Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Generic_c.iky On Vista?


  • This topic is locked This topic is locked
3 replies to this topic

#1 Offal

Offal

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:06:15 AM

Posted 16 June 2008 - 07:53 PM

Hi all,

Like most, I've been working on eliminating a virus from my hp pavillion vista machine.

My 13 year old son, who should know better, went to a site with a firefox browser the other night. He reported he was encountering some pop-ups. He was right. Norton saw nothing, I couldn't restore to a previous time, my hp interactive help didn't work, and many ip redirects, etc.

I did manage to download the free avg app, and it found Trojan Horse Generic_c.IKY while in safe mode. The scan managed to fix 'some' via the safe mode scan. I also uninstalled the java runtime environment, and deleted some temporary files as well.

The hp help managed to work a bit, and they recommended hjt. I ran a scan and eliminated all BHOs and a host redirect. After a restart it seems a bit better, no popups within firefox at least. Just want to be sure.

I then read your faq, downloaded and ran the deckard scanner and got the following:

Deckard's System Scanner v20071014.68
Run by Karl on 2008-06-16 20:07:48
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- Last 5 Restore Point(s) --
23: 2008-06-16 22:34:03 UTC - RP211 - Windows Update
22: 2008-06-16 21:50:49 UTC - RP210 - Removed Java™ SE Runtime Environment 6 Update 1
21: 2008-06-16 21:47:31 UTC - RP209 - Removed Java™ SE Runtime Environment 6 Update 1
20: 2008-06-16 21:46:24 UTC - RP208 - Removed Java™ SE Runtime Environment 6 Update 1
19: 2008-06-16 11:01:16 UTC - RP207 - Installed AVG Free 8.0


-- First Restore Point --
1: 2008-05-29 02:18:05 UTC - RP187 - Scheduled Checkpoint


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as Karl.exe) ------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:11:34 PM, on 6/16/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
C:\Program Files\Valve\Steam\Steam.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Snapfish Picture Mover\SnapfishMediaDetector.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Windows\System32\mobsync.exe
C:\hp\kbd\kbd.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Users\Karl\Music\Macks Music =O\dss(2).exe
C:\Windows\system32\Taskmgr.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Karl.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [SunJavaUpdateReg] "C:\Windows\system32\jureg.exe" -delete
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun
O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\Karl\AppData\Local\Temp\efcDtQkK.dll,c
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\Karl\AppData\Local\Temp\cbxYsSjg.dll,#1
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Snapfish Media Detector.lnk = C:\Program Files\Snapfish Picture Mover\SnapfishMediaDetector.exe
O13 - Gopher Prefix:
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 5318 bytes

-- HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\) -----------

backup-20080616-185033-239 O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
backup-20080616-185033-322 O1 - Hosts: ::1 localhost
backup-20080616-185033-346 O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
backup-20080616-185033-381 O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
backup-20080616-185033-524 O2 - BHO: (no name) - {60790EE3-1029-4BFA-8600-F9B63B447B9D} - C:\Windows\system32\wVpNEtUm.dll (file missing)
backup-20080616-185033-799 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
backup-20080616-185913-395 O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
backup-20080616-185913-594 O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

All drivers whitelisted.


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 HP Health Check Service - "c:\program files\hewlett-packard\hp health check\hphc_service.exe" <Not Verified; Hewlett-Packard; HP Health Check Service>


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Scheduled Tasks -------------------------------------------------------------

2008-06-16 14:17:37 416 --ah----- C:\Windows\Tasks\User_Feed_Synchronization-{B18532CA-B7EE-4DD0-9983-C7DF8C92A1B4}.job
2008-06-16 01:00:00 544 --a------ C:\Windows\Tasks\Norton Internet Security - Run Full System Scan - Karl.job
2008-05-30 18:32:02 318 --a------ C:\Windows\Tasks\HPCeeScheduleForKarl.job


