# Okai- need help!



## okai (Apr 25, 2005)

I NEED HELP TOO !! 
-------------------------------------
StartupList report, 2005-04-25, 00:25:29
StartupList version: 1.52
Started from : C:\Documents and Settings\aurora\Mes documents\Ma musique\Mi Musica\StartupList.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Orbit\update.exe
C:\Program Files\Orbit\view.exe
C:\WINDOWS\dhbrwsr.exe
C:\PROGRA~1\Toolbar\TBPS.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr-ca\msnappau.exe
C:\PROGRA~1\FICHIE~1\WinTools\WToolsA.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\Internet Optimizer\optimize.exe
C:\Program Files\BullsEye Network\bin\bargains.exe
C:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe
C:\Program Files\Qvkt\Eygdy.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\ltfod.exe
C:\Program Files\Hotbar\Bin\4.6.1.0\HbOEAddOn.exe
C:\Program Files\Hotbar\Bin\4.6.1.0\WeatherOnTray.exe
C:\WINDOWS\system32\gah95on6.exe
C:\PROGRA~1\Toolbar\PIB.exe
C:\Program Files\Media Access\MediaAccK.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Media Access\MediaAccess.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\msnmsg.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\WinTools\WSup.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Optimizer\actalert.exe
C:\WINDOWS\system32\msnmsg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\dhsvr.exe
c:\windows\msbb.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\aurora\Mes documents\Ma musique\Mi Musica\StartupList.exe

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

AdaptecDirectCD = "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
SoundMan = SOUNDMAN.EXE
OrbitUpdate = C:\Program Files\Orbit\update.exe
OrbitView = C:\Program Files\Orbit\view.exe
DealHelperUpdate = C:\WINDOWS\DHUpdt.exe
DealHelperBrwsr = C:\WINDOWS\dhbrwsr.exe
TBPS = C:\PROGRA~1\Toolbar\TBPS.exe
HP Software Update = C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
HPDJ Taskbar Utility = C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
DeviceDiscovery = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
msnappau = "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr-ca\msnappau.exe"
WinTools = C:\PROGRA~1\FICHIE~1\WinTools\WToolsA.exe
MessengerPlus3 = "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
Internet Optimizer = "C:\Program Files\Internet Optimizer\optimize.exe"
BullsEye Network = C:\Program Files\BullsEye Network\bin\bargains.exe
xif = C:\WINDOWS\xif.exe
navapp = C:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe
Yldmr = C:\Program Files\Qvkt\Eygdy.exe
SunJavaUpdateSched = C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
IST Service = C:\Program Files\ISTsvc\istsvc.exe
Power Scan = C:\Program Files\Power Scan\powerscan.exe
QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime
sLfHeo2 = C:\WINDOWS\ltfod.exe
Hotbar = C:\Program Files\Hotbar\Bin\4.6.1.0\HbOEAddOn.exe
WeatherOnTray = C:\Program Files\Hotbar\Bin\4.6.1.0\WeatherOnTray.exe
-
 = C:\WINDOWS\ltfod.exe
bPUs9jD3i = C:\WINDOWS\ltfod.exe
gah95on6 = C:\WINDOWS\system32\gah95on6.exe
typemeowsavegrey = C:\Documents and Settings\All Users\Application Data\locks wma type meow\Bikeregs.exe
Media Access = C:\Program Files\Media Access\MediaAccK.exe
Á³#*K"h'þ9Ó÷3rÅWC:\Program Files\ISTsvc\istsvc.exe = C:\WINDOWS\ltfod.exe
WinampAgent = C:\Program Files\Winamp\winampa.exe
Msn Messenger Service = msnmsg.exe
msbb = c:\windows\msbb.exe
ubsb = C:\WINDOWS\ubsb.exe
ErrorGuard = C:\Program Files\ErrorGuard\ErrorGuard.Exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

