Need help with smitfraud-c trojan

I hit express for update.
(While it is scanning this is mostly when I get the virtual mem. min. too low notice)
The update is service pack 3
I hit install, follow prompts.
it goes into Initializing installation...
Then I get the message some updates were not installed
(Problem: A problem on your computer is preventing updates from being downloaded or installed) is the message I get
 
Hi

Ok. Let's see if some extra details of your system can reveal the problem.


Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.
  1. Close all applications and windows.
  2. Double-click on dss.exe to run it, and follow the prompts.
  3. When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt<-this one will be minimized
  4. Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and the extra.txt to your post. in your reply
 
OK that was weird. My firewall I installed shut down my internet access. So I had to uninstall it and reboot. But I did get the logs you requested first. Am I doing something wrong? Did I miss a step or something? I don't know, there is so much to learn about a computer as well as the WWW. OK here are the logs.


Deckard's System Scanner v20071014.68
Run by Customer on 2008-07-28 12:05:59
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
5: 2008-07-28 17:06:12 UTC - RP6 - Deckard's System Scanner Restore Point
4: 2008-07-28 16:52:15 UTC - RP5 - Software Distribution Service 3.0
3: 2008-07-28 15:59:08 UTC - RP4 - Installed Ad-Aware
2: 2008-07-28 14:44:41 UTC - RP3 - Software Distribution Service 3.0
1: 2008-07-28 14:40:22 UTC - RP2 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.

Total Physical Memory: 256 MiB (512 MiB recommended).


-- HijackThis (run as Customer.exe) --------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:09:28 PM, on 7/28/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\VIRTUA~1\SMARTB~1\SprintDSLAlert.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\R-TT\R-Firewall\R-Firewall.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\MozyHome\mozystat.exe
C:\Program Files\Virtual Assistant\bin\mpbtn.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\iWin Games\iWinGamesInstaller.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\MozyHome\mozybackup.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\R-TT\R-Firewall\Service\RTT_CRC_Service.exe
C:\Documents and Settings\Customer\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Customer.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myembarq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.searchsave.com/index.php?req=search&source=1term=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Embarq Toolbar - {4E7BD74F-2B8D-469E-92BE-BF2DFE9AAE2C} - C:\PROGRA~1\EMBARQ~1\EMBARQ~1.DLL
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O3 - Toolbar: Embarq Toolbar - {4E7BD74F-2B8D-469E-92BE-BF2DFE9AAE2C} - C:\PROGRA~1\EMBARQ~1\EMBARQ~1.DLL
O3 - Toolbar: EFOToolbar - {AB26BF6C-BB04-4F00-8F98-BDE786CDE97D} - C:\WINDOWS\system32\EFOToolbar.dll
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VIRTUA~1\SMARTB~1\SprintDSLAlert.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [R-Firewall] C:\Program Files\R-TT\R-Firewall\R-Firewall.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: EMBARQ Help.lnk = C:\Program Files\Virtual Assistant\bin\matcli.exe
O4 - Global Startup: MozyHome Status.lnk = C:\Program Files\MozyHome\mozystat.exe
O8 - Extra context menu item: &3D Satellite Search - res://C:\WINDOWS\system32\EFOToolbar.dll/GoSatteliteSearch.dll.htm
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll/search.htm
O8 - Extra context menu item: S&earchSave Web Search - res://C:\WINDOWS\system32\EFOToolbar.dll/GoWebSearch.dll.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
O15 - Trusted Zone: http://sckesc.owotw.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.nl/scanforvirus-en/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {38A5F6F0-0B64-421B-A553-3D49A76ECDCD} (CPlayFirstMythicMarblesControl Object) - http://download.playfirst.com/play/game/mythicmarbles/MythicMarbles.1.0.0.3.cab
O16 - DPF: {49E67060-2C0D-415E-94C7-52A49F73B2F1} (CPlayFirstPiratePoppersControl Object) - http://www.gamehouse.com/realarcade-webgames/piratepoppers/PiratePoppers.cab
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://catalog.update.microsoft.com.../en/x86/MuCatalogWebControl.cab?1216430943179
O16 - DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} (CPlayFirstDinerDash2Control Object) - http://download.playfirst.com/play/game/dinerdash2/DinerDash2.1.0.0.67.cab
O16 - DPF: {B516CA4E-A5BA-405C-AFCF-A97F08CC7429} (GoBit Games Player) - http://www.gamehouse.com/realarcade-webgames/burgershop/GoBitGamesPlayer.cab
O16 - DPF: {BAC761D3-DFFD-4DB4-A01D-173346E090A7} (CPlayFirstzenerchiControl Object) - http://download.playfirst.com/play/game/zenerchi/ZenerchiWeb.1.0.0.10.cab
O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - http://www.gamehouse.com/realarcade-webgames/dinerdashfloonthego/DinerDashFloGo.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://www.gamehouse.com/realarcade-webgames/zylom/zylomplayer.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: iWinGamesInstaller - iWin Inc. - C:\Program Files\iWin Games\iWinGamesInstaller.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: MozyHome Backup Service (mozybackup) - Unknown owner - C:\Program Files\MozyHome\mozybackup.exe
O23 - Service: RTT CRC Service (RTT_CRC_Service) - Unknown owner - C:\Program Files\R-TT\R-Firewall\Service\RTT_CRC_Service.exe
O24 - Desktop Component 1: How to Make a Website on SiteRightNow.com - http://www.siteritenow.com/

