Thanks
Deckard's System Scanner v20071014.68
Run by DavidM on 2008-04-17 16:33:34
Computer is in Normal Mode.
--------------------------------------------------------------------------------
-- System Restore --------------------------------------------------------------
Successfully created a Deckard's System Scanner Restore Point.
-- Last 5 Restore Point(s) --
61: 2008-04-17 22:33:46 UTC - RP593 - Deckard's System Scanner Restore Point
60: 2008-04-16 22:17:15 UTC - RP592 - Last known good configuration
59: 2008-04-16 22:15:27 UTC - RP591 - System Checkpoint
58: 2008-04-16 22:15:25 UTC - RP590 - System Checkpoint
57: 2008-04-16 22:15:24 UTC - RP589 - System Checkpoint
-- First Restore Point --
1: 2008-04-16 22:14:39 UTC - RP533 - System Checkpoint
Backed up registry hives.
Performed disk cleanup.
Total Physical Memory: 503 MiB (512 MiB recommended).System Drive C: has 2.71 GiB (less than 15%) free.-- HijackThis (run as DavidM.exe) ----------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:37:37 PM, on 4/17/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Documents and Settings\DavidM\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\DavidM.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.dell.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft....k/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft....k/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft....k/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft....k/?LinkId=69157R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {7e44116e-e869-4fc6-97cb-b0cf635b541a} - C:\WINDOWS\system32\fjeenog.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: (no name) - {B84D9C3C-65AF-4468-B6F7-A44B4C7A2FCA} - C:\WINDOWS\system32\hgdcdcya.dll
O2 - BHO: (no name) - {FB422E7B-3D5E-4D9B-84C2-91B6C888CDE2} - C:\WINDOWS\system32\ljjigefe.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - Global Startup: ColorVisionStartup.lnk = C:\Program Files\PANTONE COLORVISION\Startup\ColorVisionStartup.exe
O8 - Extra context menu item: Download Using &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\prxernsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\prxerdrv.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\prxerdrv.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://www.update.mi...b?1205334524732O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) -
http://www.photogize...geUploader4.cabO16 - DPF: {C1BAC744-8F0B-11D0-89E7-00C0A8295197} (Cameractl Class) -
http://www.berkeley....cams/camera.cabO17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = dtaus.local
O17 - HKLM\Software\..\Telephony: DomainName = dtaus.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = dtaus.local
O20 - Winlogon Notify: ljjigefe - C:\WINDOWS\SYSTEM32\ljjigefe.dll
--
End of file - 5609 bytes
-- HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\) -----------
backup-20080417-160138-194 O4 - HKLM\..\Run: [AntiSpywareMaster] C:\Program Files\AntiSpywareMaster\asm.exe
-- File Associations -----------------------------------------------------------
.js - JSFile - DefaultIcon - "C:\Program Files\Macromedia\Dreamweaver 8\dreamweaver.exe",2-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------
All drivers whitelisted.
-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------
S4 DWMRCS (DameWare Mini Remote Control) - c:\windows\system32\dwrcs.exe -service <Not Verified; DameWare Development LLC; DameWare Development DWRCS>
S4 ProtexisLicensing - c:\windows\system32\psiservice.exe <Not Verified; ; PSIService>
-- Device Manager: Disabled ----------------------------------------------------
No disabled devices found.
