I am trying to "Clean" my daughters computer.
The problem it had when I got it was the computer would "Shut Down" when it started loading windows..
I replaced the 256 memory with 2 512's and it no longer shuts down..
But there is a definate problem.
I think it may be malware? I am not sure...
I do keep getting " recovering from a critical error message" ??
I sure hope someone can help me...
The computer I am working is:
OS Name Microsoft Windows XP Home Edition
Version 5.1.2600 Service Pack 3 Build 2600
OS Manufacturer Microsoft Corporation
System Manufacturer Gateway
System Model T3414
System Type X86-based PC
Processor x86 Family 15 Model 4 Stepping 9 GenuineIntel ~3061 Mhz
BIOS Version/Date Phoenix Technologies, LTD 6.00 PG, 1/3/2006
SMBIOS Version 2.3
Windows Directory C:\WINDOWS
System Directory C:\WINDOWS\system32
Boot Device \Device\HarddiskVolume1
Locale United States
Total Physical Memory 512.00 MB
Available Physical Memory 134.73 MB
Total Virtual Memory 2.00 GB
Available Virtual Memory 1.95 GB
Page File Space 668.91 MB
I have followed the "malware and Cleaning Guide" but I ran into a few problems...
TFC (Temp File Cleaner)- Done
System Restore -Done
ERUNT- Done
and now the problems begin...
Malwarebytes' Anti-Malware- Will install but when I try to open it and start a scan.... Nothing.. Tried to change the name....Nothing.. It will not open..
Viruses/Trojans- anti virus program- Same problem as Malware program.. will not open
Windows Update -Done
RootRepeal -Done
Hijack this- Done
I will post the logs...
I hope this is enough information..
Thank You
ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/10/21 23:15
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================
Drivers
-------------------
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xF56FD000 Size: 98304 File Visible: No Signed: -
Status: -
Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF7B46000 Size: 8192 File Visible: No Signed: -
Status: -
Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xEFFFE000 Size: 49152 File Visible: No Signed: -
Status: -
Hidden Services
-------------------
Service Name: UACd.sys
Image Path: C:\WINDOWS\system32\drivers\UACtexmnswempqmafwkp.sys
==EOF==
ROOTREPEAL © AD, 2007-2009==================================================
Scan Start Time: 2009/10/21 23:16
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================
Drivers
-------------------
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xF56FD000 Size: 98304 File Visible: No Signed: -
Status: -
Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF7B46000 Size: 8192 File Visible: No Signed: -
Status: -
Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xEFFFE000 Size: 49152 File Visible: No Signed: -
Status: -
Hidden/Locked Files
-------------------
Path: C:\hiberfil.sys
Status: Locked to the Windows API!
Path: C:\WINDOWS\system32\UACagvsvptblnqlrxjok.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACbouutncvgi.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACftewivnksibmkjlxb.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UAChpdkerfolw.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\uacinit.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACmyurtlwxid.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACnmtnpsbvpdswviqin.dat
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACpievppphut.dat
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACqpphwbuyfq.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACriwucbfpfe.dat
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACwbuxoqmqvr.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACwdjqbrrnav.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\Temp\UAC551b.tmp
Status: Invisible to the Windows API!
Path: C:\WINDOWS\Temp\UAC810d.tmp
Status: Invisible to the Windows API!
Path: C:\WINDOWS\Temp\UAC813c.tmp
Status: Invisible to the Windows API!
Path: C:\WINDOWS\Temp\UAC85ef.tmp
Status: Invisible to the Windows API!
Path: C:\WINDOWS\Temp\UAC9030.tmp
Status: Invisible to the Windows API!
Path: C:\WINDOWS\Temp\UAC9b2c.tmp
Status: Invisible to the Windows API!
Path: C:\WINDOWS\Temp\UACb210.tmp
Status: Invisible to the Windows API!
Path: C:\WINDOWS\Temp\UACb2fa.tmp
Status: Invisible to the Windows API!
Path: C:\WINDOWS\Temp\UACb694.tmp
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\drivers\UACtexmnswempqmafwkp.sys
Status: Invisible to the Windows API!
Path: C:\Documents and Settings\Owner\Local Settings\Temp\UAC1e58.tmp
Status: Invisible to the Windows API!
Path: C:\Documents and Settings\Owner\Local Settings\Temp\UAC7ecc.tmp
Status: Invisible to the Windows API!
Path: C:\Documents and Settings\Owner\Local Settings\Temp\UAC8004.tmp
Status: Invisible to the Windows API!