--
End of file - 9467 bytes

-- HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\) -----------

backup-20080727-111804-155 O4 - Startup: Deewoo.lnk = C:\WINDOWS\system32\rcntntdm.exe
backup-20080727-111805-345 O4 - Startup: DW_Start.lnk = C:\WINDOWS\system32\rrwnw64r.exe
backup-20080727-111805-395 O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZBzeb032YYUS

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 RFW (R-Firewall Kernel Driver) - c:\windows\system32\rfwnt.sys <Not Verified; R-TT; R-Firewall>
R1 SbcpHid - c:\windows\system32\drivers\sbcphid.sys
R3 ADBLOCK.DLL (R-Firewall Plugin(ADBLOCK.DLL)) - c:\program files\r-tt\r-firewall\kernel\adblock.dll <Not Verified; R-TT; R-Firewall>
R3 CONTENT.DLL (R-Firewall Plugin(CONTENT.DLL)) - c:\program files\r-tt\r-firewall\kernel\content.dll <Not Verified; R-TT; R-Firewall>
R3 DNSCACHE.DLL (R-Firewall Plugin(DNSCACHE.DLL)) - c:\program files\r-tt\r-firewall\kernel\dnscache.dll <Not Verified; R-TT; R-Firewall>
R3 FTPFILT.DLL (R-Firewall Plugin(FTPFILT.DLL)) - c:\program files\r-tt\r-firewall\kernel\ftpfilt.dll <Not Verified; R-TT; R-Firewall>
R3 HTMLFILT.DLL (R-Firewall Plugin(HTMLFILT.DLL)) - c:\program files\r-tt\r-firewall\kernel\htmlfilt.dll <Not Verified; R-TT; R-Firewall>
R3 httpfilt.dll (R-Firewall Plugin(httpfilt.dll)) - c:\program files\r-tt\r-firewall\kernel\httpfilt.dll <Not Verified; R-TT; R-Firewall>
R3 IMAPFILT.DLL (R-Firewall Plugin(IMAPFILT.DLL)) - c:\program files\r-tt\r-firewall\kernel\imapfilt.dll <Not Verified; R-TT; R-Firewall>
R3 MAILFILT.DLL (R-Firewall Plugin(MAILFILT.DLL)) - c:\program files\r-tt\r-firewall\kernel\mailfilt.dll <Not Verified; R-TT; R-Firewall>
R3 NNTPFILT.DLL (R-Firewall Plugin(NNTPFILT.DLL)) - c:\program files\r-tt\r-firewall\kernel\nntpfilt.dll <Not Verified; R-TT; R-Firewall>
R3 POP3FILT.DLL (R-Firewall Plugin(POP3FILT.DLL)) - c:\program files\r-tt\r-firewall\kernel\pop3filt.dll <Not Verified; R-TT; R-Firewall>
R3 PROTECT.DLL (R-Firewall Plugin(PROTECT.DLL)) - c:\program files\r-tt\r-firewall\kernel\protect.dll <Not Verified; R-TT; R-Firewall>

S3 ATWPKT2 - c:\program files\america online 8.0a\atwpkt2.sys (file missing)
S3 MREMP50 (MREMP50 NDIS Protocol Driver) - c:\program files\common files\motive\mremp50.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
S3 MREMP50a64 (MREMP50a64 NDIS Protocol Driver) - c:\progra~1\common~1\motive\mremp50a64.sys (file missing)
S3 MRESP50 (MRESP50 NDIS Protocol Driver) - c:\program files\common files\motive\mresp50.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
S3 MRESP50a64 (MRESP50a64 NDIS Protocol Driver) - c:\progra~1\common~1\motive\mresp50a64.sys (file missing)
S3 SQTECH9080 (MegaCam(PID_9080_00)) - c:\windows\system32\drivers\capt9080.sys <Not Verified; Service & Quality Technology.; SQ908>
S3 wanatw (WAN Miniport (ATW)) - c:\windows\system32\drivers\wanatw4.sys (file missing)


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 AntiVirScheduler (Avira AntiVir Personal - Free Antivirus Scheduler) - "c:\program files\avira\antivir personaledition classic\sched.exe" <Not Verified; Avira GmbH; AntiVir Workstation>
R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service>
R2 Bonjour Service - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Inc.; Bonjour>
R2 McciCMService - "c:\program files\common files\motive\mccicmservice.exe" <Not Verified; Motive Communications, Inc.; >
R3 RTT_CRC_Service (RTT CRC Service) - c:\program files\r-tt\r-firewall\service\rtt_crc_service.exe


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Scheduled Tasks -------------------------------------------------------------

2008-07-25 23:44:05 414 --ah----- C:\WINDOWS\Tasks\{5237129E-AB10-445E-B37F-02814D2F34BD}_KCRC-75F6A08A51_Customer.job
2008-07-21 23:12:01 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job