-- Files created between 2008-05-16 and 2008-06-16 -----------------------------

2008-06-16 18:39:10 0 d-------- C:\Program Files\Trend Micro
2008-06-16 07:06:32 0 d--h----- C:\$AVG8.VAULT$
2008-06-16 07:01:42 0 d-------- C:\Windows\system32\drivers\Avg
2008-06-16 07:01:34 0 d-------- C:\Users\All Users\avg8
2008-06-16 07:01:34 0 d-------- C:\Program Files\AVG
2008-06-06 22:04:04 0 d-------- C:\Program Files\Common Files\BioWare
2008-06-06 21:37:52 0 d-------- C:\Program Files\Mass Effect
2008-06-04 23:48:42 0 d-------- C:\Users\All Users\Codemasters
2008-06-04 19:48:21 0 d-------- C:\Saved Docs
2008-06-02 22:56:23 0 d-------- C:\Users\All Users\Ironclad Games
2008-06-02 22:49:24 0 d-------- C:\Program Files\Common Files\Stardock
2008-06-02 22:49:05 0 d-------- C:\Program Files\Stardock
2008-05-25 17:31:22 0 d-------- C:\Users\Karl\unzipped
2008-05-25 16:47:28 0 d-------- C:\starforce utils
2008-05-25 16:25:23 0 d-------- C:\GTL
2008-05-24 09:35:31 0 d-------- C:\PerfLogs
2008-05-24 08:13:55 0 d-------- C:\fc166da5314398f5e76d101290
2008-05-19 08:11:42 0 d-------- C:\Windows\system32\N360_BACKUP
2008-05-16 12:55:07 0 d-------- C:\Users\All Users\Windows Genuine Advantage
2008-05-16 12:25:30 0 d-------- C:\Program Files\The Witcher


-- Find3M Report ---------------------------------------------------------------

2008-06-16 19:16:16 0 d-------- C:\Program Files\Common Files\Symantec Shared
2008-06-16 18:12:31 0 d-------- C:\Program Files\Common Files
2008-06-16 10:49:13 0 d-------- C:\Program Files\Norton Security Scan
2008-06-15 20:58:38 0 d-------- C:\Program Files\Microsoft Works
2008-06-10 20:55:56 0 d-------- C:\Program Files\Windows Mail
2008-06-10 17:01:21 0 d-------- C:\Program Files\Common Files\Steam
2008-06-06 22:05:53 0 dr-h----- C:\Users\Karl\AppData\Roaming\SecuROM
2008-06-04 01:28:42 0 d-------- C:\Program Files\Windows Sidebar
2008-06-04 01:28:42 0 d-------- C:\Program Files\Windows Photo Gallery
2008-05-31 15:03:37 0 d-------- C:\Users\Karl\AppData\Roaming\Lionhead Studios
2008-05-29 20:49:33 1078 --a------ C:\Users\Karl\AppData\Roaming\wklnhst.dat
2008-05-29 20:07:57 0 d-------- C:\Users\Karl\AppData\Roaming\MSNInstaller
2008-05-24 23:10:48 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-05-24 22:45:33 0 d-------- C:\Program Files\Bethesda Softworks
2008-05-10 19:18:45 0 d-------- C:\Program Files\Activision
2008-05-06 19:53:55 0 d-------- C:\Program Files\Mozilla Thunderbird
2008-05-06 15:49:59 0 d-------- C:\Program Files\Lionhead Studios Ltd
2008-05-05 21:53:48 0 d-------- C:\Program Files\Autodesk
2008-05-05 20:11:35 0 d-------- C:\Users\Karl\AppData\Roaming\Subversion
2008-05-05 20:11:11 0 d-------- C:\Program Files\TortoiseSVN
2008-04-27 19:00:43 0 d-------- C:\Program Files\HP
2008-04-24 18:46:22 0 d-------- C:\Users\Karl\AppData\Roaming\My The Lord of the Rings, The Rise of the Witch-king Files
2008-04-23 19:51:41 0 d-------- C:\Users\Karl\AppData\Roaming\Symantec
2008-04-22 17:55:27 0 d-------- C:\Users\Karl\AppData\Roaming\Download Manager
2008-04-20 10:04:33 0 d-------- C:\Users\Karl\AppData\Roaming\Petroglyph
2008-04-20 10:00:35 0 d-------- C:\Program Files\LucasArts
2008-04-17 20:13:20 0 d-------- C:\Program Files\Black Isle
2008-04-05 22:24:06 413696 --a------ C:\Windows\system32\wrap_oal.dll <Not Verified; Creative Labs; Creative Labs OpenAL32>
2008-04-05 22:24:06 110592 --a------ C:\Windows\system32\OpenAL32.dll <Not Verified; Portions © Creative Labs Inc. and NVIDIA Corp.; Standard OpenAL™ Library>
2008-03-31 10:10:56 0 -rahs---- C:\MSDOS.SYS
2008-03-31 10:10:56 0 -rahs---- C:\IO.SYS