Msn Messenger Service = msnmsg.exe

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

CTFMON.EXE = C:\WINDOWS\system32\ctfmon.exe
ares = "C:\Program Files\Ares\Ares.exe" -h
MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background
pokeclose = C:\DOCUME~1\aurora\APPLIC~1\ELSEKI~1\First idle play.exe
msnmsgr = "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
Msn Messenger Service = msnmsg.exe

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

Msn Messenger Service = msnmsg.exe

--------------------------------------------------

Load/Run keys from C:\WINDOWS\WIN.INI:

load=*INI section not found*
run=*INI section not found*

Load/Run keys from Registry:

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=c:\\rofl.exe
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\sstext3d.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - (no file) - {00000010-6F7D-442C-93E3-4A4827C2E4C8}
(no name) - (no file) - {1D7E3B41-23CE-469B-BE1B-A64B877923E1}
ShprRprts - (no file) - {2A8A997F-BB9F-48F6-AA2B-2762D50F9289}
(no name) - C:\Program Files\Fichiers communs\OE\toolbar.dll (file missing) - {702AD576-FDDB-4d0f-9811-A43252064684}
(no name) - (no file) - {87766247-311C-43B4-8499-3D5FEC94A183}
(no name) - C:\PROGRA~1\Toolbar\toolbar.dll - {8952A998-1E7E-4716-B23D-3DBE03910972}
(no name) - (no file) - {9394EDE7-C8B5-483E-8773-474BF36AF6E4}
(no name) - (no file) - {A28DD286-DB3B-5936-5B16-4C5EE349C20E}
(no name) - (no file) - {A3FDD654-A057-4971-9844-4ED8E67DBBB8}
Hotbar - (no file) - {B195B3B3-8A05-11D3-97A4-0004ACA6948E}
(no name) - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr-ca\msntb.dll - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}
(no name) - (no file) - {C1E58A84-95B3-4630-B8C2-D06B77B7A0FC}
(no name) - C:\Program Files\Fichiers communs\OE\redirector.dll (file missing) - {D48F2E28-68E2-4920-9848-D6E6C7AB3EB7}
(no name) - (no file) - {D80C4E21-C346-4E21-8E64-20746AA20AEB}
(no name) - C:\WINDOWS\dealhlpr.dll - {D848A3CA-0BFB-4DE0-BA9E-A57F0CCA1C13}

--------------------------------------------------

Enumerating Task Scheduler jobs:

A36779A49180F708.job
ACAF5C589180CEB8.job
AFA878A19187EA09.job

--------------------------------------------------

Enumerating Download Program Files:

[{00B71CFB-6864-4346-A978-C0A14556272C}]
CODEBASE = http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab

[{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}]
CODEBASE = http://www.apple.com/qtactivex/qtplugin.cab

[{14B87622-7E19-4EA8-93B3-97215F77A6BC}]
CODEBASE = http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab

[{15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6}]
CODEBASE = http://static.windupdates.com/cab/MusicUnlimited/ie/bridge-c8.cab

[{15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6}]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\MediaAccX.dll
CODEBASE = http://static.windupdates.com/cab/MusicAccess/ie/bridge-c8.cab

[{166B1BCA-3F9C-11CF-8075-444553540000}]
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

[CInstall Class]
InProcServer32 = C:\WINDOWS\DOWNLO~1\Install.dll
CODEBASE = http://www.errorguard.com/installation/Install.cab

[{288C5F13-7E52-4ADA-A32E-F5BF9D125F98}]
CODEBASE = http://www.miniclip.com/inflaterball/miniclipGameLoader.dll

[{2917297F-F02B-4B9D-81DF-494B6333150B}]
CODEBASE = http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab

[{45E83043-1F6F-4D22-A5E7-0138EA171B49}]
CODEBASE = http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fr/filesharingctrl.cab

[{4F1E5B1A-2A80-42CA-8532-2D05CB959537}]
CODEBASE = http://spaces.msn.com//PhotoUpload/MsnPUpld.cab

[WUWebControl Class]
InProcServer32 = C:\WINDOWS\System32\wuweb.dll
CODEBASE = http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1096049990728

