Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

« previous next »
Pages: [1] 2 3 4  All   Go Down

Author Topic: problem after running first spybot S & D  (Read 31393 times)

0 Members and 1 Guest are viewing this topic.

okbreeze

    Topic Starter


    Beginner

  • semi-illiterate pc user
    problem after running first spybot S & D
    « on: June 09, 2008, 01:37:44 AM »
     :-[ Downloaded spybot, ran first time. Long list of infections dealt with, but I was asked if I wanted to allow or deny name changes on two items. I read all user stuff  before using, but saw nothing about that. I guessed wrong. My desktop disappeared! I'm not sure if my BitDefender is running. I can't tell which, out of the list of things I deleted, is connected with my desk top. I'm afraid to shut down, but don't like being open like this, all night.
    Logged
    "The rarest of blooms is enhanced by the coldest of winters"

    evilfantasy

    • Malware Removal Specialist
    • Moderator


      • Genius
    • Calm like a bomb
      • Thanked: 493
    • Experience: Experienced
    • OS: Windows 11
    Re: problem after running first spybot S & D
    « Reply #1 on: June 09, 2008, 01:52:18 AM »
    Is Spybot open? Click Recovery and restore everything.

    Then post a Hijackthis log so we can have a look.
    Logged

    okbreeze

      Topic Starter


      Beginner

    • semi-illiterate pc user
      Re: problem after running first spybot S & D
      « Reply #2 on: June 09, 2008, 02:18:26 AM »
      Spybot is open. Don't have hijack this. Open another page and download it? Major Geeks.com suggests hijack this is for advanced users?
      Logged
      "The rarest of blooms is enhanced by the coldest of winters"

      evilfantasy

      • Malware Removal Specialist
      • Moderator


        • Genius
      • Calm like a bomb
        • Thanked: 493
      • Experience: Experienced
      • OS: Windows 11
      Re: problem after running first spybot S & D
      « Reply #3 on: June 09, 2008, 02:24:11 AM »
      Quote from: okbreeze on June 09, 2008, 02:18:26 AM
      Major Geeks.com suggests hijack this is for advanced users?

      We're here to help ;)

      Download and rename TrendMicro HijackThis.exe (HJT)
      • Double-click on HJTInstall.
      • Click on the Install button.
      • It will automatically place HJT in C:\Program Files\TrendMicro\HijackThis\HijackThis.exe.
      • Upon install, HijackThis should open for you.
      • Close HijackThis and rename it.
      • Go to C:\Program Files\Trend Micro\HijackThis.exe
      • Right click on HijackThis.exe and select Rename.
      • Type in sniper.exe and press Enter.
      • Right-click on sniper.exe and select Send To > Desktop (create shortcut)
      • From the desktop open Hijackthis.
      • If using Windows Vista, Right-click and Run As Administrator.
      • Click on the Do a system scan and save a log file button
      • Hijackthis will scan and then a log will open in notepad.
      • Copy and then paste the entire contents of the log in your post.
      • Do not have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.
      Although we have renamed Hijackthis to sniper, we will still refer to it as Hijackthis or HJT.
      Logged

      okbreeze

        Topic Starter


        Beginner

      • semi-illiterate pc user
        Re: problem after running first spybot S & D....no desktop
        « Reply #4 on: June 09, 2008, 10:33:53 AM »
          ??? :-[ How do I change the name if I can't get into anything on my pc? If I just shut down, then turn on again later, will the desktop restore? I did restore all removed with spybot
        Thanks for all the patience here.
        « Last Edit: June 09, 2008, 02:41:12 PM by okbreeze »
        Logged
        "The rarest of blooms is enhanced by the coldest of winters"

        evilfantasy

        • Malware Removal Specialist
        • Moderator


          • Genius
        • Calm like a bomb
          • Thanked: 493
        • Experience: Experienced
        • OS: Windows 11
        Re: problem after running first spybot S & D
        « Reply #5 on: June 09, 2008, 04:25:23 PM »