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [12/08/2007 03:33 AM]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [04/18/2007 11:01 AM]
"KBD"="C:\HP\KBD\KbdStub.EXE" [12/08/2006 12:16 PM]
"OsdMaestro"="C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [02/15/2007 07:59 AM]
"RtHDVCpl"="RtHDVCpl.exe" [01/15/2008 11:26 AM C:\Windows\RtHDVCpl.exe]
"HP Health Check Scheduler"="[ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" []
"SunJavaUpdateReg"="C:\Windows\system32\jureg.exe" [04/07/2007 06:56 AM]
"@"="" []
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 10:16 PM]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [03/24/2008 07:52 PM]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [03/24/2008 07:52 PM]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [05/08/2007 04:24 PM]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [06/16/2008 07:01 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [03/01/2008 01:38 PM]
"HPAdvisor"="C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [10/03/2007 10:02 PM]
"Steam"="c:\program files\valve\steam\steam.exe" [03/28/2008 07:07 AM]
"cmds"="C:\Users\Karl\AppData\Local\Temp\efcDtQkK.dll,c" []
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [11/02/2006 08:36 AM]
"MSServer"="C:\Users\Karl\AppData\Local\Temp\cbxYsSjg.dll,#1" []

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Snapfish Media Detector.lnk - C:\Program Files\Snapfish Picture Mover\SnapfishMediaDetector.exe [5/7/2007 2:35:56 PM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]
@="IEEE 1394 Bus host controllers"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]
@="SBP2 IEEE 1394 Devices"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]
@="SecurityDevices"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc EMDMgmt TabletInputService wlansvc WPDBusEnum


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a2c9b85f-bce7-11dc-96ca-806e6f6e6963}]
AutoRun\command- E:\Setup.exe


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
C:\Windows\system32\unregmp2.exe /ShowWMP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
%SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI



-- End of Deckard's System Scanner: finished at 2008-06-16 20:12:37 ------------
Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft® Windows Vista™ Home Premium (build 6000)
Architecture: X86; Language: English

CPU 0: AMD Athlon™ 64 X2 Dual Core Processor 5600+
Percentage of Memory in Use: 39%
Physical Memory (total/avail): 3069.94 MiB / 1868.28 MiB
Pagefile Memory (total/avail): 6322.41 MiB / 5058.81 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1910.2 MiB

C: is Fixed (NTFS) - 456.21 GiB total, 204.84 GiB free.
D: is Fixed (NTFS) - 9.55 GiB total, 1.3 GiB free.
E: is CDROM (CDFS)
F: is Removable (No Media)
G: is Removable (No Media)
H: is Removable (No Media)
I: is Removable (No Media)

\\.\PHYSICALDRIVE0 - WDC WD50 00AAKS-65YGA SCSI Disk Device - 465.76 GiB - 2 partitions
\PARTITION0 (bootable) - Installable File System - 456.21 GiB - C:
\PARTITION1 - Installable File System - 9.55 GiB - D:

\\.\PHYSICALDRIVE1 - Generic- Compact Flash USB Device

\\.\PHYSICALDRIVE4 - Generic- MS/MS-Pro USB Device

\\.\PHYSICALDRIVE3 - Generic- SD/MMC USB Device

\\.\PHYSICALDRIVE2 - Generic- SM/xD-Picture USB Device



-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is enabled.

