Google search result links redirected

Question

I'm running Windows XP (SP3), using IE 7 and am having troubles with IE redirecting my Google search result links through "phrasesearch.net". My only work-around that I have found so far is to CTRL-click a search result link and it will open the correct link in a new tab. But, a majority of my search results are redirecting through "phrasesearch.net" I've downloaded and ran a system scan using HijackThis. Below is the log file generated. Any help deciphering would be greatly appreciated.

I have iolo AntiVirus installed and it scans regularly and has found nothing, I also run SpyBot Search & Destroy, but nothing is fixing this problem.

HijackThis Log File:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:40:45 AM, on 1/30/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\iolo\common\lib\ioloServiceManager.exe
C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMWDSrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ARPWRMSG.EXE
C:\Program Files\DISC\DISCover.exe
C:\Program Files\DISC\DiscUpdateMgr.exe
C:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe
C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\DISC\DiscGui.exe
C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\StartAutorun.exe
C:\Program Files\iolo\AntiVirus\ioloAV.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMConfig.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMProcess.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\iolo\AntiVirus\iAVEmailScanner.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\DISC\DiscStreamHub.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
c:\windows\system\hpsysdrv.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\sorry.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: hpWebHelper Class - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [DISCover] C:\Program Files\DISC\DISCover.exe
O4 - HKLM\..\Run: [DiscUpdateManager] C:\Program Files\DISC\DiscUpdateMgr.exe
O4 - HKLM\..\Run: [DMAScheduler] c:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe"
O4 - HKLM\..\Run: [KMCONFIG] C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\StartAutorun.exe KMConfig.exe
O4 - HKLM\..\Run: [iolo AntiVirus] "C:\Program Files\iolo\AntiVirus\ioloAV.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\iavlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iavlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iavlsp.dll
O15 - Trusted Zone: http://*.trymedia.com (HKLM)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by118w.bay118.mail.live.com/mail/resources/MsnPUpld.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {BBF89515-EDB6-4236-8FBB-B6045290076D} (Image Uploader ShellCombo Control) - http://c.ancestry.com/trees/upload/ImageUploader4.cab
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} (Java Runtime Environment 1.5.0) - https://timekeeper.cmh.edu/wfcstatic/plugins/jre-1_5_0_09-windows-i586-p.exe
O20 - AppInit_DLLs: \\?\globalroot\systemroot\system32\senekawi.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: iolo System Service (ioloSystemService) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMWDSrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

--
End of file - 12183 bytes

bamajim · Answer

millercolby 1. Go HERE and download File Lister. Save it to your Desktop Rt Click ->> Extract all ->> And extract it to your Desktop Additional help on extracting zip files can be found HERE Open the File Lister Folder. Rt Click FileLister.vbe ->>Select Open Then Open to confirm. As the program runs, it will appear that nothing is happening. When the program is fnished it will produce a log for you C:\Files.txt Copy and paste the contents of that log in your reply.