-- Files created between 2008-06-28 and 2008-07-28 -----------------------------

2008-07-28 11:14:56 0 d-------- C:\Program Files\R-TT
2008-07-28 11:09:26 0 d-------- C:\Program Files\SpywareBlaster
2008-07-28 10:59:17 0 d-------- C:\Program Files\Lavasoft
2008-07-28 10:59:14 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-27 12:03:44 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-07-27 12:03:42 0 d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-07-26 09:11:59 0 d-------- C:\Program Files\Avira
2008-07-26 09:11:59 0 d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-07-21 16:25:48 0 d-------- C:\Program Files\Trend Micro
2008-07-20 17:32:08 0 d-------- C:\Program Files\MozyHome
2008-07-19 17:04:08 0 d-------- C:\WINDOWS\Prefetch
2008-07-19 16:11:29 0 d-------- C:\WINDOWS\system32\scripting
2008-07-19 16:11:23 0 d-------- C:\WINDOWS\l2schemas
2008-07-19 16:11:21 0 d-------- C:\WINDOWS\system32\en
2008-07-19 15:45:35 409600 --a------ C:\WINDOWS\system32\qmgr.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-07-19 15:41:12 1845248 --a------ C:\WINDOWS\system32\win32k.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-07-19 15:40:56 15360 --a------ C:\WINDOWS\system32\asfsipc.dll <Not Verified; Microsoft Corporation; Microsoft (R) DRM>
2008-07-19 15:39:27 0 d-------- C:\WINDOWS\EHome
2008-07-19 09:50:36 0 d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-07-18 21:38:38 0 d-------- C:\WINDOWS\system32\CatRoot_bak
2008-07-18 20:55:49 0 d-------- C:\Program Files\Windows Media Connect 2
2008-07-18 20:46:11 0 d-------- C:\WINDOWS\system32\LogFiles
2008-07-18 20:46:11 0 d-------- C:\WINDOWS\system32\drivers\UMDF
2008-07-16 11:36:04 0 d-------- C:\Program Files\Cat Computer
2008-07-16 11:07:18 0 d-------- C:\Program Files\Quick Heal
2008-07-14 15:58:54 0 d-------- C:\WINDOWS\system32\bits
2008-07-14 15:57:59 7168 --a------ C:\WINDOWS\system32\bitsprx4.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-07-13 20:53:49 0 d-------- C:\WINDOWS\system32\NtmsData
2008-07-13 19:25:15 13893632 --a------ C:\Documents and Settings\Customer\ntuser.dat
2008-07-13 19:23:34 0 d-------- C:\Documents and Settings\LocalService\Application Data\Macromedia
2008-07-13 19:23:17 0 d-------- C:\Documents and Settings\LocalService\Application Data\Adobe
2008-07-13 19:20:56 0 d-------- C:\Documents and Settings\LocalService\Application Data\EMBARQTOOLBAR
2008-07-13 19:20:42 0 dr------- C:\Documents and Settings\LocalService\Favorites
2008-07-09 10:26:22 0 d-------- C:\Program Files\iPod
2008-07-09 10:25:55 0 d-------- C:\Program Files\iTunes
2008-07-09 10:24:01 0 d-------- C:\Program Files\Bonjour
2008-07-09 10:21:37 0 d-------- C:\Program Files\QuickTime
2008-07-09 10:20:19 0 d-------- C:\Program Files\Apple Software Update
2008-07-09 10:19:13 0 d-------- C:\Program Files\Common Files\Apple
2008-07-09 10:18:49 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-07-09 00:15:11 0 d-------- C:\Program Files\Common Files\xing shared
2008-07-07 11:58:11 0 d-------- C:\Documents and Settings\Customer\Application Data\Meridian93
2008-07-07 11:12:02 0 d-------- C:\Documents and Settings\All Users\Application Data\HipSoft
2008-07-07 11:08:42 0 d-------- C:\Documents and Settings\Customer\Application Data\Gamelab
2008-07-06 18:01:21 0 d-------- C:\Program Files\sisagp
2008-07-06 14:58:22 0 d-------- C:\Documents and Settings\Customer\Application Data\Legends of pirates
2008-07-06 13:06:13 0 d-------- C:\Documents and Settings\Customer\Application Data\TheScruffs
2008-07-06 13:01:35 0 d-------- C:\Documents and Settings\All Users\Application Data\PlayPond
2008-07-06 12:57:51 0 d-------- C:\Documents and Settings\Customer\Application Data\Super-Cow
2008-07-06 12:32:37 0 d-------- C:\Documents and Settings\All Users\Application Data\3 Blokes Studios
2008-07-06 11:37:49 0 d-------- C:\Documents and Settings\Customer\Application Data\Twilight Games
2008-07-06 10:26:08 0 d-------- C:\Documents and Settings\All Users\Application Data\JollyBear
2008-07-06 10:25:07 0 d-------- C:\Documents and Settings\All Users\Application Data\MonteCristo
2008-07-04 11:38:23 0 d-------- C:\Documents and Settings\Customer\Application Data\Eyeblaster
2008-07-04 11:23:45 0 d-------- C:\users
2008-07-04 11:21:33 0 d-------- C:\Program Files\RealArcade
2008-07-02 22:30:16 691545 --a------ C:\WINDOWS\unins001.exe
2008-07-02 22:30:15 2553 --a------ C:\WINDOWS\unins001.dat
2008-07-02 21:12:45 0 --a------ C:\Documents and Settings\Customer\jagex_runescape_preferences.dat
2008-07-02 21:12:26 0 d-------- C:\WINDOWS\.jagex_cache_32
2008-07-01 11:34:52 278528 --a------ C:\WINDOWS\system32\EFOToolbar.dll <Not Verified; ; EFOToolbar Module>
2008-07-01 11:34:35 691545 --a------ C:\WINDOWS\unins000.exe
2008-07-01 11:34:35 8294 --a------ C:\WINDOWS\unins000.dat
2008-06-29 16:43:09 0 d-------- C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-06-29 16:11:43 0 d-------- C:\Program Files\WOMGames
2008-06-28 15:16:34 0 d-------- C:\WINDOWS\system32\Adobe
2008-06-28 08:35:25 0 d-------- C:\Documents and Settings\All Users\Application Data\GoBit Games
2008-06-28 08:19:47 0 d-------- C:\Documents and Settings\All Users\Application Data\Zylom