AV: AVG Anti-Virus Free v8.0 (AVG Technologies)
AS: AVG Anti-Virus Free v8.0 (AVG Technologies) Disabled
AS: Windows Defender v1.1.1505.0 (Microsoft Corporation)

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"="C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe:*:Enabled:Earthlink"


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Karl\AppData\Roaming
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=HPAVILION
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Karl
LOCALAPPDATA=C:\Users\Karl\AppData\Local
LOGONSERVER=\\HPAVILION
NUMBER_OF_PROCESSORS=2
OnlineServices=Online Services
OS=Windows_NT
Path=C:\PROGRA~1\MOZILL~1;C:\Program Files\Mozilla Firefox;C:\Program Files\Trend Micro\HijackThis;C:\Program Files\Autodesk\Maya 8.5 Personal Learning Edition\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\hp\bin\Python
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PCBRAND=Pavilion
PLATFORM=HPD
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 67 Stepping 3, AuthenticAMD
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=4303
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
PROMPT=$P$G
PUBLIC=C:\Users\Public
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\Karl\AppData\Local\Temp
TMP=C:\Users\Karl\AppData\Local\Temp
USERDOMAIN=hpavilion
USERNAME=Karl
USERPROFILE=C:\Users\Karl
windir=C:\Windows


-- User Profiles ---------------------------------------------------------------

Karl


-- Add/Remove Programs ---------------------------------------------------------

--> "C:\Program Files\HP Games\3D Ultra Minigolf Adventures\Uninstall.exe"
--> "C:\Program Files\HP Games\7 Wonders of the Ancient World\Uninstall.exe"
--> "C:\Program Files\HP Games\Bejeweled 2 Deluxe\Uninstall.exe"
--> "C:\Program Files\HP Games\Blasterball 2 Revolution\Uninstall.exe"
--> "C:\Program Files\HP Games\Blasterball 3\Uninstall.exe"
--> "C:\Program Files\HP Games\Chuzzle Deluxe\Uninstall.exe"
--> "C:\Program Files\HP Games\Crystal Maze\Uninstall.exe"
--> "C:\Program Files\HP Games\Diner Dash\Uninstall.exe"
--> "C:\Program Files\HP Games\FATE\Uninstall.exe"
--> "C:\Program Files\HP Games\Fish Tycoon\Uninstall.exe"
--> "C:\Program Files\HP Games\Insaniquarium Deluxe\Uninstall.exe"
--> "C:\Program Files\HP Games\Jewel Quest Solitaire\Uninstall.exe"
--> "C:\Program Files\HP Games\Jewel Quest\Uninstall.exe"
--> "C:\Program Files\HP Games\Magic Academy\Uninstall.exe"
--> "C:\Program Files\HP Games\Mah Jong Quest\Uninstall.exe"
--> "C:\Program Files\HP Games\My HP Game Console\Uninstall.exe"
--> "C:\Program Files\HP Games\Otto's Magic Blocks\Uninstall.exe"
--> "C:\Program Files\HP Games\Peggle\Uninstall.exe"
--> "C:\Program Files\HP Games\Penguins!\Uninstall.exe"
--> "C:\Program Files\HP Games\Polar Bowler\Uninstall.exe"
--> "C:\Program Files\HP Games\Polar Golfer Pineapple Cup\Uninstall.exe"
--> "C:\Program Files\HP Games\Polar Golfer\Uninstall.exe"
--> "C:\Program Files\HP Games\Ricochet Lost Worlds\Uninstall.exe"
--> "C:\Program Files\HP Games\Shooting Stars Pool\Uninstall.exe"
--> "C:\Program Files\HP Games\Slingo Deluxe\Uninstall.exe"
--> "C:\Program Files\HP Games\Super Granny\Uninstall.exe"
--> "C:\Program Files\HP Games\Tradewinds\Uninstall.exe"
--> "C:\Program Files\HP Games\Virtual Villagers - A New Home\Uninstall.exe"
--> "C:\Program Files\HP Games\Virtual Villagers - Chapter 2 - The Lost Children\Uninstall.exe"
--> "C:\Program Files\HP Games\Zuma Deluxe\Uninstall.exe"
--> MsiExec /X{95FC26FB-19FD-4A96-BBB1-B1062E8648F5}
Adobe Flash Player ActiveX --> C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8.1.2 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003}
Adobe Shockwave Player --> C:\Windows\System32\Adobe\SHOCKW~1\UNWISE.EXE C:\Windows\System32\Adobe\SHOCKW~1\Install.log
AGEIA PhysX v7.11.13 --> MsiExec.exe /X{95FC26FB-19FD-4A96-BBB1-B1062E8648F5}
Audiosurf --> "C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/12900
AVG Free 8.0 --> C:\Program Files\AVG\AVG8\setup.exe /UNINSTALL
Baldur's Gate --> C:\Windows\IsUninst.exe -f"C:\Program Files\Black Isle\Baldur's Gate\Uninst.isu"
Baldur's Gate™ II - Shadows of Amn™ --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7AF32AB1-CB97-11D4-9607-0050BA84F5F7}\Setup.exe" -l0009
Bioshock --> "C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/7670
Black and White --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E51B4CD9-A0A6-4324-B26A-31B3F2DE26CE}\Setup.exe"
Call of Duty 4: Modern Warfare --> "C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/7940
Compatibility Pack for the 2007 Office system --> MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE}