        Use ctrl-shift-esc to bring up task manager, from there you can File -> New Task (run) type in explorer.exe to see if you can get the desktop back.
        Logged

        okbreeze

          Topic Starter


          Beginner

        • semi-illiterate pc user
          Re: problem after running first spybot S & D
          « Reply #6 on: June 09, 2008, 06:15:44 PM »
          Hi, evilfantasy!
          It wouldn't come up, before, but I got it again, so going to try it. Thanks!
          Logged
          "The rarest of blooms is enhanced by the coldest of winters"

          evilfantasy

          • Malware Removal Specialist
          • Moderator


            • Genius
          • Calm like a bomb
            • Thanked: 493
          • Experience: Experienced
          • OS: Windows 11
          Re: problem after running first spybot S & D
          « Reply #7 on: June 09, 2008, 06:18:04 PM »
          OK. If we can get a HijackThis log we will know where to go from there.
          Logged

          okbreeze

            Topic Starter


            Beginner

          • semi-illiterate pc user
            Re: problem after running first spybot S & D
            « Reply #8 on: June 09, 2008, 06:26:09 PM »
             ;D Yay! Got desktop back!
            spybot just popped up with "System Startup global entry Value deleted" entry: "SpybotSnD", old data: "C:\Program Files\Spybot-Search...."  Before I could finish keying that in, got a pop up saying "user denied". Is that good?
            Go ahead and proceed with HijackThis download, or run spybot again, change name, etc, as per previous instructions?
            Logged
            "The rarest of blooms is enhanced by the coldest of winters"

            evilfantasy

            • Malware Removal Specialist
            • Moderator


              • Genius
            • Calm like a bomb
              • Thanked: 493
            • Experience: Experienced
            • OS: Windows 11
            Re: problem after running first spybot S & D
            « Reply #9 on: June 09, 2008, 06:43:43 PM »
            Yes I think the Hijackthis instructions would be best.
            Logged

            okbreeze

              Topic Starter


              Beginner

            • semi-illiterate pc user
              Re: problem after running first spybot S & D
              « Reply #10 on: June 09, 2008, 09:41:40 PM »
              I got a window that says "renaming, moving, or deleting 'Hijack This' could make some programs not work. Are sure you want to do this?" Yes?
              Logged
              "The rarest of blooms is enhanced by the coldest of winters"

              evilfantasy

              • Malware Removal Specialist
              • Moderator


                • Genius
              • Calm like a bomb
                • Thanked: 493
              • Experience: Experienced
              • OS: Windows 11
              Re: problem after running first spybot S & D
              « Reply #11 on: June 09, 2008, 09:54:55 PM »
              Lets run this instead.

              Download Deckard's System Scanner (DSS) to your Desktop.
              Note: You must be logged onto an account with administrator privileges.
              Vista users Right click DSS and Run as Administrator.

              • Close all applications and windows.
              • Double-click on dss.exe to run it, and follow the prompts.
              • When the scan is complete, two text files will open.
                • main.txt <- this one will be maximized
                • extra.txt <- this one will be minimized
              • Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and extra.txt in your reply.
              Logged

              okbreeze

                Topic Starter


                Beginner

              • semi-illiterate pc user
                Re: problem after running first spybot S & D
                « Reply #12 on: June 09, 2008, 10:28:41 PM »
                Thank you.
                It says only save to disc, with option to save file or cancel.
                Ok, on desk. Proceeding
                Logged
                "The rarest of blooms is enhanced by the coldest of winters"

                evilfantasy

                • Malware Removal Specialist
                • Moderator


                  • Genius
                • Calm like a bomb
                  • Thanked: 493
                • Experience: Experienced
                • OS: Windows 11
                Re: problem after running first spybot S & D
                « Reply #13 on: June 09, 2008, 10:32:19 PM »
                When DSS finishes it should pop up two logs. If it instead gives you options save them, choose to save them to the Desktop and then copy/paste them back here.
                Logged

                okbreeze

                  Topic Starter


                  Beginner

                • semi-illiterate pc user
                  Re: problem after running first spybot S & D
                  « Reply #14 on: June 09, 2008, 11:01:40 PM »
                  Deckard's System Scanner v20071014.68
                  Run by txboots on 2008-06-09 23:31:08
                  Computer is in Normal Mode.
                  --------------------------------------------------------------------------------

                  -- System Restore --------------------------------------------------------------

                  Successfully created a Deckard's System Scanner Restore Point.