-- Find3M Report ---------------------------------------------------------------

2008-07-28 11:46:25 0 d-------- C:\Documents and Settings\Customer\Application Data\EMBARQTOOLBAR
2008-07-28 10:57:11 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-07-27 21:48:01 0 d-------- C:\Program Files\iWin.com
2008-07-27 11:29:08 0 d-------- C:\Program Files\Common Files
2008-07-27 11:00:27 0 d-------- C:\Program Files\Java
2008-07-26 16:39:52 0 d-------- C:\Program Files\SearchAssistant6
2008-07-26 15:54:57 0 d-------- C:\Program Files\Desktop
2008-07-25 22:35:07 1524 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-07-20 23:04:29 0 d-------- C:\Program Files\AMS
2008-07-19 18:57:24 0 d-------- C:\Program Files\Yahoo!
2008-07-19 16:50:22 0 d-------- C:\Program Files\Messenger
2008-07-19 16:36:18 0 d-------- C:\Program Files\Windows NT
2008-07-19 16:36:09 0 d-------- C:\Program Files\Movie Maker
2008-07-19 09:28:37 1636 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-07-16 18:55:33 0 d-------- C:\Program Files\MSN Messenger
2008-07-16 17:47:12 0 d-------- C:\Program Files\Symantec
2008-07-16 17:37:18 0 d-------- C:\Program Files\Common Files\Symantec Shared
2008-07-16 17:05:45 0 d-------- C:\Program Files\XoftSpy
2008-07-16 16:50:13 0 d-------- C:\Program Files\Norton SystemWorks
2008-07-16 12:26:42 0 d-------- C:\Program Files\iWin Games
2008-07-12 00:34:14 0 d-------- C:\Documents and Settings\Customer\Application Data\PlayFirst
2008-07-10 19:08:04 0 d-------- C:\Documents and Settings\Customer\Application Data\Apple Computer
2008-07-10 11:31:26 0 d-------- C:\Program Files\PopCap Games
2008-07-09 00:14:19 0 d-------- C:\Program Files\Common Files\Real
2008-07-07 12:57:15 0 d-------- C:\Documents and Settings\Customer\Application Data\iWin
2008-07-06 18:01:40 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-07-04 22:54:29 101 --a----c- C:\WINDOWS\popcinfo.dat
2008-07-04 14:57:36 0 d-------- C:\Documents and Settings\Customer\Application Data\Lavasoft
2008-07-01 12:53:18 0 d-------- C:\Program Files\iConferenceCL
2008-07-01 11:39:32 0 d-------- C:\Documents and Settings\Customer\Application Data\Mozilla
2008-06-29 17:02:10 0 d-------- C:\Documents and Settings\Customer\Application Data\Yahoo!
2008-06-28 15:18:51 0 d-------- C:\Documents and Settings\Customer\Application Data\Adobe
2008-06-27 21:14:21 0 d-------- C:\Documents and Settings\Customer\Application Data\iWinArcade
2008-06-27 18:18:35 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-06-27 13:02:26 0 d-------- C:\Program Files\Virtual Assistant
2008-06-27 13:01:04 0 d-------- C:\Program Files\Motive
2008-06-27 12:57:44 0 d-------- C:\Program Files\embarqtoolbar
2008-06-27 12:56:46 0 d-------- C:\Program Files\EMBARQ
2008-06-27 12:54:09 0 d-------- C:\Program Files\Common Files\Motive
2008-06-16 08:13:45 0 d-------- C:\Program Files\Atlantis Adventure
2008-06-02 10:44:01 0 d-------- C:\Program Files\Crystalize


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E7BD74F-2B8D-469E-92BE-BF2DFE9AAE2C}]
06/08/2007 06:13 PM 1897472 --a------ C:\PROGRA~1\EMBARQ~1\EMBARQ~1.DLL

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{4E7BD74F-2B8D-469E-92BE-BF2DFE9AAE2C}"= C:\PROGRA~1\EMBARQ~1\EMBARQ~1.DLL [06/08/2007 06:13 PM 1897472]
"{AB26BF6C-BB04-4F00-8F98-BDE786CDE97D}"= C:\WINDOWS\system32\EFOToolbar.dll [03/31/2008 12:16 AM 278528]

[-HKEY_CLASSES_ROOT\CLSID\{4E7BD74F-2B8D-469E-92BE-BF2DFE9AAE2C}]
[HKEY_CLASSES_ROOT\embarqtoolbar.EMBARQTOOLBAR]

