[XP] Audio no longer working

Hi,

I just crashed my entire system (which MAY have had something to do with the fact that I was trying to download an Exe file of monopoly to my drive... it all seemed to go wrong after that. Naughty, I know) and after that I've been unable to get audio.

The actual hardware is registering as working perfectly, but there's no listing in the audio used category. I've tried restarting twice, but to no avail. I've also tried downloading spybot - search and destroy just to try and clean up whatever mess I've made, but that won't work now either.


Anything I should try?

This could be caused by malware :( Do a full Antivirus scan, here are three good online scanners if you need them, or want a second opinion:

Housecall

Panda Online scan

eTrust Web Scanner

Then run these three spyware removal programs, after updating the definitions:

Spybot S & D

Adaware

Microsoft Windows Defender

If you are still experiencing problems after that, unzip this program into its own permanent folder, then run it and post the logfile in our Hijack This Logfile forum here:

Hijack This

Virtual Dr Hijack This Forum

Please read these instructions before posting logfiles:

Rules for Hijack This Log Forum

Thankyou for that, I suspected this might be the case.

I just felt like a game of monopoly on my computer... serves me right for being cheap (and criminal).

Let's hope this does the trick.

This is taking longer than I'd thought... my computer is sadly so screwed up that even the virus scans are crashing. :(

Okay, here's what I've got:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:58:45, on 13/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\AOL\Loader\aolload.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Common Files\AOL\1127326511\ee\AOLSoftware.exe
C:\Program Files\VoyagerTest\fts.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\WINDOWS\system32\VTTimer.exe
C:\apps\ABoard\ABoard.exe
C:\apps\ABoard\AOSD.exe
c:\program files\common files\aol\1127326511\ee\services\antiSpywareApp\ver2_0_12\AOLSP Scheduler.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AOL\Broadband Assistant\bin\mpbtn.exe
C:\Program Files\AOL 9.0\waol.exe
C:\Program Files\AOL 9.0\shellmon.exe
C:\Program Files\Common Files\AOL\aoltpspd.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Rich\Local Settings\Temporary Internet Files\Content.IE5\09DFVXWV\HiJackThis[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: EWPBrowseObject Class - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1127326511\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: AOL Broadband Assistant.lnk = C:\Program Files\AOL\Broadband Assistant\bin\matcli.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\uk.htm
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/content.info...TunesSetup.exe
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aolsvc.aol.co.uk/comput...up/qdiagcc.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.av.aolsvc.co.uk/molb...4/mcinsctl.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1149629461453
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.av.aolsvc.co.uk/molb...21/mcgdmgr.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5579E0B6-547A-45DA-986C-0AC6EF882E25}: NameServer = 208.67.222.222,208.67.220.220
O17 - HKLM\System\CCS\Services\Tcpip\..\{5EFB0746-51A7-40AC-ADA1-5557E3600C4A}: NameServer = 205.188.146.145
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 9107 bytes

My computer is now in such a state I can't view images online, my desktop manager has been "disabled by the administrator" (??) and I can't even run spyware programs without it crashing.

There is nothing that jumps out at me from your Hijack This logs, though I am far from expert at reading them. I think you need to do an over-the-top re-install of Windows XP here. Boot up with the XP CD in the drive and let Setup run. Go past the "C" and "R" repair options by pressing Enter just as if you're doing a clean install and you'll eventually get an option to "Repair an existing installation". That's the one you want. If it asks about formatting you've gone wrong, so start over.

You'll get to keep your existing apps & settings, but you need to re-install SP2, Windows Updates & any unsigned drivers afterwards. NOTE: Be aware that you'll lose any protection from Blaster / Sasser type worms. Don't go online without a firewall, whether the built in Windows one or 3rd party.

How to perform a re-install of WinXP

Repair XP

WinXP Non-destructive Total Rebuild

Thankyou for taking a look.

It's unfortunate, because my system has got even worse since I last posted. I've tried the spyware blockers and so on, but they either say I have to pay to get rid of the viruses (which is something I'll consider if I can't get anywhere) or they crash.

Anything that tells you that you need to pay to get rid of a nasty is either a scam or malware itself :( I'm starting to think that biting the bullet and doing a clean install of Windows is the way to go here.

