Main.txt follwed by extra.txt. thanks for the help.
Jay
Deckard's System Scanner v20071014.68
Run by Jay on 2008-08-06 14:29:57
Computer is in Normal Mode.
--------------------------------------------------------------------------------
-- System Restore --------------------------------------------------------------
-- Last 5 Restore Point(s) --
71: 2008-08-06 04:41:20 UTC - RP71 - Deckard's System Scanner Restore Point
70: 2008-08-05 18:49:21 UTC - RP70 - Installed Microsoft Office Professional Edition 2003
69: 2008-08-04 23:22:43 UTC - RP69 - System Checkpoint
68: 2008-08-03 22:30:13 UTC - RP68 - System Checkpoint
67: 2008-08-02 22:28:58 UTC - RP67 - Software Distribution Service 3.0
-- First Restore Point --
1: 2008-06-26 03:05:47 UTC - RP1 - System Checkpoint
Performed disk cleanup.
Percentage of Memory in Use: 83% (more than 75%).-- HijackThis (run as Jay.exe) -------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:30:51 PM, on 8/6/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\iolo\common\lib\ioloServiceManager.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Jim\Desktop\dss.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Jay.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKLM\..\Policies\Explorer\Run: [9OnHcEd4Ww] C:\Documents and Settings\Jim\Desktop\FlashPlayerH264Ext.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {25365FF3-2746-4230-9DA7-163CCA318309} (Automatic Driver Installation Control) -
http://inst.c-wss.co...ll/gtdownlr.cabO21 - SSODL: ApiSrv - {6E1764FA-F752-29C7-7EBF-061861B87703} - C:\Program Files\dqvtkld\ApiSrv.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: iolo System Service (ioloSystemService) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 6284 bytes
-- File Associations -----------------------------------------------------------
.js - JSFile - shell\open\command - NOTEPAD.EXE %1.reg - regfile - shell\open\command - regedit.exe "%1" %*.scr - scrfile - shell\open\command - NOTEPAD.EXE %1.vbs - VBSFile - shell\open\command - NOTEPAD.EXE %1-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------
All drivers whitelisted.
-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------
All services whitelisted.
-- Device Manager: Disabled ----------------------------------------------------
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Realtek RTL8139 Family PCI Fast Ethernet NIC
Device ID: PCI\VEN_10EC&DEV_8139&SUBSYS_813910EC&REV_10\3&61AAA01&0&28
Manufacturer: Realtek
Name: Realtek RTL8139 Family PCI Fast Ethernet NIC
PNP Device ID: PCI\VEN_10EC&DEV_8139&SUBSYS_813910EC&REV_10\3&61AAA01&0&28
Service: rtl8139
-- Process Modules -------------------------------------------------------------
C:\WINDOWS\explorer.exe (pid 1840)
2008-07-30 11:29:30 122880 --a------ C:\Program Files\dqvtkld\ApiSrv.dll
-- Files created between 2008-07-06 and 2008-08-06 -----------------------------
2008-08-06 03:11:56 0 d-------- C:\Program Files\CMUD
2008-08-06 00:37:55 202784 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-08-05 15:03:08 0 d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-08-05 15:02:36 11264 --a------ C:\WINDOWS\system32\SpOrder.dll <Not Verified; Microsoft Corporation; Microsoft® Windows NT Operating System>
2008-08-05 15:00:10 0 d-------- C:\Program Files\Microsoft ActiveSync
2008-08-05 14:52:39 0 d-------- C:\WINDOWS\SHELLNEW
2008-08-02 19:12:03 0 d-------- C:\WINDOWS\system32\CatRoot_bak
2008-08-02 18:28:51 0 d-------- C:\Program Files\SpywareBlaster
2008-08-02 18:10:40 0 d-------- C:\Documents and Settings\Jay\Application Data\Malwarebytes
2008-08-02 17:37:46 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2008-08-02 17:37:04 0 d-------- C:\WINDOWS\system32\ZoneLabs
2008-08-02 17:36:26 0 d-------- C:\WINDOWS\Internet Logs
2008-08-02 15:16:09 0 d-------- C:\Documents and Settings\Jim\Application Data\Malwarebytes