[-HKEY_CLASSES_ROOT\CLSID\{AB26BF6C-BB04-4F00-8F98-BDE786CDE97D}]
[HKEY_CLASSES_ROOT\EFOToolbar.EFOObj.1]
[HKEY_CLASSES_ROOT\TypeLib\{668611E3-7EC2-44EF-BF11-2D814E19FAA3}]
[HKEY_CLASSES_ROOT\EFOToolbar.EFOObj]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Motive SmartBridge"="C:\PROGRA~1\VIRTUA~1\SMARTB~1\SprintDSLAlert.exe" [04/21/2006 03:41 PM]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [07/09/2008 12:11 AM]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [05/27/2008 10:50 AM]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [06/12/2008 02:28 PM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [06/10/2008 04:27 AM]
"R-Firewall"="C:\Program Files\R-TT\R-Firewall\R-Firewall.exe" [03/02/2005 09:49 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 07:00 AM]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [07/07/2008 09:42 AM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [9/24/2005 1:05:26 AM]
EMBARQ Help.lnk - C:\Program Files\Virtual Assistant\bin\matcli.exe [6/27/2008 1:00:24 PM]
MozyHome Status.lnk - C:\Program Files\MozyHome\mozystat.exe [7/20/2008 5:32:22 PM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=0 (0x0)
"HideStartupScripts"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=0 (0x0)
"HideStartupScripts"=0 (0x0)
"disableregistrytools"=0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^eFax DllCmd 4.0.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\eFax DllCmd 4.0.lnk
backup=C:\WINDOWS\pss\eFax DllCmd 4.0.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^eFax Tray Menu 4.0.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\eFax Tray Menu 4.0.lnk
backup=C:\WINDOWS\pss\eFax Tray Menu 4.0.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Desktop Search.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Desktop Search.lnk
backup=C:\WINDOWS\pss\Windows Desktop Search.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Customer^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=C:\Documents and Settings\Customer\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Customer^Start Menu^Programs^Startup^TypeItIn.lnk]
path=C:\Documents and Settings\Customer\Start Menu\Programs\Startup\TypeItIn.lnk
backup=C:\WINDOWS\pss\TypeItIn.lnkStartup

*Newly Created Service* - ADBLOCK.DLL
*Newly Created Service* - CONTENT.DLL
*Newly Created Service* - DNSCACHE.DLL
*Newly Created Service* - FTPFILT.DLL
*Newly Created Service* - HTMLFILT.DLL
*Newly Created Service* - HTTPFILT.DLL
*Newly Created Service* - IMAPFILT.DLL
*Newly Created Service* - MAILFILT.DLL
*Newly Created Service* - NNTPFILT.DLL
*Newly Created Service* - POP3FILT.DLL
*Newly Created Service* - PROTECT.DLL
*Newly Created Service* - RFW
*Newly Created Service* - RTT_CRC_SERVICE



-- End of Deckard's System Scanner: finished at 2008-07-28 12:13:36 ------------
 
Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Home Edition (build 2600) SP 2.0
Architecture: X86; Language: English

CPU 0: Intel Celeron processor
Percentage of Memory in Use: 74%
Physical Memory (total/avail): 255.48 MiB / 65.63 MiB
Pagefile Memory (total/avail): 491.13 MiB / 174.09 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1919.57 MiB

A: is Removable (No Media)
C: is Fixed (NTFS) - 57.26 GiB total, 32.89 GiB free.
D: is CDROM (No Media)
E: is Fixed (NTFS) - 152.66 GiB total, 134.27 GiB free.

\\.\PHYSICALDRIVE0 - HDS722580VLAT20 - 57.27 GiB - 1 partition
\PARTITION0 (bootable) - Installable File System - 57.26 GiB - C:

\\.\PHYSICALDRIVE1 - - 152.66 GiB - 1 partition
\PARTITION0 - Installable File System - 152.66 GiB - E:



-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is enabled.

FirstRunDisabled is set.

FW: R-Firewall v01.05.0053 (R-TT)
AV: Avira AntiVir PersonalEdition v8.0.1.26 (Avira GmbH)

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Customer\Application Data
CLASSPATH=.;C:\Program Files\Java\jre1.5.0_06\lib\ext\QTJava.zip
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=KCRC-75F6A08A51
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Customer
LOGONSERVER=\\KCRC-75F6A08A51
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;C:\Program Files\QuickTime\QTSystem
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 8 Stepping 10, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=080a
ProgramFiles=C:\Program Files
PROMPT=$P$G
QTJAVA=C:\Program Files\Java\jre1.5.0_06\lib\ext\QTJava.zip
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\Customer\LOCALS~1\Temp
TMP=C:\DOCUME~1\Customer\LOCALS~1\Temp
USERDOMAIN=KCRC-75F6A08A51
USERNAME=Customer
USERPROFILE=C:\Documents and Settings\Customer
windir=C:\WINDOWS


-- User Profiles ---------------------------------------------------------------

Customer (admin)
Guest (guest)