Yeah, unfortunately it came ready installed.

Another problem I have now is that several of the anti-adware systems I installed (like you say, I now believe that these are malware) come up on my start, which often causes my computer to crash.

I can't seem to get into the required section to prevent them from auto loading.

ad aware causes my system to crash when it scans, search and destroy says its not a "win32 program" (A recurring error in lots of these) and windows defender won't load either.

I also seem to have XP Antivirus 2008 and Antispywaresuite permanently installed onto my system.

This isn't looking good at all...

Hard way uninstall, that worked for me a couple of times when the program resisted conventional un-install routes.

Go to Program Files on C:\, find the folder for the offending program, open it and manually delete every file and sub-folder that will delete. Some will not.
Then go to regedit, under Edit finf "Search" or "Find".

Enter the name of the program and press "Search". This will come up with entry associated with the program you want to get rid of. Delete it till search function ceases to come up with more entries.
Go back to the Program Files on C:\ go back to the programs folder and you will probably be able to manually delete the rest of the files.

This is a very in-elegant crude procedure, equivalent to using a hammer by Engineers. However I found it effective and preferable to OS re-install. In the registry be carefull to delete only the items that are highlighted by Search, and be sure to double check that they truly belong to the program you want to get rid of.

Thanks for the tip... incidentally, editing the registery as well as things like desktop task manager are saying that they've "been disabled by the computer administrator".

I think I'm in real trouble this time...

I can't even get life out of hijack this anymore :(

Here's my results from the e-trust webscanner anyway, none of the other systems will now work for me to try and fix them:


Spyware found 73 Searching START PRINT

expand all collapse all
Level Pests Type
Ruternam E Trojan
Trojan "Ruternam E" found in:ProcessId "1940" File "C:\WINDOWS\system32\drivers\spools.exe"
ProcessId "1948" File "C:\WINDOWS\system32\drivers\spools.exe"
ProcessId "1956" File "C:\WINDOWS\system32\drivers\spools.exe"
ProcessId "1964" File "C:\WINDOWS\system32\drivers\spools.exe"
ProcessId "1972" File "C:\WINDOWS\system32\drivers\spools.exe"
ProcessId "1988" File "C:\WINDOWS\system32\drivers\spools.exe"
ProcessId "2036" File "C:\WINDOWS\system32\drivers\spools.exe"
ProcessId "2044" File "C:\WINDOWS\system32\drivers\spools.exe"
ProcessId "300" File "C:\WINDOWS\system32\drivers\spools.exe"
ProcessId "416" File "C:\WINDOWS\system32\drivers\spools.exe"
ProcessId "468" File "C:\WINDOWS\system32\drivers\spools.exe"
ProcessId "580" File "C:\WINDOWS\system32\drivers\spools.exe"
ProcessId "588" File "C:\WINDOWS\system32\drivers\spools.exe"
File "c:\windows\system32\drivers\spools.exe"

More Info
AntivirusForAll Rogue Security Software
Rogue Security Software "AntivirusForAll" found in:ProcessId "544" File "C:\PROGRA~1\COMMON~1\ANTISP~1\ugac.exe"
File "C:\PROGRA~1\COMMON~1\ANTISP~1\ugac.exe"

More Info
KaZaA P2P
P2P "KaZaA" found in:Key "hkey_local_machine \software\kazaa"
Key "hkey_local_machine \software\microsoft\windows\currentversion\app management\arpcache\p2p networking"
Key "hkey_current_user \software\kazaa"
Key "hkey_local_machine \software\magnet"

More Info
MSN SmartTags Browser Helper Object
Browser Helper Object "MSN SmartTags" found in:Key "hkey_local_machine \software\classes\clsid\{9dd4258a-7138-49c4-8d34-587879a5c7a4}"
Key "hkey_classes_root \clsid\{9dd4258a-7138-49c4-8d34-587879a5c7a4}"

More Info
PCAntivirusPro Rogue Security Software
Rogue Security Software "PCAntivirusPro" found in:Key "hkey_local_machine \software\microsoft\windows\currentversion\run" value "ugac"