-- Files created between 2008-03-17 and 2008-04-17 -----------------------------
2008-04-17 13:53:04 0 d-------- C:\Program Files\Trend Micro
2008-04-17 08:38:05 0 d-------- C:\WINDOWS\pss
2008-04-16 16:14:18 289193 --ahs---- C:\WINDOWS\system32\aycdcdgh.ini2
2008-04-16 16:14:11 393677 --a------ C:\WINDOWS\system32\hgdcdcya.dll
2008-04-16 16:12:23 34099 --a------ C:\WINDOWS\system32\wvusrqpq.dll
2008-04-16 16:09:26 38400 --a------ C:\WINDOWS\mrofinu572.exe
2008-04-16 16:09:00 0 d-------- C:\WINDOWS\system32\xcsDd01
2008-04-16 16:08:57 34099 --a------ C:\WINDOWS\system32\ljjigefe.dll
2008-03-19 13:57:56 0 d-------- C:\Program Files\DCETools
-- Find3M Report ---------------------------------------------------------------
2008-04-17 14:34:16 0 d-------- C:\Documents and Settings\DavidM\Application Data\AdobeUM
2008-04-17 09:12:18 0 d-------- C:\Program Files\Plaxo
2008-04-16 15:41:32 0 d-------- C:\Documents and Settings\DavidM\Application Data\Adobe
2008-04-16 15:25:42 0 d-------- C:\Documents and Settings\DavidM\Application Data\U3
2008-04-04 14:15:36 0 d-------- C:\Program Files\PeerGuardian2
2008-03-24 16:09:41 0 d-------- C:\Program Files\Java
2008-03-12 10:44:58 0 d-------- C:\Program Files\Microsoft Works
2008-03-05 13:00:24 112 --a------ C:\Documents and Settings\DavidM\Application Data\Current.prx
2008-03-05 12:42:27 0 d-------- C:\Program Files\Proxifier
2008-03-04 13:18:49 0 d-------- C:\Program Files\SopCast
2008-03-04 13:05:10 0 d-------- C:\Program Files\TVAnts
2008-03-04 13:01:26 0 d-------- C:\Documents and Settings\DavidM\Application Data\SopCast
2008-02-20 12:26:22 0 d-------- C:\Program Files\ArtMasterPro
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7e44116e-e869-4fc6-97cb-b0cf635b541a}]
09/14/2007 10:03 AM 171520 --a------ C:\WINDOWS\system32\fjeenog.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B84D9C3C-65AF-4468-B6F7-A44B4C7A2FCA}]
04/16/2008 04:14 PM 393677 --a------ C:\WINDOWS\system32\hgdcdcya.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FB422E7B-3D5E-4D9B-84C2-91B6C888CDE2}]
04/16/2008 04:08 PM 34099 --a------ C:\WINDOWS\system32\ljjigefe.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [08/04/2004 04:00 AM]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 04:00 AM]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [08/30/2007 05:43 PM]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
ColorVisionStartup.lnk - C:\Program Files\PANTONE COLORVISION\Startup\ColorVisionStartup.exe [12/21/2004 11:37:55 AM]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{FB422E7B-3D5E-4D9B-84C2-91B6C888CDE2}"= C:\WINDOWS\system32\ljjigefe.dll [04/16/2008 04:08 PM 34099]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljjigefe]
ljjigefe.dll 04/16/2008 04:08 PM 34099 C:\WINDOWS\system32\ljjigefe.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\hgdcdcya
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1957994488-1532298954-839522115-1685\Scripts\Logon\0\0]
"Script"=denvermapped.bat
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1957994488-1532298954-839522115-1749\Scripts\Logon\0\0]
"Script"=denvermapped.bat
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1957994488-1532298954-839522115-1750\Scripts\Logon\0\0]
"Script"=denvermapped.bat