millercolby · Answer

Thanks bamajim.....Here's the log file from File Lister:++++++++++++++++++++++++++++++++++ File Lister  Version 1.0.5++  By bamajim / bamajim.com+++++++++++++++++++++++++++++++++ Report ran on --->>>  1/30/2009 9:27:54 AM ====== Running Processes ====== C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Windows Defender\MsMpEng.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\WINDOWS\arservice.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exeC:\WINDOWS\eHome\ehRecvr.exeC:\WINDOWS\eHome\ehSched.exeC:\Program Files\iolo\common\lib\ioloServiceManager.exeC:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMWDSrv.exeC:\Program Files\Common Files\LightScribe\LSSrvc.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\dllhost.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\ehome\ehtray.exeC:\WINDOWS\ARPWRMSG.EXEC:\Program Files\DISC\DISCover.exeC:\Program Files\DISC\DiscUpdateMgr.exeC:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exeC:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exeC:\HP\KBD\KBD.EXEC:\Program Files\DISC\DiscGui.exeC:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\StartAutorun.exeC:\Program Files\iolo\AntiVirus\ioloAV.exeC:\WINDOWS\eHome\ehmsas.exeC:\Program Files\iTunes\iTunesHelper.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMConfig.exeC:\Program Files\Windows Defender\MSASCui.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\FinePixViewer\QuickDCF.exeC:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMProcess.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\iolo\AntiVirus\iAVEmailScanner.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\DISC\DiscStreamHub.exeC:\WINDOWS\ALCXMNTR.EXEC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exec:\windows\system\hpsysdrv.exeC:\Program Files\Java\jre6\bin\jusched.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeC:\WINDOWS\System32\CScript.exe ====== BHO's under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects ====== BHO: (NO NAME) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll BHO: (NO NAME) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll BHO: (NO NAME) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll BHO: (NO NAME) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll BHO: (NO NAME) - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll BHO: (NO NAME) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL ====== Values under HKLM\~\Run ====== REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]'ehTray'='C:\WINDOWS\ehome\ehtray.exe''AlwaysReady Power Message APP'='ARPWRMSG.EXE''DISCover'='C:\Program Files\DISC\DISCover.exe''DiscUpdateManager'='C:\Program Files\DISC\DiscUpdateMgr.exe''DMAScheduler'='c:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe''Recguard'='C:\WINDOWS\SMINST\RECGUARD.EXE''PCDrProfiler'='''HPBootOp'='\'C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe\' /run''REGSHAVE'='C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN''AdobeVersionCue'='C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe''KBD'='C:\HP\KBD\KBD.EXE''TkBellExe'='\'C:\Program Files\Common Files\Real\Update_OB\realsched.exe\'  -osboot''SMSystemAnalyzer'='\'C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe\'''KMCONFIG'='C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\StartAutorun.exe KMConfig.exe''iolo AntiVirus'='\'C:\Program Files\iolo\AntiVirus\ioloAV.exe\'''QuickTime Task'='\'C:\Program Files\QuickTime\qttask.exe\' -atboottime''iTunesHelper'='\'C:\Program Files\iTunes\iTunesHelper.exe\'''SunJavaUpdateSched'='\'C:\Program Files\Java\jre6\bin\jusched.exe\'''Windows Defender'='\'C:\Program Files\Windows Defender\MSASCui.exe\' -hide' [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]'Installed'='1' [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]'Installed'='1''NoChange'='1' [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]'Installed'='1' ====== Values under HKCU\~\Run ====== REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]'ctfmon.exe'='C:\WINDOWS\system32\ctfmon.exe' ====== Folders and Files from '%\' and '%\Windows' Created Last 60 Days ====== 12/29/2008 8:15:12 PM    51147189    C:\Ancestry Stuff1/14/2009 5:28:01 PM    50897333    C:\Ancestry Stuff\Robert C. Miller's info on Footnote.com12/29/2008 8:15:20 PM    249856    C:\Ancestry Stuff\Robert L. Miller's Navy Diary1/6/2009 7:49:55 AM    141578065    C:\Family Photos1/6/2009 5:12:43 PM    4814421    C:\Family Photos\for ancestry.com1/11/2009 4:47:12 PM    13202128    C:\Family Photos\Photos with descriptions1/6/2009 5:42:16 PM    33692968    C:\Family Photos\uploaded to ancestry1/30/2009 9:27:54 AM    5539    32    C:\Files.txt1/23/2009 8:15:19 AM    441909957    C:\WINDOWS\$NtServicePackUninstall$1/23/2009 8:15:19 AM    2712549    C:\WINDOWS\$NtServicePackUninstall$\spuninst1/23/2009 8:38:53 AM    634508    C:\WINDOWS\$NtUninstallKB938464$1/23/2009 8:38:53 AM    622203    C:\WINDOWS\$NtUninstallKB938464$\spuninst1/23/2009 8:39:07 AM    717971    C:\WINDOWS\$NtUninstallKB946648$1/23/2009 8:39:07 AM    622596    C:\WINDOWS\$NtUninstallKB946648$\spuninst1/23/2009 8:39:21 AM    838003    C:\WINDOWS\$NtUninstallKB950762$1/23/2009 8:39:21 AM    622948    C:\WINDOWS\$NtUninstallKB950762$\spuninst1/23/2009 8:39:35 AM    881549    C:\WINDOWS\$NtUninstallKB950974$1/23/2009 8:39:35 AM    622846    C:\WINDOWS\$NtUninstallKB950974$\spuninst1/23/2009 8:39:47 AM    1327031    C:\WINDOWS\$NtUninstallKB951066$1/23/2009 8:39:47 AM    622888    C:\WINDOWS\$NtUninstallKB951066$\spuninst1/23/2009 8:40:04 AM    908739    C:\WINDOWS\$NtUninstallKB951376$1/23/2009 8:40:04 AM    623284    C:\WINDOWS\$NtUninstallKB951376$\spuninst1/23/2009 8:40:17 AM    908030    C:\WINDOWS\$NtUninstallKB951376-v2$1/23/2009 8:40:17 AM    623471    C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst1/23/2009 8:40:30 AM    1923497    C:\WINDOWS\$NtUninstallKB951698$1/23/2009 8:40:30 AM    622874    C:\WINDOWS\$NtUninstallKB951698$\spuninst1/23/2009 8:40:45 AM    1761608    C:\WINDOWS\$NtUninstallKB951748$1/23/2009 8:40:45 AM    624487    C:\WINDOWS\$NtUninstallKB951748$\spuninst1/23/2009 7:23:46 PM    2448123    C:\WINDOWS\$NtUninstallKB951978$1/23/2009 7:23:46 PM    629499    C:\WINDOWS\$NtUninstallKB951978$\spuninst12/11/2008 3:01:04 AM    4119130    C:\WINDOWS\$NtUninstallKB952069_WM9$12/11/2008 3:01:04 AM    629338    C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst1/23/2009 8:40:59 AM    967284    C:\WINDOWS\$NtUninstallKB952287$1/23/2009 8:40:59 AM    623077    C:\WINDOWS\$NtUninstallKB952287$\spuninst1/23/2009 8:41:13 AM    709026    C:\WINDOWS\$NtUninstallKB952954$1/23/2009 8:41:13 AM    622867    C:\WINDOWS\$NtUninstallKB952954$\spuninst1/23/2009 8:41:31 AM    2481261    C:\WINDOWS\$NtUninstallKB954211$1/23/2009 8:41:31 AM    622900    C:\WINDOWS\$NtUninstallKB954211$\spuninst1/23/2009 7:23:35 PM    1930150    C:\WINDOWS\$NtUninstallKB954459$1/23/2009 7:23:35 PM    623526    C:\WINDOWS\$NtUninstallKB954459$\spuninst1/23/2009 8:41:44 AM    880481    C:\WINDOWS\$NtUninstallKB954600$1/23/2009 8:41:44 AM    622955    C:\WINDOWS\$NtUninstallKB954600$\spuninst12/10/2008 3:01:04 AM    875955    C:\WINDOWS\$NtUninstallKB954600_0$12/10/2008 3:01:04 AM    629141    C:\WINDOWS\$NtUninstallKB954600_0$\spuninst1/23/2009 8:42:00 AM    1742322    C:\WINDOWS\$NtUninstallKB955069$1/23/2009 8:42:00 AM    622947    C:\WINDOWS\$NtUninstallKB955069$\spuninst12/10/2008 3:03:51 AM    692846    C:\WINDOWS\$NtUninstallKB955839$12/10/2008 3:03:51 AM    629870    C:\WINDOWS\$NtUninstallKB955839$\spuninst1/23/2009 8:42:16 AM    918255    C:\WINDOWS\$NtUninstallKB956802$1/23/2009 8:42:16 AM    622871    C:\WINDOWS\$NtUninstallKB956802$\spuninst12/11/2008 3:00:55 AM    911878    C:\WINDOWS\$NtUninstallKB956802_0$12/11/2008 3:00:55 AM    629254    C:\WINDOWS\$NtUninstallKB956802_0$\spuninst1/23/2009 8:42:27 AM    773924    C:\WINDOWS\$NtUninstallKB956803$1/23/2009 8:42:27 AM    622997    C:\WINDOWS\$NtUninstallKB956803$\spuninst1/23/2009 8:42:50 AM    4810686    C:\WINDOWS\$NtUninstallKB956841$1/23/2009 8:42:50 AM    624371    C:\WINDOWS\$NtUninstallKB956841$\spuninst1/23/2009 8:43:08 AM    970206    C:\WINDOWS\$NtUninstallKB957095$1/23/2009 8:43:08 AM    622927    C:\WINDOWS\$NtUninstallKB957095$\spuninst1/23/2009 8:43:22 AM    1090050    C:\WINDOWS\$NtUninstallKB957097$1/23/2009 8:43:22 AM    623274    C:\WINDOWS\$NtUninstallKB957097$\spuninst1/23/2009 8:43:33 AM    970696    C:\WINDOWS\$NtUninstallKB958644$1/23/2009 8:43:33 AM    623088    C:\WINDOWS\$NtUninstallKB958644$\spuninst1/23/2009 8:43:45 AM    967021    C:\WINDOWS\$NtUninstallKB958687$1/23/2009 8:43:45 AM    622997    C:\WINDOWS\$NtUninstallKB958687$\spuninst1/14/2009 11:15:25 PM    962564    C:\WINDOWS\$NtUninstallKB958687_0$1/14/2009 11:15:25 PM    629508    C:\WINDOWS\$NtUninstallKB958687_0$\spuninst12/24/2008 11:19:55 AM    646586    C:\WINDOWS\$NtUninstallWIC$12/24/2008 11:19:55 AM    646586    C:\WINDOWS\$NtUninstallWIC$\spuninst1/23/2009 8:27:45 AM    46127    C:\WINDOWS\l2schemas1/6/2009 5:13:01 PM    0    C:\WINDOWS\PIF1/23/2009 9:08:50 AM    6413154    C:\WINDOWS\Prefetch1/23/2009 8:24:12 AM    595270300    C:\WINDOWS\ServicePackFiles1/23/2009 8:24:12 AM    592135051    C:\WINDOWS\ServicePackFiles\i3861/23/2009 8:27:32 AM    49218301    C:\WINDOWS\ServicePackFiles\i386\lang1/23/2009 8:28:28 AM    3135249    C:\WINDOWS\ServicePackFiles\ServicePackCache1/23/2009 8:28:28 AM    3135249    C:\WINDOWS\ServicePackFiles\ServicePackCache\i3861/23/2009 5:20:30 PM    15336    32    C:\WINDOWS\KB951978.log12/11/2008 3:01:03 AM    11692    32    C:\WINDOWS\KB952069.log1/23/2009 5:20:22 PM    13098    32    C:\WINDOWS\KB954459.log12/10/2008 3:00:38 AM    208689    32    C:\WINDOWS\KB954600.log12/9/2008 11:09:32 PM    35365    32    C:\WINDOWS\KB955839.log12/9/2008 11:08:38 PM    218743    32    C:\WINDOWS\KB956802.log12/10/2008 3:01:58 AM    18936    32    C:\WINDOWS\KB958215-IE7.log1/14/2009 11:14:56 PM    209855    32    C:\WINDOWS\KB958687.log12/18/2008 7:56:36 AM    8581    32    C:\WINDOWS\KB960714-IE7.log1/23/2009 9:10:17 AM    187    32    C:\WINDOWS\spupdsvc.log.1.log12/24/2008 11:19:51 AM    5172    32    C:\WINDOWS\WIC.log1/23/2009 8:27:43 AM    409088    C:\WINDOWS\system32\bits1/23/2009 8:27:44 AM    76288    C:\WINDOWS\system32\en1/23/2009 8:27:45 AM    83456    C:\WINDOWS\system32\scripting1/30/2009 8:20:11 AM    410984    32    C:\WINDOWS\system32\deploytk.dll12/12/2008 11:18:16 AM    87336    32    C:\WINDOWS\system32\dns-sd.exe12/12/2008 11:11:46 AM    61440    32    C:\WINDOWS\system32\dnssd.dll1/30/2009 8:20:11 AM    144792    32    C:\WINDOWS\system32\java.exe1/30/2009 8:20:11 AM    144792    32    C:\WINDOWS\system32\javaw.exe1/30/2009 8:20:11 AM    148888    32    C:\WINDOWS\system32\javaws.exe12/17/2008 10:23:13 PM    246272    32    C:\WINDOWS\system32\lfj2k13n.dll12/17/2008 10:23:14 PM    90112    32    C:\WINDOWS\system32\lfjbg13n.dll12/17/2008 10:23:13 PM    189976    32    C:\WINDOWS\system32\mfimgvwr.ocx1/12/2009 9:34:41 AM    59    32    C:\WINDOWS\system32\seneka.dat1/12/2009 9:34:42 AM    3    32    C:\WINDOWS\system32\senekadf.dat1/12/2009 9:29:40 AM    20992    32    C:\WINDOWS\system32\senekalight.dll1/12/2009 9:29:40 AM    78966    32    C:\WINDOWS\system32\senekalog.dat1/12/2009 9:29:40 AM    14336    32    C:\WINDOWS\system32\senekawi.dll1/23/2009 9:10:14 AM    263    32    C:\WINDOWS\system32\spupdwxp.log ====== Files under '\Administrator\Startup' Last 60 Days====== ====== Files under '\All Users\Startup' Last 60 Days====== ====== Folders under '\Program Files' Last 60 Days====== 12/24/2008 5:19:46 PM    390387    C:\Program Files\Bonjour12/17/2008 10:23:03 PM    6523947    C:\Program Files\MFInstall1/30/2009 8:40:26 AM    408473    C:\Program Files\Trend Micro1/30/2009 8:40:26 AM    408473    C:\Program Files\Trend Micro\HijackThis12/24/2008 11:19:44 AM    19887665    C:\Program Files\Virtual Earth 3D12/24/2008 11:20:35 AM    2274441    C:\Program Files\Virtual Earth 3D\Data12/24/2008 11:20:36 AM    81920    C:\Program Files\Virtual Earth 3D\de12/24/2008 11:20:36 AM    528384    C:\Program Files\Virtual Earth 3D\es12/24/2008 11:20:36 AM    524288    C:\Program Files\Virtual Earth 3D\fr12/24/2008 11:20:36 AM    81920    C:\Program Files\Virtual Earth 3D\it12/24/2008 11:20:36 AM    540672    C:\Program Files\Virtual Earth 3D\ja1/30/2009 12:24:49 AM    4797090    C:\Program Files\Windows Defender ====== Files under '\System32\Drivers' Last 60 Days====== 12/24/2008 5:12:54 PM    32000    32    C:\WINDOWS\system32\drivers\usbaapl.sys ====== Files Deleted under '%Temp%' ====== C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\0PEK6QR8.emfC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\10696765.mstC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\108.