More Info
Downloader Downloader
Downloader "Downloader" found in:Key "hkey_local_machine \software\microsoft\windows\currentversion\explorer\sharedtaskscheduler" value "{c5af49a2-94f3-42bd-f434-2604812c897d}"
Key "hkey_local_machine \software\microsoft\windows\currentversion\explorer\browser helper objects\{c5af49a2-94f3-42bd-f434-2604812c897d}"
Key "hkey_classes_root \clsid\{c5af49a2-94f3-42bd-f434-2604812c897d}"

More Info
MediaUpdate Hijacker
Hijacker "MediaUpdate" found in:Key "hkey_classes_root \clsid\{b8c0220d-763d-49a4-95f4-61dfdec66ee6}"
Key "hkey_local_machine \software\classes\clsid\{b8c0220d-763d-49a4-95f4-61dfdec66ee6}"

More Info
Burgspill J Trojan
Trojan "Burgspill J" found in:Key "hkey_current_user \software\microsoft\bind" value "comment2" data "f"

More Info
eMule P2P
P2P "eMule" found in:Key "hkey_current_user \software\emule"
Key "hkey_local_machine \software\classes\ed2k"
Key "hkey_classes_root \.emulecollection"
Key "hkey_local_machine \software\microsoft\windows\currentversion\uninstall\emule"
Key "hkey_classes_root \emule"
Folder "c:\documents and settings\all users\start menu\programs\eMule"
Folder "c:\program files\eMule"

More Info
ClickSpring Adware
Adware "ClickSpring" found in:Key "hkey_local_machine \software\clickspring"

More Info
FlashGet Browser Helper Object
Browser Helper Object "FlashGet" found in:Key "hkey_local_machine \software\classes\clsid\{e0e899ab-f487-11d5-8d29-0050ba6940e3}"
Key "hkey_local_machine \software\classes\clsid\{a5366673-e8ca-11d3-9cd9-0090271d075b}"
Key "hkey_local_machine \software\microsoft\internet explorer\toolbar" value "{e0e899ab-f487-11d5-8d29-0050ba6940e3}"
Key "hkey_classes_root \clsid\{a5366673-e8ca-11d3-9cd9-0090271d075b}"
Key "hkey_classes_root \clsid\{e0e899ab-f487-11d5-8d29-0050ba6940e3}"
File "c:\program files\flashget\fgiebar.dll"
File "c:\program files\flashget\flashget.exe"
File "c:\program files\flashget\language\jctur.ini"
File "c:\program files\flashget\language\jcswe.ini"
File "c:\program files\flashget\language\jcbul.ini"
File "c:\program files\flashget\language\jcthi.ini"
File "c:\program files\flashget\language\jccht.ini"
File "c:\program files\flashget\language\jcesp.ini"
File "c:\program files\flashget\language\jcnor.ini"
File "c:\program files\flashget\language\jcfin.ini"
File "c:\program files\flashget\language\jcdax.ini"
File "c:\program files\flashget\language\jcnld.ini"
File "c:\program files\flashget\language\jchun.ini"
File "c:\program files\flashget\flashget.chm"
File "c:\program files\flashget\language\jclat.ini"
File "c:\program files\flashget\language\jcell.ini"
File "c:\program files\flashget\language\jcfra.ini"
File "c:\program files\flashget\skin\normal.ini"
File "c:\program files\flashget\language\jcjpn.ini"
File "c:\program files\flashget\jc_all.htm"
File "c:\program files\flashget\language\jcrom.ini"
File "c:\program files\flashget\skin\xp_luna(gradient).ini"
File "c:\program files\flashget\unreg.inf"
File "c:\program files\flashget\language\jcita.ini"
File "c:\program files\flashget\language\jcpob.ini"
File "c:\program files\flashget\language\jckor.ini"
File "c:\program files\flashget\language\jcltu.ini"
File "c:\program files\flashget\language\jcsrl.ini"
File "c:\program files\flashget\language\jcchs.ini"
File "c:\program files\flashget\language\jcsvk.ini"
File "c:\program files\flashget\jc_link.htm"
File "c:\program files\flashget\language\jcdeu.ini"
File "c:\program files\flashget\language\jcrus.ini"
File "c:\program files\flashget\skin\xp_luna.ini"
File "c:\program files\flashget\language\jccat.ini"
File "c:\program files\flashget\language\jceng.ini"
File "c:\program files\flashget\language\jcheb.ini"
File "c:\program files\flashget\skin\imagebk.ini"
File "c:\program files\flashget\language\jcukr.ini"
File "c:\program files\flashget\language\jcpls.ini"
File "c:\program files\flashget\skin\sky(gradient).ini"
File "c:\program files\flashget\language\jcptp.ini"
File "c:\program files\flashget\language\jccze.ini"
File "c:\program files\flashget\language\jcslo.ini"
File "c:\program files\flashget\jccatch.dll"

