ann Christinese\Favorites
2008-04-01 04:04:33 0 d-------- C:\Documents and Settings\Jo Ann Christinese\Desktop
2008-04-01 04:04:33 0 d---s---- C:\Documents and Settings\Jo Ann Christinese\Cookies
2008-04-01 04:04:33 0 d--h----- C:\Documents and Settings\Jo Ann Christinese\Application Data
2008-04-01 04:04:14 0 d--hs---- C:\System Volume Information
2008-04-01 03:48:47 0 d-------- C:\WINNT\system32\rpcproxy
2008-04-01 03:48:47 0 d-------- C:\WINNT\system32\rocket
2008-04-01 03:48:47 0 d-------- C:\WINNT\system32\inetsrv
2008-04-01 03:48:47 0 d-------- C:\WINNT\mww32
2008-04-01 03:48:47 0 d-------- C:\WINNT\ime
2008-04-01 03:48:47 0 d-------- C:\Program Files\microsoft frontpage
2008-04-01 03:48:17 122880 ---h----- C:\Documents and Settings\Default User\NTUSER.DAT
2008-04-01 03:47:51 0 -rahs---- C:\MSDOS.SYS
2008-04-01 03:47:51 0 -rahs---- C:\IO.SYS
2008-04-01 03:47:51 0 ---h----- C:\CONFIG.SYS
2008-04-01 03:47:51 0 ---h----- C:\AUTOEXEC.BAT
2008-04-01 03:47:06 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft
2008-04-01 03:46:53 0 d--hs---- C:\Documents and Settings\All Users\DRM
2008-04-01 03:46:49 0 dr------- C:\WINNT\Offline Web Pages
2008-04-01 03:46:49 0 d---s---- C:\WINNT\Downloaded Program Files
2008-04-01 03:46:29 0 d-a-s---- C:\WINNT\Tasks
2008-04-01 03:45:55 15012 --a------ C:\WINNT\system32\emptyregdb.dat
2008-04-01 03:45:25 0 d-------- C:\WINNT\Registration
2008-04-01 03:45:10 0 d-------- C:\WINNT\system32\DTCLog
2008-04-01 03:45:05 0 d-ah----- C:\Program Files\WindowsUpdate
2008-04-01 03:44:36 0 d-------- C:\Program Files\Accessories
2008-04-01 03:44:27 0 d-------- C:\Program Files\Windows NT
2008-04-01 03:44:23 0 d-------- C:\WINNT\system32\Com
2008-04-01 03:36:14 0 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-03-31 20:04:29 0 d-a------ C:\Program Files\Common Files\ODBC
2008-03-31 20:04:26 0 d-a------ C:\WINNT\Speech
2008-03-31 20:04:24 0 dra------ C:\Program Files
2008-03-31 20:04:24 0 d-a------ C:\Program Files\Common Files
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Templates
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\Start Menu
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\SendTo
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Recent
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\PrintHood
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\NetHood
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\My Documents
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Local Settings
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\Favorites
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\Default User\Desktop
2008-03-31 20:04:11 0 d---s---- C:\Documents and Settings\Default User\Cookies
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\Default User\Application Data
2008-03-31 20:04:11 0 d--h----- C:\Documents and Settings\All Users\Templates
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\All Users\Start Menu
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\All Users\Favorites
2008-03-31 20:04:11 0 d-a------ C:\Documents and Settings\All Users\Documents
2008-03-31 20:04:11 0 d-------- C:\Documents and Settings\All Users\Desktop
2008-03-31 20:04:11 0 d-ah----- C:\Documents and Settings\All Users\Application Data
2008-03-31 20:03:56 0 d-a------ C:\WINNT\system32\CatRoot
2008-03-31 20:03:43 0 d-a------ C:\Documents and Settings
2008-03-31 20:00:18 0 d-a------ C:\WINNT
2008-03-31 20:00:18 0 d---s---- C:\WINNT\Web
2008-03-31 20:00:18 0 d-a------ C:\WINNT\twain_32
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\wins
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\wbem
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\spool
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\ShellExt
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\Setup
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\ras
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\os2
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\npp
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\mui
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\ias
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\export
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\drivers
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\drivers\etc
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\drivers\disdn
2008-03-31 20:00:18 0 drahs--c- C:\WINNT\system32\dllcache
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\dhcp
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system32\config
2008-03-31 20:00:18 0 d-a------ C:\WINNT\system
2008-03-31 20:00:18 0 d-a------ C:\WINNT\security
2008-03-31 20:00:18 0 d-a------ C:\WINNT\repair
2008-03-31 20:00:18 0 d-a------ C:\WINNT\msapps
2008-03-31 20:00:18 0 d-a------ C:\WINNT\msagent
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Media
2008-03-31 20:00:18 0 d-a------ C:\WINNT\java
2008-03-31 20:00:18 0 d--h----- C:\WINNT\inf
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Help
2008-03-31 20:00:18 0 dra-s---- C:\WINNT\Fonts
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Driver Cache
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Debug
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Cursors
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Connection Wizard
2008-03-31 20:00:18 0 d-a------ C:\WINNT\Config
2008-03-31 20:00:18 0 d-a------ C:\WINNT\AppPatch
2008-03-31 20:00:18 0 d-a------ C:\WINNT\addins
-- Find3M Report ---------------------------------------------------------------
Nothing modified in this timespan.
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A8FB8EB3-183B-4598-924D-86F0E5E37085}]
08-04-02 08:39 237056 --a------ c:\program files\peoplepc\toolbar\ppctoolbar.dll
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{A8FB8EB3-183B-4598-924D-86F0E5E37085}"= c:\program files\peoplepc\toolbar\ppctoolbar.dll [08-04-02 08:39 237056]
[-HKEY_CLASSES_ROOT\CLSID\{A8FB8EB3-183B-4598-924D-86F0E5E37085}]
[HKEY_CLASSES_ROOT\PeoplePC.Toolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{994D628D-4D22-4DB9-B6DB-F7D9F1635817}]
[HKEY_CLASSES_ROOT\PeoplePC.Toolbar]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [03-06-19 12:05 C:\WINNT\system32\mobsync.exe]
"SMSERIAL"="sm56hlpr.exe" [03-10-07 19:15 C:\WINNT\sm56hlpr.exe]
"Bart Station"="C:\Program Files\PeoplePC\ISP6500\BIN\PPCOLink.exe" [07-03-12 15:11 ]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [08-03-29 11:37 ]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"disableregistrytools"=0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"
-- End of Deckard's System Scanner: finished at 2008-04-03 19:03:46 ------------
Thanks again.
Similar Topics
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users