[{771A1334-6B08-4A6B-AEDC-CF994BA2CEBE}]
CODEBASE = http://www.ysbweb.com/ist/softwares/v4.0/ysb_1002245.cab

[{8E0D4DE5-3180-4024-A327-4DFAD1796A8D}]
CODEBASE = http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab

[{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}]
CODEBASE = http://fpdownload.macromedia.com/get/shockwave/cabs/flash/ultrashim.cab

[{B8BE5E93-A60C-4D26-A2DC-220313175592}]
CODEBASE = http://messenger.zone.msn.com/binary/ZIntro.cab31267.cab

[{BD393C14-72AD-4790-A095-76522973D6B8}]
CODEBASE = http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab

[{D27CDB6E-AE6D-11CF-96B8-444553540000}]
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[{E2F2B9D0-96B9-4B25-B90C-636ECB207D18}]
CODEBASE = http://www.whenusearch.com/WUInstSECS.cab

[MSN Chat Control 4.5]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\MSNChat45.ocx
CODEBASE = http://chat.msn.com/bin/msnchat45.cab

[{F6BF0D00-0B2A-4A75-BF7B-F385591623AF}]
CODEBASE = http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab

--------------------------------------------------

Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*

Windows NT checkdisk command:
BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':
PendingFileRenameOperations: @C:\WINDOWS\system32\@c:\windows\system32\scrrun.dll.tmp

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll

--------------------------------------------------
End of report, 12*764 bytes
Report generated in 0,031 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only


----------



## okai (Apr 25, 2005)

HOW MUCH TIME DO I HAVE TO SEND THIS ??
-----------------------------------------------------
StartupList report, 2005-04-25, 00:25:29
StartupList version: 1.52
Started from : C:\Documents and Settings\aurora\Mes documents\Ma musique\Mi Musica\StartupList.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Orbit\update.exe
C:\Program Files\Orbit\view.exe
C:\WINDOWS\dhbrwsr.exe
C:\PROGRA~1\Toolbar\TBPS.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr-ca\msnappau.exe
C:\PROGRA~1\FICHIE~1\WinTools\WToolsA.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\Internet Optimizer\optimize.exe
C:\Program Files\BullsEye Network\bin\bargains.exe
C:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe
C:\Program Files\Qvkt\Eygdy.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\ltfod.exe
C:\Program Files\Hotbar\Bin\4.6.1.0\HbOEAddOn.exe
C:\Program Files\Hotbar\Bin\4.6.1.0\WeatherOnTray.exe
C:\WINDOWS\system32\gah95on6.exe
C:\PROGRA~1\Toolbar\PIB.exe
C:\Program Files\Media Access\MediaAccK.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Media Access\MediaAccess.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\msnmsg.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\WinTools\WSup.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Optimizer\actalert.exe
C:\WINDOWS\system32\msnmsg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\dhsvr.exe
c:\windows\msbb.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\aurora\Mes documents\Ma musique\Mi Musica\StartupList.exe