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1957994488-1532298954-839522115-1906\Scripts\Logon\0\0]
"Script"=denvermapped.bat
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
backup=C:\WINDOWS\pss\Acrobat Assistant.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^DavidM^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\Documents and Settings\DavidM\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^DavidM^Start Menu^Programs^Startup^TA_Start.lnk]
path=C:\Documents and Settings\DavidM\Start Menu\Programs\Startup\TA_Start.lnk
backup=C:\WINDOWS\pss\TA_Start.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CAVRID]
"C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cctray]
"C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
C:\WINDOWS\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
C:\WINDOWS\system32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
C:\WINDOWS\system32\igfxpers.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlaxoUpdate]
C:\Program Files\Plaxo\2.13.1.3\PlaxoHelper.exe -a
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\runner1]
C:\WINDOWS\mrofinu572.exe 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
C:\Program Files\Analog Devices\Core\smax4pnp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WebBuying]
C:\Program Files\Web Buying\v1.8.4\webbuying.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{D7-7A-A8-86-ZN}]
C:\Documents and Settings\DavidM\Local Settings\Temp\thinksnet.exe CHD003
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"VETMSGNT"=2 (0x2)
"ProtexisLicensing"=2 (0x2)
"ose"=3 (0x3)
"MDM"=2 (0x2)
"gusvc"=3 (0x3)
"DWMRCS"=2 (0x2)
"CAISafe"=2 (0x2)
"CaCCProvSP"=3 (0x3)
"Adobe LM Service"=3 (0x3)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
AutoRun\command- E:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{272379b9-1388-11dc-98e8-00123f43777c}]
AutoRun\command- E:\LaunchU3.exe -a
*Newly Created Service* - FILEMON701
-- End of Deckard's System Scanner: finished at 2008-04-17 16:38:57 ------------
Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------
-- System Information ----------------------------------------------------------
Microsoft Windows XP Professional (build 2600) SP 2.0
Architecture: X86; Language: English
CPU 0: Intel® Pentium® 4 CPU 3.00GHz
Percentage of Memory in Use: 44%
Physical Memory (total/avail): 502.07 MiB / 277.69 MiB
Pagefile Memory (total/avail): 1224.51 MiB / 1049.92 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1931.52 MiB
A: is Removable (No Media)
C: is Fixed (NTFS) - 37.21 GiB total, 2.7 GiB free.
D: is CDROM (No Media)
G: is Network (NTFS)
H: is Network (NTFS)
R: is Network (NTFS)
T: is Network (NTFS)
\\.\PHYSICALDRIVE0 - ST340014AS - 37.25 GiB - 2 partitions
\PARTITION0 - Unknown - 31.35 MiB
\PARTITION1 (bootable) - Installable File System - 37.21 GiB - C:
-- Security Center -------------------------------------------------------------
AUOptions is scheduled to auto-install.
Windows Internal Firewall is enabled.
FirstRunDisabled is set.
AV: CA Anti-Virus v8.4.0.11 (CA, Inc.)
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Mining_Contacts\\Band\\mp3\\utorrent.exe"="C:\\Mining_Contacts\\Band\\mp3\\utorrent.exe:*:Enabled:µTorrent"