                  -- Last 5 Restore Point(s) --
                  11: 2008-06-10 04:31:45 UTC - RP397 - Deckard's System Scanner Restore Point
                  10: 2008-06-09 00:11:49 UTC - RP396 - System Checkpoint
                  9: 2008-06-07 23:21:12 UTC - RP395 - 6-07-08 first multi cleanout
                  8: 2008-06-07 20:55:50 UTC - RP394 - System Checkpoint
                  7: 2008-06-05 20:21:22 UTC - RP393 - System Checkpoint


                  -- First Restore Point --
                  1: 2008-05-31 00:59:44 UTC - RP387 - System Checkpoint


                  Backed up registry hives.
                  Performed disk cleanup.

                  Total Physical Memory: 319 MiB (512 MiB recommended).


                  -- HijackThis (run as txboots.exe) ---------------------------------------------

                  Logfile of Trend Micro HijackThis v2.0.2
                  Scan saved at 11:38:18 PM, on 6/9/2008
                  Platform: Windows XP SP2 (WinNT 5.01.2600)
                  MSIE: Internet Explorer v7.00 (7.00.6000.16640)
                  Boot mode: Normal

                  Running processes:
                  C:\WINDOWS\System32\smss.exe
                  C:\WINDOWS\system32\winlogon.exe
                  C:\WINDOWS\system32\services.exe
                  C:\WINDOWS\system32\lsass.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\WINDOWS\Explorer.EXE
                  C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
                  C:\WINDOWS\system32\WgaTray.exe
                  C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
                  C:\WINDOWS\system32\spoolsv.exe
                  C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
                  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                  C:\Documents and Settings\txboots\Desktop\dss.exe
                  C:\PROGRA~1\TRENDM~1\HIJACK~1\txboots.exe

                  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
                  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://login.yahoo.com/config/verify?.done=http%3a//www.yahoo.com
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
                  R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c=2c00&s=searchbar&LC=0409
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://if.searchcentrix.com/sidecat.jsp?p=98567&appid=21&id=191313216167143173
                  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
                  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
                  O1 - Hosts: 216.177.73.139 auto.search.msn.com
                  O1 - Hosts: 216.177.73.139 search.netscape.com
                  O2 - BHO: biObj Class - {000006B1-19B5-414A-849F-2A3C64AE6939} - (no file)
                  O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - (no file)
                  O2 - BHO: ZIBho Class - {029CA12C-89C1-46a7-A3C7-82F2F98635CB} - (no file)
                  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                  O2 - BHO: GSIM - {4E7BD74F-2B8D-469E-DFF7-EC6BF4D5FA7D} - (no file)
                  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                  O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\SearchSuggest\YSearchSuggest.dll
                  O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
                  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                  O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
                  O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
                  O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
                  O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
                  O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
                  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                  O9 - Extra button: (no name) - {06FE5D02-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirectors/presario/srchredir.dll?s=avlinksearch&c=2c00&LC=0409 (file missing)
                  O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL - {06FE5D02-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirectors/presario/srchredir.dll?s=avlinksearch&c=2c00&LC=0409 (file missing)
                  O9 - Extra button: (no name) - {06FE5D03-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirectors/presario/srchredir.dll?s=avhostsearch&c=2c00&LC=0409 (file missing)
                  O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host - {06FE5D03-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirectors/presario/srchredir.dll?s=avhostsearch&c=2c00&LC=0409 (file missing)
                  O9 - Extra button: (no name) - {06FE5D04-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/home (file missing)
                  O9 - Extra 'Tools' menuitem: AV Home - {06FE5D04-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/home (file missing)
                  O9 - Extra button: Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirectors/presario/srchredir.dll?s=avbabelfish&c=2c00&LC=0409 (file missing)
                  O9 - Extra 'Tools' menuitem: AV &Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirectors/presario/srchredir.dll?s=avbabelfish&c=2c00&LC=0409 (file missing)
                  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
                  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
                  O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                  O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                  O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
                  O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
                  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                  O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
                  O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
                  O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
                  O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe

                  --
                  End of file - 7792 bytes

                  -- File Associations -----------------------------------------------------------

                  .bat - batfile - DefaultIcon - C:\WINDOWS\SYSTEM32\SHELL32.DLL,-153
                  .com - comfile - DefaultIcon - C:\WINDOWS\SYSTEM32\SHELL32.DLL,2
                  .hlp - hlpfile - DefaultIcon - C:\WINDOWS\SYSTEM32\SHELL32.DLL,23
                  .ini - inifile - DefaultIcon - shell32.dll,-151
                  .js - JSFile - DefaultIcon - C:\WINDOWS\System32\migicons.exe,11
                  .reg - regfile - DefaultIcon - C:\WINDOWS\regedit.exe,1
                  .reg - regfile - shell\open\command - unable to read value
                  .txt - txtfile - DefaultIcon - shell32.dll,-152
                  .vbs - VBSFile - DefaultIcon - C:\WINDOWS\System32\migicons.exe,10


                  -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

                  R3 BDSelfPr - c:\program files\bitdefender\bitdefender 2008\bdselfpr.sys <Not Verified; BitDefender S.R.L.; BitDefender>

                  S3 iAimTV2 - c:\windows\system32\drivers\watv03nt.sys (file missing)


                  -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

                  All services whitelisted.


                  -- Device Manager: Disabled ----------------------------------------------------

                  Class GUID: {4D36E96F-E325-11CE-BFC1-08002BE10318}
                  Description: PS/2 Compatible Mouse
                  Device ID: ACPI\PNP0F13\4&264480D3&0
                  Manufacturer: Microsoft
                  Name: PS/2 Compatible Mouse
                  PNP Device ID: ACPI\PNP0F13\4&264480D3&0
                  Service: i8042prt

                  Class GUID: {4D36E96B-E325-11CE-BFC1-08002BE10318}
                  Description: Standard 101/102-Key or Microsoft Natural PS/2 Keyboard
                  Device ID: ACPI\PNP0303\4&264480D3&0
                  Manufacturer: (Standard keyboards)
                  Name: Standard 101/102-Key or Microsoft Natural PS/2 Keyboard
                  PNP Device ID: ACPI\PNP0303\4&264480D3&0
                  Service: i8042prt