Crysis® --> MsiExec.exe /I{000E79B7-E725-4F01-870A-C12942B7F8E4}
CyberLink DVD Suite Deluxe --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\Setup.exe" -uninstall
Dawn of War - Dark Crusade --> C:\Program Files\InstallShield Installation Information\{FF39FC01-819B-42E4-AE49-1968AF12DDD4}\setup.exe -runfromtemp -l0x0009 -removeonly
Enhanced Multimedia Keyboard Solution --> C:\HP\KBD\Install.exe /u
Fallout --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{941F9BA8-06F6-42FD-AB91-CFB99B5E13BF}\Setup.exe" -l0x9 -removeonly
Final Doom --> "C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/2290
Garry's Mod --> "C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/4000
GPGNet --> MsiExec.exe /I{C194D333-B84A-4BB7-B35E-060732D98DC4}
GRID --> "C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/12750
GT Legends 1.1.0.0 --> "C:\GTL\Support\unins000.exe"
Half-Life 2 --> "C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/220
Half-Life 2: Deathmatch --> "C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/320
Half-Life 2: Episode One --> "C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/380
Half-Life 2: Episode Two --> "C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/420
Half-Life 2: Lost Coast --> "C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/340
Half-Life® 2 --> MsiExec.exe /I{D45EC259-4A19-4656-B588-C2C360DD18EA}
Hardware Diagnostic Tools --> C:\Program Files\PC-Doctor 5 for Windows\uninst.exe
Hewlett-Packard Active Check --> MsiExec.exe /X{254C37AA-6B72-4300-84F6-98A82419187E}
Hewlett-Packard Asset Agent for Health Check --> MsiExec.exe /X{669D4A35-146B-4314-89F1-1AC3D7B88367}
HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
HP Customer Experience Enhancements --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AFAD41A9-9687-48A3-848F-693C11451433}\setup.exe" -l0x9 -removeonly
HP Customer Feedback --> MsiExec.exe /I{9DBA770F-BF73-4D39-B1DF-6035D95268FC}
HP Easy Setup - Frontend --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9885A11E-60E4-417C-B58B-8B31B21C0B8A}\setup.exe" -l0x9 -removeonly
HP On-Screen Cap/Num/Scroll Lock Indicator --> C:\Windows\system32\OsdRemove.exe
HP Photosmart Essential 2.5 --> C:\Program Files\HP\Digital Imaging\PhotoSmartEssential\hpzscr01.exe -datfile hpqbud13.dat
HP Picasso Media Center Add-In --> MsiExec.exe /I{55979C41-7D6A-49CC-B591-64AC1BBE2C8B}
HP Total Care Advisor --> MsiExec.exe /X{e96b3d28-47d6-43cc-98fd-7069eeab6b11}
HP Update --> MsiExec.exe /X{C8FD5BC1-92EF-4C15-92A9-F9AC7F61985F}
LabelPrint --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C59C179C-668D-49A9-B6EA-0121CCFC1243}\Setup.exe" -uninstall
LightScribe System Software 1.10.16.1 --> MsiExec.exe /X{E6CFBFB5-9232-410C-B353-AF6E614B2681}
LightScribe Template Labeler --> MsiExec.exe /X{3EBA6E7C-3DF6-48AE-B87B-4CAFB2C1C3F7}
Mass Effect --> C:\Program Files\Common Files\BioWare\Uninstall Mass Effect.exe
Maya 8.5 Personal Learning Edition --> MsiExec.exe /I{2D8ECB5E-9F6C-4332-AEE6-0E4EE1DEC926}
Maya 8.5 Personal Learning Edition Documentation (en_US) --> MsiExec.exe /I{6A829DA3-E377-4BC0-938F-F453C6BB3F67}
Microsoft .NET Framework 1.1 --> msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1 --> MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1 Hotfix (KB929729) --> "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\M929729\M929729Uninstall.msp"
Microsoft Office Home and Student 60 day trial --> c:\hp\bin\MSOffice\uninst2.cmd
Microsoft Office PowerPoint Viewer 2007 (English) --> MsiExec.exe /X{95120000-00AF-0409-0000-0000000FF1CE}
Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Works --> MsiExec.exe /I{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}
Morrowind --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\Bethesda Softworks\Morrowind\MWUninstall\Setup.exe" -l0x9
Mozilla Firefox (2.0.0.14) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Mozilla Thunderbird (2.0.0.14) --> C:\Program Files\Mozilla Thunderbird\uninstall\helper.exe
MSN --> C:\Program Files\MSN\MsnInstaller\msniadm.exe /Action:ARP
muvee autoProducer 6.1 --> C:\Program Files\InstallShield Installation Information\{E8C2622C-9FF1-4F60-8008-A0208154F9F3}\muveesetup.exe -removeonly -runfromtemp
My HP Games --> "C:\Program Files\HP Games\Uninstall.exe"
Neverwinter Nights 2 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F20C1251-1D0A-4944-B2AE-678581B33B19}\SETUP.exe" -l0x9 -removeonly
Norton Security Scan --> MsiExec.exe /I{48B82226-75E3-4E90-92CC-D30F79EA6380}
NVIDIA Drivers --> C:\Windows\system32\NVUNINST.EXE UninstallGUI
Oblivion --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{35CB6715-41F8-4F99-8881-6FC75BF054B0}\setup.exe" -l0x9 -removeonly