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\11.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\113.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\12.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\13.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\131.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\14.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\15.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\16.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\17.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\18.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\19.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\1A.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\1B.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\1C.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\1D.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\1E.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\1ec998.mstC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\1F.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\1VJV33GD.emfC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\20.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\21.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\22.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\23.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\24.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\25.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\26.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\27.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\28.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\29.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\2A.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\2B.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\2C.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\2D.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\2E.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\2F.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\30.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\31.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\32.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\33.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\34.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\35.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\36.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\37.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\38.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\39.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\3A.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\3B.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\3C.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\3D.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\3E.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\3F.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\40.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\41.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\42.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\43.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\44.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\45.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\46.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\47.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\48.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\49.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\4A.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\4B.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\4C.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\4D.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\4E.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\4F.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\50.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\51.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\52.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\53.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\54.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\55.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\56.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\57.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\5709_appcompat.txtC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\571f_appcompat.txtC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\58.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\59.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\5A.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\5a35_appcompat.txtC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\5B.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\5C.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\5D.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\5E.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\5F.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\60.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\61.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\62.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\63.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\64.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\65.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\66.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\669e_appcompat.txtC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\67.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\68.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\69.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\6A.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\6B.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\6C.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\6D.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\6E.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\6F.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\70.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\71.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\72.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\73.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\74.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\75.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\76.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\77.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\7782_appcompat.txtC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\78.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\79.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\7A.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\7B.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\7C.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\7cdf_appcompat.txtC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\7D.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\7E.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\7F.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\7fa5_appcompat.txtC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\80.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\81.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\82.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\83.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\84.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\85.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\86.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\87.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\88.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\89.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\8A.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\8B.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\8C.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\8D.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\8E.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\8F.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\90.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\91.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\92.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\93.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\94.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\95.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\96.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\97.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\98.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\99.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\9A.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\9B.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\9C.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\9D.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\9E.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\9F.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\9f9f_appcompat.txtC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\A0.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\A1.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\A9.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\abdb_appcompat.txtC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\AC11.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\B4.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\b6b8_appcompat.txtC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\C.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\c539_appcompat.txtC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\C7.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\CB.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\cc2log.txtC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\D7.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\dvpmgr.logC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\e600_appcompat.txtC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\F3.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\f7yqpf4o.0.csC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\f7yqpf4o.cmdlineC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\f7yqpf4o.dllC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\f7yqpf4o.errC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\f7yqpf4o.outC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\FB.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\fb_2628.lckC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\fb_3048.lckC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\fb_3280.lckC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\fb_3356.lckC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\fb_336.lckC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\fb_3532.lckC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\fb_364.lckC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\fb_3904.lckC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\fla53.