2008-08-02 15:16:00 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-02 15:15:59 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-02 15:14:51 0 d-------- C:\Program Files\Common Files\Download Manager
2008-08-02 15:04:25 0 d-------- C:\Program Files\Trend Micro
2008-07-31 13:41:44 0 d-------- C:\Program Files\Lavasoft
2008-07-31 13:41:43 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-30 11:29:30 0 d-------- C:\Program Files\dqvtkld
2008-07-30 11:29:05 0 d-------- C:\Documents and Settings\All Users\Application Data\apufofqv
2008-07-30 11:28:58 98304 --a------ C:\WINDOWS\system32\udyfibyx.exe
2008-07-30 02:50:26 0 d-------- C:\Program Files\GamesBar
2008-07-30 02:50:07 0 d-------- C:\Program Files\Common Files\Oberon Media
2008-07-30 02:50:06 0 d-------- C:\Program Files\Oberon Media
2008-07-29 22:33:05 0 d-------- C:\Program Files\FedTerm
2008-07-27 18:54:42 0 d-------- C:\Program Files\zMUD
2008-07-27 18:53:29 0 d-------- C:\Program Files\CMUD3
2008-07-27 13:25:05 0 d-------- C:\Program Files\Spyware Doctor
2008-07-27 13:25:05 0 d-------- C:\Documents and Settings\Jim\Application Data\PC Tools
2008-07-27 10:11:24 0 d-------- C:\Documents and Settings\Jim\Application Data\Google
2008-07-27 10:06:35 0 d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-07-27 10:06:31 0 d-------- C:\Program Files\Google
2008-07-25 08:45:24 0 d-------- C:\Documents and Settings\Jim\Application Data\iolo
2008-07-24 15:19:33 0 d-------- C:\Documents and Settings\LocalService\Application Data\iolo
2008-07-24 15:19:18 22528 --a------ C:\WINDOWS\system32\smrgdf.exe
2008-07-24 15:19:18 34304 --a------ C:\WINDOWS\system32\iolobtdfg.exe
2008-07-24 15:19:12 0 d-------- C:\Program Files\iolo
2008-07-23 13:55:56 0 d-------- C:\Program Files\Microsoft Money Plus
2008-07-17 10:44:43 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-16 16:28:12 0 d-------- C:\Documents and Settings\Jay\Application Data\Netscape
2008-07-15 10:13:49 0 d-------- C:\Documents and Settings\Jim\Application Data\Netscape
2008-07-15 10:13:37 0 d-------- C:\Program Files\Netscape
2008-07-10 02:57:42 0 d-------- C:\WINDOWS\Sun
2008-07-10 02:57:42 0 d-------- C:\Documents and Settings\Jay\Application Data\Sun
2008-07-10 02:55:49 0 d-------- C:\Program Files\Java
2008-07-10 02:52:27 0 d-------- C:\Program Files\Common Files\Java
2008-07-08 00:55:01 0 d-------- C:\Program Files\Symantec
2008-07-08 00:54:44 0 d-------- C:\Program Files\Symantec AntiVirus
2008-07-08 00:54:44 0 d-------- C:\Program Files\Common Files\Symantec Shared
2008-07-08 00:54:44 0 d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2008-07-06 01:03:10 0 d---s---- C:\Documents and Settings\Jay\UserData
-- Find3M Report ---------------------------------------------------------------
2008-08-05 23:15:19 0 d-------- C:\Documents and Settings\Jay\Application Data\Move Networks
2008-08-05 14:55:27 0 d-------- C:\Program Files\Common Files
2008-07-24 17:01:33 0 d-------- C:\Documents and Settings\Jay\Application Data\iolo
2008-07-04 22:46:07 0 d-------- C:\Program Files\IrfanView
2008-06-30 21:30:45 0 d-------- C:\Documents and Settings\Jay\Application Data\Microsoft Web Folders
2008-06-30 17:29:49 0 d-------- C:\Documents and Settings\Jay\Application Data\Adobe
2008-06-28 08:27:40 0 --a------ C:\WINDOWS\ativpsrm.bin
2008-06-27 21:06:42 0 d-------- C:\Program Files\Messenger
2008-06-26 14:13:08 0 d-------- C:\Documents and Settings\Jay\Application Data\Help
2008-06-26 14:11:01 0 d-------- C:\Program Files\Common Files\Adobe
2008-06-26 13:51:54 0 d-------- C:\Documents and Settings\Jay\Application Data\Gtek
2008-06-26 13:27:00 0 d-------- C:\Documents and Settings\Jay\Application Data\Macromedia
2008-06-26 00:13:06 0 d-------- C:\Program Files\microsoft frontpage
2008-06-26 00:07:33 0 d-------- C:\Documents and Settings\Jay\Application Data\Mozilla
2008-06-26 00:03:53 0 --a------ C:\WINDOWS\nsreg.dat
2008-06-25 23:34:43 0 d-------- C:\Program Files\Yahoo!