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

AdaptecDirectCD = "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
SoundMan = SOUNDMAN.EXE
OrbitUpdate = C:\Program Files\Orbit\update.exe
OrbitView = C:\Program Files\Orbit\view.exe
DealHelperUpdate = C:\WINDOWS\DHUpdt.exe
DealHelperBrwsr = C:\WINDOWS\dhbrwsr.exe
TBPS = C:\PROGRA~1\Toolbar\TBPS.exe
HP Software Update = C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
HPDJ Taskbar Utility = C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
DeviceDiscovery = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
msnappau = "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr-ca\msnappau.exe"
WinTools = C:\PROGRA~1\FICHIE~1\WinTools\WToolsA.exe
MessengerPlus3 = "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
Internet Optimizer = "C:\Program Files\Internet Optimizer\optimize.exe"
BullsEye Network = C:\Program Files\BullsEye Network\bin\bargains.exe
xif = C:\WINDOWS\xif.exe
navapp = C:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe
Yldmr = C:\Program Files\Qvkt\Eygdy.exe
SunJavaUpdateSched = C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
IST Service = C:\Program Files\ISTsvc\istsvc.exe
Power Scan = C:\Program Files\Power Scan\powerscan.exe
QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime
sLfHeo2 = C:\WINDOWS\ltfod.exe
Hotbar = C:\Program Files\Hotbar\Bin\4.6.1.0\HbOEAddOn.exe
WeatherOnTray = C:\Program Files\Hotbar\Bin\4.6.1.0\WeatherOnTray.exe
-
 = C:\WINDOWS\ltfod.exe
bPUs9jD3i = C:\WINDOWS\ltfod.exe
gah95on6 = C:\WINDOWS\system32\gah95on6.exe
typemeowsavegrey = C:\Documents and Settings\All Users\Application Data\locks wma type meow\Bikeregs.exe
Media Access = C:\Program Files\Media Access\MediaAccK.exe
Á³#*K"h'þ9Ó÷3rÅWC:\Program Files\ISTsvc\istsvc.exe = C:\WINDOWS\ltfod.exe
WinampAgent = C:\Program Files\Winamp\winampa.exe
Msn Messenger Service = msnmsg.exe
msbb = c:\windows\msbb.exe
ubsb = C:\WINDOWS\ubsb.exe
ErrorGuard = C:\Program Files\ErrorGuard\ErrorGuard.Exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

Msn Messenger Service = msnmsg.exe

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

CTFMON.EXE = C:\WINDOWS\system32\ctfmon.exe
ares = "C:\Program Files\Ares\Ares.exe" -h
MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background
pokeclose = C:\DOCUME~1\aurora\APPLIC~1\ELSEKI~1\First idle play.exe
msnmsgr = "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
Msn Messenger Service = msnmsg.exe

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

Msn Messenger Service = msnmsg.exe

--------------------------------------------------

Load/Run keys from C:\WINDOWS\WIN.INI:

load=*INI section not found*
run=*INI section not found*

Load/Run keys from Registry:

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=c:\\rofl.exe
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\sstext3d.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - (no file) - {00000010-6F7D-442C-93E3-4A4827C2E4C8}
(no name) - (no file) - {1D7E3B41-23CE-469B-BE1B-A64B877923E1}
ShprRprts - (no file) - {2A8A997F-BB9F-48F6-AA2B-2762D50F9289}
(no name) - C:\Program Files\Fichiers communs\OE\toolbar.dll (file missing) - {702AD576-FDDB-4d0f-9811-A43252064684}
(no name) - (no file) - {87766247-311C-43B4-8499-3D5FEC94A183}
(no name) - C:\PROGRA~1\Toolbar\toolbar.dll - {8952A998-1E7E-4716-B23D-3DBE03910972}
(no name) - (no file) - {9394EDE7-C8B5-483E-8773-474BF36AF6E4}
(no name) - (no file) - {A28DD286-DB3B-5936-5B16-4C5EE349C20E}
(no name) - (no file) - {A3FDD654-A057-4971-9844-4ED8E67DBBB8}
Hotbar - (no file) - {B195B3B3-8A05-11D3-97A4-0004ACA6948E}
(no name) - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr-ca\msntb.dll - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}
(no name) - (no file) - {C1E58A84-95B3-4630-B8C2-D06B77B7A0FC}
(no name) - C:\Program Files\Fichiers communs\OE\redirector.dll (file missing) - {D48F2E28-68E2-4920-9848-D6E6C7AB3EB7}
(no name) - (no file) - {D80C4E21-C346-4E21-8E64-20746AA20AEB}
(no name) - C:\WINDOWS\dealhlpr.dll - {D848A3CA-0BFB-4DE0-BA9E-A57F0CCA1C13}

--------------------------------------------------

Enumerating Task Scheduler jobs:

A36779A49180F708.job
ACAF5C589180CEB8.job
AFA878A19187EA09.job

--------------------------------------------------

Enumerating Download Program Files:

[{00B71CFB-6864-4346-A978-C0A14556272C}]
CODEBASE = http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab

[{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}]
CODEBASE = http://www.apple.com/qtactivex/qtplugin.cab

[{14B87622-7E19-4EA8-93B3-97215F77A6BC}]
CODEBASE = http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab

[{15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6}]
CODEBASE = http://static.windupdates.com/cab/MusicUnlimited/ie/bridge-c8.cab

[{15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6}]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\MediaAccX.dll
CODEBASE = http://static.windupdates.com/cab/MusicAccess/ie/bridge-c8.cab

[{166B1BCA-3F9C-11CF-8075-444553540000}]
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

[CInstall Class]
InProcServer32 = C:\WINDOWS\DOWNLO~1\Install.dll
CODEBASE = http://www.errorguard.com/installation/Install.cab

[{288C5F13-7E52-4ADA-A32E-F5BF9D125F98}]
CODEBASE = http://www.miniclip.com/inflaterball/miniclipGameLoader.dll

[{2917297F-F02B-4B9D-81DF-494B6333150B}]
CODEBASE = http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab

[{45E83043-1F6F-4D22-A5E7-0138EA171B49}]
CODEBASE = http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fr/filesharingctrl.cab

[{4F1E5B1A-2A80-42CA-8532-2D05CB959537}]
CODEBASE = http://spaces.msn.com//PhotoUpload/MsnPUpld.cab

[WUWebControl Class]
InProcServer32 = C:\WINDOWS\System32\wuweb.dll
CODEBASE = http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1096049990728

[{771A1334-6B08-4A6B-AEDC-CF994BA2CEBE}]
CODEBASE = http://www.ysbweb.com/ist/softwares/v4.0/ysb_1002245.cab

[{8E0D4DE5-3180-4024-A327-4DFAD1796A8D}]
CODEBASE = http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab

[{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}]
CODEBASE = http://fpdownload.macromedia.com/get/shockwave/cabs/flash/ultrashim.cab

[{B8BE5E93-A60C-4D26-A2DC-220313175592}]
CODEBASE = http://messenger.zone.msn.com/binary/ZIntro.cab31267.cab

[{BD393C14-72AD-4790-A095-76522973D6B8}]
CODEBASE = http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab

[{D27CDB6E-AE6D-11CF-96B8-444553540000}]
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[{E2F2B9D0-96B9-4B25-B90C-636ECB207D18}]
CODEBASE = http://www.whenusearch.com/WUInstSECS.cab

[MSN Chat Control 4.5]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\MSNChat45.ocx
CODEBASE = http://chat.msn.com/bin/msnchat45.cab

[{F6BF0D00-0B2A-4A75-BF7B-F385591623AF}]
CODEBASE = http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab

--------------------------------------------------

Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*

Windows NT checkdisk command:
BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':
PendingFileRenameOperations: @C:\WINDOWS\system32\@c:\windows\system32\scrrun.dll.tmp

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll

--------------------------------------------------
End of report, 12*764 bytes
Report generated in 0,031 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only


----------



## Byteman (Jan 24, 2002)

Hi, Please stick with this thread. I split you off from the one you posted on so now you have your own.

Please post a Hijackthis log> Use the link below to get it and follow the directions to post the log here as a reply.

Your computer is badly infected and it will be no small job to get it fixed.



dvk01 said:


> Getting Hijackthis and installing it correctly
> 
> go to here and download 'Hijack This!' double click on the file and it will install to C:\program files\hijackthis and create an entry in the start menu and an optional shortcut on desktop.
> Click on the entry in start menu or on the desktop to run HijackThis


----------



## okai (Apr 25, 2005)

I Download 'Hijack This!' and it work  THANKS


----------



## Byteman (Jan 24, 2002)

Hi, Do you mean you used Hijackthis, and removed the bad items you had? Would you like to post a new log from Hijackthis, so we can see if anything still is on there you should remove?


----------