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\flaE3.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\flaE4.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\GEC915BZ.emfC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\h2r1EE.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\jar_cache416.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\java_install.logC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\java_install_reg.logC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\java_install_sp.logC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\jinstall.cfgC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\jusched.logC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\MsiInstall.logC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\NetFxUpdate_v1.0.3705.logC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\pdfupd.exeC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Perflib_Perfdata_114.datC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Perflib_Perfdata_150.datC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Perflib_Perfdata_16c.datC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Perflib_Perfdata_ac0.datC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Perflib_Perfdata_bc0.datC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Perflib_Perfdata_be8.datC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Perflib_Perfdata_cd0.datC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Perflib_Perfdata_d1c.datC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Perflib_Perfdata_dcc.datC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Perflib_Perfdata_f8.datC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Photoshop Temp23269C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Photoshop Temp5991798C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\QTInstallCode.logC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\qtplugin.logC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp2h1ED.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\RegisterLsp.logC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Set24.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\set27.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Set28.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Set29.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Set2C.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\set40.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Setup Log 2008-05-20 #001.txtC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Setup Log 2008-05-20 #002.txtC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Setup Log 2009-01-16 #001.txtC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\TWAIN.LOGC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Twain001.MtxC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Twunk001.MTXC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Twunk002.MTXC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\U9NZOVKU.emfC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\VirtualEarth3DInstallLog.txtC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\wic.exeC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\wmplog00.sqmC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\_NDP_OCM_SetRegNI.logC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\_NDP_OCM_ToGAC.logC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF13BE.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF1AF7.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF1BBF.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF1BD5.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF1D04.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF1D41.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF1EAC.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF2027.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF21F0.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF239E.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF240C.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF244F.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF2490.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF24D1.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF268E.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF289E.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF2ACA.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF2B7D.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF2E73.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF2E76.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF2EC4.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF2F8C.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF3083.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF3102.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF3462.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF3481.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF3484.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF34A9.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF352B.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF36C5.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF3751.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF3797.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF379B.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF38FE.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF399E.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF3AD3.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF3C5.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF3C52.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF3CF0.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF3F62.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF4092.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF41BA.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF41F7.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF424D.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF4275.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF42CE.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF4344.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF43EA.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF44E1.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF4518.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF465F.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF47EE.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF4829.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF492A.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF497.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF49B1.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF49E9.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF4A0C.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF4BDC.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF4CC6.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF4CDB.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF4E25.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF4FF7.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF5084.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF5142.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF5188.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF522A.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF537B.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF5513.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF55EE.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF577B.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF57E8.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF5903.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF5910.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF5B67.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF5B79.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF5CBB.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF5CC9.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF5D64.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF5E5F.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF5E72.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF5EF5.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF5FBB.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF60AB.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF6132.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF6310.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF6426.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF66AF.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF6824.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF682E.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF683C.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF68A8.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF693.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF6997.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF6A6A.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF6B35.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF6BF2.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF6C96.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF6CA1.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF6D0.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF6D12.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF6F00.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF6F63.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF6F6D.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF701F.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF70DB.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF7124.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF7137.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF7359.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF740A.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF75EC.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF7672.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF7D23.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF7DFF.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF7E3.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF7EA4.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF7FAC.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF8303.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF859F.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF861E.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF88E1.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF8900.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF8913.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF8B3E.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF8C6D.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF8C8B.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF8DE2.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF8F83.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF9084.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF928E.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF934B.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF9581.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF9719.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF9723.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF9927.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF9938.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF99DF.