Oblivion - Construction Set --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{23D683DD-93C6-48E6-B84E-78B57778F126}\setup.exe" -l0x9 -removeonly
OpenAL --> "C:\Program Files\OpenAL\oalinst.exe" /U
Peggle Deluxe --> "C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/3480
Peggle Extreme --> "C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/3483
Portal --> "C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/400
Power2Go --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{40BF1E83-20EB-11D8-97C5-0009C5020658}\Setup.exe" -uninstall
PowerDirector --> "C:\Program Files\InstallShield Installation Information\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}\setup.exe" /z-uninstall
Psychonauts --> "C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/3830
PunkBuster Services --> C:\Windows\system32\pbsvc.exe -u
Puzzle Quest --> "C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/12500
Python 2.5 --> MsiExec.exe /I{0A2C5854-557E-48C8-835A-3B9F074BDCAA}
Quake --> "C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/2310
RACE 07 --> "C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/8600
Realtek High Definition Audio Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x9 -removeonly
Refresher --> C:\Users\Karl\Desktop\Mack\Uninstal.exe
Richard Burns Rally --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{92C7D009-A464-4948-A980-7A3E28CB2F49}\setup.exe" -l0x9
Rome - Total War™ --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{A642BB6B-CA1D-4142-8DD4-318C3F3DC834} /l1033
Sins of a Solar Empire --> "C:\ProgramData\{0E8E33D8-193A-414A-A909-0F101A142D26}\setup.exe" REMOVE=TRUE MODIFY=FALSE
Sins of a Solar Empire --> C:\ProgramData\{0E8E33D8-193A-414A-A909-0F101A142D26}\setup.exe
Snapfish Picture Mover --> MsiExec.exe /X{029B5901-1F27-4347-9923-E8ACC8F54E15}
Soft Data Fax Modem with SmartCP --> C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1\UIU32m.exe -U -ITrx200Cz.INF
Source SDK --> "C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/211
Star Wars Empire at War --> C:\Program Files\InstallShield Installation Information\{99AE7207-8612-4DBA-A8F8-BAE5C633390D}\Setup.exe -runfromtemp -l0x0009 -removeonly
Star Wars Republic Commando --> C:\Program Files\InstallShield Installation Information\{DFAE9340-E8BB-4433-9A08-C8334DAFE1B9}\Setup.exe -runfromtemp -l0x0009 -removeonly
Stardock Central --> C:\PROGRA~1\Stardock\SDCENT~1\UNWISE.EXE C:\PROGRA~1\Stardock\SDCENT~1\INSTALL.LOG
Steam™ --> MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
StepMania (remove only) --> "C:\Users\Karl\Desktop\Mack\StepMania\uninstall.exe"
Super Mario World --> "C:\Users\Karl\Desktop\Mack\unins001.exe"
Supreme Commander --> C:\Program Files\InstallShield Installation Information\{25A1E6A4-2DBD-4AC0-8650-8EA9A45B183D}\setup.exe -runfromtemp -l0x0009 -removeonly
System Requirements Lab --> C:\Program Files\SystemRequirementsLab\Uninstall.exe
Team Fortress 2 --> "C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/440
TES Construction Set --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\Bethesda Softworks\Morrowind\CSUninstall\Setup.exe" -l0x9
The Battle for Middle-earth ™ II --> C:\Program Files\Electronic Arts\The Battle for Middle-earth ™ II\EAUninstall.exe
The Lord of the Rings, The Rise of the Witch-king --> C:\Program Files\Electronic Arts\The Lord of the Rings, The Rise of the Witch-king\EAUninstall.exe
The Movies --> "C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/7900
The Movies: Stunts and Effects --> "C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/7910
The Sims 2 --> C:\Program Files\EA GAMES\The Sims 2\EAUninstall.exe
The Witcher --> "C:\Program Files\InstallShield Installation Information\{F138762F-5A1F-4CF0-A5E1-1588EF6088A4}\setup.exe" -runfromtemp -l0x0009 -removeonly
Titan Quest --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{412B69AF-C352-4F6F-A318-B92B3CB9ACC6}\setup.exe" -l0x9 -removeonly
TortoiseSVN 1.4.8.12137 (32 bit) --> MsiExec.exe /X{1E010E57-0453-4A84-A899-47EEA104661C}
TrackMania United --> "C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/7200
Unreal Gold --> "C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/13250
Unreal II: The Awakening --> "C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/13200
Unreal Tournament --> "C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/13240
Unreal Tournament 2004 --> "C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/13230
Unreal Tournament 3 --> "C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/13210
WeatherBug Gadget --> MsiExec.exe /I{209CDA54-D390-46A2-A97C-7BF61734418D}
Yahoo! Toolbar --> C:\PROGRA~1\Yahoo!\Common\unyt.exe


