VONDO

spricelessspriceless
edited July 2008 in Spyware & Virus Removal
:sad2: I had hooked up a laptop from my job to my home system. When I turned my system on it kept rebooting. I finally was able to stop it long enough to do a chkdsk /r/f it repaired itself. But the laptop had this vondo/resident and vondo/j and other vondo adware viruses on it and i dont know if it is still affecting my system.

This is my log (i cant get into the laptop the dll i guess was eaten up)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:22:41 PM, on 5/16/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: FlyOrDie Games Toolbar - {70a732af-f392-4ed8-823a-85fd644d4d92} - C:\Program Files\FlyOrDie_Games\tbFly1.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: FlyOrDie Games Toolbar - {70a732af-f392-4ed8-823a-85fd644d4d92} - C:\Program Files\FlyOrDie_Games\tbFly1.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: FlyOrDie Games Toolbar - {70a732af-f392-4ed8-823a-85fd644d4d92} - C:\Program Files\FlyOrDie_Games\tbFly1.dll
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZCxdm801MTUS
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: CarbonPoker - {6FDD5236-C9F0-49ef-935D-385F5E21991A} - C:\Documents and Settings\Susan\Start Menu\Programs\CarbonPoker\CarbonPoker.lnk (HKCU)
O9 - Extra button: CarbonPoker - {e4e8c758-34b4-44bb-8ef9-1f0786e81d2d} - C:\Documents and Settings\Susan\Start Menu\Programs\CarbonPoker\CarbonPoker.lnk (HKCU)
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/CursorManiaFWBInitialSetup1.0.0.15-3.cab
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.3.7.cab
O16 - DPF: {6FDB0065-2787-11D6-B1D8-0001023916FC} (CLOActiveXInstaller Control) - http://www.igl.net/clo/install/CLOActiveXInstallerProj1.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/luxr/default/mjolauncher.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-6dd5848685b4130c.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: McAfee Application Installer Cleanup (0285661210935323) (0285661210935323mcinstcleanup) - McAfee, Inc. - C:\DOCUME~1\Susan\LOCALS~1\Temp\028566~1.EXE
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
--
End of file - 10376 bytes:sad2:

Comments

  • ThomasThomas
    edited May 2008
    Hello spriceless,

    Some unwanted software here, like that PokerStars/CarbonPoker installed, and that FlyOrDie Games Toolbar is actually a Conduit product, so you can assume your searches there are being redirected to their Israeli based servers in some fashion. But none of the more serious malware you mention. Why not go to Add/Remove Programs and uninstall at least those undesirable items, to get them out of the way, and then let's see get more details and see what needs repairs there. If MyWay/MySearch/MyWebSearch or other FunWeb listings show in Add/Remove uninstall those as well.


    To keep them from interfering with the repairs, be sure to temporarily disable all antivirus/anti-spyware softwares while these steps are being completed. This can usually be done through right clicking the software's Taskbar icons, or accessing each software through Start - Programs.


    Download Deckard's System Scanner (dss.exe) to your Desktop. Note: You must be logged onto an account with administrator privileges.

    Making sure dss.exe is directly on your desktop, go to Start - Run, and copy/paste the following (then press OK):

    "%userprofile%\desktop\dss.exe" /config

    When the DSS Configuration display opens click the "Check All" button (if the "Uncheck All" button shows, click that, then click "Check All"). Next, Under Main Log, uncheck the following:

    System Restore
    Temp Cleanup
    Process Modules

    Then under Options, place a check next to the following:

    Backup Registry Hives

    Don't make any other changes at this time. Then click the "Scan!" button to start the scan.

    Once the scan has completed a textbox will appear - copy/paste those contents back here (main.txt). Also a second text file, extra.txt, will show as minimized in your Task Bar. Maximize/Open this, and copy/paste those contents back here along with the main.txt please. (The logs can also be found in the C:\Deckard\System Scanner folder)

    You can use extra posts here if needed for that.
  • spricelessspriceless
    edited May 2008
    Deckard's System Scanner v20071014.68
    Run by Susan on 2008-05-20 18:08:29
    Computer is in Normal Mode.
    -- System Restore
    Successfully created a Deckard's System Scanner Restore Point.

    -- Last 5 Restore Point(s) --
    78: 2008-05-20 22:08:35 UTC - RP237 - Deckard's System Scanner Restore Point
    77: 2008-05-20 22:05:25 UTC - RP236 - Removed Norton Security Scan
    76: 2008-05-20 22:04:04 UTC - RP235 - Removed Full Tilt Poker
    75: 2008-05-20 22:02:44 UTC - RP234 - Removed Apple Software Update
    74: 2008-05-20 22:01:40 UTC - RP233 - Removed Apple Mobile Device Support

    -- First Restore Point --
    1: 2008-02-21 14:42:54 UTC - RP160 - System Checkpoint

    Backed up registry hives.
    Performed disk cleanup.
    Total Physical Memory: 383 MiB (512 MiB recommended).

    -- HijackThis (run as Susan.exe)
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 6:10:09 PM, on 5/20/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
    C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
    C:\Program Files\Windows Desktop Search\WindowsSearch.exe
    C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
    c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\McAfee\MPF\MPFSrv.exe
    C:\PROGRA~1\McAfee\MPS\mps.exe
    C:\Program Files\CDBurnerXP\NMSAccessU.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\SearchIndexer.exe
    C:\Program Files\McAfee\MPS\mpsevh.exe
    c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\Documents and Settings\Susan\Desktop\dss.exe
    C:\PROGRA~1\TRENDM~1\HIJACK~1\Susan.exe
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
    O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
    O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
    O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
    O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe
    O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
    O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
    O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZCxdm801MTUS
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: CarbonPoker - {6FDD5236-C9F0-49ef-935D-385F5E21991A} - C:\Documents and Settings\Susan\Start Menu\Programs\CarbonPoker\CarbonPoker.lnk (file missing) (HKCU)
    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/CursorManiaFWBInitialSetup1.0.0.15-3.cab
    O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.3.7.cab
    O16 - DPF: {6FDB0065-2787-11D6-B1D8-0001023916FC} (CLOActiveXInstaller Control) - http://www.igl.net/clo/install/CLOActiveXInstallerProj1.cab
    O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/luxr/default/mjolauncher.cab
    O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-6dd5848685b4130c.spaces.live.com/PhotoUpload/MsnPUpld.cab
    O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
    O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
    O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
    O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
    --
    End of file - 9199 bytes
    -- File Associations
    All associations okay.

    -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled
    R1 SASDIFSV - c:\program files\superantispyware\sasdifsv.sys
    R3 pcouffin (VSO Software pcouffin) - c:\windows\system32\drivers\pcouffin.sys <Not Verified; VSO Software; Patin couffin engine>
    R3 ProtoWall (ProtoWall Network Service) - c:\windows\system32\drivers\protowall.sys <Not Verified; ; ProtoWall Driver>
    S3 SASENUM - c:\program files\superantispyware\sasenum.sys <Not Verified; SuperAdBlocker, Inc.; SuperAntiSpyware>

    -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled
    S4 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe
    S4 Vongo Service - c:\program files\vongo\vongoservice.exe <Not Verified; Starz Entertainment Group LLC; Vongo>

    -- Device Manager: Disabled
    No disabled devices found.

    -- Scheduled Tasks
    2008-05-16 06:55:10 340 --a
    C:\WINDOWS\Tasks\McDefragTask.job
    2008-05-16 06:55:08 332 --a
    C:\WINDOWS\Tasks\McQcTask.job

    -- Files created between 2008-04-20 and 2008-05-20
    2008-05-16 19:22:13 0 d
    C:\Program Files\Trend Micro
    2008-05-16 06:57:40 143360 --a
    C:\WINDOWS\system32\dunzip32.dll <Not Verified; Inner Media, Inc.; DynaZIP-32 Multi-Threading UnZIP DLL>
    2008-05-16 06:54:47 0 d
    C:\Program Files\McAfee.com
    2008-05-16 06:54:39 0 d
    C:\Program Files\Common Files\McAfee
    2008-05-16 06:54:33 0 d
    C:\Program Files\McAfee
    2008-05-16 06:54:04 0 d
    C:\Documents and Settings\All Users\Application Data\Avg7
    2008-05-16 06:47:13 0 d
    C:\Documents and Settings\All Users\Application Data\McAfee
    2008-05-11 10:45:36 0 d
    C:\Documents and Settings\Susan\Application Data\Download Manager