"C:\\Program Files\\BitSpirit\\BitSpirit.exe"="C:\\Program Files\\BitSpirit\\BitSpirit.exe:*:Enabled:The powerful and easy-to-use BitTorrent Client"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Mining_Contacts\\Band\\utorrent.exe"="C:\\Mining_Contacts\\Band\\utorrent.exe:*:Enabled:µTorrent"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\BitSpirit\\BitSpirit.exe"="C:\\Program Files\\BitSpirit\\BitSpirit.exe:*:Enabled:The powerful and easy-to-use BitTorrent Client"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
-- Environment Variables -------------------------------------------------------
ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\DavidM\Application Data
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=DENVER08
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\DavidM
LOGONSERVER=\\DENVERDB
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\Program Files\Mozilla Firefox;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Microsoft Office\OFFICE11\Business Contact Manager\IM;C:\Program Files\Microsoft SQL Server\80\Tools\Binn\;C:\Program Files\Microsoft Office\OFFICE11\Business Contact Manager\;C:\Program Files\Common Files\Adobe\AGL
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 3, GenuineIntel
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=0403
ProgramFiles=C:\Program Files
PROMPT=$P$G
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\DavidM\LOCALS~1\Temp
TMP=C:\DOCUME~1\DavidM\LOCALS~1\Temp
USERDNSDOMAIN=DTAUS.LOCAL
USERDOMAIN=DTAUS
USERNAME=DavidM
USERPROFILE=C:\Documents and Settings\DavidM
windir=C:\WINDOWS
-- User Profiles ---------------------------------------------------------------
david
(new local, admin)Administrator
(admin)cas
(admin)lfreeman
(admin)kylef
(new local, admin, net ready)DavidM
(admin)billr
(new local, admin, net ready)-- Add/Remove Programs ---------------------------------------------------------
--> C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\orun32.isu
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Abacast Client --> C:\PROGRA~1\Abacast\UNWISE.EXE C:\PROGRA~1\Abacast\client.LOG
Adobe Acrobat - Reader 6.0.2 Update --> MsiExec.exe /I{AC76BA86-0000-0000-0000-6028747ADE01}
Adobe Acrobat 6.0.1 Standard --> MsiExec.exe /I{AC76BA86-1033-0000-BA7E-000000000001}
Adobe Acrobat and Reader 6.0.3 Update --> MsiExec.exe /I{AC76BA86-0000-7EC8-7489-000000000603}
Adobe Acrobat and Reader 6.0.4 Update --> MsiExec.exe /I{AC76BA86-0000-7EC8-7489-000000000604}
Adobe Acrobat and Reader 6.0.5 Update --> MsiExec.exe /I{AC76BA86-0000-7EC8-7489-000000000605}
Adobe Acrobat and Reader 6.0.6 Update --> MsiExec.exe /I{AC76BA86-0000-7EC8-7489-000000000606}
Adobe Bridge 1.0 --> MsiExec.exe /I{B74D4E10-1033-0000-0000-000000000001}
Adobe Common File Installer --> MsiExec.exe /I{8EDBA74D-0686-4C99-BFDD-F894678E5B39}
Adobe Download Manager 2.2 (Remove Only) --> "C:\Program Files\Common Files\Adobe\ESD\uninst.exe"
Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin --> C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Help Center 1.0 --> MsiExec.exe /I{E9787678-1033-0000-8E67-000000000001}
Adobe Photoshop CS --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EFB21DE7-8C19-4A88-BB28-A766E16493BC}\setup.exe" -l0x9
Adobe Photoshop CS2 --> msiexec /I {236BB7C4-4419-42FD-0409-1E257A25E34D}