-- Add/Remove Programs ---------------------------------------------------------

--> C:\PROGRA~1\VIRTUA~1\Uninstall.exe Sprint
--> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CBBB5EED-CC92-49F2-A276-D5433F39D1EB}\Setup.exe" -l0x9
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Ad-Aware --> MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Adobe Acrobat Reader 3.01 --> C:\WINDOWS\uninst.exe -fC:\Acrobat3\Reader\DeIsL1.isu
Adobe Download Manager 2.0 (Remove Only) --> "C:\Program Files\Common Files\Adobe\ESD\uninst.exe"
Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin --> C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Photoshop Album 2.0 Starter Edition --> MsiExec.exe /I{11B569C2-4BF6-4ED0-9D17-A4273943CB24}
Adobe Reader 7.0.5 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70000000000}
Adobe Shockwave Player 11 --> C:\WINDOWS\system32\adobe\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Adobe\SHOCKW~1\Install.log
Affiliates Alert 1.1.134 --> "C:\Program Files\Affiliates Alert\unins000.exe"
Apple Mobile Device Support --> MsiExec.exe /I{44734179-8A79-4DEE-BB08-73037F065543}
Apple Software Update --> MsiExec.exe /I{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}
ArcSoft PhotoImpression --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E142615E-5ED8-4511-9BF0-0284BFA25766}\Setup.exe" -l0x9 -uninst
ArcSoft PhotoImpression 4 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{326D4A09-71E0-401B-9C69-94DBF32088D4}\setup.exe" -l0x9
ArcSoft VideoImpression 1.6 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{ED10343F-D30A-4200-9B00-665FC45F52B4}\Setup.exe" -l0x9 -uninst
AstroPop Deluxe 1.0 --> C:\Program Files\PopCap Games\AstroPop Deluxe\PopUninstall.exe "C:\Program Files\PopCap Games\AstroPop Deluxe\Install.log"
Atlantis Adventure 1.0 --> C:\WINDOWS\iun506.exe C:\Program Files\Atlantis Adventure\irunin.ini
Attune 2.3.2 --> MsiExec.exe /I{8F7C09A4-EBAE-11D3-A9AF-005004D2ECE4}
Audio/Video Conference 4.1 --> C:\Program Files\Conference\Conference.exe /UNINSTALL
Avira AntiVir Personal - Free Antivirus --> C:\Program Files\Avira\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
Bonjour --> MsiExec.exe /I{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}
Burger Shop (remove only) --> "C:\Program Files\iWin.com\Burger Shop\Uninstall.exe"
Business Card Maker --> C:\WINDOWS\uninst.exe -f"C:\Program Files\Cosmi\Business Card Maker\DeIsL1.isu" -c"C:\Program Files\Cosmi\Business Card Maker\_ISREG32.DLL"
CIF Dual-Mode Camera --> MsiExec.exe /X{857343AD-9A00-4287-BF8B-F65C9633CA0C}
Cosmi Photo Editor Plus --> C:\WINDOWS\uninst.exe -f"C:\Program Files\Cosmi\Photo Plus\DeIsL1.isu" -c"C:\Program Files\Cosmi\Photo Plus\_ISREG32.DLL"
Crystalize --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B33802E1-328A-473C-B5D6-7DA0D6BEA4BE}\Setup.exe" -l0x9 -removeonly
Desktop --> MsiExec.exe /I{CDEBF9E7-BCEB-43A7-986C-E66377C28ABC}
DivX --> C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Player --> C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
ebgcInfra --> MsiExec.exe /X{39B1BD87-561E-4762-AED9-7C5213B06C24}
ebgcRes --> MsiExec.exe /X{B0ED2820-A422-49C9-A5C7-9A0E97EB4904}
ebgcSDK --> MsiExec.exe /X{28E7B64D-150F-4A9E-B7A3-5A6AC8C2F822}
EMBARQ Help --> C:\WINDOWS\Motive\Sprint\MCCUninst.exe
EMBARQ Help Online --> "C:\Program Files\EMBARQ\EMBARQ Help Online\UNWISE.EXE" "C:\Program Files\EMBARQ\EMBARQ Help Online\INSTALL.LOG"
EMBARQ Remote Control --> "C:\Program Files\EMBARQ\EMBARQ Remote Control\UNWISE.EXE" "C:\Program Files\EMBARQ\EMBARQ Remote Control\INSTALL.LOG"
Embarq Toolbar --> C:\Program Files\embarqtoolbar\uninstall.exe /S
eMusic - 100 Free MP3 offer --> "C:\Program Files\Winamp\eMusic\Uninst-eMusic-promotion.exe"
Extensions Bundle 1.0 --> "C:\WINDOWS\unins000.exe"
Flow Chart Maker --> C:\WINDOWS\uninst.exe -f"C:\Program Files\Aflow\DeIsL1.isu" -c"C:\Program Files\Aflow\_ISREG32.DLL"
Forms Maker And Filler --> C:\WINDOWS\uninst.exe -f"C:\Program Files\Cosmi\Forms Maker And Filler\DeIsL1.isu" -c"C:\Program Files\Cosmi\Forms Maker And Filler\_ISREG32.DLL"
GameHouse Sudoku --> "C:\Program Files\RealArcade\Installer\bin\gameinstaller.exe" "C:\Program Files\RealArcade\Installer\installerMain.clf" "C:\Program Files\RealArcade\Installer\uninstall\GameHouse Sudoku.rguninst" "AddRemove"
Golden Hearts Juice Bar (remove only) --> "C:\Program Files\iWin.com\Golden Hearts Juice Bar\Uninstall.exe"
Good Keywords v2.0.072205 --> "C:\Program Files\Softnik Technologies\Good Keywords v2\unins000.exe"
GraphicView 32 --> C:\PROGRA~1\GRAPHI~1\UNWISE.EXE C:\PROGRA~1\GRAPHI~1\INSTALL.LOG
HighMAT Extension to Microsoft Windows XP CD Writing Wizard --> MsiExec.exe /X{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}
HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399) --> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