    -- Find3M Report
    2008-05-20 18:04:13 0 d--h
    C:\Program Files\InstallShield Installation Information
    2008-05-20 18:04:13 0 d
    C:\Program Files\Full Tilt Poker
    2008-05-20 18:03:25 0 d
    C:\Documents and Settings\Susan\Application Data\Vso
    2008-05-20 18:02:07 0 d
    C:\Program Files\Common Files
    2008-05-20 18:00:48 0 d
    C:\Program Files\BitLord
    2008-05-20 17:55:02 0 d
    C:\Program Files\FlyOrDie_Games
    2008-05-20 17:46:55 0 d
    C:\Documents and Settings\Susan\Application Data\Skype
    2008-05-20 17:00:14 0 d
    C:\Documents and Settings\Susan\Application Data\skypePM
    2008-05-17 22:50:31 0 d
    C:\Program Files\Case's Ladder
    2008-05-14 20:41:50 0 d
    C:\Program Files\PokerStars
    2008-04-16 22:56:16 0 d
    C:\Program Files\SUPERAntiSpyware
    2008-04-11 21:41:04 668 --a
    C:\Documents and Settings\Susan\Application Data\vso_ts_preview.xml
    2008-04-09 02:32:29 0 d
    C:\Program Files\Windows Live
    2008-04-09 02:11:07 0 d
    C:\Program Files\Microsoft Works
    2008-03-29 10:01:37 0 d
    C:\Program Files\Java
    2008-03-02 20:18:18 50 --a
    C:\WINDOWS\system32\bridf06a.dat

    -- Registry Dump
    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [05/14/2007 06:22 PM]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 11:16 PM]
    "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [02/01/2008 12:13 AM]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [02/19/2008 02:10 PM]
    "SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [10/14/2003 11:22 AM]
    "PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [03/17/2005 03:25 PM]
    "IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [03/17/2005 03:45 PM]
    "BrMfcWnd"="C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe" [03/28/2006 04:48 PM]
    "SetDefPrt"="C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe" [01/26/2005 07:02 PM]
    "ControlCenter3"="C:\Program Files\Brother\ControlCenter3\brctrcen.exe" [04/10/2006 03:58 PM]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25 AM]
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [10/26/2007 08:13 PM]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 08:00 AM]
    [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
    "swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Windows Desktop Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe [2/5/2007 4:40:46 PM]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [12/20/2006 02:55 PM 77824]
    "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [02/05/2007 04:39 PM 294400]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 04/19/2007 02:41 PM 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=&quot;"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Vongo Tray.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Vongo Tray.lnk
    backup=C:\WINDOWS\pss\Vongo Tray.lnkCommon Startup
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
    backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    C:\WINDOWS\system32\ctfmon.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDAudDeck]
    C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    "C:\Program Files\iTunes\iTunesHelper.exe"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\My Web Search Bar Search Scope Monitor]
    "C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe" /m=2 /w
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
    C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NWEReboot]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\S3Trayp]
    S3trayp.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
    "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer]
    VTTimer.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "WLSetupSvc"=3 (0x3)
    "Vongo Service"=2 (0x2)
    "NBService"=3 (0x3)
    "iPod Service"=3 (0x3)
    "gusvc"=3 (0x3)
    "AVGEMS"=2 (0x2)
    "Apple Mobile Device"=2 (0x2)

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{11d5b522-9ab4-11dc-a53c-0019211edd2e}]
    AutoRun\command- setupSNK.exe


    -- End of Deckard's System Scanner: finished at 2008-05-20 18:10:53
    Deckard's System Scanner v20071014.68
    Extra logfile - please post this as an attachment with your post.
    -- System Information
    Microsoft Windows XP Home Edition (build 2600) SP 2.0
    Architecture: X86; Language: English
    CPU 0: Intel(R) Pentium(R) 4 CPU 3.00GHz
    CPU 1: Intel(R) Pentium(R) 4 CPU 3.00GHz
    Percentage of Memory in Use: 70%
    Physical Memory (total/avail): 382.23 MiB / 113.2 MiB
    Pagefile Memory (total/avail): 1016.47 MiB / 632.55 MiB
    Virtual Memory (total/avail): 2047.88 MiB / 1930.27 MiB
    C: is Fixed (NTFS) - 298.08 GiB total, 252.11 GiB free.
    D: is CDROM (No Media)
    E: is Removable (No Media)
    F: is Removable (No Media)
    G: is Removable (No Media)
    H: is Removable (No Media)
    [URL="file://\\.\PHYSICALDRIVE0"]\\.\PHYSICALDRIVE0[/URL] - WDC WD3200AAJB-00TYA0 - 298.09 GiB - 1 partition
    \PARTITION0 (bootable) - Installable File System - 298.08 GiB - C:
    [URL="file://\\.\PHYSICALDRIVE1"]\\.\PHYSICALDRIVE1[/URL] - USB2.0 CardReader CF USB Device
    [URL="file://\\.\PHYSICALDRIVE3"]\\.\PHYSICALDRIVE3[/URL] - USB2.0 CardReader MS USB Device
    [URL="file://\\.\PHYSICALDRIVE4"]\\.\PHYSICALDRIVE4[/URL] - USB2.0 CardReader SD USB Device
    [URL="file://\\.\PHYSICALDRIVE2"]\\.\PHYSICALDRIVE2[/URL] - USB2.0 CardReader SM XD USB Device

    -- Security Center
    AUOptions is scheduled to auto-install.
    Windows Internal Firewall is disabled.
    FirstRunDisabled is set.
    AntiVirusDisableNotify is set.
    FirewallDisableNotify is set.
    AntivirusOverride is set.
    FW: McAfee Personal Firewall v (McAfee)
    AV: McAfee VirusScan v (McAfee)
    [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
    ""=""
    "C:\\Program Files\\Vongo\\VongoService.exe"="C:\\Program Files\\Vongo\\VongoService.exe:*:enabled:VongoService"
    [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
    "C:\\Program Files\\Case's Ladder\\bidwhist.exe"="C:\\Program Files\\Case's Ladder\\bidwhist.exe:*:Enabled:Bidwhist Game"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
    "C:\\Program Files\\Case's Ladder\\ChatClient.exe"="C:\\Program Files\\Case's Ladder\\ChatClient.exe:*:Enabled:Chat Client Program"
    "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader"
    "C:\\Program Files\\BitLord\\BitLord.exe"="C:\\Program Files\\BitLord\\BitLord.exe:*:Enabled:BitLord"
    "C:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"="C:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe:*:Enabled:Nero Home"
    "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
    "C:\\Program Files\\Bluetack\\Blocklist Manager\\BlockMgr.exe"="C:\\Program Files\\Bluetack\\Blocklist Manager\\BlockMgr.exe:*:Enabled:The Blocklist Manager"
    "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
    "C:\\Program Files\\CarbonPoker\\client.exe"="C:\\Program Files\\CarbonPoker\\client.exe:*:Disabled:Carbon Poker Client"
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype. Take a deep breath "
    "C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"="C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe:*:Enabled:McAfee Network Agent"

    -- Environment Variables
    ALLUSERSPROFILE=C:\Documents and Settings\All Users
    APPDATA=C:\Documents and Settings\Susan\Application Data
    CLASSPATH=.;C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip
    CLIENTNAME=Console
    CommonProgramFiles=C:\Program Files\Common Files
    COMPUTERNAME=SUSAN
    ComSpec=C:\WINDOWS\system32\cmd.exe
    FP_NO_HOST_CHECK=NO
    HOMEDRIVE=C:
    HOMEPATH=\Documents and Settings\Susan
    LOGONSERVER=\\SUSAN
    NUMBER_OF_PROCESSORS=2
    OS=Windows_NT
    Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\QuickTime\QTSystem\
    PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
    PROCESSOR_ARCHITECTURE=x86
    PROCESSOR_IDENTIFIER=x86 Family 15 Model 6 Stepping 5, GenuineIntel
    PROCESSOR_LEVEL=15
    PROCESSOR_REVISION=0605
    ProgramFiles=C:\Program Files
    PROMPT=$P$G
    QTJAVA=C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip
    SESSIONNAME=Console
    SystemDrive=C:
    SystemRoot=C:\WINDOWS
    TEMP=C:\DOCUME~1\Susan\LOCALS~1\Temp
    TMP=C:\DOCUME~1\Susan\LOCALS~1\Temp
    USERDOMAIN=SUSAN
    USERNAME=Susan
    USERPROFILE=C:\Documents and Settings\Susan
    windir=C:\WINDOWS

    -- User Profiles
    Susan (admin)