Adobe Reader 6.0.1 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A00000000001}
Adobe Stock Photos 1.0 --> MsiExec.exe /I{786C5747-1033-0000-B58E-000000000001}
Advanced WMA Workshop version 2.3 --> "C:\Program Files\LitexMedia\Advanced WMA Workshop\unins000.exe"
Alien Skin Blow Up --> C:\PROGRA~1\Adobe\ADOBEP~1\Plug-Ins\ALIENS~1\BLOWUP~1\Unwise32.exe C:\PROGRA~1\Adobe\ADOBEP~1\Plug-Ins\ALIENS~1\BLOWUP~1\INSTALL.LOG
Alien Skin Exposure --> C:\PROGRA~1\Adobe\PHOTOS~1\Plug-Ins\ALIENS~1\Exposure\Unwise32.exe C:\PROGRA~1\Adobe\PHOTOS~1\Plug-Ins\ALIENS~1\Exposure\INSTALL.LOG
Alien Skin Eye Candy 5 Nature --> C:\PROGRA~1\Adobe\PHOTOS~1\Plug-Ins\ALIENS~1\EYECAN~1\Unwise32.exe C:\PROGRA~1\Adobe\PHOTOS~1\Plug-Ins\ALIENS~1\EYECAN~1\INSTALL.LOG
Alien Skin Image Doctor 1.0 --> C:\PROGRA~1\Adobe\PHOTOS~1\Plug-Ins\IMAGED~1\UNWISE.EXE C:\PROGRA~1\Adobe\PHOTOS~1\Plug-Ins\IMAGED~1\INSTALL.LOG
Alien Skin Xenofex 2.0 --> C:\PROGRA~1\Adobe\PHOTOS~1\Plug-Ins\ALIENS~2\UNWISE.EXE C:\PROGRA~1\Adobe\PHOTOS~1\Plug-Ins\ALIENS~2\INSTALL.LOG
Antares Autotune DX v4.12 --> C:\PROGRA~1\Antares\AUTOTU~1\ANTARE~1\UNWISE.EXE C:\PROGRA~1\Antares\AUTOTU~1\ANTARE~1\INSTALL.LOG
Antares AVOX Vocal Kit Bundle VST v1.02 --> C:\PROGRA~1\STEINB~1\VSTPLU~1\Antares\AVOXVO~1\Choir\UNWISE.EXE C:\PROGRA~1\STEINB~1\VSTPLU~1\Antares\AVOXVO~1\Choir\INSTALL.LOG
ArtMasterPro --> MsiExec.exe /I{8B2DB7C0-6315-499A-9479-D7C6F50AF319}
ArtRage 2.1 --> "C:\Program Files\Ambient Design\ArtRage 2\unins000.exe"
ArtStudioPro --> "C:\Program Files\TwistingPixels\ArtStudioPro\unins000.exe"
AviSynth 2.5 --> "C:\Program Files\AviSynth 2.5\Uninstall.exe"
B/W Styler 1.0 --> C:\Program Files\BWStyler\SXUNINST.EXE
B/Works for Digital Cameras --> "C:\Program Files\BWorks\unins000.exe"
Bibble Pro --> C:\WINDOWS\unvise32.exe C:\Program Files\Bibble Labs\Prouninstal.log
BitSpirit v3.0.0.087 Stable Release --> "C:\Program Files\BitSpirit\unins000.exe"
BLM 2.6.5 --> "C:\Program Files\Bluetack\Blocklist Manager\unins000.exe"
Broadcom Advanced Control Suite --> MsiExec.exe /I{058B32E2-6310-4359-B2D4-1988390C3B83}
Business Contact Manager for Outlook 2003 --> MsiExec.exe /I{66563AD8-637B-407F-BCA7-0233A16891AB}
BW Workflow Pro v1.0 --> "C:\Program Files\FredMiranda\BW Workflow Pro v1.0\Uninstall.exe" "C:\Program Files\FredMiranda\BW Workflow Pro v1.0\install.log"
CA Anti-Virus --> "C:\Program Files\CA\CA Internet Security Suite\caunst.exe" /u /product=av
CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe"
CDBurnerXP Pro 3 --> MsiExec.exe /I{896D642C-7125-44F0-AC49-A23ABF82209C}
Claris Home Page 3.0 --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Claris Corp\Claris Home Page 3.0\Uninst.isu"
Corel Painter X --> C:\Program Files\Corel\Corel Painter X\MSILauncher {05D60953-9012-44DF-A1A6-9DD97AD6580A} C:\DOCUME~1\DavidM\LOCALS~1\Temp\PainterX.log
Corel Painter X --> MsiExec.exe /I{05D60953-9012-44DF-A1A6-9DD97AD6580A}
Curves 2 --> C:\WINDOWS\Curves 2 Uninstaller.exe
DCETools - ReDynaMix HDR 1.01 --> "C:\Program Files\DCETools\ReDynaMix\unins000.exe"
Dell Printer Software Uninstall --> C:\Program Files\Dell\Install\Uninstall.exe
DivX --> C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Player --> C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DVD Flick --> "C:\Program Files\DVD Flick\unins000.exe"