iTunes --> MsiExec.exe /I{9F70BF98-003C-491D-81FC-FF9792206AF0}
iWin Games (remove only) --> "C:\Program Files\iWin Games\Uninstall.exe"
Java(TM) 6 Update 7 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Jewel Quest 2 (remove only) --> "C:\Program Files\iWin.com Games\Jewel Quest 2\Uninstall.exe"
Jewel Quest Solitaire (remove only) --> "C:\Program Files\iWin.com\Jewel Quest Solitaire\Uninstall.exe"
Jewel Quest Solitaire II (remove only) --> "C:\Program Files\iWin.com\Jewel Quest Solitaire II\Uninstall.exe"
Kaspersky Online Scanner --> C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
Label Publisher with Wizards --> C:\WINDOWS\uninst.exe -f"C:\Program Files\Cosmi\Label Publisher with Wizards\DeIsL1.isu" -c"C:\Program Files\Cosmi\Label Publisher with Wizards\_ISREG32.DLL"
Magical Forest (remove only) --> "C:\Program Files\iWin.com\Magical Forest\Uninstall.exe"
Mahjong Quest 2 (remove only) --> "C:\Program Files\iWin.com Games\Mahjong Quest 2\Uninstall.exe"
Mavis Beacon Teaches Typing 15 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A1F2EF0E-1EE5-4F0B-8A31-EE875EBD3F01}\SETUP.EXE" -l0x9
MaxBlast 3 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{639858DD-4966-40F3-A706-7C838BCF3A2B}\setup.exe"
MegaCam --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{77F69001-4D35-4BEA-A074-26DA04EA0CDA}\Setup.exe" -l0x9
Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Video Screensaver --> MsiExec.exe /I{98FD8BB5-59A9-4163-883C-2997F7BB59D9}
Mozilla Firefox (3.0.1) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MozyHome 1.8.8.2 --> "C:\Program Files\MozyHome\uninstall\unins000.exe"
MSN --> C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARP
MSN Music Assistant --> rundll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\msninst.inf,Uninstall
MSN Search Toolbar --> MsiExec.exe /X{7D1DCBBA-F6F5-42B4-B90B-F04ACE4DFD6C}
OpenOffice.org 1.0.2 --> C:\Program Files\OpenOffice.org1.0.2\program\setup.exe -deinstall
PhoTags Express --> C:\PROGRA~1\PHOTAG~1\Setup.exe /remove
PopCap Browser Plugin --> C:\Program Files\PopCap Games\PopCap Browser Plugin\Uninstall.exe
QuickTime --> MsiExec.exe /I{08CA9554-B5FE-4313-938F-D4A417B81175}
R-Firewall 1.05.53 --> C:\Program Files\R-TT\R-Firewall\uninst-R-Firewall.exe
RealPlayer --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Roxio UDF Reader --> C:\WINDOWS\system32\UDFRUNIN.EXE
Security Update for CAPICOM (KB931906) --> MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906) --> MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
SiSAGP driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DC226AC9-0314-496C-BE6A-B6A132628466}\setup.exe" -l0x9
Snood for Windows version 3.52-W --> "C:\Program Files\Snood\unins000.exe"
Snood Slide 2.0 --> "C:\Program Files\WOMGames\Snood Slide\unins000.exe"
Soda Pipes --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8CA5F9E5-4BC1-47D2-9AD3-7D1CF3850746}\Setup.exe" -l0x9 -removeonly
Sproink (remove only) --> "C:\Program Files\iWin.com\Sproink\Uninstall.exe"
Spybot - Search & Destroy --> "C:\Program Files\Spybot - Search & Destroy\unins000.exe"
SpywareBlaster 4.1 --> "C:\Program Files\SpywareBlaster\unins000.exe"
Super Collapse! --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A301896D-9F55-4492-B518-30EAC4C723E1}\Setup.exe" -l0x9
The Scruffs (remove only) --> "C:\Program Files\iWin.com\The Scruffs\Uninstall.exe"
TurboNote --> C:\PROGRA~1\TURBON~1\UNwise.EXE C:\PROGRA~1\TURBON~1\install.log
TVolution --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0E2FF92D-1E63-41FB-A945-99A2DB58015A}\Setup.exe" -l0x9
TypeItIn --> C:\WINDOWS\GPInstall.exe "/UNINST=C:\Program Files\TypeItIn\UnInst.log" "/APPNAME=TypeItIn"
VGA USB Camera --> C:\WINDOWS\CleanDev.exe C:\WINDOWS\ov519.TXT
VideoLAN VLC media player 0.8.1 --> C:\Program Files\VideoLAN\VLC\uninstall.exe
Viewpoint Media Player (Remove Only) --> C:\Program Files\Viewpoint\Viewpoint Experience Technology\\mtsAxInstaller.exe /u
Web Page Creator --> C:\WINDOWS\uninst.exe -f"C:\Program Files\COSMI\Web Page Creator\DeIsL1.isu" -c"C:\Program Files\COSMI\Web Page Creator\_ISREG32.DLL"
Winamp (remove only) --> "C:\Program Files\Winamp\UninstWA.exe"
Windows Driver Package - Camera Maker (MR97310_USB_DUAL_CAMERA) Image 05/02/2006 2.0.1.0 --> C:\WINDOWS\system32\DRVSTORE\f1490bc41e7d27129cb157cba768cf63b89e7752\DPInst.exe /u mr97310c_79b33283ba293e6c94e125bce27e0ecded0a2591
Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
XnView 1.25 --> "C:\Program Files\XnView\unins000.exe"
Yahoo! Browser Services --> C:\PROGRA~1\Yahoo!\Common\UNIN_Y~1.EXE /S
Yahoo! Messenger --> C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG
Zuma Deluxe 1.0 --> C:\Program Files\Yahoo! Games\Zuma Deluxe\PopUninstall.exe "C:\Program Files\Yahoo! Games\Zuma Deluxe\Install.log"