    -- Add/Remove Programs
    --> C:\Program Files\Nero\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL
    --> C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
    --> C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
    --> C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
    --> C:\WINDOWS\UNNeroVision.exe /UNINSTALL
    --> C:\WINDOWS\UNRecode.exe /UNINSTALL
    --> MsiExec.exe /I{8A42F680-2DD6-11D4-9A8C-0040F6982C20}
    --> MsiExec.exe /I{A2529672-574A-4A99-86A5-C1770A0E31FE}
    --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
    Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
    Adobe Reader 8.1.2 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003}
    Adobe Shockwave Player 11 --> C:\WINDOWS\system32\adobe\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Adobe\SHOCKW~1\Install.log
    AIM 6 --> C:\Program Files\AIM6\uninst.exe
    Brother MFL-Pro Suite --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9A912C12-A7DA-44D7-BD57-5CA85E2F33E1}\Setup.exe" -l0x9 Brunin03.dll -removeonly
    burnatonce --> "C:\Program Files\burnatonce\unins000.exe"
    CDBurnerXP --> "C:\Program Files\CDBurnerXP\unins000.exe"
    Certiprep for MOS : Office 2003 --> MsiExec.exe /X{70DDE848-8E97-4CCC-BFEE-0157079EA328}
    Certiprep for MOS : Office XP --> MsiExec.exe /X{1FEE650E-9F11-4AEA-860B-8485C8C5CBD0}
    CLO --> C:\Program Files\Case's Ladder\Uninstall.exe
    Comcast High-Speed Internet Install Wizard --> C:\Program Files\support.com\uninstall\chsi_uninstaller.exe
    ConvertXtoDVD 3.0.0.1 --> "C:\Program Files\VSO\ConvertX\3\unins000.exe"
    Dungeon Runners --> C:\Program Files\InstallShield Installation Information\{187A2986-3081-4BBB-A2A7-345F4A2DDEB7}\setup.exe -runfromtemp -l0x0009 -removeonly
    eMusic - 50 Free MP3 offer --> "C:\Program Files\Winamp\eMusic\Uninst-eMusic-promotion.exe"
    Google Toolbar for Internet Explorer --> MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
    Google Toolbar for Internet Explorer --> regsvr32 /u /s "c:\program files\google\googletoolbar1.dll"
    Guild Wars --> "C:\Program Files\Guild Wars\Gw.exe" -uninstall
    High Definition Audio Driver Package - KB888111 --> C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe
    HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
    Hotfix for Windows Media Format 11 SDK (KB929399) --> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
    iTunes --> MsiExec.exe /I{80FD852F-5AAC-4129-B931-06AAFFA43138}
    IZArc 3.81 --> "C:\Program Files\IZArc\unins000.exe"
    Java(TM) 6 Update 5 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
    K-Lite Mega Codec Pack 3.6.5 --> "C:\Program Files\K-Lite Codec Pack\unins000.exe"
    McAfee SecurityCenter --> C:\Program Files\McAfee\MSC\mcuninst.exe
    Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
    Microsoft Office Excel MUI (English) 2007 --> MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
    Microsoft Office Home and Student 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL
    Microsoft Office Home and Student 2007 --> MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE}
    Microsoft Office OneNote MUI (English) 2007 --> MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
    Microsoft Office Outlook MUI (English) 2007 --> MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
    Microsoft Office PowerPoint MUI (English) 2007 --> MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
    Microsoft Office Proof (English) 2007 --> MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
    Microsoft Office Proof (French) 2007 --> MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
    Microsoft Office Proof (Spanish) 2007 --> MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
    Microsoft Office Proofing (English) 2007 --> MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
    Microsoft Office Shared MUI (English) 2007 --> MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
    Microsoft Office Shared Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
    Microsoft Office Standard 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall STANDARD /dll OSETUP.DLL
    Microsoft Office Standard 2007 --> MsiExec.exe /X{90120000-0012-0000-0000-0000000FF1CE}
    Microsoft Office Word MUI (English) 2007 --> MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
    Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
    Microsoft Windows Media Video 9 VCM --> RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmv9vcm.inf, Uninstall
    Mocha W32 TN5250 -- software from MochaSoft --> C:\Program Files\mochasoft\uninstall52.exe
    Move Networks Media Player for Internet Explorer --> C:\Documents and Settings\Susan\Application Data\Move Networks\ie_bin\Uninst.exe
    MSXML 6.0 Parser (KB933579) --> MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
    My Web Search (Cursor Mania) --> rundll32 C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsbar.dll,O
    Nero 7 Essentials --> MsiExec.exe /I{55CE417E-BCB2-47B6-86B5-B40860D81033}
    PaperPort --> MsiExec.exe /I{71C97545-E547-4A8B-B0C8-61FF853270AC}
    PlayNC Launcher --> C:\Program Files\InstallShield Installation Information\{5F8E2CBB-949D-4175-AC98-5ADE7F6C9697}\setup.exe -runfromtemp -l0x0009 -removeonly
    PokerStars --> "C:\Program Files\PokerStars\PokerStarsUninstall.exe" /u:PokerStars
    PowerDVD --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall
    QuickTime --> MsiExec.exe /I{BFD96B89-B769-4CD6-B11E-E79FFD46F067}
    Security Update for Excel 2007 (KB946974) --> msiexec /package {90120000-0012-0000-0000-0000000FF1CE} /uninstall {85E83E2E-AF9B-439B-B4F9-EB9B7EF6A00E}
    Security Update for Excel 2007 (KB946974) --> msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {85E83E2E-AF9B-439B-B4F9-EB9B7EF6A00E}
    Security Update for Microsoft Office system 2007 (KB951808) --> msiexec /package {90120000-0012-0000-0000-0000000FF1CE} /uninstall {8F375E11-4FD6-4B89-9E2B-A76D48B51E00}
    Security Update for Microsoft Office system 2007 (KB951808) --> msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {8F375E11-4FD6-4B89-9E2B-A76D48B51E00}
    Security Update for Microsoft Office Word 2007 (KB950113) --> msiexec /package {90120000-0012-0000-0000-0000000FF1CE} /uninstall {AD72BABE-C733-4FCF-9674-4314466191B9}
    Security Update for Microsoft Office Word 2007 (KB950113) --> msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {AD72BABE-C733-4FCF-9674-4314466191B9}
    Security Update for Office 2007 (KB934062) --> msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {305D509B-F194-4638-9F0F-D9E4C05F9D33}
    Security Update for Office 2007 (KB947801) --> msiexec /package {90120000-0012-0000-0000-0000000FF1CE} /uninstall {02B5A17B-01BE-4BA6-95F1-1CBB46EBC76E}
    Security Update for Office 2007 (KB947801) --> msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {02B5A17B-01BE-4BA6-95F1-1CBB46EBC76E}
    Security Update for Outlook 2007 (KB946983) --> msiexec /package {90120000-0012-0000-0000-0000000FF1CE} /uninstall {66B9496E-C0C3-4065-9868-85CCA92126C3}
    Security Update for the 2007 Microsoft Office System (KB936960) --> msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {5E5BD655-7AA9-47F9-BB6D-A1D8CE29AC86}
    Security Update for Visio 2007 (KB947590) --> msiexec /package {90120000-0012-0000-0000-0000000FF1CE} /uninstall {6BAD036C-261F-4BEF-96CF-C20678D07A41}
    Security Update for Visio 2007 (KB947590) --> msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {6BAD036C-261F-4BEF-96CF-C20678D07A41}
    Skype™ 3.6 --> MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
    SUPERAntiSpyware Free Edition --> MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}
    Total Video Converter 3.11 070908 --> "C:\Program Files\Total Video Converter\unins000.exe"
    Update for Office 2007 (KB932080) --> msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {EDC9CA29-6BC1-471C-828C-7A36109005D7}
    Update for Office 2007 (KB934391) --> msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {B3091818-7C56-4C45-BE7D-CA23027A5EA5}
    Update for Office 2007 (KB946691) --> msiexec /package {90120000-0012-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
    Update for Office 2007 (KB946691) --> msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
    Update for Outlook 2007 Junk Email Filter (kb950378) --> msiexec /package {90120000-0012-0000-0000-0000000FF1CE} /uninstall {F6296086-AED5-4EC0-938B-08EA0254F20E}
    VIA Platform Device Manager --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{20D4A895-748C-4D88-871C-FDB1695B0169}
    VIA Rhine-Family Fast Ethernet Adapter --> Rundll32.exe vuins32.dll,vuins32Ex $Rhine $VIA
    VIA/S3G Display Driver 6.14.10.0078 --> C:\PROGRA~1\S3\UChromeP\s3minset.exe /u UChromeP.uns
    VideoLAN VLC media player 0.8.6d --> C:\Program Files\VideoLAN\VLC\uninstall.exe
    Viewpoint Media Player --> C:\Program Files\Viewpoint\Viewpoint Experience Technology\mtsAxInstaller.exe /u
    Vongo --> MsiExec.exe /X{8C3AE2D1-854D-4650-A73D-C7CC7EE36B80}
    VSO Image Resizer 1.3.2 --> "C:\Program Files\VSO\Image Resizer\unins000.exe"
    VSO Inspector 1.3.1.82b --> "C:\Program Files\vso\tools\unins000.exe"
    Winamp (remove only) --> "C:\Program Files\Winamp\UninstWA.exe"
    Windows Desktop Search 3.01 --> MsiExec.exe /X {E72019B8-1287-4093-BE9B-1CFA7BA1A8D2}
    Windows Desktop Search 3.01 --> MsiExec.exe /X{E72019B8-1287-4093-BE9B-1CFA7BA1A8D2}
    Windows Live installer --> MsiExec.exe /I{621AF8B2-75D2-4074-BA44-79178A617255}
    Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
    WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe

    -- Application Event Log
    Event Record #/Type4319 / Error
    Event Submitted/Written: 05/17/2008 10:24:29 PM
    Event ID/Source: 3024 / Windows Search Service
    Event Description:
    The update cannot be started because the content sources cannot be accessed. Fix the errors and try the update again.
    Context: Windows Application, SystemIndex Catalog
    Event Record #/Type4318 / Warning
    Event Submitted/Written: 05/17/2008 10:24:29 PM
    Event ID/Source: 3036 / Windows Search Service
    Event Description:
    The content source <mapi://{s-1-5-21-789336058-115176313-725345543-1004}/> cannot be accessed.
    Context: Windows Application, SystemIndex Catalog
    Details:
    A server error occurred. Check that the server is available. (0x80041206)
    Event Record #/Type4273 / Error
    Event Submitted/Written: 05/16/2008 06:33:26 AM
    Event ID/Source: 3024 / Windows Search Service
    Event Description:
    The update cannot be started because the content sources cannot be accessed. Fix the errors and try the update again.
    Context: Windows Application, SystemIndex Catalog
    Event Record #/Type4272 / Warning
    Event Submitted/Written: 05/16/2008 06:33:26 AM
    Event ID/Source: 3036 / Windows Search Service
    Event Description:
    The content source <outlookexpress://{s-1-5-21-789336058-115176313-725345543-1004}/{4ee1f49c-39f8-4dba-95c6-f3e06da8ad5e}/> cannot be accessed.
    Context: Windows Application, SystemIndex Catalog
    Details:
    The item cannot be processed further because search failed to find one of its properties. Check that the item is valid in the store. (0x80041213)
    Event Record #/Type4265 / Warning
    Event Submitted/Written: 05/16/2008 06:31:12 AM
    Event ID/Source: 1008 / Windows Search Service
    Event Description:
    The Windows Search Service is attempting to remove the old catalog.

    -- Security Event Log
    No Errors/Warnings found.

    -- System Event Log
    Event Record #/Type12507 / Error
    Event Submitted/Written: 05/20/2008 06:05:39 PM
    Event ID/Source: 7023 / Service Control Manager
    Event Description:
    The Application Management service terminated with the following error:
    %%126
    Event Record #/Type12504 / Error
    Event Submitted/Written: 05/20/2008 06:05:39 PM
    Event ID/Source: 7023 / Service Control Manager
    Event Description:
    The Application Management service terminated with the following error:
    %%126
    Event Record #/Type12501 / Error
    Event Submitted/Written: 05/20/2008 06:05:38 PM
    Event ID/Source: 7023 / Service Control Manager
    Event Description:
    The Application Management service terminated with the following error:
    %%126
    Event Record #/Type12498 / Error
    Event Submitted/Written: 05/20/2008 06:05:38 PM
    Event ID/Source: 7023 / Service Control Manager
    Event Description:
    The Application Management service terminated with the following error:
    %%126
    Event Record #/Type12495 / Error
    Event Submitted/Written: 05/20/2008 06:05:38 PM
    Event ID/Source: 7023 / Service Control Manager
    Event Description:
    The Application Management service terminated with the following error:
    %%126

    -- End of Deckard's System Scanner: finished at 2008-05-20 18:10:53
  • spricelessspriceless
    edited May 2008
    I was not able to remove the mywebsearch it gave me an error message - "Error loading C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsbar.dll The specified module cannot be found." I removed the other flyordie etc. thanks for the info wow - never knew.
  • ThomasThomas
    edited May 2008
    You are getting the MyWeb error because you have the startup disabled through msconfig there - quite a few actually. Really was meant as an MS diagnostic tool and not a startup disabler. What happens are things like you just experienced, as well as services getting disabled other service are "dependents" of, and startups left behind when the software is uninstalled. Really a long list of "why nots" as far as using msconfig to make startup changes, instead of using the software's settings/options, or just opting to uninstall those that don't help you do that (Real Player always comes to mind - the ultimate no disable software, but uninstalls just fine).


    Let's do a scan, and if no serious malware is located to address we will turn our attentions to all these disabled items and issues.


    Go here and run the Kaspersky online scan, and post back the log it creates (it requires IE).

    To use the scan, accept the agreement and make sure you allow the ActiveX object to download and install (check the "yellow bar" at the top of IE if needed to allow this). Once the download has completed click Next, then Scan Settings, then make sure the "extended option" is checked (leave all others as they are) and click OK. Then click "My Computer" to begin the scan. Save the Report as a text file and post that back here.

    To save it as a text file, still with the page in Internet Explorer, go to the top of the page and select File - Save As... Then make sure in the "Save as type" drop down you change it to "Text File(*.txt)".

    Just post back that log for now please.
  • ThomasThomas
    edited May 2008
    Forgot to ask - when you indicate something found "vondo", I assumed you meant the well known "vundo" infection group. But your system has Vongo's movie downloader service installed there. Name mixup perhaps?
  • spricelessspriceless
    edited May 2008
    Thomas wrote:
    Forgot to ask - when you indicate something found "vondo", I assumed you meant the well known "vundo" infection group. But your system has Vongo's movie downloader service installed there. Name mixup perhaps?

    true ment vundo
  • ThomasThomas
    edited May 2008
    That's fine - just wanted to check on the Vongo angle. Go ahead with the scan and let's check those results.
  • spricelessspriceless
    edited May 2008
    KASPERSKY ONLINE SCANNER REPORTKASPERSKY ONLINE SCANNER REPORT
    Friday, May 23, 2008 6:31:19 AM
    Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build
    2600)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 23/05/2008
    Kaspersky Anti-Virus database records: 797188

    Scan Settings
    Scan using the following antivirus databaseextended
    Scan Archivestrue
    Scan Mail Basestrue
    Scan TargetMy Computer
    C:\
    D:\
    E:\
    F:\
    G:\
    H:\
    Scan Statistics
    Total number of scanned objects59224
    Number of viruses found15
    Number of infected objects28
    Number of suspicious objects0
    Duration of the scan process01:23:57
    Infected Object NameVirus NameLast Action
    C:\Documents and Settings\All Users\Application Data\McAfee\MNA\NAData
    Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\McAfee\MPF\data\log.edb Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\McAfee\MSC\Logs\Events.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\McAfee\MSC\Logs\{947F59A9-13BF-4385-8BC0-C05E3FEDFFC2}.log Object is
    locked skipped
    C:\Documents and Settings\All Users\Application
    Data\McAfee\MSC\McUsers.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\McAfee\VirusScan\Data\TFR1.tmp Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\McAfee\VirusScan\Logs\OAS.Log Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.6.Crwl
    Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.6.gthr
    Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\MSS.log Object is locked
    skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\MSStmp.log Object is
    locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.wid
    Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010002.wid
    Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010003.wid
    Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010004.wid
    Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010005.wid
    Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010006.wid
    Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010007.wid
    Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010008.wid
    Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010009.wid
    Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000A.wid
    Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000B.wid
    Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000C.wid
    Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000D.wid
    Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000E.ci
    Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000E.wid
    Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000E.wsb
    Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010014.wid
    Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010015.wid
    Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\INDEX.000
    Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.000
    Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\Used0000.000
    Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\CiST0000.000
    Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk1.gthr
    Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk2.gthr
    Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.Ntfy2.gthr
    Object is locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\tmp.edb Object is locked
    skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Applications\Windows\Windows.edb Object is
    locked skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Temp\usgthrsvc\Ntf2.tmp Object is locked
    skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Temp\usgthrsvc\Ntf3.tmp Object is locked
    skipped
    C:\Documents and Settings\All Users\Application
    Data\Microsoft\Search\Data\Temp\usgthrsvc\Perflib_Perfdata_558.dat Object
    is locked skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked
    skipped
    C:\Documents and Settings\LocalService\Local Settings\Application
    Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application
    Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local
    Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet
    Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked
    skipped
    C:\Documents and Settings\NetworkService\Cookies\index.dat Object is
    locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application
    Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application
    Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local
    Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet
    Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked
    skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked
    skipped
    C:\Documents and Settings\Susan\Cookies\index.dat Object is locked skipped

    C:\Documents and Settings\Susan\Local Settings\Application
    Data\Microsoft\Desktop Search\Logs\OTFSMonLog.txt Object is locked skipped