Evrsoft First Page 2006 --> "C:\Program Files\Evrsoft First Page 2006\unins000.exe"
Genuine Fractals PrintPro --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6B14FCEE-A1D6-4CF3-B6EF-C0DDA98F978C}\Setup.exe" -l0x9
Google Earth --> MsiExec.exe /I{1E04F83B-2AB9-4301-9EF7-E86307F79C72}
Google Toolbar for Internet Explorer --> regsvr32 /u /s "c:\program files\google\googletoolbar3.dll"
Guitar Power 1.2.9 --> "C:\Program Files\GuitarPower\unins000.exe"
Guitar Pro 5.2 --> "C:\Program Files\Guitar Pro 5\unins000.exe"
Haali Media Splitter --> "C:\Program Files\Haali\MatroskaSplitter\uninstall.exe"
HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Intel® Graphics Media Accelerator Driver --> RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx2ID PCI\VEN_8086&DEV_2776 PCI\VEN_8086&DEV_2772
jacoZoom 1.5 --> MsiExec.exe /I{B69F219F-F63B-4A50-91E2-EB7E8ECDBCAF}
Java 2 Runtime Environment, SE v1.4.2_03 --> MsiExec.exe /I{7148F0A8-6813-11D6-A77B-00B0D0142030}
Kodak DIGITAL GEM Plug-In 1.1.3 --> MsiExec.exe /I{F0C10949-AF4E-426C-A57F-865562F0689B}
Kodak DIGITAL ROC Professional Plug-In 1.0.1 --> MsiExec.exe /I{98E8A908-33E9-458F-88A8-52316AC3E4C1}
Kodak DIGITAL SHO Professional Plug-In 1.0.1 --> MsiExec.exe /I{3F2155B8-1BC1-4887-BAB2-8A6D43E08242}
Lexmark Printer Software Uninstall --> C:\Program Files\Lexmark\Install\Uninstall.exe
Macromedia Dreamweaver 8 --> MsiExec.exe /I{0837A661-FEC3-48B3-876C-91E7D32048A9}
Macromedia Extension Manager --> MsiExec.exe /I{5546CDB5-2CE2-498B-B059-5B3BF81FC41F}
Macromedia Flash 8 --> MsiExec.exe /I{2BD5C305-1B27-4D41-B690-7A61172D2FEB}
Macromedia Flash 8 Video Encoder --> MsiExec.exe /X{8BF2C401-02CE-424D-BC26-6C4F9FB446B6}
Macromedia Shockwave Player --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
MAGIX Audio Cleaning Lab 12 8.0.1.0 (US) --> C:\Program Files\MAGIX\Audio_Cleaning_Lab_12\instslct.exe
MetaFrame Presentation Server Web Client for Win32 --> C:\WINDOWS\system32\ctxsetup.exe /uninst C:\PROGRA~1\Citrix\icaweb32\uninst.inf
Microsoft Office Professional Edition 2003 --> MsiExec.exe /I{91110409-6000-11D3-8CFE-0150048383C9}
Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mozilla Firefox (2.0.0.14) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Neat Image v5.2 Pro+ --> "C:\Program Files\Neat Image\unins000.exe"
nik Sharpener Pro 2.0 Complete --> C:\WINDOWS\unvise32.exe C:\Program Files\Adobe\Adobe Photoshop CS2\Plug-Ins\nik Sharpener Pro 2.0 Complete\uninstal.log
Nikon Message Center --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}\Setup.exe" -l0x9 UNINSTALL
Noiseware Professional Plug-in --> MsiExec.exe /I{0176AC71-9EDE-48A0-AC3B-94FEB38B1FFE}
PeerGuardian 2.0 --> "C:\Program Files\PeerGuardian2\unins000.exe"
PhotoArtMaster Classic --> MsiExec.exe /I{4A52630B-2CF2-47A5-937F-9E3378FD21E9}
PhotoArtMaster Limited Use Download Edition 1.0 --> MsiExec.exe /I{8BDC3836-D9CE-44F5-9C7E-9F1027951153}
Plaxo Toolbar for Outlook and Outlook Express --> C:\Program Files\Plaxo\2.13.1.3\uninstall.exe
Portrait Professional 5.0 --> "C:\Program Files\Portrait Professional 5\unins000.exe"
Portraiture Plug-in --> MsiExec.exe /I{D301EE05-D1E1-4A58-B89C-A0EFDAB491E2}
PPMate Network TV 2.0.0.40 --> C:\Program Files\PPMate\uninst.exe