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF9A22.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF9B25.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF9BD5.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF9CC1.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF9D5B.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF9DA4.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF9DA6.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF9E2C.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF9E39.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF9FC8.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFA00.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFA36E.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFA455.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFA48D.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFA4E.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFA5E2.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFA608.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFA67F.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFA683.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFA6DC.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFA7B7.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFA7D1.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFA829.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFA83C.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFA8E2.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFA96D.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFA9DC.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFA9EF.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFAB42.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFAB96.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFAD3E.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFAD60.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFAD9E.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFADDF.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFADEE.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFAE01.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFAF07.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFAF25.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFAFDC.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFB00E.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFB121.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFB155.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFB161.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFB1EC.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFB1F2.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFB1FE.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFB5A5.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFB5AF.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFB5D9.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFB736.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFB7C.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFB80B.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFB9D5.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFBB3F.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFBCE8.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFBD3B.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFBD93.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFBDFD.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFBEA6.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFBEB4.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFBED7.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFBF9F.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFBFDD.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFC007.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFC099.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFC10A.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFC157.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFC1A2.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFC25B.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFC2DE.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFC430.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFC623.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFC661.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFC7EC.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFC810.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFC81D.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFC859.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFC9A9.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFCABE.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFCB46.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFCBE6.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFCC25.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFCC4C.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFCD81.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFD08F.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFD0AA.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFD120.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFD1D2.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFD238.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFD304.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFD32C.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFD46C.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFD716.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFD773.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFD781.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFD826.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFD8BF.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFD8CB.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFDB20.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFDCFD.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFDD81.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFDDCD.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFDEBE.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFE017.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFE05C.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFE2AE.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFE2DB.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFE2EA.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFE32F.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFE342.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFE3BE.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFE3E0.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFE6D3.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFE7F2.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFE837.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFEA37.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFEB8F.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFEBB0.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFEC8C.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFEC94.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFEE55.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFF015.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFF23C.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFF415.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFF422.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFF6B8.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFF6C7.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFF7B4.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFFAF4.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFFFEB.tmpC:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~e5d141.tmp 505 Files deleted ====== Files and Folders under 'All Users\Application Data' Last 60 Days====== 12/24/2008 5:18:00 PM    510849    C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}12/24/2008 5:18:29 PM    510849    C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x8612/24/2008 5:18:29 PM    122832    C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86\x86  ====== Possible Rootkit Scan (Note: Items listed here are not necessarily bad)======Possible rootkit found: dvpapi ====== Values under HKLM\Software\microsoft\shared tools\msconfig\startupreg ====== HKLM\Software\microsoft\shared tools\msconfig\startupreg\ ====== Services ( Services that are Whitelisted are not shown) ======  Adobe LM Service (Adobe LM Service) 'C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe'  - Manual AdobeVersionCue (AdobeVersionCue) C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe  - Manual Alerter (Alerter) C:\WINDOWS\system32\svchost.exe -k LocalService  - Disabled Application Layer Gateway Service (ALG) C:\WINDOWS\System32\alg.exe  - Manual Apple Mobile Device (Apple Mobile Device) 'C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe'  - Auto Application Management (AppMgmt) C:\WINDOWS\system32\svchost.exe -k netsvcs  - Manual ARSVC (ARSVC) C:\WINDOWS\arservice.exe  - Auto ASP.NET State Service (aspnet_state) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe  - Manual Ati HotKey Poller (Ati HotKey Poller) C:\WINDOWS\system32\Ati2evxx.exe  - Auto Windows Audio (AudioSrv) C:\WINDOWS\System32\svchost.exe -k netsvcs  - Auto Background Intelligent Transfer Service (BITS) C:\WINDOWS\system32\svchost.exe -k netsvcs  - Manual Bonjour Service (Bonjour Service) 'C:\Program Files\Bonjour\mDNSResponder.exe'  - Auto Computer Browser (Browser) C:\WINDOWS\system32\svchost.exe -k netsvcs  - Auto Indexing Service (CiSvc) C:\WINDOWS\system32\cisvc.exe  - Manual ClipBook (ClipSrv) C:\WINDOWS\system32\clipsrv.exe  - Disabled .NET Runtime Optimization Service v2.0.50727_X86 (clr_optimization_v2.0.50727_32) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe  - Manual COM+ System Application (COMSysApp) C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}  - Manual Cryptographic Services (CryptSvc) C:\WINDOWS\system32\svchost.exe -k netsvcs  - Auto DCOM Server Process Launcher (DcomLaunch) C:\WINDOWS\system32\svchost -k DcomLaunch  - Auto DHCP Client (Dhcp) C:\WINDOWS\system32\svchost.exe -k netsvcs  - Auto Logical Disk Manager Administrative Service (dmadmin) C:\WINDOWS\System32\dmadmin.exe /com  - Manual Logical Disk Manager (dmserver) C:\WINDOWS\System32\svchost.exe -k netsvcs  - Auto DNS Client (Dnscache) C:\WINDOWS\system32\svchost.exe -k NetworkService  - Auto Wired AutoConfig (Dot3svc) C:\WINDOWS\System32\svchost.exe -k dot3svc  - Manual DvpApi (dvpapi) 'C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe'  - Auto Extensible Authentication Protocol Service (EapHost) C:\WINDOWS\System32\svchost.exe -k eapsvcs  - Manual Media Center Receiver Service (ehRecvr) C:\WINDOWS\eHome\ehRecvr.exe  - Auto Media Center Scheduler Service (ehSched) C:\WINDOWS\eHome\ehSched.exe  - Auto Error Reporting Service (ERSvc) C:\WINDOWS\System32\svchost.exe -k netsvcs  - Auto Event Log (Eventlog) C:\WINDOWS\system32\services.exe  - Auto COM+ Event System (EventSystem) C:\WINDOWS\system32\svchost.exe -k netsvcs  - Manual Fast User Switching Compatibility (FastUserSwitchingCompatibility) C:\WINDOWS\System32\svchost.exe -k netsvcs  - Manual Fax (Fax) C:\WINDOWS\system32\fxssvc.exe  - Manual Help and Support (helpsvc) C:\WINDOWS\System32\svchost.exe -k netsvcs  - Auto HID Input Service (HidServ) C:\WINDOWS\System32\svchost.exe -k netsvcs  - Auto Health Key and Certificate Management Service (hkmsvc) C:\WINDOWS\System32\svchost.exe -k netsvcs  - Manual HTTP SSL (HTTPFilter) C:\WINDOWS\System32\svchost.exe -k HTTPFilter  - Manual InstallDriver Table Manager (IDriverT) 'C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe'  - Manual IMAPI CD-Burning COM Service (ImapiService) C:\WINDOWS\system32\imapi.exe  - Manual iolo FileInfoList Service (ioloFileInfoList) C:\Program Files\iolo\common\lib\ioloServiceManager.exe  - Auto iolo System Service (ioloSystemService) C:\Program Files\iolo\common\lib\ioloServiceManager.exe  - Auto iPod Service (iPod Service) 'C:\Program Files\iPod\bin\iPodService.exe'  - Manual Keyboard And Mouse Communication Service (KMWDSERVICE) C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMWDSrv.exe  - Auto Server (lanmanserver) C:\WINDOWS\system32\svchost.exe -k netsvcs  - Auto Workstation (lanmanworkstation) C:\WINDOWS\system32\svchost.exe -k netsvcs  - Auto LightScribeService Direct Disc Labeling Service (LightScribeService) 'C:\Program Files\Common Files\LightScribe\LSSrvc.exe'  - Auto TCP/IP NetBIOS Helper (LmHosts) C:\WINDOWS\system32\svchost.exe -k LocalService  - Auto Media Center Extender Service (McrdSvc) C:\WINDOWS\ehome\mcrdsvc.exe  - Auto Machine Debug Manager (MDM) 'C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE'  - Auto Messenger (Messenger) C:\WINDOWS\system32\svchost.exe -k netsvcs  - Disabled MHN (MHN) C:\WINDOWS\System32\svchost.exe -k netsvcs  - Manual NetMeeting Remote Desktop Sharing (mnmsrvc) C:\WINDOWS\system32\mnmsrvc.exe  - Manual Windows Installer (MSIServer) C:\WINDOWS\system32\msiexec.exe /V  - Manual Network Access Protection Agent (napagent) C:\WINDOWS\System32\svchost.exe -k netsvcs  - Manual Network DDE (NetDDE) C:\WINDOWS\system32