Path: c:\documents and settings\owner\local settings\temp\~df1f1b.tmp
Status: Allocation size mismatch (API: 16384, Raw: 0)
Path: c:\documents and settings\owner\local settings\temp\~df2764.tmp
Status: Allocation size mismatch (API: 16384, Raw: 0)
Path: c:\documents and settings\owner\local settings\temp\~df423a.tmp
Status: Allocation size mismatch (API: 16384, Raw: 0)
Path: c:\documents and settings\owner\local settings\temp\~df4f02.tmp
Status: Allocation size mismatch (API: 16384, Raw: 0)
Path: c:\documents and settings\owner\local settings\temp\~df506f.tmp
Status: Allocation size mismatch (API: 16384, Raw: 0)
Path: c:\documents and settings\owner\local settings\temp\~df7439.tmp
Status: Allocation size mismatch (API: 16384, Raw: 0)
Path: c:\documents and settings\owner\local settings\temp\~dfab68.tmp
Status: Allocation size mismatch (API: 16384, Raw: 0)
Path: c:\documents and settings\owner\local settings\temp\~dfab70.tmp
Status: Allocation size mismatch (API: 32768, Raw: 16384)
Path: c:\documents and settings\owner\local settings\temp\~dfab78.tmp
Status: Allocation size mismatch (API: 163840, Raw: 16384)
Path: c:\documents and settings\owner\local settings\temp\~dfab80.tmp
Status: Allocation size mismatch (API: 16384, Raw: 0)
Path: c:\documents and settings\owner\local settings\temp\~dfab88.tmp
Status: Allocation size mismatch (API: 65536, Raw: 16384)
Path: c:\documents and settings\owner\local settings\temp\~dfac75.tmp
Status: Allocation size mismatch (API: 24576, Raw: 0)
Path: c:\documents and settings\owner\local settings\temp\~dfc3e1.tmp
Status: Allocation size mismatch (API: 16384, Raw: 0)
Path: c:\documents and settings\owner\local settings\temp\~dfd465.tmp
Status: Allocation size mismatch (API: 16384, Raw: 0)
Stealth Objects
-------------------
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: winlogon.exe (PID: 500) Address: 0x00790000 Size: 45056
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: winlogon.exe (PID: 500) Address: 0x008f0000 Size: 49152
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: services.exe (PID: 552) Address: 0x007a0000 Size: 45056
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: services.exe (PID: 552) Address: 0x00900000 Size: 49152
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: lsass.exe (PID: 564) Address: 0x00840000 Size: 45056
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: lsass.exe (PID: 564) Address: 0x009d0000 Size: 49152
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: svchost.exe (PID: 732) Address: 0x00850000 Size: 45056
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: svchost.exe (PID: 732) Address: 0x009a0000 Size: 49152
Object: Hidden Module [Name: UACagvsvptblnqlrxjok.dll]
Process: svchost.exe (PID: 732) Address: 0x00cb0000 Size: 73728
Object: Hidden Module [Name: UACqpphwbuyfq.dll]
Process: svchost.exe (PID: 804) Address: 0x00850000 Size: 204800
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: svchost.exe (PID: 804) Address: 0x00950000 Size: 45056
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: svchost.exe (PID: 804) Address: 0x009e0000 Size: 49152
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: svchost.exe (PID: 876) Address: 0x00850000 Size: 45056
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: svchost.exe (PID: 876) Address: 0x009a0000 Size: 49152
Object: Hidden Module [Name: UACqpphwbuyfq.dll]
Process: svchost.exe (PID: 940) Address: 0x00850000 Size: 204800
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: svchost.exe (PID: 940) Address: 0x00950000 Size: 45056
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: svchost.exe (PID: 940) Address: 0x009e0000 Size: 49152
Object: Hidden Module [Name: UACqpphwbuyfq.dll]
Process: svchost.exe (PID: 1028) Address: 0x00850000 Size: 204800
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: svchost.exe (PID: 1028) Address: 0x00950000 Size: 45056
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: svchost.exe (PID: 1028) Address: 0x009e0000 Size: 49152
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: Explorer.EXE (PID: 1292) Address: 0x00ae0000 Size: 45056
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: Explorer.EXE (PID: 1292) Address: 0x00ed0000 Size: 49152
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: spoolsv.exe (PID: 1408) Address: 0x00ac0000 Size: 45056
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: spoolsv.exe (PID: 1408) Address: 0x00c30000 Size: 49152
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: shwiconem.exe (PID: 1772) Address: 0x00bf0000 Size: 45056
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: shwiconem.exe (PID: 1772) Address: 0x00d60000 Size: 49152
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: VTTimer.exe (PID: 1784) Address: 0x00c40000 Size: 45056
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: VTTimer.exe (PID: 1784) Address: 0x00da0000 Size: 49152
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: VTtrayp.exe (PID: 1796) Address: 0x00c10000 Size: 45056
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: VTtrayp.exe (PID: 1796) Address: 0x00d60000 Size: 49152
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: PDVDServ.exe (PID: 1816) Address: 0x00bd0000 Size: 45056