-- Application Event Log -------------------------------------------------------

Event Record #/Type20043 / Success
Event Submitted/Written: 06/16/2008 07:47:39 PM
Event ID/Source: 5617 / WinMgmt
Event Description:


Event Record #/Type20042 / Success
Event Submitted/Written: 06/16/2008 07:47:38 PM
Event ID/Source: 5615 / WinMgmt
Event Description:


Event Record #/Type20038 / Success
Event Submitted/Written: 06/16/2008 07:47:22 PM
Event ID/Source: 902 / Software Licensing Service
Event Description:
The Software Licensing service has started.

Event Record #/Type20030 / Warning
Event Submitted/Written: 06/16/2008 07:44:35 PM
Event ID/Source: 6000 / Wlclntfy
Event Description:
The winlogon notification subscriber <GPClient> was unavailable to handle a notification event.

Event Record #/Type20027 / Warning
Event Submitted/Written: 06/16/2008 07:44:35 PM
Event ID/Source: 6000 / Wlclntfy
Event Description:
The winlogon notification subscriber <GPClient> was unavailable to handle a notification event.



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type35720 / Warning
Event Submitted/Written: 06/16/2008 08:11:53 PM
Event ID/Source: 3004 / WinDefend
Event Description:
%hpavilion27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %hpavilion27 can't undo changes that you allow.

For more information please see the following:
%hpavilion275

Scan ID: {80569D79-DADB-4ECF-AEAE-1D3E944FE7D9}

User: hpavilion\Karl

Name: %hpavilion271

ID: %hpavilion272

Severity ID: %hpavilion273

Category ID: %hpavilion274

Path Found: %hpavilion276

Alert Type: %hpavilion278

Detection Type: 1.1.1505.02

Event Record #/Type35719 / Warning
Event Submitted/Written: 06/16/2008 08:11:53 PM
Event ID/Source: 3004 / WinDefend
Event Description:
%hpavilion27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %hpavilion27 can't undo changes that you allow.