More Info
AVSystemCare Rogue Security Software
Rogue Security Software "AVSystemCare" found in:Key "hkey_local_machine \software\microsoft\windows\currentversion\uninstall\uavun_is1" value "displayname"
Key "hkey_classes_root \sbiebho.iefw"
Key "hkey_local_machine \software\microsoft\windows\currentversion\uninstall\uavun_is1" value "inno setup: setup version"
Key "hkey_local_machine \software\microsoft\windows\currentversion\uninstall\uavun_is1" value "inno setup: icon group"
Key "hkey_local_machine \software\microsoft\windows\currentversion\uninstall\uavun_is1" value "norepair"
Key "hkey_local_machine \software\microsoft\windows\currentversion\uninstall\uavun_is1" value "installlocation"
Key "hkey_classes_root \clsid\{6f87f145-dc2d-4766-af03-3a3b96ffad98}"
Key "hkey_classes_root \sbiebho.iefw.2"
Key "hkey_local_machine \software\microsoft\windows\currentversion\uninstall\uavun_is1" value "inno setup: user"
Key "hkey_local_machine \software\microsoft\windows\currentversion\uninstall\uavun_is1" value "nomodify"
Key "hkey_local_machine \software\ugac" value "domainname"
Key "hkey_local_machine \software\microsoft\windows\currentversion\uninstall\uavun_is1" value "inno setup: deselected tasks"
Key "hkey_classes_root \typelib\{d761645b-6b20-4698-aee8-729981152a82}"
Key "hkey_local_machine \software\microsoft\windows\currentversion\uninstall\uavun_is1" value "inno setup: app path"
Key "hkey_local_machine \software\microsoft\windows\currentversion\uninstall\uavun_is1" value "inno setup: selected tasks"
Key "hkey_local_machine \software\microsoft\windows\currentversion\uninstall\uavun_is1" value "installpath"
Key "hkey_local_machine \software\microsoft\windows\currentversion\uninstall\uavun_is1" value "installdate"

More Info
ImIServer IEPlugin Adware
Adware "ImIServer IEPlugin" found in:Key "hkey_local_machine \system\currentcontrolset\enum\root\legacy_network_monitor\0000" value "class" data "legacydriver"
Key "hkey_local_machine \system\currentcontrolset\enum\root\legacy_network_monitor\0000" value "devicedesc" data "network monitor"
Key "hkey_local_machine \system\currentcontrolset\enum\root\legacy_network_monitor\0000" value "service" data "network monitor"

More Info
Vividence Connector Browser Helper Object
Browser Helper Object "Vividence Connector" found in:Key "hkey_local_machine \software\classes\clsid\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338}"
Key "hkey_classes_root \clsid\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338}"

More Info
Bewschy C Adware
Adware "Bewschy C" found in:Key "hkey_classes_root \e404.e404mgr"
Key "hkey_classes_root \interface\{f7d09218-46d7-4d3d-9b7f-315204cd0836}"
Key "hkey_classes_root \typelib\{e63648f7-3933-440e-b4f6-a8584dd7b7eb}"
Key "hkey_classes_root \e404.e404mgr.1"
Key "hkey_classes_root \clsid\{c03fd59d-9104-44b7-929a-9eaa0ba05211}"

More Info
Multidropper BZ Trojan
Trojan "Multidropper BZ" found in:Key "hkey_current_user \software\classes\clsid\{0656a137-b161-cadd-9777-e37a75727e78}"