etdde.exe  - Disabled Network DDE DSDM (NetDDEdsdm) C:\WINDOWS\system32
etdde.exe  - Disabled Net Logon (Netlogon) C:\WINDOWS\system32\lsass.exe  - Manual Network Connections (Netman) C:\WINDOWS\System32\svchost.exe -k netsvcs  - Manual Network Location Awareness (NLA) (Nla) C:\WINDOWS\system32\svchost.exe -k netsvcs  - Manual NT LM Security Support Provider (NtLmSsp) C:\WINDOWS\system32\lsass.exe  - Manual Removable Storage (NtmsSvc) C:\WINDOWS\system32\svchost.exe -k netsvcs  - Disabled Office Source Engine (ose) 'C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE'  - Manual Plug and Play (PlugPlay) C:\WINDOWS\system32\services.exe  - Auto IPSEC Services (PolicyAgent) C:\WINDOWS\system32\lsass.exe  - Auto Protected Storage (ProtectedStorage) C:\WINDOWS\system32\lsass.exe  - Auto Remote Access Auto Connection Manager (RasAuto) C:\WINDOWS\system32\svchost.exe -k netsvcs  - Disabled Remote Access Connection Manager (RasMan) C:\WINDOWS\system32\svchost.exe -k netsvcs  - Manual Remote Desktop Help Session Manager (RDSessMgr) C:\WINDOWS\system32\sessmgr.exe  - Manual Routing and Remote Access (RemoteAccess) C:\WINDOWS\system32\svchost.exe -k netsvcs  - Disabled Remote Registry (RemoteRegistry) C:\WINDOWS\system32\svchost.exe -k LocalService  - Disabled Remote Procedure Call (RPC) Locator (RpcLocator) C:\WINDOWS\system32\locator.exe  - Manual Remote Procedure Call (RPC) (RpcSs) C:\WINDOWS\system32\svchost -k rpcss  - Auto QoS RSVP (RSVP) C:\WINDOWS\system32svp.exe  - Manual Security Accounts Manager (SamSs) C:\WINDOWS\system32\lsass.exe  - Auto Smart Card (SCardSvr) C:\WINDOWS\System32\SCardSvr.exe  - Manual Task Scheduler (Schedule) C:\WINDOWS\System32\svchost.exe -k netsvcs  - Auto Secondary Logon (seclogon) C:\WINDOWS\System32\svchost.exe -k netsvcs  - Auto senekalight (senekalight) C:\WINDOWS\system32\svchost.exe -k netsvcs  - Auto System Event Notification (SENS) C:\WINDOWS\system32\svchost.exe -k netsvcs  - Auto Windows Firewall/Internet Connection Sharing (ICS) (SharedAccess) C:\WINDOWS\system32\svchost.exe -k netsvcs  - Auto Shell Hardware Detection (ShellHWDetection) C:\WINDOWS\System32\svchost.exe -k netsvcs  - Auto Print Spooler (Spooler) C:\WINDOWS\system32\spoolsv.exe  - Auto System Restore Service (srservice) C:\WINDOWS\system32\svchost.exe -k netsvcs  - Auto SSDP Discovery Service (SSDPSRV) C:\WINDOWS\system32\svchost.exe -k LocalService  - Auto Windows Image Acquisition (WIA) (stisvc) C:\WINDOWS\system32\svchost.exe -k imgsvc  - Auto MS Software Shadow Copy Provider (SwPrv) C:\WINDOWS\system32\dllhost.exe /Processid:{8DA84759-6C62-4695-9DB6-4789D64FAF43}  - Manual Performance Logs and Alerts (SysmonLog) C:\WINDOWS\system32\smlogsvc.exe  - Manual Telephony (TapiSrv) C:\WINDOWS\System32\svchost.exe -k netsvcs  - Manual Terminal Services (TermService) C:\WINDOWS\System32\svchost -k DComLaunch  - Manual Themes (Themes) C:\WINDOWS\System32\svchost.exe -k netsvcs  - Auto Telnet (TlntSvr) C:\WINDOWS\system32	lntsvr.exe  - Disabled Distributed Link Tracking Client (TrkWks) C:\WINDOWS\system32\svchost.exe -k netsvcs  - Auto Universal Plug and Play Device Host (upnphost) C:\WINDOWS\system32\svchost.exe -k LocalService  - Manual Uninterruptible Power Supply (UPS) C:\WINDOWS\System32\ups.exe  - Manual Volume Shadow Copy (VSS) C:\WINDOWS\System32\vssvc.exe  - Manual Windows Time (W32Time) C:\WINDOWS\System32\svchost.exe -k netsvcs  - Auto WebClient (WebClient) C:\WINDOWS\system32\svchost.exe -k LocalService  - Auto Windows Defender (WinDefend) 'C:\Program Files\Windows Defender\MsMpEng.exe'  - Auto Windows Management Instrumentation (winmgmt) C:\WINDOWS\system32\svchost.exe -k netsvcs  - Auto Portable Media Serial Number Service (WmdmPmSN) C:\WINDOWS\System32\svchost.exe -k netsvcs  - Manual Windows Management Instrumentation Driver Extensions (Wmi) C:\WINDOWS\System32\svchost.exe -k netsvcs  - Manual WMI Performance Adapter (WmiApSrv) C:\WINDOWS\system32\wbem\wmiapsrv.exe  - Manual Windows Media Player Network Sharing Service (WMPNetworkSvc) 'C:\Program Files\Windows Media Player\WMPNetwk.exe'  - Manual Security Center (wscsvc) C:\WINDOWS\System32\svchost.exe -k netsvcs  - Auto Automatic Updates (wuauserv) C:\WINDOWS\system32\svchost.exe -k netsvcs  - Auto Windows Driver Foundation - User-mode Driver Framework (WudfSvc) C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup  - Manual Wireless Zero Configuration (WZCSVC) C:\WINDOWS\System32\svchost.exe -k netsvcs  - Auto Network Provisioning Service (xmlprov) C:\WINDOWS\System32\svchost.exe -k netsvcs  - Manual Java Quick Starter (JavaQuickStarterService) 'C:\Program Files\Java\jre6\bin\jqs.exe' -service -config 'C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf'  - Auto ====== Uninstall List From Registry ====== GemMaster MysticAdobe Flash Player ActiveXAdobe Shockwave PlayerAdobe SVG Viewer 3.0Adobe Download Manager 2.0 (Remove Only)Agere Systems PCI-SV92PP Soft ModemAsk ToolbarATI Display DriverMicrosoft Away ModeOttoBroadJump Client FoundationCopyPod (remove only)DISCoverCanon Utilities Easy-PhotoPrintCanon Utilities Easy-PhotoPrint PlusHijackThis 2.0.2HP Imaging Device Functions 6.0HP Photosmart Premier Software 6.0HP RhapsodyMicrosoft Internationalized Domain Names Mitigation APIsWindows Internet Explorer 7iPod for Windows 2006-03-23Customer Experience EnhancementFinePixViewer Ver.3.2Easy Internet Sign-upWireless Keyboard & Mouse DriverPC CameraQiolo AntiVirusHigh Definition Audio Driver Package - KB888111Security Update for Step By Step Interactive Training (KB898458)Update Rollup 2 for Windows XP Media Center Edition 2005Hotfix for Windows Media Player 10 (KB903157)Security Update for Windows Media Player 10 (KB911565)Update for Windows Media Player 10 (KB913800)Security Update for Windows Media Player 10 (KB917734)Security Update for Windows XP (KB923689)Security Update for Step By Step Interactive Training (KB923723)Security Update for Windows Media Player 6.4 (KB925398)Windows XP Media Center Edition 2005 KB925766Update for Windows Media Player 10 (KB926251)Hotfix for Windows Media Format 11 SDK (KB929399)Security Update for CAPICOM (KB931906)Security Update for Windows Media Player 11 (KB936782)Security Update for Windows Internet Explorer 7 (KB938127)Security Update for Windows XP (KB938464)Hotfix for Windows Media Player 11 (KB939683)Security Update for Windows XP (KB941569)Security Update for Windows Internet Explorer 7 (KB942615)Security Update for Windows Internet Explorer 7 (KB944533)Security Update for Windows XP (KB946648)Hotfix for Windows Internet Explorer 7 (KB947864)Security Update for Windows Internet Explorer 7 (KB950759)Security Update for Windows XP (KB950760)Security Update for Windows XP (KB950762)Security Update for Windows XP (KB950974)Security Update for Windows XP (KB951066)Update for Windows XP (KB951072-v2)Security Update for Windows XP (KB951376)Security Update for Windows XP (KB951376-v2)Security Update for Windows XP (KB951698)Security Update for Windows XP (KB951748)Update for Windows XP (KB951978)Security Update for Windows Media Player (KB952069)Hotfix for Windows XP (KB952287)Security Update for Windows XP (KB952954)Update for Windows XP (KB953356)Security Update for Windows Internet Explorer 7 (KB953838)Security Update for Windows XP (KB953839)Security Update for Windows Media Player 11 (KB954154)Security Update for Windows XP (KB954211)Security Update for Windows XP (KB954459)Security Update for Windows XP (KB954600)Security Update for Windows XP (KB955069)Update for Windows XP (KB955839)Security Update for Windows Internet Explorer 7 (KB956390)Security Update for Windows XP (KB956391)Security Update for Windows XP (KB956802)Security Update for Windows XP (KB956803)Security Update for Windows XP (KB956841)Security Update for Windows XP (KB957095)Security Update for Windows XP (KB957097)Security Update for Windows Internet Explorer 7 (KB958215)Security Update for Windows XP (KB958644)Security Update for Windows XP (KB958687)Security Update for Windows Internet Explorer 7 (KB960714)Enhanced Multimedia Keyboard SolutionMicrosoft .NET Framework 1.1 Hotfix (KB928366)Microsoft .NET Framework 1.1Microsoft Money 2006Mozilla Firefox (2.0.0.3)Microsoft Compression Client Pack 1.0 for Windows XPMicroStaff WINASPIMicrosoft National Language Support Downlevel APIsPS2Python 2.2 pywin32 extensions (build 203)SightSpeed (remove only)Spybot - Search & Destroy 1.4Windows Genuine Advantage Notifications (KB905474)Windows Imaging ComponentWindows Media Format 11 runtimeWindows Media Player 11Windows XP Service Pack 3Windows Media Format 11 runtimeWindows Media Player 11Microsoft Windows Media Video 9 VCMMicrosoft User-Mode Driver Framework Feature Pack 1.0BonjourSonic RecordNow DataATI Control PanelSafariSecurity Update for CAPICOM (KB931906)CP_CalendarTemplates1iPod for Windows 2006-03-23Sonic MyDVD PlusCustomer Experience EnhancementGoogle Toolbar for Internet ExplorerCP_Package_Variety2DestinationsFinePixViewer Ver.3.2Java(TM) 6 Update 11SkinsHP1Sonic Update ManageriTunesJ2SE Runtime Environment 5.0 Update 9Java(TM) SE Runtime Environment 6 Update 1UnloadWebFldrs XPOptionalContentQFolderMSXML 4.0 SP2 (KB927978)HP Boot OptimizerVirtual Earth 3D (Beta)RandMapBufferChmHP DVD Play 1.0CP_Panorama1Configcp_LightScribeConfigMacromedia Flash PlayerCP_Package_Variety1FullDPAppQFolderFUJIFILM USB Drivercp_PosterPrintConfigiolo technologies' System MechanicSony USB DriverSonic Express LabelerApple Software UpdateMSXML 4.0 SP2 Parser and SDKCP_Package_Basic1Sonic_PrimoSDKcp_UpdateProjectsConfigEasy Internet Sign-upMSXML 4.0 SP2 (KB954430)PhotoGalleryMicrosoft Office Standard Edition 2003CueTourWindows DefenderDeviceManagementQFolderSonic RecordNow AudioLightScribe  1.4.62.1Adobe Reader 7.0.9EZMedia Box 2.0CP_AtenaShokunin1ConfigSonic RecordNow CopyMicrosoft .NET Framework 2.0 Service Pack 1CP_Package_Variety3Wireless Keyboard & Mouse DriverEZVideo Mailcp_OnlineProjectsConfigMSXML 4.0 SP2 (KB936181)Authentium AntiVirus SDK - 2EZLive Monitor 2.0Microsoft .NET Framework 1.1ImageMixer VCD for FinePixAdobe Creative SuiteHP Support OverviewPC CameraQHP Web HelperHpSdpAppCoreAppApple Mobile Device SupportHP Software UpdateHP DigitalMedia ArchiveQuickTimeInstantShareDevices ======== Other Info ======== TOTAL PHYSICAL RAM: 1005 MB