For more information please see the following:
%hpavilion275

Scan ID: {7D1E042B-FA7A-45AD-89E3-4F14EFEFDE05}

User: hpavilion\Karl

Name: %hpavilion271

ID: %hpavilion272

Severity ID: %hpavilion273

Category ID: %hpavilion274

Path Found: %hpavilion276

Alert Type: %hpavilion278

Detection Type: 1.1.1505.02

Event Record #/Type35718 / Warning
Event Submitted/Written: 06/16/2008 08:11:53 PM
Event ID/Source: 3004 / WinDefend
Event Description:
%hpavilion27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %hpavilion27 can't undo changes that you allow.

For more information please see the following:
%hpavilion275

Scan ID: {1A8CFDC5-3BBB-46DF-9385-BBFDA48F6E52}

User: hpavilion\Karl

Name: %hpavilion271

ID: %hpavilion272

Severity ID: %hpavilion273

Category ID: %hpavilion274

Path Found: %hpavilion276

Alert Type: %hpavilion278

Detection Type: 1.1.1505.02

Event Record #/Type35717 / Warning
Event Submitted/Written: 06/16/2008 08:11:50 PM
Event ID/Source: 3004 / WinDefend
Event Description:
%hpavilion27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %hpavilion27 can't undo changes that you allow.

For more information please see the following:
%hpavilion275

Scan ID: {1DC468E8-83A8-4F92-91BF-CAB74E13A8A2}

User: hpavilion\Karl

Name: %hpavilion271

ID: %hpavilion272

Severity ID: %hpavilion273

Category ID: %hpavilion274

Path Found: %hpavilion276

Alert Type: %hpavilion278

Detection Type: 1.1.1505.02

Event Record #/Type35716 / Warning
Event Submitted/Written: 06/16/2008 08:11:50 PM
Event ID/Source: 3004 / WinDefend
Event Description:
%hpavilion27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %hpavilion27 can't undo changes that you allow.

For more information please see the following:
%hpavilion275

Scan ID: {BF841E39-3FE8-4CD9-9E0B-0D58F1A1F867}

User: hpavilion\Karl

Name: %hpavilion271

ID: %hpavilion272

Severity ID: %hpavilion273

Category ID: %hpavilion274

Path Found: %hpavilion276

Alert Type: %hpavilion278

Detection Type: 1.1.1505.02



-- End of Deckard's System Scanner: finished at 2008-06-16 20:12:37 ------------

BC AdBot (Login to Remove)

 


#2 silver

silver

  • Members
  • 480 posts
  • OFFLINE
  •  
  • Location:GMT+7
  • Local time:05:15 PM

Posted 07 July 2008 - 10:42 PM

Hi Offal,

I'm sorry it's taken so long for you to get a response, if you still need help please do as follows:

Please make new reports with DSS, if you need to download it again you can do so from here:
http://www.techsupportforum.com/sectools/Deckard/dss.exe
  • Make sure DSS.exe is on your Desktop
  • Press the Start->Run, copy/paste the following command into the box and press OK:

    "%userprofile%\desktop\dss.exe" /config

  • A configuration box will appear, make sure all boxes are checked in the Main Log and Extra Log sections press Scan!
  • When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt<-this one will be minimized
  • Make sure Format->Word Wrap is unchecked
  • Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and extra.txt in your reply
Once complete, please post both DSS logs
Teacher at Malware Removal University | ASAP & UNITE Member

#3 silver

silver

  • Members
  • 480 posts
  • OFFLINE
  •  
  • Location:GMT+7
  • Local time:05:15 PM

Posted 10 July 2008 - 09:35 PM

Do you still need help with your machine?

If the instructions are unclear or something isn't working, please let me know before proceeding.
Teacher at Malware Removal University | ASAP & UNITE Member

#4 silver

silver

  • Members
  • 480 posts
  • OFFLINE
  •  
  • Location:GMT+7
  • Local time:05:15 PM

Posted 13 July 2008 - 09:42 PM

Due to lack of response, this thread will now be closed.

If you are the topic starter and would like this topic reopened, please PM a staff member with a link to this thread and we will reopen it for you. Anyone else who needs assistance should begin a new topic.
Teacher at Malware Removal University | ASAP & UNITE Member




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users