-- Application Event Log -------------------------------------------------------

Event Record #/Type5601 / Error
Event Submitted/Written: 07/28/2008 09:25:01 AM
Event ID/Source: 1002 / Application Hang
Event Description:
Hanging application rundll32.exe, version 5.1.2600.2180, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Event Record #/Type5600 / Warning
Event Submitted/Written: 07/27/2008 10:24:12 PM
Event ID/Source: 4113 / Avira AntiVir
Event Description:
TR/Drop.Irsd.VC:\Program Files\iWin.com\Burger Shop\GameLauncher.exe

Event Record #/Type5599 / Warning
Event Submitted/Written: 07/27/2008 09:47:59 PM
Event ID/Source: 4113 / Avira AntiVir
Event Description:
TR/Drop.Irsd.VC:\Program Files\iWin.com\Burger Shop\GameLauncher.exe

Event Record #/Type5598 / Warning
Event Submitted/Written: 07/27/2008 09:47:52 PM
Event ID/Source: 4113 / Avira AntiVir
Event Description:
TR/Drop.Irsd.VC:\Program Files\iWin.com\Burger Shop\GameLauncher.exe

Event Record #/Type5597 / Warning
Event Submitted/Written: 07/27/2008 09:47:41 PM / 07/27/2008 09:47:42 PM
Event ID/Source: 4113 / Avira AntiVir
Event Description:
TR/Drop.Irsd.VC:\Program Files\iWin.com\Burger Shop\GameLauncher.exe



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type44054 / Error
Event Submitted/Written: 07/28/2008 11:19:28 AM
Event ID/Source: 7000 / Service Control Manager
Event Description:
The Upload Manager service failed to start due to the following error:
%%1079

Event Record #/Type44052 / Error
Event Submitted/Written: 07/28/2008 11:17:14 AM / 07/28/2008 11:17:44 AM
Event ID/Source: 4 / ACPI
Event Description:
AMLI: ACPI BIOS is attempting to read from an illegal IO port address (0xcfc), which lies in the 0xcf8 - 0xcff protected
address range. This could lead to system instability. Please contact your system vendor for technical assistance.

Event Record #/Type44051 / Error
Event Submitted/Written: 07/28/2008 11:17:14 AM / 07/28/2008 11:17:44 AM
Event ID/Source: 5 / ACPI
Event Description:
AMLI: ACPI BIOS is attempting to write to an illegal IO port address (0xcf8), which lies in the 0xcf8 - 0xcff protected
address range. This could lead to system instability. Please contact your system vendor for technical assistance.

Event Record #/Type44020 / Error
Event Submitted/Written: 07/28/2008 09:30:20 AM
Event ID/Source: 7000 / Service Control Manager
Event Description:
The Upload Manager service failed to start due to the following error:
%%1079

Event Record #/Type44018 / Error
Event Submitted/Written: 07/28/2008 09:29:12 AM / 07/28/2008 09:29:42 AM
Event ID/Source: 4 / ACPI
Event Description:
AMLI: ACPI BIOS is attempting to read from an illegal IO port address (0xcfc), which lies in the 0xcf8 - 0xcff protected
address range. This could lead to system instability. Please contact your system vendor for technical assistance.



-- End of Deckard's System Scanner: finished at 2008-07-28 12:13:36 ------------
 
OK that was weird. My firewall I installed shut down my internet access.
Click to expand...
Hi

So, maybe that's the reason why you couldn't get Windows updates?



CPU 0: Intel Celeron processor
Percentage of Memory in Use: 74%
Physical Memory (total/avail): 255.48 MiB / 65.63 MiB
Pagefile Memory (total/avail): 491.13 MiB / 174.09 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1919.57 MiB
Click to expand...
You shouldn't use that large virtual memory. Check 'How to manually change the size of the virtual memory paging file' -part here to adjust the size right. Also, buying more RAM would make system performance better.

Windows Internal Firewall is enabled.


FW: R-Firewall v01.05.0053 (R-TT)
Click to expand...
You should have only one software firewall enabled. Since you have R-Firewall installed & enabled please disable Windows internal firewall (for instructions check 'Disable Windows Firewall in Windows XP SP2' -part here).


Uninstall Adobe Acrobat Reader 3.01 and get the latest one here.
 
Yes you were right I forgot to turn off windows firewall. I updated Adobe Acrobat Reader as recommended. Now as for the virtual memory volume. My settings are as follows.
Custom size:
Initial size(MB): 192
Maximum size (MB): 384

My question is what should it be set at?

Also do I delete all the installers that I have downloaded?
 
OH yes! Do I download word pad again or is it hiding somewhere. This is the tool my school has me doing my work on. Without it I'm on a stand still.
 
Never mind about word pad it was just not in the start menu anymore, although I found it and it is working just fine.
 
Hi

These were meantioned in notes behind the link I gave you:
  • To have Windows select the best paging file size, click System managed size. The recommended minimum size is equivalent to 1.5 times the RAM on your computer, and 3 times that figure for the maximum size. For example, if you have 256 MB of RAM, the minimum size is 384 MB, and the maximum size is 1152 MB.
  • For best performance, do not set the initial size to less than the minimum recommended size under Total paging file size for all drives. The recommended size is equivalent to 1.5 times the RAM on your computer. It is good practice to leave the paging file at its recommended size. However, you may increase its size if you frequently use programs that use much memory.
Click to expand...
 
You're welcome. :) Looks like we are about ready here, aren't we?
 
Since this issue appears to be resolved ... this Topic has been closed. Glad I could help. :)

Note:If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than five days since your last response and you need the thread re-opened, please send me or MOD a private message (pm). A valid, working link to the closed topic is required.
 
You must log in or register to reply here.
Back
Top