millercolby · Answer

Content of C:\avenger.txt://////////////////////////////////////////  Avenger Pre-Processor log////////////////////////////////////////// Platform: Windows XP (build 2600, Service Pack 3)Fri Jan 30 10:33:47 2009 10:33:47: Error: Invalid script.  A valid script must begin with a command directive.Aborting execution! ////////////////////////////////////////// Logfile of The Avenger Version 2.0, (c) by Swandog46http://swandog46.geekstogo.com Platform:  Windows XP ******************* Script file opened successfully.Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active.No rootkits found! File 'C:\WINDOWS\system32\lfj2k13n.dll' deleted successfully.File 'C:\WINDOWS\system32\lfjbg13n.dll' deleted successfully.File 'C:\WINDOWS\system32\mfimgvwr.ocx' deleted successfully.File 'C:\WINDOWS\system32\seneka.dat' deleted successfully.File 'C:\WINDOWS\system32\senekadf.dat' deleted successfully.File 'C:\WINDOWS\system32\senekalight.dll' deleted successfully.File 'C:\WINDOWS\system32\senekalog.dat' deleted successfully.File 'C:\WINDOWS\system32\senekawi.dll' deleted successfully. Completed script processing. ******************* Finished!  Terminate.

bamajim · Answer

millercolby

You are most welcome

1. Please download The Avenger by Swandog46 to your Desktop.

Click on Avenger.zip to open the file
Extract avenger.exe to your desktop(How to extract (decompress) zipped or compressed files, help in the link here: )

2. Copy all the text contained in the bold below to your Clipboard by highlighting it and pressing (Ctrl+C):

Files to Delete:
C:\WINDOWS\system32\lfj2k13n.dll
C:\WINDOWS\system32\lfjbg13n.dll
C:\WINDOWS\system32\mfimgvwr.ocx
C:\WINDOWS\system32\seneka.dat
C:\WINDOWS\system32\senekadf.dat
C:\WINDOWS\system32\senekalight.dll
C:\WINDOWS\system32\senekalog.dat
C:\WINDOWS\system32\senekawi.dll

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.