2008-06-25 23:24:52 74703 --a------ C:\WINDOWS\system32\mfc45.dll
2008-06-25 23:14:34 0 d-------- C:\Program Files\Windows Media Connect 2
2008-06-25 23:05:29 0 d-------- C:\Documents and Settings\Jay\Application Data\Identities
2008-06-25 22:51:31 0 -rahs---- C:\MSDOS.SYS
2008-06-25 22:51:31 0 -rahs---- C:\IO.SYS
2008-06-25 22:51:31 0 --a------ C:\CONFIG.SYS
2008-06-25 22:51:31 0 --a------ C:\AUTOEXEC.BAT
2008-06-25 22:49:39 0 d--h----- C:\Program Files\WindowsUpdate
2008-06-25 22:49:34 0 d-------- C:\Program Files\Online Services
2008-06-25 22:48:33 0 d-------- C:\Program Files\Common Files\MSSoap
2008-06-25 22:48:22 0 d-------- C:\Program Files\Movie Maker
2008-06-25 22:47:48 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat
2008-06-25 22:46:41 0 d-------- C:\Program Files\MSN Gaming Zone
2008-06-25 22:46:29 0 d-------- C:\Program Files\Windows NT
2008-06-25 18:37:37 0 d-------- C:\Program Files\Common Files\ODBC
2008-06-25 18:37:34 0 d-------- C:\Program Files\Common Files\SpeechEngines
2008-06-25 18:37:04 62 --ahs---- C:\Documents and Settings\Jay\Application Data\desktop.ini
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AlcxMonitor"="ALCXMNTR.EXE" [09/07/2004 01:47 PM C:\WINDOWS\ALCXMNTR.EXE]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [11/21/2006 05:38 PM]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [03/14/2007 07:49 PM]
"SMSystemAnalyzer"="C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe" [05/06/2008 04:36 PM]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [07/09/2008 09:05 AM]
"ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [02/01/2008 12:55 PM]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [02/28/2006 08:00 AM]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [07/07/2008 09:42 AM]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]
"9OnHcEd4Ww"=C:\Documents and Settings\Jim\Desktop\FlashPlayerH264Ext.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"ApiSrv"= {6E1764FA-F752-29C7-7EBF-061861B87703} - C:\Program Files\dqvtkld\ApiSrv.dll [07/30/2008 11:29 AM 122880]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"
-- Hosts -----------------------------------------------------------------------
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
8940 more entries in hosts file.
-- End of Deckard's System Scanner: finished at 2008-08-06 14:33:52 ------------
Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------
-- System Information ----------------------------------------------------------
Microsoft Windows XP Home Edition (build 2600) SP 2.0
Architecture: X86; Language: English
CPU 0: AMD Athlon XP 2400+
Percentage of Memory in Use: 61%
Physical Memory (total/avail): 511.48 MiB / 194.56 MiB
Pagefile Memory (total/avail): 1250.25 MiB / 672.12 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1932.3 MiB
A: is Removable (No Media)
C: is Fixed (NTFS) - 111.8 GiB total, 100.62 GiB free.
D: is CDROM (No Media)
E: is CDROM (No Media)
\\.\PHYSICALDRIVE0 - SAMSUNG SV1204H - 111.81 GiB - 1 partition
\PARTITION0 (bootable) - Installable File System - 111.8 GiB - C:
-- Security Center -------------------------------------------------------------
AUOptions is set to notify before download.
Windows Internal Firewall is disabled.
FirstRunDisabled is set.
FW: ZoneAlarm Firewall v7.0.483.000 (Check Point, LTD.)
AV: Symantec AntiVirus Corporate Edition v10.1.6.6000 (Symantec Corporation)
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
-- Environment Variables -------------------------------------------------------
ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Jay\Application Data
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=MAINOFFICE
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Jay
LOGONSERVER=\\MAINOFFICE
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 8 Stepping 1, AuthenticAMD
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0801
ProgramFiles=C:\Program Files
PROMPT=$P$G
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\Jay\LOCALS~1\Temp
TMP=C:\DOCUME~1\Jay\LOCALS~1\Temp
tvdumpflags=8
USERDOMAIN=MAINOFFICE
USERNAME=Jay
USERPROFILE=C:\Documents and Settings\Jay
windir=C:\WINDOWS
-- User Profiles ---------------------------------------------------------------
Jay
(admin)Jim
(admin)-- Add/Remove Programs ---------------------------------------------------------
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742) --> MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin --> C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 8.1.2 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003}
Adobe Reader 8.1.2 Security Update 1 (KB403742) -->
ATI Display Driver --> rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