More Info
AntispywareSuite Rogue Security Software
Rogue Security Software "AntispywareSuite" found in:Key "hkey_local_machine \software\products" value "prodname" data "antispywaresuite"
Key "hkey_local_machine \software\products" value "compname" data "locus software, inc."
Key "hkey_local_machine \software\products" value "rdomain" data "antispywaresuite.com"
Key "hkey_current_user \software\antispywaresuite"
Key "hkey_local_machine \software\antispywaresuite"
Folder "c:\program files\Common Files\AntiSpywareSuite"
Folder "c:\documents and settings\all users\start menu\programs\AntiSpywareSuite"
Folder "c:\program files\AntiSpywareSuite"
Folder "c:\documents and settings\rich\Application Data\AntiSpywareSuite"

More Info
Matcash Downloader
Downloader "Matcash" found in:Key "hkey_local_machine \software\microsoft\windows\currentversion\run" value "runner1"
Key "hkey_classes_root \wr"

More Info
AroundWeb Toolbar
Toolbar "AroundWeb" found in:Key "hkey_classes_root \clsid\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c}"

More Info
SillyDl DNB Trojan
Trojan "SillyDl DNB" found in:Key "hkey_current_user \software\microsoft\windows\currentversion\explorer" value "winid"

More Info
ISearch Spyware
Spyware "ISearch" found in:Key "hkey_local_machine \system\currentcontrolset\enum\root\legacy_cmdservice"

More Info
Zlob AM Downloader
Downloader "Zlob AM" found in:Key "hkey_local_machine \software\microsoft\videoplugin"

More Info
XP Antivirus 2008 Rogue Security Software
Rogue Security Software "XP Antivirus 2008" found in:Key "hkey_current_user \software\microsoft\windows\shellnoroam\muicache" value "c:\program files\xp antivirus\xpa.exe" data "xpa"

More Info
Emesx.dll Adware
Adware "Emesx.dll" found in:Key "hkey_classes_root \clsid\{000000da-0786-4633-87c6-1aa7a4429ef1}"

More Info
FavoriteMan Browser Helper Object
Browser Helper Object "FavoriteMan" found in:Key "hkey_local_machine \software\classes\clsid\{000000da-0786-4633-87c6-1aa7a4429ef1}"

More Info
Higlieder Trojan
Trojan "Higlieder" found in:Key "hkey_current_user \software\microsoft\windows\currentversion\run" value "drvsyskit"

More Info
247RealMedia.com Tracking Cookie
Tracking Cookie "247RealMedia.com" found in:Cookie "rich@247realmedia[1].txt" File "C:\Documents and Settings\Rich\Cookies\rich@247realmedia[1].txt"

More Info
TrackingCookie.888 Tracking Cookie
Tracking Cookie "TrackingCookie.888" found in:Cookie "rich@888[1].txt" File "C:\Documents and Settings\Rich\Cookies\rich@888[1].txt"

More Info
Ad.YieldManager.com Cookie Tracking Cookie
Tracking Cookie "Ad.YieldManager.com Cookie" found in:Cookie "[email protected][1].txt" File "C:\Documents and Settings\Rich\Cookies\[email protected][1].txt"

More Info
adbrite.com Tracking Cookie
Tracking Cookie "adbrite.com" found in:Cookie "rich@adbrite[2].txt" File "C:\Documents and Settings\Rich\Cookies\rich@adbrite[2].txt"

More Info
adecn.com Tracking Cookie
Tracking Cookie "adecn.com" found in:Cookie "rich@adecn[1].txt" File "C:\Documents and Settings\Rich\Cookies\rich@adecn[1].txt"

More Info
specificclick.net Tracking Cookie
Tracking Cookie "specificclick.net" found in:Cookie "[email protected][2].txt" File "C:\Documents and Settings\Rich\Cookies\[email protected][2].txt"

More Info
adrevolver.com Tracking Cookie
Tracking Cookie "adrevolver.com" found in:Cookie "rich@adrevolver[2].txt" File "C:\Documents and Settings\Rich\Cookies\rich@adrevolver[2].txt"

More Info
addynamix.com Tracking Cookie
Tracking Cookie "addynamix.com" found in:Cookie "[email protected][1].txt" File "C:\Documents and Settings\Rich\Cookies\[email protected][1].txt"