Select Load Script
Select Paste from Clipboard
The information should now appear in the Open window
Select Execute
Answer Yes When prompted "Are you sure you want to execute the current script?"

4. The Avenger will automatically do the following:

It will Restart your computer.
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please copy/paste the content of c:\avenger.txt into your reply

bamajim · Answer

millercolby Good work Rerun Hijackthis and post a fresh Hijackthis log.

millercolby · Answer

New HijackThis log:---------------------------------------------------------------------Logfile of Trend Micro HijackThis v2.0.2Scan saved at 11:06:17 AM, on 1/30/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16762)Boot mode: Normal Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Windows Defender\MsMpEng.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\ehome\ehtray.exeC:\Program Files\DISC\DISCover.exeC:\Program Files\DISC\DiscGui.exeC:\Program Files\DISC\DiscUpdateMgr.exeC:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exeC:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exeC:\HP\KBD\KBD.EXEC:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\StartAutorun.exeC:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMConfig.exeC:\Program Files\iolo\AntiVirus\ioloAV.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMProcess.exeC:\Program Files\Java\jre6\bin\jusched.exeC:\Program Files\Windows Defender\MSASCui.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\FinePixViewer\QuickDCF.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\WINDOWS\arservice.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exeC:\WINDOWS\eHome\ehRecvr.exeC:\WINDOWS\eHome\ehSched.exeC:\Program Files\iolo\common\lib\ioloServiceManager.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMWDSrv.exeC:\Program Files\Common Files\LightScribe\LSSrvc.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\WINDOWS\system32\svchost.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\system32\dllhost.exeC:\WINDOWS\eHome\ehmsas.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\DISC\DiscStreamHub.exeC:\Program Files\iolo\AntiVirus\iAVEmailScanner.exeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS\ALCXMNTR.EXEC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exec:\windows\system\hpsysdrv.exeC:\WINDOWS\system32
otepad.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=presario&pf=desktopR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=presario&pf=desktopR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=presario&pf=desktopR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=presario&pf=desktopR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=presario&pf=desktopR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=presario&pf=desktopR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.localR3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\sorry.exeO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dllO2 - BHO: hpWebHelper Class - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dllO2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dllO2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllO2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLLO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLLO4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exeO4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXEO4 - HKLM\..\Run: [DISCover] C:\Program Files\DISC\DISCover.exeO4 - HKLM\..\Run: [DiscUpdateManager] C:\Program Files\DISC\DiscUpdateMgr.exeO4 - HKLM\..\Run: [DMAScheduler] c:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exeO4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXEO4 - HKLM\..\Run: [HPBootOp] 'C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe' /runO4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUNO4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exeO4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXEO4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe'  -osbootO4 - HKLM\..\Run: [SMSystemAnalyzer] 'C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe'O4 - HKLM\..\Run: [KMCONFIG] C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\StartAutorun.exe KMConfig.exeO4 - HKLM\..\Run: [iolo AntiVirus] 'C:\Program Files\iolo\AntiVirus\ioloAV.exe'O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [iTunesHelper] 'C:\Program Files\iTunes\iTunesHelper.exe'O4 - HKLM\..\Run: [SunJavaUpdateSched] 'C:\Program Files\Java\jre6\bin\jusched.exe'O4 - HKLM\..\Run: [Windows Defender] 'C:\Program Files\Windows Defender\MSASCui.exe' -hideO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exeO8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.htmlO8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.htmlO8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.htmlO8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.htmlO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.htmlO8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.htmlO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLLO9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htmO9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htmO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO10 - Unknown file in Winsock LSP: c:\windows\system32\iavlsp.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\iavlsp.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\iavlsp.dllO15 - Trusted Zone: http://*.trymedia.com (HKLM)O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cabO16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by118w.bay118.mail.live.com/mail/resources/MsnPUpld.cabO16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cabO16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cabO16 - DPF: {BBF89515-EDB6-4236-8FBB-B6045290076D} (Image Uploader ShellCombo Control) - http://c.ancestry.com/trees/upload/ImageUploader4.cabO16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} (Java Runtime Environment 1.5.0) - https://timekeeper.cmh.edu/wfcstatic/plugins/jre-1_5_0_09-windows-i586-p.exeO20 - AppInit_DLLs: \?\globalroot\systemroot\system32\senekawi.dllO23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exeO23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exeO23 - Service: iolo System Service (ioloSystemService) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exeO23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMWDSrv.exeO23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe --End of file - 12192 bytes

bamajim · Answer

millercolby

1. Rerun Hijackthis (scan only) and place checks beside the following entries

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\sorry.exe
O20 - AppInit_DLLs: \\?\globalroot\systemroot\system32\senekawi.dll

Close all other open windows except Hijackthis and Select " Fix checked"

Close Hijackthis ->> Reboot your PC ->> Rerun Hijackthis and post a fresh Hijackthis log

millercolby · Answer

Here's the results of the fresh HijackThis log after following above instructions:

------------------------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:20:08 PM, on 1/30/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\iolo\common\lib\ioloServiceManager.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMWDSrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ARPWRMSG.EXE
C:\Program Files\DISC\DISCover.exe
C:\Program Files\DISC\DiscUpdateMgr.exe
C:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe
C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\DISC\DiscGui.exe
C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\StartAutorun.exe
C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMConfig.exe
C:\Program Files\iolo\AntiVirus\ioloAV.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMProcess.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\DISC\DiscStreamHub.exe
C:\Program Files\iolo\AntiVirus\iAVEmailScanner.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: hpWebHelper Class - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [DISCover] C:\Program Files\DISC\DISCover.exe
O4 - HKLM\..\Run: [DiscUpdateManager] C:\Program Files\DISC\DiscUpdateMgr.exe
O4 - HKLM\..\Run: [DMAScheduler] c:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe"
O4 - HKLM\..\Run: [KMCONFIG] C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\StartAutorun.exe KMConfig.exe
O4 - HKLM\..\Run: [iolo AntiVirus] "C:\Program Files\iolo\AntiVirus\ioloAV.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\iavlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iavlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iavlsp.dll
O15 - Trusted Zone: http://*.trymedia.com (HKLM)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by118w.bay118.mail.live.com/mail/resources/MsnPUpld.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {BBF89515-EDB6-4236-8FBB-B6045290076D} (Image Uploader ShellCombo Control) - http://c.ancestry.com/trees/upload/ImageUploader4.cab
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} (Java Runtime Environment 1.5.0) - https://timekeeper.cmh.edu/wfcstatic/plugins/jre-1_5_0_09-windows-i586-p.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: iolo System Service (ioloSystemService) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Micro Innovations\Wireless Keyboard & Mouse Driver\KMWDSrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

--
End of file - 11890 bytes

bamajim · Answer

millercolby How is your PC running now?

Virus & Spyware

Google search result links redirected

Was this post helpful?