    C:\Documents and Settings\Susan\Local Settings\Application
    Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\Susan\Local Settings\Application
    Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\Susan\Local
    Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Susan\Local Settings\Temp\hsperfdata_Susan\3232
    Object is locked skipped
    C:\Documents and Settings\Susan\Local Settings\Temp\~DFAA44.tmp Object is
    locked skipped
    C:\Documents and Settings\Susan\Local Settings\Temp\~DFEF42.tmp Object is
    locked skipped
    C:\Documents and Settings\Susan\Local Settings\Temp\~DFEF52.tmp Object is
    locked skipped
    C:\Documents and Settings\Susan\Local Settings\Temporary Internet
    Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is
    locked skipped
    C:\Documents and Settings\Susan\Local Settings\Temporary Internet
    Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Susan\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\Susan\ntuser.dat.LOG Object is locked skipped
    C:\Program Files\Internet Explorer\msimg32.dll Infected:
    not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\Program Files\MyWebSearch\bar\2.bin\F3BROVLY.DLL Infected:
    not-a-virus:AdTool.Win32.MyWebSearch.at skipped
    C:\Program Files\MyWebSearch\bar\2.bin\F3DTACTL.DLL Infected:
    not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
    C:\Program Files\MyWebSearch\bar\2.bin\F3HISTSW.DLL Infected:
    not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\Program Files\MyWebSearch\bar\2.bin\F3HTMLMU.DLL Infected:
    not-a-virus:AdTool.Win32.MyWebSearch.l skipped
    C:\Program Files\MyWebSearch\bar\2.bin\F3HTTPCT.DLL Infected:
    not-a-virus:AdTool.Win32.MyWebSearch.af skipped
    C:\Program Files\MyWebSearch\bar\2.bin\F3IMSTUB.DLL Infected:
    not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\Program Files\MyWebSearch\bar\2.bin\F3POPSWT.DLL Infected:
    not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\Program Files\MyWebSearch\bar\2.bin\F3PSSAVR.SCR Infected:
    not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\Program Files\MyWebSearch\bar\2.bin\F3REPROX.DLL Infected:
    not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\Program Files\MyWebSearch\bar\2.bin\F3RESTUB.DLL Infected:
    not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\Program Files\MyWebSearch\bar\2.bin\F3SCHMON.EXE Infected:
    not-a-virus:AdTool.Win32.MyWebSearch.a skipped
    C:\Program Files\MyWebSearch\bar\2.bin\F3SCRCTR.DLL Infected:
    not-a-virus:AdTool.Win32.MyWebSearch.an skipped
    C:\Program Files\MyWebSearch\bar\2.bin\F3SHLLVW.DLL Infected:
    not-a-virus:AdTool.Win32.MyWebSearch.aq skipped
    C:\Program Files\MyWebSearch\bar\2.bin\F3WPHOOK.DLL Infected:
    not-a-virus:AdTool.Win32.MyWebSearch.bh skipped
    C:\Program Files\MyWebSearch\bar\2.bin\M3HTML.DLL Infected:
    not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
    C:\Program Files\MyWebSearch\bar\2.bin\M3IDLE.DLL Infected:
    not-a-virus:AdTool.Win32.MyWebSearch.ax skipped
    C:\Program Files\MyWebSearch\bar\2.bin\M3MSG.DLL Infected:
    not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
    C:\Program Files\MyWebSearch\bar\2.bin\M3OUTLCN.DLL Infected:
    not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\Program Files\MyWebSearch\bar\2.bin\M3PLUGIN.DLL Infected:
    not-a-virus:AdTool.Win32.MyWebSearch.as skipped
    C:\Program Files\MyWebSearch\bar\2.bin\M3SKIN.DLL Infected:
    not-a-virus:AdTool.Win32.MyWebSearch.ad skipped
    C:\Program Files\MyWebSearch\bar\2.bin\M3SLSRCH.EXE Infected:
    not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\Program Files\MyWebSearch\bar\2.bin\M3SRCHMN.EXE Infected:
    not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\Program Files\MyWebSearch\bar\2.bin\MWSOEPLG.DLL Infected:
    not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\Program Files\MyWebSearch\bar\2.bin\MWSOESTB.DLL Infected:
    not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\Program Files\MyWebSearch\bar\2.bin\NPMYWEBS.DLL Infected:
    not-a-virus:AdTool.Win32.MyWebSearch.i skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is
    locked skipped
    C:\System Volume
    Information\_restore{5372DCC2-2467-4578-B081-C0922DED0749}\RP232\A0031952.exe
    Object is locked skipped
    C:\System Volume
    Information\_restore{5372DCC2-2467-4578-B081-C0922DED0749}\RP237\change.log
    Object is locked skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\EventCache\{92B81346-A311-4A19-818F-63742F60C16D}.bin
    Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked
    skipped
    C:\WINDOWS\Sti_Trace.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
    C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
    C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
    C:\WINDOWS\system32\f3PSSavr.scr Infected:
    not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\WINDOWS\system32\h323log.txt Object is locked skipped
    C:\WINDOWS\system32\Tools\Restart.exe Infected:
    not-a-virus:RiskTool.Win32.Reboot.j skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked
    skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked
    skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked
    skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked
    skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked
    skipped
    C:\WINDOWS\Temp\mcafee_UQfhpxrN1azQfFv Object is locked skipped
    C:\WINDOWS\Temp\mcafee_Z0YGfasyR4sTFGU Object is locked skipped
    C:\WINDOWS\Temp\mcmsc_0msyDrS2M9FOFdq Object is locked skipped
    C:\WINDOWS\Temp\mcmsc_aXe5zwFC8LLgYqg Object is locked skipped
    C:\WINDOWS\Temp\mcmsc_dUOmUMGmaiBf2lb Object is locked skipped
    C:\WINDOWS\Temp\mcmsc_edqGNqBnACAPhIb Object is locked skipped
    C:\WINDOWS\wiadebug.log Object is locked skipped
    C:\WINDOWS\wiaservc.log Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped
    Scan process completed.
  • ThomasThomas
    edited May 2008
    No hint of Vundo, which is always a good thing. Or any of the more malicious type malware like that. Kaspersky shows mostly normally locked system functions, is alerting to the uses of a restart.exe file, which is likely there from Deckards or perhaps some previous use of a tool like that there, and then all the MyWebSearch files. What scan earlier identified Vundo, and any chance you know what files it located on that?

    A good idea now would be to enable all those startups at least once, get MyWeb uninstalled (and if it balks again we'll yank it), check for any startup remnants and make things right there.


    Go to Start - Run, type msconfig (and Enter).

    Under the Startup and Services tabs, click Enable All, then Apply/OK to close msconfig. Allow the reboot at this time. You can expect to receive alerts/error messages at reboot after this, but we will be addressing all this during the repairs.

    Still making sure dss.exe is directly on your desktop, go to Start - Run, and copy/paste the following (then press OK):

    "%userprofile%\desktop\dss.exe" /config

    When the DSS Configuration display opens click the "Check All" button. Next, under Main Log, again uncheck the following:

    System Restore
    Process Modules

    Then under Extra Log, uncheck all the boxes.

    Don't make any other changes at this time. Then click the "Scan!" button to start the scan.

    Once the scan has completed a textbox will appear - copy/paste those contents back here please (main.txt). (The logs can also be found in the C:\Deckard\System Scanner folder)
  • spricelessspriceless
    edited May 2008
    Thomas wrote:
    No hint of Vundo, which is always a good thing. Or any of the more malicious type malware like that. Kaspersky shows mostly normally locked system functions, is alerting to the uses of a restart.exe file, which is likely there from Deckards or perhaps some previous use of a tool like that there, and then all the MyWebSearch files. What scan earlier identified Vundo, and any chance you know what files it located on that?

    A good idea now would be to enable all those startups at least once, get MyWeb uninstalled (and if it balks again we'll yank it), check for any startup remnants and make things right there.


    Go to Start - Run, type msconfig (and Enter).

    Under the Startup and Services tabs, click Enable All, then Apply/OK to close msconfig. Allow the reboot at this time. You can expect to receive alerts/error messages at reboot after this, but we will be addressing all this during the repairs.

    Still making sure dss.exe is directly on your desktop, go to Start - Run, and copy/paste the following (then press OK):

    "%userprofile%\desktop\dss.exe" /config

    When the DSS Configuration display opens click the "Check All" button. Next, under Main Log, again uncheck the following:

    System Restore
    Process Modules

    Then under Extra Log, uncheck all the boxes.

    Don't make any other changes at this time. Then click the "Scan!" button to start the scan.

    Once the scan has completed a textbox will appear - copy/paste those contents back here please (main.txt). (The logs can also be found in the C:\Deckard\System Scanner folder)

    I did not do a previous scan of this magnitude prior. I had a company laptop hooked up to my home system and when I finished and went to use my system it kept recycling the post it would not get past the "Windows" screen. Needless to say that laptop is in the dead pile and I ended up having to do a data file transfer but, I am no expert on viruses so i came to you guys for assistance. I don't know how to read the logs below or nor the Hijack logs so to play it safe I come to the experts. But! I would love to learn though. By the way, I still cannot remove that MyWebSearch I get the same error message.


    Deckard's System Scanner v20071014.68
    Run by Susan on 2008-05-24 11:31:34
    Computer is in Normal Mode.
    Performed disk cleanup.
    Total Physical Memory: 383 MiB (512 MiB recommended).