More Info
Adtech.de Tracking Cookie
Tracking Cookie "Adtech.de" found in:Cookie "rich@adtech[1].txt" File "C:\Documents and Settings\Rich\Cookies\rich@adtech[1].txt"

More Info
adverticum.net Tracking Cookie
Tracking Cookie "adverticum.net" found in:Cookie "rich@adverticum[1].txt" File "C:\Documents and Settings\Rich\Cookies\rich@adverticum[1].txt"

More Info
Advertising.com Tracking Cookie
Tracking Cookie "Advertising.com" found in:Cookie "rich@advertising[1].txt" File "C:\Documents and Settings\Rich\Cookies\rich@advertising[1].txt"
Cookie "rich@advertising[3].txt" File "C:\Documents and Settings\Rich\Cookies\rich@advertising[3].txt"

More Info
Adviva Tracking Cookie
Tracking Cookie "Adviva" found in:Cookie "rich@adviva[2].txt" File "C:\Documents and Settings\Rich\Cookies\rich@adviva[2].txt"

More Info
tacoda.net Tracking Cookie
Tracking Cookie "tacoda.net" found in:Cookie "[email protected][2].txt" File "C:\Documents and Settings\Rich\Cookies\[email protected][2].txt"
Cookie "[email protected][3].txt" File "C:\Documents and Settings\Rich\Cookies\[email protected][3].txt"

More Info
2o7.net Tracking Cookie
Tracking Cookie "2o7.net" found in:Cookie "[email protected][1].txt" File "C:\Documents and Settings\Rich\Cookies\[email protected][1].txt"
Cookie "[email protected][2].txt" File "C:\Documents and Settings\Rich\Cookies\[email protected][2].txt"
Cookie "[email protected][1].txt" File "C:\Documents and Settings\Rich\Cookies\[email protected][1].txt"

More Info
apmebf.com Tracking Cookie
Tracking Cookie "apmebf.com" found in:Cookie "rich@apmebf[1].txt" File "C:\Documents and Settings\Rich\Cookies\rich@apmebf[1].txt"

More Info
AtlasDMT.com Tracking Cookie
Tracking Cookie "AtlasDMT.com" found in:Cookie "rich@atdmt[2].txt" File "C:\Documents and Settings\Rich\Cookies\rich@atdmt[2].txt"

More Info
atwola.com Tracking Cookie
Tracking Cookie "atwola.com" found in:Cookie "rich@atwola[1].txt" File "C:\Documents and Settings\Rich\Cookies\rich@atwola[1].txt"

More Info
BS.Serving-Sys Tracking Cookie
Tracking Cookie "BS.Serving-Sys" found in:Cookie "[email protected][1].txt" File "C:\Documents and Settings\Rich\Cookies\[email protected][1].txt"
Cookie "[email protected][2].txt" File "C:\Documents and Settings\Rich\Cookies\[email protected][2].txt"

More Info
BurstNet.com Tracking Cookie
Tracking Cookie "BurstNet.com" found in:Cookie "rich@burstnet[2].txt" File "C:\Documents and Settings\Rich\Cookies\rich@burstnet[2].txt"

More Info
Casalemedia Tracking Cookie
Tracking Cookie "Casalemedia" found in:Cookie "rich@casalemedia[1].txt" File "C:\Documents and Settings\Rich\Cookies\rich@casalemedia[1].txt"

More Info
DealTime Tracking Cookie
Tracking Cookie "DealTime" found in:Cookie "rich@dealtime[1].txt" File "C:\Documents and Settings\Rich\Cookies\rich@dealtime[1].txt"
Cookie "[email protected][1].txt" File "C:\Documents and Settings\Rich\Cookies\[email protected][1].txt"

More Info
DoubleClick Tracking Cookie
Tracking Cookie "DoubleClick" found in:Cookie "rich@doubleclick[1].txt" File "C:\Documents and Settings\Rich\Cookies\rich@doubleclick[1].txt"
Cookie "rich@doubleclick[2].txt" File "C:\Documents and Settings\Rich\Cookies\rich@doubleclick[2].txt"