                  -- Files created between 2008-05-09 and 2008-06-09 -----------------------------

                  2008-06-09 15:25:17         0 d-------- C:\Program Files\MyWebSearch
                  2008-06-09 04:06:13         0 d-------- C:\Program Files\Trend Micro
                  2008-05-31 20:34:19   1753088 --a------ C:\WINDOWS\system32\ExGrid.dll <Not Verified; Exontrol Inc.; ExGrid Module>
                  2008-05-31 20:34:10    614400 --a------ C:\WINDOWS\system32\ExButton.dll <Not Verified; Exontrol Inc.; ExButton Module>
                  2008-05-31 20:34:09    602112 --a------ C:\WINDOWS\system32\ExMenu.dll <Not Verified; Exontrol Inc.; ExMenu Control>
                  2008-05-31 20:34:08    516096 --a------ C:\WINDOWS\system32\ExTab.dll <Not Verified; Exontrol Inc.; ExTab Module>
                  2008-05-31 20:34:08    307200 --a------ C:\WINDOWS\system32\ExPMenu.dll <Not Verified; Exontrol Inc.; ExPopupMenu Control>
                  2008-05-31 20:33:58    356352 --a------ C:\WINDOWS\system32\eSellerateEngine.dll <Not Verified; eSellerate Inc.; eSellerateEngine>
                  2008-05-31 20:33:57    118784 --a------ C:\WINDOWS\system32\eWebControl.dll <Not Verified; eSellerate Inc.; >
                  2008-05-31 20:33:57         0 d-------- C:\Program Files\Common Files\eSellerate
                  2008-05-31 20:33:56    368912 --a------ C:\WINDOWS\system32\vbar332.dll <Not Verified; Microsoft Corporation; Microsoft Visual Basic for Applications>
                  2008-05-31 20:33:49         0 d-------- C:\Program Files\AnswersThatWork
                  2008-05-31 15:18:22       335 --a------ C:\WINDOWS\mozregistry.dat
                  2008-05-30 19:54:38         0 dr-h----- C:\Documents and Settings\txboots\Recent
                  2008-05-29 18:06:51         0 d-------- C:\Program Files\Foxit Software
                  2008-05-28 18:17:21         0 d-------- C:\Program Files\WhatsRunning
                  2008-05-23 11:11:46         0 d-------- C:\Documents and Settings\txboots\dwhelper
                  2008-05-23 10:27:10      1160 --a------ C:\WINDOWS\mozver.dat
                  2008-05-22 22:08:37         0 d-------- C:\Documents and Settings\txboots\Application Data\Mozilla


                  -- Find3M Report ---------------------------------------------------------------

                  2008-05-08 20:04:12         0 d-------- C:\Documents and Settings\txboots\Application Data\W Photo Studio
                  2008-05-08 20:03:32         0 d-------- C:\Documents and Settings\txboots\Application Data\Walgreens
                  2008-05-08 20:03:22         0 d-------- C:\Program Files\Common Files\HP
                  2008-05-08 20:03:10         0 d-------- C:\Program Files\Walgreens
                  2008-05-08 19:55:06         0 d-------- C:\Documents and Settings\txboots\Application Data\W Photo Studio Viewer
                  2008-05-07 11:43:40         0 d-------- C:\Documents and Settings\txboots\Application Data\Uniblue
                  2008-04-22 11:29:30         0 d-------- C:\Documents and Settings\txboots\Application Data\BitDefender
                  2008-04-22 11:28:02         0 d-------- C:\Program Files\BitDefender
                  2008-04-22 11:26:16         0 d-------- C:\Program Files\Common Files\BitDefender
                  2008-04-21 20:26:56         0 d-------- C:\Program Files\Screen-Savers.com
                  2008-04-21 20:26:56         0 d-------- C:\Program Files\Java
                  2008-04-21 20:26:56         0 d-------- C:\Program Files\Java Web Start
                  2008-04-01 11:24:06     29948 --a------ C:\my pictures


                  -- Registry Dump ---------------------------------------------------------------

                  *Note* empty entries & legit default entries are not shown


                  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{000006B1-19B5-414A-849F-2A3C64AE6939}]

                  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E7BD74F-2B8D-469E-DFF7-EC6BF4D5FA7D}]

                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                  "SystemTray"="SysTray.Exe" [08/23/2001 12:00 PM C:\WINDOWS\SYSTEM32\systray.exe]
                  "BitDefender Antiphishing Helper"="C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe" [10/09/2007 03:46 PM]
                  "BDAgent"="C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe" [06/09/2008 10:13 AM]

                  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                  "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [01/28/2008 11:43 AM]

                  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
                  "SpybotSnD"="C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck

                  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
                  @="Service"

                  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
                  @="Volume shadow copy"

                  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
                  C:\WINDOWS\system32\ctfmon.exe

                  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EXSHOW95.EXE]
                  EXSHOW95.EXE

                  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
                  %systemroot%\system32\dumprep 0 -k