    -- HijackThis (run as Susan.exe)
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:31:38 AM, on 5/24/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
    c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\McAfee\MPF\MPFSrv.exe
    C:\PROGRA~1\McAfee\MPS\mps.exe
    C:\Program Files\CDBurnerXP\NMSAccessU.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\SearchIndexer.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
    C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe
    C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
    C:\WINDOWS\system32\VTTimer.exe
    C:\WINDOWS\system32\S3trayp.exe
    C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\McAfee\MPS\mpsevh.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Windows Desktop Search\WindowsSearch.exe
    C:\Program Files\Vongo\Tray.exe
    C:\Program Files\Vongo\VongoService.exe
    C:\Program Files\Skype\Plugin Manager\skypePM.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\Susan\desktop\dss.exe
    C:\PROGRA~1\TRENDM~1\HIJACK~1\Susan.exe
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
    O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
    O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
    O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
    O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe
    O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe" /m=2 /w
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
    O4 - Global Startup: Vongo Tray.lnk = ?
    O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZCxdm801MTUS
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: CarbonPoker - {6FDD5236-C9F0-49ef-935D-385F5E21991A} - C:\Documents and Settings\Susan\Start Menu\Programs\CarbonPoker\CarbonPoker.lnk (file missing) (HKCU)
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/CursorManiaFWBInitialSetup1.0.0.15-3.cab
    O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.3.7.cab
    O16 - DPF: {6FDB0065-2787-11D6-B1D8-0001023916FC} (CLOActiveXInstaller Control) - http://www.igl.net/clo/install/CLOActiveXInstallerProj1.cab
    O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/luxr/default/mjolauncher.cab
    O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-6dd5848685b4130c.spaces.live.com/PhotoUpload/MsnPUpld.cab
    O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
    O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
    O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
    O23 - Service: Vongo Service - Starz Entertainment Group LLC - C:\Program Files\Vongo\VongoService.exe
    O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
    --
    End of file - 10594 bytes
    -- File Associations
    All associations okay.

    -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled
    R3 pcouffin (VSO Software pcouffin) - c:\windows\system32\drivers\pcouffin.sys <Not Verified; VSO Software; Patin couffin engine>
    R3 ProtoWall (ProtoWall Network Service) - c:\windows\system32\drivers\protowall.sys <Not Verified; ; ProtoWall Driver>
    R3 SASENUM - c:\program files\superantispyware\sasenum.sys <Not Verified; SuperAdBlocker, Inc.; SuperAntiSpyware>

    -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled
    R2 Vongo Service - c:\program files\vongo\vongoservice.exe <Not Verified; Starz Entertainment Group LLC; Vongo>
    S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe

    -- Device Manager: Disabled
    No disabled devices found.

    -- Scheduled Tasks
    2008-05-16 06:55:10 340 --a
    C:\WINDOWS\Tasks\McDefragTask.job
    2008-05-16 06:55:08 332 --a
    C:\WINDOWS\Tasks\McQcTask.job

    -- Files created between 2008-04-24 and 2008-05-24
    2008-05-22 23:38:52 0 d
    C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
    2008-05-22 23:38:49 0 d
    C:\WINDOWS\system32\Kaspersky Lab
    2008-05-16 19:22:13 0 d
    C:\Program Files\Trend Micro
    2008-05-16 06:57:40 143360 --a
    C:\WINDOWS\system32\dunzip32.dll <Not Verified; Inner Media, Inc.; DynaZIP-32 Multi-Threading UnZIP DLL>
    2008-05-16 06:54:47 0 d
    C:\Program Files\McAfee.com
    2008-05-16 06:54:39 0 d
    C:\Program Files\Common Files\McAfee
    2008-05-16 06:54:33 0 d
    C:\Program Files\McAfee
    2008-05-16 06:54:04 0 d
    C:\Documents and Settings\All Users\Application Data\Avg7
    2008-05-16 06:47:13 0 d
    C:\Documents and Settings\All Users\Application Data\McAfee
    2008-05-11 10:45:36 0 d
    C:\Documents and Settings\Susan\Application Data\Download Manager

    -- Find3M Report
    2008-05-24 11:23:24 0 d
    C:\Documents and Settings\Susan\Application Data\Skype
    2008-05-24 11:15:16 0 d
    C:\Documents and Settings\Susan\Application Data\skypePM
    2008-05-24 11:00:50 0 d
    C:\Program Files\SUPERAntiSpyware
    2008-05-23 21:09:27 0 d
    C:\Program Files\Case's Ladder
    2008-05-20 18:17:53 0 d
    C:\Program Files\PokerStars
    2008-05-20 18:04:13 0 d--h
    C:\Program Files\InstallShield Installation Information
    2008-05-20 18:04:13 0 d
    C:\Program Files\Full Tilt Poker
    2008-05-20 18:03:25 0 d
    C:\Documents and Settings\Susan\Application Data\Vso
    2008-05-20 18:02:07 0 d
    C:\Program Files\Common Files
    2008-05-20 18:00:48 0 d
    C:\Program Files\BitLord
    2008-05-20 17:55:02 0 d
    C:\Program Files\FlyOrDie_Games
    2008-04-11 21:41:04 668 --a
    C:\Documents and Settings\Susan\Application Data\vso_ts_preview.xml
    2008-04-09 02:32:29 0 d
    C:\Program Files\Windows Live
    2008-04-09 02:11:07 0 d
    C:\Program Files\Microsoft Works
    2008-03-29 10:01:37 0 d
    C:\Program Files\Java
    2008-03-02 20:18:18 50 --a
    C:\WINDOWS\system32\bridf06a.dat

    -- Registry Dump
    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [05/14/2007 06:22 PM]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 11:16 PM]
    "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [02/01/2008 12:13 AM]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [02/19/2008 02:10 PM]
    "SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [10/14/2003 11:22 AM]
    "PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [03/17/2005 03:25 PM]
    "IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [03/17/2005 03:45 PM]
    "BrMfcWnd"="C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe" [03/28/2006 04:48 PM]
    "SetDefPrt"="C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe" [01/26/2005 07:02 PM]
    "ControlCenter3"="C:\Program Files\Brother\ControlCenter3\brctrcen.exe" [04/10/2006 03:58 PM]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25 AM]
    "My Web Search Bar Search Scope Monitor"="C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe" [12/24/2007 06:40 PM]
    "VTTimer"="VTTimer.exe" [09/21/2006 04:36 AM C:\WINDOWS\system32\VTTimer.exe]
    "S3Trayp"="S3trayp.exe" [10/09/2006 05:14 PM C:\WINDOWS\system32\S3Trayp.exe]
    "NWEReboot"="" []
    "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [01/12/2006 04:40 PM]
    "HDAudDeck"="C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe" [11/21/2006 11:50 PM]
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [10/26/2007 08:13 PM]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 08:00 AM]
    "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [05/24/2008 11:00 AM]
    "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [12/07/2007 04:08 PM]
    [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
    "swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Vongo Tray.lnk - C:\WINDOWS\Installer\{8C3AE2D1-854D-4650-A73D-C7CC7EE36B80}\NewShortcut2_DB7E00C96DEF489A8112D8F81614F45A.exe [9/14/2007 6:43:29 PM]
    Windows Desktop Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe [2/5/2007 4:40:46 PM]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [02/05/2007 04:39 PM 294400]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [05/24/2008 11:00 AM 77824]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 04/19/2007 02:41 PM 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=&quot;"
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "AVGEMS"=2 (0x2)
    "Apple Mobile Device"=2 (0x2)

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{11d5b522-9ab4-11dc-a53c-0019211edd2e}]
    AutoRun\command- setupSNK.exe


    -- End of Deckard's System Scanner: finished at 2008-05-24 11:32:16
  • ThomasThomas
    edited May 2008
    Let's give MyWebSearch an opportunity to leave now. I scripted the install, so now we'll just reverse those MyWebSearch steps for the uninstall.


    Open HijackThis, and choose None of the above, just start the program. Click Config – Misc Tools – Open process manager. From the list, click each of the following if it is present, and Kill Process. Close HijackThis. This is actually monitoring the keyboard to keep itself from being removed.

    C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe

    To keep them from interfering with the repairs, be sure to temporarily disable all antivirus/anti-spyware softwares while these steps are being completed. This can usually be done through right clicking the software's Taskbar icons, or accessing each software through Start - Programs. Very Important! Also see if you can disable any that have a reboot startup, as the next step will be making changes during reboot.


    Download The Avenger by Swandog from here and save it to your Desktop.

    Then close all open programs and unzip the downloaded avenger.zip file. Then in the new avenger folder created locate and click on avenger.exe to run the tool.

    Okay the warning. When the Avenger display opens copy/paste the following text inside the Code box into the Avenger box titled "Input script here:". Then click the Execute button to run the repair, click Yes, then allow Avenger to reboot your system.
    Begin copying here:
Drivers to delete:
MyWebSearchService
Folders to delete:
C:\Program Files\FunWebProducts
C:\Program Files\MyWebSearch
Files to delete:
C:\Windows\System32\f3pssavr.scr
Registry values to delete:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | My Web Search Bar Search Scope Monitor
Registry keys to delete:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25560540-9571-4D7B-9389-0F166788785A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84DA4FDF-A1CF-4195-8688-3E961F505983}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{938AA51A-996C-4884-98CE-80DD16A5C9DA}

    Your system may reboot twice to complete the repairs. After the reboot a text will open - copy/paste those contents back here please. The log can also be found at C:\avenger.txt.

    After the reboot do the following:
    Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.dat]
"Permissions"=dword:00000001
"Runtime"=dword:00000007
"ReplaceApps"="*.*"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceCurrent]
@=dword:00000011

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent]
@=dword:00000011
    Open Notepad (Start - Run, type notepad and OK) and copy and paste the above text (inside the box) into the text file. Now go to File > Save As and call it endmyweb.reg. Where it says "Files of Type", select All Files and click on Save. Exit Notepad, double-click on the file and ok the prompt asking if you wish to merge the file with your registry.