More Info
FastClick.com Tracking Cookie
Tracking Cookie "FastClick.com" found in:Cookie "rich@fastclick[1].txt" File "C:\Documents and Settings\Rich\Cookies\rich@fastclick[1].txt"
Cookie "rich@fastclick[2].txt" File "C:\Documents and Settings\Rich\Cookies\rich@fastclick[2].txt"

More Info
Findwhat Tracking Cookie
Tracking Cookie "Findwhat" found in:Cookie "rich@findwhat[1].txt" File "C:\Documents and Settings\Rich\Cookies\rich@findwhat[1].txt"

More Info
HitBox.com Tracking Cookie
Tracking Cookie "HitBox.com" found in:Cookie "rich@hitbox[1].txt" File "C:\Documents and Settings\Rich\Cookies\rich@hitbox[1].txt"

More Info
gureport.co.uk Tracking Cookie
Tracking Cookie "gureport.co.uk" found in:Cookie "[email protected][1].txt" File "C:\Documents and Settings\Rich\Cookies\[email protected][1].txt"

More Info
LookSmart Tracking Cookie
Tracking Cookie "LookSmart" found in:Cookie "rich@looksmart[1].txt" File "C:\Documents and Settings\Rich\Cookies\rich@looksmart[1].txt"

More Info
webtrends.com Tracking Cookie
Tracking Cookie "webtrends.com" found in:Cookie "[email protected][2].txt" File "C:\Documents and Settings\Rich\Cookies\[email protected][2].txt"

More Info
Mediaplex.com Tracking Cookie
Tracking Cookie "Mediaplex.com" found in:Cookie "rich@mediaplex[1].txt" File "C:\Documents and Settings\Rich\Cookies\rich@mediaplex[1].txt"
Cookie "rich@mediaplex[2].txt" File "C:\Documents and Settings\Rich\Cookies\rich@mediaplex[2].txt"

More Info
quantserve.com Tracking Cookie
Tracking Cookie "quantserve.com" found in:Cookie "rich@quantserve[2].txt" File "C:\Documents and Settings\Rich\Cookies\rich@quantserve[2].txt"
Cookie "rich@quantserve[3].txt" File "C:\Documents and Settings\Rich\Cookies\rich@quantserve[3].txt"

More Info
QuestionMarket.com Tracking Cookie
Tracking Cookie "QuestionMarket.com" found in:Cookie "rich@questionmarket[2].txt" File "C:\Documents and Settings\Rich\Cookies\rich@questionmarket[2].txt"

More Info
RealMedia.com Tracking Cookie
Tracking Cookie "RealMedia.com" found in:Cookie "rich@realmedia[1].txt" File "C:\Documents and Settings\Rich\Cookies\rich@realmedia[1].txt"

More Info
revsci.net Tracking Cookie
Tracking Cookie "revsci.net" found in:Cookie "rich@revsci[1].txt" File "C:\Documents and Settings\Rich\Cookies\rich@revsci[1].txt"

More Info
roiservice.com Tracking Cookie
Tracking Cookie "roiservice.com" found in:Cookie "rich@roiservice[1].txt" File "C:\Documents and Settings\Rich\Cookies\rich@roiservice[1].txt"

More Info
adjuggler.com Tracking Cookie
Tracking Cookie "adjuggler.com" found in:Cookie "[email protected][2].txt" File "C:\Documents and Settings\Rich\Cookies\[email protected][2].txt"
Cookie "[email protected][3].txt" File "C:\Documents and Settings\Rich\Cookies\[email protected][3].txt"

More Info
Serving-Sys Tracking Cookie
Tracking Cookie "Serving-Sys" found in:Cookie "rich@serving-sys[1].txt" File "C:\Documents and Settings\Rich\Cookies\rich@serving-sys[1].txt"
Cookie "rich@serving-sys[2].txt" File "C:\Documents and Settings\Rich\Cookies\rich@serving-sys[2].txt"

More Info
Ads.SpecificClick.com Tracking Cookie
Tracking Cookie "Ads.SpecificClick.com" found in:Cookie "rich@specificclick[2].txt" File "C:\Documents and Settings\Rich\Cookies\rich@specificclick[2].txt"