Bejeweled 2 Deluxe --> "C:\Program Files\Oberon Media\Bejeweled 2 Deluxe\Uninstall.exe" "C:\Program Files\Oberon Media\Bejeweled 2 Deluxe\install.log"
Canon PIXMA iP3000 --> C:\WINDOWS\system32\CNMCP61.exe "-PRINTERNAMECanon PIXMA iP3000" "-HELPERDLLC:\BJPrinter\CNMWINDOWS\Canon PIXMA iP3000 Installer\Inst2\cnmis.dll" "-RCDLLC:\BJPrinter\CNMWINDOWS\Canon PIXMA iP3000 Installer\Inst2\cnmi0409.dll"
CMUD 2.35 --> C:\Program Files\CMUD\uninst.exe
FedTerm v2.02 --> "C:\Program Files\FedTerm\unins000.exe"
Google Earth --> MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
Google Updater --> "C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399) --> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
iolo technologies' System Mechanic 7 --> "C:\Program Files\iolo\System Mechanic 7\unins000.exe"
IrfanView (remove only) --> C:\Program Files\IrfanView\iv_uninstall.exe
Java 6 Update 7 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
LiveUpdate 3.1 (Symantec Corporation) --> "C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
Malwarebytes' Anti-Malware --> "C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Money Plus --> "C:\Program Files\Microsoft Money Plus\MNYCoreFiles\Setup\uninst.exe" /s:120
Microsoft Money Shared Libraries --> MsiExec.exe /X{7F1B3341-A94E-4F5C-B587-CA0EB964221E}
Microsoft Office Professional Edition 2003 --> MsiExec.exe /I{90110409-6000-11D3-8CFE-0150048383C9}
Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Mozilla Firefox (3.0.1) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Spybot - Search & Destroy --> "C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Spyware Doctor 5.5 --> C:\Program Files\Spyware Doctor\unins000.exe /LOG
SpywareBlaster 4.1 --> "C:\Program Files\SpywareBlaster\unins000.exe"
Symantec AntiVirus --> MsiExec.exe /I{50E125D1-88E5-48CE-80AE-98EC9698E639}
VIA Rhine-Family Fast Ethernet Adapter --> Rundll32.exe vuins32.dll,vuins32Ex $Rhine $VIA
Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Yahoo! Messenger --> C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG
zMUD 7.21.0.0 --> C:\Program Files\zMUD\uninst.exe
ZoneAlarm --> C:\Program Files\Zone Labs\ZoneAlarm\zauninst.exe
-- Application Event Log -------------------------------------------------------
Event Record #/Type455 / Error
Event Submitted/Written: 08/06/2008 00:53:33 AM
Event ID/Source: 1002 / Application Hang
Event Description:
Hanging application SpybotSD.exe, version 1.6.0.30, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Event Record #/Type445 / Warning
Event Submitted/Written: 08/05/2008 03:03:44 PM
Event ID/Source: 63 / WinMgmt
Event Description:
A provider, OffProv11, has been registered in the WMI namespace, Root\MSAPPS11, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.
Event Record #/Type433 / Error
Event Submitted/Written: 08/05/2008 02:17:19 PM
Event ID/Source: 1002 / Application Hang
Event Description:
Hanging application WINWORD.EXE, version 9.0.0.2717, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Event Record #/Type432 / Error
Event Submitted/Written: 08/05/2008 02:16:43 PM
Event ID/Source: 1002 / Application Hang
Event Description:
Hanging application WINWORD.EXE, version 9.0.0.2717, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Event Record #/Type431 / Error
Event Submitted/Written: 08/05/2008 02:12:08 PM
Event ID/Source: 1002 / Application Hang
Event Description:
Hanging application WINWORD.EXE, version 9.0.0.2717, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
-- Security Event Log ----------------------------------------------------------
No Errors/Warnings found.
-- System Event Log ------------------------------------------------------------
Event Record #/Type2421 / Error
Event Submitted/Written: 08/06/2008 09:57:38 AM / 08/06/2008 09:58:20 AM
Event ID/Source: 12294 / ati2mtag
Event Description:
CRT invalid display type
Event Record #/Type2409 / Error
Event Submitted/Written: 08/06/2008 09:44:24 AM
Event ID/Source: 12294 / ati2mtag
Event Description:
CRT invalid display type
Event Record #/Type2391 / Error
Event Submitted/Written: 08/06/2008 02:42:49 AM
Event ID/Source: 7000 / Service Control Manager
Event Description:
The PC Tools Security Service service failed to start due to the following error:
%%1053
Event Record #/Type2390 / Error
Event Submitted/Written: 08/06/2008 02:42:49 AM
Event ID/Source: 7009 / Service Control Manager
Event Description:
Timeout (30000 milliseconds) waiting for the PC Tools Security Service service to connect.
Event Record #/Type2389 / Error
Event Submitted/Written: 08/06/2008 02:39:02 AM / 08/06/2008 02:39:32 AM
Event ID/Source: 12294 / ati2mtag
Event Description:
CRT invalid display type
-- End of Deckard's System Scanner: finished at 2008-08-06 14:33:52 ------------