                  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WebSavingsfromEbates]
                  wjview /cp:p "C:\Program Files\WebSavingsfromEbates\System\Code" Main lp: "C:\Program Files\WebSavingsfromEbates"

                  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
                  "MoneyAgent"="C:\Program Files\Microsoft Money\System\Money Express.exe"
                  "MSMSGS"=C:\Program Files\Messenger\msmsgs.exe /background

                  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
                  "ScanRegistry"=c:\windows\scanregw.exe /autorun
                  "CPQEASYACC"=C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
                  "EACLEAN"=C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe
                  "Service Connection"=c:\cpqs\bwtools\sccenter.exe
                  "CountrySelection"=pctptt.exe
                  "CPQInet"=c:\compaq\CPQInet\CpqInet.exe
                  "LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
                  "Digital Dashboard"=C:\Program Files\Compaq\Digital Dashboard\DevGulp.exe
                  "LoadQM"=loadqm.exe
                  "QuickTime Task"=C:\WINDOWS\SYSTEM32\qttask.exe
                  "ausvc"=C:\WINDOWS\ausvc.exe
                  "SysScan"=C:\WINDOWS\bvt.exe
                  "ABsr"=C:\WINDOWS\absr.exe
                  "MovieNetworks"="C:\Program Files\MovieNetworks\MovieNetworks.exe" /H
                  "WebInstall2"=C:\WINDOWS\TEMP\INS93B4.TMP /R /A
                  "Hotbar"=C:\PROGRAM FILES\HOTBAR\BIN\4.2.8.0\HBINST.EXE /Upgrade
                  "DXM6Patch_981116"=C:\WINDOWS\p_981116.exe /Q:A
                  "LVComs"=C:\WINDOWS\SYSTEM32\LVComS.exe
                  "KAZAA"=C:\PROGRAM FILES\KAZAA\KAZAA.EXE /SYSTRAY
                  "Mouse Suite 98 Daemon"=PELMICED.EXE

                  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
                  "PTSNOOP"=ptsnoop.exe
                  "LexStart"=Lexstart.exe
                  "LexmarkPrinTray"=PrinTray.exe
                  "CountrySelection"=pctptt.exe
                  "LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

                  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices-]
                  "SchedulingAgent"=mstask.exe
                  "LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
                  "Hidserv"=Hidserv.exe run

                  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
                  bdx   scan


                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>IEPerUser]
                  RUNDLL32.EXE IEDKCS32.DLL,BrandIE4 SIGNUP

                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
                  "C:\Program Files\Outlook Express\setup50.exe" /APP:OE /CALLER:IE50 /user /install
                  "C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:IE50 /user /install
                  "C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:IE50 /user /install

                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA851-CC51-11CF-AAFA-00AA00B6015C}]
                  rundll32.exeadvpack.dll

                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
                  "C:\Program Files\Outlook Express\setup50.exe" /APP:WAB /CALLER:IE50 /user /install
                  "C:\Program Files\Outlook Express\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install
                  "C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:IE50 /user /install

                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}]
                  C:\WINDOWS\SYSTEM32\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl



                  -- Hosts -----------------------------------------------------------------------

                  216.177.73.139 auto.search.msn.com
                  216.177.73.139 search.netscape.com
                  127.0.0.1   www.007guard.com
                  127.0.0.1   007guard.com
                  127.0.0.1   008i.com
                  127.0.0.1   www.008k.com
                  127.0.0.1   008k.com
                  127.0.0.1   www.00hq.com
                  127.0.0.1   00hq.com
                  127.0.0.1   010402.com

                  8701 more entries in hosts file.


                  -- End of Deckard's System Scanner: finished at 2008-06-09 23:44:39 ------------

                  exceeded allowable max length, so the extra.txt-Notepad on next reply?
                  Logged
                  "The rarest of blooms is enhanced by the coldest of winters"
                  Pages: [1] 2 3 4  All   Go Up
                  « previous next »