Protected Music Converter 0.95 --> "C:\Program Files\WMA-MP3.com\Protected Music Converter\unins000.exe"
Proxifier version 2.7 --> "C:\Program Files\Proxifier\unins000.exe"
PTGui Pro 7.2 --> C:\Program Files\PTGui\Uninstall.exe
QuickGamma 2.0.0.3 --> "C:\Program Files\QuickGamma\unins000.exe"
Real Alternative 1.44 --> "C:\Program Files\Real Alternative\unins000.exe"
RealGrain Plug-in --> MsiExec.exe /I{687E87C0-E4C2-414A-B8A2-E2B9B83670AA}
Recruit Application --> C:\WINDOWS\system32\javaws.exe -uninstall -prompt "
http://192.168.2.237...pp/launch.jnlp"Security Update for Step By Step Interactive Training (KB898458) --> "C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe"
Security Update for Step By Step Interactive Training (KB923723) --> "C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
Sigview v1.9.8.3 --> "C:\Program Files\Sigview\unins000.exe"
Sketch --> "C:\Program Files\AKVIS\Sketch\Uninstall\Uninstall.exe" "C:\Program Files\AKVIS\Sketch\Uninstall\install.log" -u
Sony Noise Reduction Plug-In 2.0e --> MsiExec.exe /X{D533C9D4-ED96-4191-B9C3-279C0DD6BABA}
Sony Sound Forge 9.0 --> MsiExec.exe /X{6842DCCB-2840-4E46-8AF3-BEA9CFF3455B}
SopCast 1.1.2 --> C:\Program Files\SopCast\uninst.exe
SopCore 1.1.1 --> C:\Program Files\SopCast\uninst.exe
Spybot - Search & Destroy 1.4 --> "C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Spyder2 --> C:\WINDOWS\unvise32.exe C:\Program Files\PANTONE COLORVISION\uninstal.log
Total Video Converter 3.10 --> "C:\Program Files\Total Video Converter\unins000.exe"
Total Xaos-Demo --> C:\WINDOWS\IsUninst.exe -f"c:\program files\adobe\photoshop cs\plug-ins\Uninst.isu"
TurboTax ItsDeductible 2006 --> MsiExec.exe /X{AFF1EA96-9C23-4249-B7D4-CD4B54D4582F}
TVAnts 1.0 --> C:\PROGRA~1\TVAnts\UNWISE.EXE C:\PROGRA~1\TVAnts\INSTALL.LOG
TVUPlayer 2.3.2.19 --> C:\Program Files\TVUPlayer\uninst.exe
VideoLAN VLC media player 0.8.5-test1 --> C:\Program Files\VideoLAN\VLC\uninstall.exe
Virtual Painter 5 (for Photoshop) --> C:\PROGRA~1\Adobe\ADOBEP~1\Plug-Ins\vp5e\UNWISE.EXE C:\PROGRA~1\Adobe\ADOBEP~1\Plug-Ins\vp5e\INSTALL.LOG
Web Buying --> C:\Program Files\Web Buying\v1.8.4\wbuninst.exe
WeBuilder 2006 v7.4 --> "C:\Program Files\WeBuilder 2006\unins000.exe"
WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe
XviD MPEG4 Video Codec v1.0.3 (remove only) --> "C:\WINDOWS\system32\xvid-uninstall.exe"
Yahoo! Browser Services --> C:\PROGRA~1\Yahoo!\Common\UNIN_Y~1.EXE /S
Yahoo! Install Manager --> C:\WINDOWS\system32\regsvr32 /u C:\PROGRA~1\Yahoo!\Common\YINSTH~1.DLL
Yahoo! Internet Mail --> C:\WINDOWS\system32\regsvr32 /u /s C:\PROGRA~1\Yahoo!\Common\YMMAPI.dll
Yahoo! Messenger --> C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG
Yahoo! Toolbar --> C:\PROGRA~1\Yahoo!\Common\unyt.exe
-- Application Event Log -------------------------------------------------------
Event Record #/Type13107 / Warning
Event Submitted/Written: 04/17/2008 08:47:21 AM
Event ID/Source: 32068 / Microsoft Fax
Event Description:
The outgoing routing rule is not valid because it cannot find a valid device. The outgoing faxes that use this rule will not be routed. Verify that the targeted device or devices (if routed to a group of devices) is connected and installed correctly, and turned on. If routed to a group, verify that the group is configured correctly.