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: PDVDServ.exe (PID: 1816) Address: 0x00d40000 Size: 49152
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: SOUNDMAN.EXE (PID: 1824) Address: 0x00d60000 Size: 49152
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: SOUNDMAN.EXE (PID: 1824) Address: 0x00c20000 Size: 45056
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: qttask.exe (PID: 1856) Address: 0x00be0000 Size: 45056
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: qttask.exe (PID: 1856) Address: 0x00d50000 Size: 49152
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: NetFilter.exe (PID: 1868) Address: 0x01080000 Size: 49152
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: NetFilter.exe (PID: 1868) Address: 0x10000000 Size: 45056
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: jusched.exe (PID: 1936) Address: 0x00e40000 Size: 45056
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: jusched.exe (PID: 1936) Address: 0x00fb0000 Size: 49152
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: ctfmon.exe (PID: 1948) Address: 0x00a60000 Size: 45056
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: ctfmon.exe (PID: 1948) Address: 0x00bb0000 Size: 49152
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: msmsgs.exe (PID: 1980) Address: 0x00b70000 Size: 45056
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: msmsgs.exe (PID: 1980) Address: 0x00cd0000 Size: 49152
Object: Hidden Module [Name: UACqpphwbuyfq.dll]
Process: svchost.exe (PID: 436) Address: 0x00850000 Size: 204800
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: svchost.exe (PID: 436) Address: 0x00950000 Size: 45056
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: svchost.exe (PID: 436) Address: 0x009e0000 Size: 49152
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: jqs.exe (PID: 856) Address: 0x007f0000 Size: 45056
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: jqs.exe (PID: 856) Address: 0x00950000 Size: 49152
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: PRISMXL.SYS (PID: 988) Address: 0x00b90000 Size: 49152
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: PRISMXL.SYS (PID: 988) Address: 0x10000000 Size: 45056
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: wdfmgr.exe (PID: 1236) Address: 0x006e0000 Size: 45056
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: wdfmgr.exe (PID: 1236) Address: 0x00840000 Size: 49152
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: alg.exe (PID: 1988) Address: 0x00770000 Size: 45056
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: alg.exe (PID: 1988) Address: 0x008e0000 Size: 49152
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: iexplore.exe (PID: 3856) Address: 0x00c80000 Size: 45056
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: iexplore.exe (PID: 3856) Address: 0x00df0000 Size: 49152
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: iexplore.exe (PID: 444) Address: 0x00c80000 Size: 45056
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: iexplore.exe (PID: 444) Address: 0x00df0000 Size: 49152
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: Iexplore.exe (PID: 3884) Address: 0x00c80000 Size: 45056
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: Iexplore.exe (PID: 3884) Address: 0x00df0000 Size: 49152
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: Iexplore.exe (PID: 3748) Address: 0x00c80000 Size: 45056
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: Iexplore.exe (PID: 3748) Address: 0x00df0000 Size: 49152
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: taskmgr.exe (PID: 2064) Address: 0x00ad0000 Size: 45056
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: taskmgr.exe (PID: 2064) Address: 0x00c30000 Size: 49152
Object: Hidden Module [Name: UACwdjqbrrnav.dll]
Process: RootRepeal.exe (PID: 848) Address: 0x00f50000 Size: 49152
Object: Hidden Module [Name: UACmyurtlwxid.dll]
Process: RootRepeal.exe (PID: 848) Address: 0x10000000 Size: 45056
Hidden Services
-------------------
Service Name: UACd.sys
Image Path: C:\WINDOWS\system32\drivers\UACtexmnswempqmafwkp.sys
==EOF==
Logfile of Trend Micro HijackThis v2.0.2Scan saved at 6:30:47 AM, on 10/22/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\Iexplore.exe
C:\WINDOWS\system32\spoolsv.exe
c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\MGtools\analyse.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R3 - URLSearchHook: (no name) - CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {A77D3539-581D-450C-9E44-A84C415A6172} - (no file)
O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Adware_ProNET] C:\Program Files\AdwarePro\Adware_Pro.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Search - http://edits.mywebse...?p=ZKxdm176YYUS
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfar...etup1.0.1.1.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://games.myspace...ronGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O21 - SSODL: tudefokob - {e044bb4e-1cb4-42ea-849d-f315c20dbabb} - (no file)
O22 - SharedTaskScheduler: kupuhivus - {e044bb4e-1cb4-42ea-849d-f315c20dbabb} - (no file)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
--
End of file - 5006 bytes