    Go Here and download ATF Cleaner. Click on the downloaded file to run it, and select "Select All", then click Empty Selected (and close ATF).

    If you have them, also click on Firefox/Opera at the top and repeat the steps (and close ATF). Firefox/Opera will need to be closed first for the cleaning to be effective.


    Then Go here for an online AV scan. Follow all prompts to Allow all ActiveX objects to install. If your AV alerts you while the scan installs ignore this - Panda's Active Scan method is often mistaken for infection activity.

    When the scan completes do not click any of the disinfection links provided. Click the small "Export to:" button and save the log file to your desktop. Then copy the contents of that ActiveScan.txt file back here for review please.

    Then still making sure dss.exe is directly on your desktop, go to Start - Run, and copy/paste the following (then press OK):

    "%userprofile%\desktop\dss.exe" /config

    When the DSS Configuration display opens click the "Check All" button. Next, under Main Log, again uncheck the following:

    System Restore
    Temp Cleanup
    Process Modules

    Then under Extra Log, uncheck all the boxes.

    Don't make any other changes at this time. Then click the "Scan!" button to start the scan.

    Once the scan has completed a textbox will appear - copy/paste those contents back here please (main.txt). (The logs can also be found in the C:\Deckard\System Scanner folder)

    Post that, the Panda ActiveScan log and the C:\avenger.txt please.
  • spricelessspriceless
    edited May 2008
    Thomas wrote:
    Let's give MyWebSearch an opportunity to leave now. I scripted the install, so now we'll just reverse those MyWebSearch steps for the uninstall.


    Open HijackThis, and choose None of the above, just start the program. Click Config – Misc Tools – Open process manager. From the list, click each of the following if it is present, and Kill Process. Close HijackThis. This is actually monitoring the keyboard to keep itself from being removed.

    C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe

    To keep them from interfering with the repairs, be sure to temporarily disable all antivirus/anti-spyware softwares while these steps are being completed. This can usually be done through right clicking the software's Taskbar icons, or accessing each software through Start - Programs. Very Important! Also see if you can disable any that have a reboot startup, as the next step will be making changes during reboot.


    Download The Avenger by Swandog from here and save it to your Desktop.

    Then close all open programs and unzip the downloaded avenger.zip file. Then in the new avenger folder created locate and click on avenger.exe to run the tool.

    Okay the warning. When the Avenger display opens copy/paste the following text inside the Code box into the Avenger box titled "Input script here:". Then click the Execute button to run the repair, click Yes, then allow Avenger to reboot your system.
    Begin copying here:
Drivers to delete:
MyWebSearchService
Folders to delete:
C:\Program Files\FunWebProducts
C:\Program Files\MyWebSearch
Files to delete:
C:\Windows\System32\f3pssavr.scr
Registry values to delete:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | My Web Search Bar Search Scope Monitor
Registry keys to delete:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25560540-9571-4D7B-9389-0F166788785A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84DA4FDF-A1CF-4195-8688-3E961F505983}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{938AA51A-996C-4884-98CE-80DD16A5C9DA}

    Your system may reboot twice to complete the repairs. After the reboot a text will open - copy/paste those contents back here please. The log can also be found at C:\avenger.txt.

    After the reboot do the following:
    Windows Registry Editor Version 5.00
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.dat]
"Permissions"=dword:00000001
"Runtime"=dword:00000007
"ReplaceApps"="*.*"
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceCurrent]
@=dword:00000011
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent]
@=dword:00000011
    Open Notepad (Start - Run, type notepad and OK) and copy and paste the above text (inside the box) into the text file. Now go to File > Save As and call it endmyweb.reg. Where it says "Files of Type", select All Files and click on Save. Exit Notepad, double-click on the file and ok the prompt asking if you wish to merge the file with your registry.

    Go Here and download ATF Cleaner. Click on the downloaded file to run it, and select "Select All", then click Empty Selected (and close ATF).

    If you have them, also click on Firefox/Opera at the top and repeat the steps (and close ATF). Firefox/Opera will need to be closed first for the cleaning to be effective.


    Then Go here for an online AV scan. Follow all prompts to Allow all ActiveX objects to install. If your AV alerts you while the scan installs ignore this - Panda's Active Scan method is often mistaken for infection activity.

    When the scan completes do not click any of the disinfection links provided. Click the small "Export to:" button and save the log file to your desktop. Then copy the contents of that ActiveScan.txt file back here for review please.

    Then still making sure dss.exe is directly on your desktop, go to Start - Run, and copy/paste the following (then press OK):

    "%userprofile%\desktop\dss.exe" /config

    When the DSS Configuration display opens click the "Check All" button. Next, under Main Log, again uncheck the following:

    System Restore
    Temp Cleanup
    Process Modules

    Then under Extra Log, uncheck all the boxes.

    Don't make any other changes at this time. Then click the "Scan!" button to start the scan.

    Once the scan has completed a textbox will appear - copy/paste those contents back here please (main.txt). (The logs can also be found in the C:\Deckard\System Scanner folder)

    Post that, the Panda ActiveScan log and the C:\avenger.txt please.


    I get an error message: "Error: Invalid script. A valid script must begin with a command directive. Aborting execution!":sad2: Then it gives me the OK button.
  • ThomasThomas
    edited May 2008
    Likely got it copied wrong somehow. Go to the top of this thread and click Thread Tools - Show Printable Version. Then scroll down to where the Avenger script starts after the forum "Code:" word, and copy everything below that, including the first "Begin copying here:" line.
  • spricelessspriceless
    edited May 2008
    Thomas wrote:
    Likely got it copied wrong somehow. Go to the top of this thread and click Thread Tools - Show Printable Version. Then scroll down to where the Avenger script starts after the forum "Code:" word, and copy everything below that, including the first "Begin copying here:" line.

    //////////////////////////////////////////
    Avenger Pre-Processor log
    //////////////////////////////////////////
    Platform: Windows XP (build 2600, Service Pack 2)
    Mon May 26 11:57:21 2008
    11:57:21: Error: Invalid script. A valid script must begin with a command directive.
    Aborting execution!

    //////////////////////////////////////////

    //////////////////////////////////////////
    Avenger Pre-Processor log
    //////////////////////////////////////////
    Platform: Windows XP (build 2600, Service Pack 2)
    Mon May 26 11:58:36 2008
    11:58:36: Error: Invalid script. A valid script must begin with a command directive.
    Aborting execution!

    //////////////////////////////////////////

    //////////////////////////////////////////
    Avenger Pre-Processor log
    //////////////////////////////////////////
    Platform: Windows XP (build 2600, Service Pack 2)
    Mon May 26 11:58:47 2008
    11:58:47: Error: Invalid script. A valid script must begin with a command directive.
    Aborting execution!

    //////////////////////////////////////////

    //////////////////////////////////////////
    Avenger Pre-Processor log
    //////////////////////////////////////////
    Platform: Windows XP (build 2600, Service Pack 2)
    Mon May 26 11:59:43 2008
    11:59:43: Error: Invalid script. A valid script must begin with a command directive.
    Aborting execution!

    //////////////////////////////////////////

    //////////////////////////////////////////
    Avenger Pre-Processor log
    //////////////////////////////////////////
    Platform: Windows XP (build 2600, Service Pack 2)
    Mon May 26 12:00:00 2008
    12:00:00: Error: Invalid script. A valid script must begin with a command directive.
    Aborting execution!

    //////////////////////////////////////////

    //////////////////////////////////////////
    Avenger Pre-Processor log
    //////////////////////////////////////////
    Platform: Windows XP (build 2600, Service Pack 2)
    Mon May 26 12:00:29 2008
    12:00:29: Error: Invalid script. A valid script must begin with a command directive.
    Aborting execution!

    //////////////////////////////////////////

    //////////////////////////////////////////
    Avenger Pre-Processor log
    //////////////////////////////////////////
    Platform: Windows XP (build 2600, Service Pack 2)
    Mon May 26 12:03:53 2008
    12:03:53: Error: Invalid script. A valid script must begin with a command directive.
    Aborting execution!

    //////////////////////////////////////////

    //////////////////////////////////////////
    Avenger Pre-Processor log
    //////////////////////////////////////////
    Platform: Windows XP (build 2600, Service Pack 2)
    Mon May 26 16:22:25 2008
    16:22:25: Error: Invalid script. A valid script must begin with a command directive.
    Aborting execution!

    //////////////////////////////////////////

    Logfile of The Avenger Version 2.0, (c) by Swandog46
    http://swandog46.geekstogo.com
    Platform: Windows XP
    *******************
    Script file opened successfully.
    Script file read successfully.
    Backups directory opened successfully at C:\Avenger
    *******************
    Beginning to process script file:
    Rootkit scan active.
    No rootkits found!

    Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\MyWebSearchService" not found!
    Deletion of driver "MyWebSearchService" failed!
    Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
    --> the object does not exist
    Folder "C:\Program Files\FunWebProducts" deleted successfully.
    Folder "C:\Program Files\MyWebSearch" deleted successfully.
    File "C:\Windows\System32\f3pssavr.scr" deleted successfully.
    Registry value "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|My Web Search Bar Search Scope Monitor" deleted successfully.
    Error: registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}" not found!
    Deletion of registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}" failed!
    Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
    --> the object does not exist
    Registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70}" deleted successfully.
    Registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239}" deleted successfully.
    Registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC}" deleted successfully.
    Registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25560540-9571-4D7B-9389-0F166788785A}" deleted successfully.
    Registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}" deleted successfully.
    Registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}" deleted successfully.
    Registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}" deleted successfully.
    Registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}" deleted successfully.
    Registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}" deleted successfully.
    Registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84DA4FDF-A1CF-4195-8688-3E961F505983}" deleted successfully.
    Registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14}" deleted successfully.
    Registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{938AA51A-996C-4884-98CE-80DD16A5C9DA}" deleted successfully.
    Completed script processing.
    *******************
    Finished! Terminate.

    //////////////////////////////////////////
    Avenger Pre-Processor log
    //////////////////////////////////////////
    Platform: Windows XP (build 2600, Service Pack 2)
    Mon May 26 16:41:31 2008
    16:41:31: Error: Invalid script. A valid script must begin with a command directive.
    Aborting execution!

    //////////////////////////////////////////

    Logfile of The Avenger Version 2.0, (c) by Swandog46
    http://swandog46.geekstogo.com
    Platform: Windows XP
    *******************
    Script file opened successfully.
    Script file read successfully.
    Backups directory opened successfully at C:\Avenger
    *******************
    Beginning to process script file:
    Rootkit scan active.
    No rootkits found!

    Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\MyWebSearchService" not found!
    Deletion of driver "MyWebSearchService" failed!
    Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
    --> the object does not exist

    Error: folder "C:\Program Files\FunWebProducts" not found!
    Deletion of folder "C:\Program Files\FunWebProducts" failed!
    Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
    --> the object does not exist

    Error: folder "C:\Program Files\MyWebSearch" not found!
    Deletion of folder "C:\Program Files\MyWebSearch" failed!
    Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
    --> the object does not exist

    Error: file "C:\Windows\System32\f3pssavr.scr" not found!
    Deletion of file "C:\Windows\System32\f3pssavr.scr" failed!
    Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
    --> the object does not exist

    Error: could not delete registry value "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|My Web Search Bar Search Scope Monitor"
    Deletion of registry value "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|My Web Search Bar Search Scope Monitor" failed!
    Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
    --> the object does not exist

    Error: registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}" not found!
    Deletion of registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}" failed!
    Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
    --> the object does not exist

    Error: registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70}" not found!
    Deletion of registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70}" failed!
    Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
    --> the object does not exist

    Error: registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239}" not found!
    Deletion of registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239}" failed!
    Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
    --> the object does not exist

    Error: registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC}" not found!
    Deletion of registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC}" failed!
    Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
    --> the object does not exist

    Error: registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25560540-9571-4D7B-9389-0F166788785A}" not found!
    Deletion of registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25560540-9571-4D7B-9389-0F166788785A}" failed!
    Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
    --> the object does not exist

    Error: registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}" not found!
    Deletion of registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}" failed!
    Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
    --> the object does not exist

    Error: registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}" not found!
    Deletion of registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}" failed!
    Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
    --> the object does not exist

    Error: registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}" not found!
    Deletion of registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}" failed!
    Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
    --> the object does not exist

    Error: registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}" not found!
    Deletion of registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}" failed!
    Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
    --> the object does not exist

    Error: registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}" not found!
    Deletion of registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}" failed!
    Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
    --> the object does not exist

    Error: registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84DA4FDF-A1CF-4195-8688-3E961F505983}" not found!
    Deletion of registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84DA4FDF-A1CF-4195-8688-3E961F505983}" failed!
    Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
    --> the object does not exist

    Error: registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14}" not found!
    Deletion of registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14}" failed!
    Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
    --> the object does not exist

    Error: registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{938AA51A-996C-4884-98CE-80DD16A5C9DA}" not found!
    Deletion of registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{938AA51A-996C-4884-98CE-80DD16A5C9DA}" failed!
    Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
    --> the object does not exist

    Completed script processing.
    *******************
    Finished! Terminate.
  • spricelessspriceless
    edited May 2008
    When I try to do the next step it tells me "Cannot import C:\Documents and Settings\Susan\Desktop\endmyweb.reg: Not all data was successfully written to the regisry. Some keys are open by the system or other processes."
  • ThomasThomas
    edited May 2008
    I sense McAfee is involved in the Avenger errors occuring, including interfering during the reboot phase.


    Let's see if you can merge that registry info in Safe Mode. Reboot into Safe Mode (at startup tap the F8 key about once per second and select safe Mode from the menu).

    Then right click the endmyweb.reg file you created earlier and allow it to Merge with the Registry. Be sure McAfee is not interfering when doing this.

    Then reboot, and do the remainder of the steps posted earlier please. Unless it is important to you no need to use the Reply/Quote and repost my earlier steps. Just clicking the New Reply button will be fine.


    And whatever you do (or anyone else reviewing these steps) don't click that eyesore "Click Here To Cutomize" flashy ad at the bottom of these threads. It takes you to an install of IAC Search and Media's Webfetti, which is only their MyWebSearch adware/spyware/search hijacker software with some glitter on it.
  • spricelessspriceless
    edited June 2008
    I get the same message in SafeMode
  • ThomasThomas
    edited June 2008
    Likely the protective software just does not like changes being made to the controlsets there. Since the mapping of all this came from a trial install of MyWeb we can forgo changing those. They became meaningless numbers in the registry once the associated files and functions were removed.

    Windows Registry Editor Version 5.00
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.dat]
"Permissions"=dword:00000001
"Runtime"=dword:00000007
"ReplaceApps"="*.*"
    Open Notepad (Start - Run, type notepad and OK) and copy and paste the above text (inside the box) into the text file. Now go to File > Save As and call it fixer.reg. Where it says "Files of Type", select All Files and click on Save. Exit Notepad, double-click on the file and ok the prompt asking if you wish to merge the file with your registry.

    Post back if that was successful instead.
  • spricelessspriceless
    edited June 2008
    Sorry for the absentee. I have been getting hit badly on my job with these bug viruses. I was not getting no help here. I accidentally answered myself so everybody thought someone was helping me. anyways now I have another system that is experiencing bugs crawling on their screen. I am having them ship it to the office overnight. This time I will have to put in ER room. I am surprised no one else is getting this or know what its name is you know.

    But back to my system YES! That was successful.
  • ThomasThomas
    edited June 2008
    ???? Lost me there. You are getting assistance here, or at least I call this assistance. The other infection is a tough vundo/rogue software package that uses a blackster.scr screensaver to give the bugs-eating-screen look. But if blackster silliness is showing then quite a bit of repairs would be necessary.

    But all those problems are for some other system, somewhere else, yes? This computer we have been working on was able to get that final regeistry change done?
  • spricelessspriceless
    edited June 2008
    yes, you are correct. The one we are currently working on does not have the blackster. Yes, I was finally able to get the registry change done.

    Oh no don't get me wrong. I am getting help here but what I did was I answered by own thread so it was no longer at 0 so I kept being skipped because it looked like I was being helped (my own fault) I did not know how to undo my mistake. When we finish here can you also assist with the blackster or do I need to start a new thread?
  • spricelessspriceless
    edited June 2008
    ok where did my reply go?
  • ThomasThomas
    edited June 2008
    You are talking about this other thread? If so, you also posted that same request elsewhere, and Shaba was assisting you. I don't see that you responded to his last steps posted either, so not sure why you felt no help was being provided. You can still follow up with Shaba, as once someone has responded anywhere else none of us will duplicate the efforts here.


    For this system, in our thread here, if you were able to merge the reg info things should be okay now. Any issues we still need to address on this computer?
  • spricelessspriceless
    edited June 2008
    Thomas wrote: »
    You are talking about this other thread? If so, you also posted that same request elsewhere, and Shaba was assisting you. I don't see that you responded to his last steps posted either, so not sure why you felt no help was being provided. You can still follow up with Shaba, as once someone has responded anywhere else none of us will duplicate the efforts here.


    For this system, in our thread here, if you were able to merge the reg info things should be okay now. Any issues we still need to address on this computer?
    I don't appreciate whatever you are trying to implicate here but thank you for your assistance anyway.
  • ThomasThomas
    edited June 2008
    Implicate? Not really trying to imply anything spriceless. You posted a request, a volunteer responded, and you did not follow through after that. And I responded to a request here. So not sure what your statements that you are not getting help are in reference to.
  • KatanaKatana
    edited July 2008
    Inactive

    Whilst we appreciate that you may be busy, it has been 7 days or more since we heard from you. This topic is now closed.

    Infections can change and fresh instructions will now need to be given. If you wish to reopen your topic, please send a Private Message (PM) to Trogan with a link to your thread.

    If you are not the user who started this thread, you must start your own Thread instead :)
This discussion has been closed.