Country/region code: '*'
Area code: '*'
Event Record #/Type13106 / Warning
Event Submitted/Written: 04/17/2008 08:47:21 AM
Event ID/Source: 32026 / Microsoft Fax
Event Description:
Fax Service failed to initialize any assigned fax devices (virtual or TAPI).
No faxes can be sent or received until a fax device is installed.
Event Record #/Type13096 / Warning
Event Submitted/Written: 04/17/2008 08:21:45 AM
Event ID/Source: 32068 / Microsoft Fax
Event Description:
The outgoing routing rule is not valid because it cannot find a valid device. The outgoing faxes that use this rule will not be routed. Verify that the targeted device or devices (if routed to a group of devices) is connected and installed correctly, and turned on. If routed to a group, verify that the group is configured correctly.
Country/region code: '*'
Area code: '*'
Event Record #/Type13095 / Warning
Event Submitted/Written: 04/17/2008 08:21:45 AM
Event ID/Source: 32026 / Microsoft Fax
Event Description:
Fax Service failed to initialize any assigned fax devices (virtual or TAPI).
No faxes can be sent or received until a fax device is installed.
Event Record #/Type13090 / Warning
Event Submitted/Written: 04/17/2008 08:07:41 AM
Event ID/Source: 32068 / Microsoft Fax
Event Description:
The outgoing routing rule is not valid because it cannot find a valid device. The outgoing faxes that use this rule will not be routed. Verify that the targeted device or devices (if routed to a group of devices) is connected and installed correctly, and turned on. If routed to a group, verify that the group is configured correctly.
Country/region code: '*'
Area code: '*'
-- Security Event Log ----------------------------------------------------------
No Errors/Warnings found.
-- System Event Log ------------------------------------------------------------
Event Record #/Type24745 / Error
Event Submitted/Written: 04/17/2008 11:00:00 AM
Event ID/Source: 7034 / Service Control Manager
Event Description:
The IMAPI CD-Burning COM Service service terminated unexpectedly. It has done this 1 time(s).
Event Record #/Type24717 / Error
Event Submitted/Written: 04/17/2008 10:28:53 AM
Event ID/Source: 10010 / DCOM
Event Description:
The server {601AC3DC-786A-4EB0-BF40-EE3521E70BFB} did not register with DCOM within the required timeout.
Event Record #/Type24653 / Error
Event Submitted/Written: 04/17/2008 08:25:48 AM
Event ID/Source: 10010 / DCOM
Event Description:
The server {601AC3DC-786A-4EB0-BF40-EE3521E70BFB} did not register with DCOM within the required timeout.
Event Record #/Type24632 / Error
Event Submitted/Written: 04/17/2008 08:18:33 AM
Event ID/Source: 10005 / DCOM
Event Description:
DCOM got error "%%1084" attempting to start the service EventSystem with arguments ""
in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}
Event Record #/Type24628 / Error
Event Submitted/Written: 04/17/2008 08:18:09 AM
Event ID/Source: 7026 / Service Control Manager
Event Description:
The following boot-start or system-start driver(s) failed to load:
Fips
intelppm
VET-FILT
VET-REC
VETEFILE
VETMONNT
-- End of Deckard's System Scanner: finished at 2008-04-17 16:38:57 ------------