I've been using Roboform for two years now without problem up to a few weeks ago -- internet freezes often, when Roboform is active, but I'm not sure that is the cause of the problem.
I installed IE 8 several days ago and reinstalled Roboform 6.9.95 (latest version, which is supposed to be compatible with IE 8).
Can't figure out what's wrong -- any ideas ?
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:06:55, on 2009-07-10
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\
mscorsvw.exe
C:\Program Files\NVIDIA
Corporation\NetworkAccessManager\Apache
Group\Apache2\bin\apache.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program
Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program
Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\NVIDIA
Corporation\NetworkAccessManager\Apache
Group\Apache2\bin\apache.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\
E_FATIAEA.EXE
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.e
xe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcpro
xy.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.ex
e
C:\Program
Files\EasySearch\SiteVacuumClient.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Search
Settings\SearchSettings.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\NVIDIA
Corporation\NetworkAccessManager\bin\nSvcLog.
exe
C:\Program
Files\Google\GoogleToolbarNotifier\GoogleToolbar
Notifier.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared
Files\RichVideo.exe
C:\Program Files\Siber Systems\AI
RoboForm\RoboTaskBarIcon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\NVIDIA
Corporation\NetworkAccessManager\bin\nSvcIp.ex
e
C:\WINDOWS\ShoveIt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Documents and Settings\Marco\Local
Settings\Temporary Internet
Files\Content.IE5\0YJR3OLA\winlogon[1].exe
C:\WINDOWS\system32\notepad.exe
R0 - HKCU\Software\Microsoft\Internet
Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet
Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet
Explorer\Search,SearchAssistant =
http://www.ask.com/web?q={searchTerms}&o=144
82&l=dis
R1 - HKCU\Software\Microsoft\Internet
Explorer\SearchURL,(Default) =
http://search.yahoo.com/search?fr=mcafee&p=%s
R3 - URLSearchHook: (no name) -
{00A6FAF6-072E-44cf-8957-5838F569A31D} -
C:\Program
Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
R3 - URLSearchHook: Yahoo! Barre d'outils -
{EF99BD32-C1FB-11D2-892F-0090271D4F88} -
C:\Program
Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: SearchSettings Class -
{E312764E-7706-43F1-8DAB-FCDD2B1E416D} -
C:\Program Files\Search
Settings\kb128\SearchSettings.dll
O2 - BHO: MyWebSearch Search Assistant BHO -
{00A6FAF1-072E-44cf-8957-5838F569A31D} -
C:\Program
Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
O2 - BHO: Dealio Toolbar -
{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} -
C:\Program Files\Dealio Toolbar\DealioToolbarIE.dll
O2 - BHO: &Yahoo! Toolbar Helper -
{02478D38-C3F9-4efb-9B51-7695ECA05670} -
C:\Program
Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: mwsBar BHO -
{07B18EA1-A523-4961-B6BB-170DE4475CCA} -
C:\Program
Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O2 - BHO: AcroIEHelperStub -
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} -
C:\Program Files\Common
Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RoboForm -
{724d43a9-0d85-11d4-9908-00400523e39a} -
C:\Program Files\Siber Systems\AI
RoboForm\roboform.dll
O2 - BHO: scriptproxy -
{7DB2D5A0-7241-4E79-B68D-6309F01C5231} -
c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll
O2 - BHO: Google Toolbar Helper -
{AA58ED58-01DD-4d91-8333-CF10577473F7} -
c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO -
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -
C:\Program
Files\Google\GoogleToolbarNotifier\3.1.807.1746\sw
g.dll
O2 - BHO: McAfee SiteAdvisor BHO -
{B164E929-A1B6-4A06-B104-2CD0E90A88FF} -
c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper -
{DBC80044-A445-435b-BC74-9C25C1C588A9} -
C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SearchSettings Class -
{E312764E-7706-43F1-8DAB-FCDD2B1E416D} -
C:\Program Files\Search
Settings\kb128\SearchSettings.dll
O2 - BHO: JQSIEStartDetectorImpl -
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} -
C:\Program
Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class -
{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} -
C:\Program
Files\Yahoo!\Companion\Installs\cpn\YTSingleInsta
nce.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar -
{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} -
c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: &Google -
{2318C2B1-4965-11d4-9B18-009027A5CD4F} -
c:\program files\google\googletoolbar1.dll
O3 - Toolbar: My Web Search -
{07B18EA9-A523-4961-B6BB-170DE4475CCA} -
C:\Program
Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O3 - Toolbar: &RoboForm -
{724d43a0-0d85-11d4-9908-00400523e39a} -
C:\Program Files\Siber Systems\AI
RoboForm\roboform.dll
O3 - Toolbar: Yahoo! Barre d'outils -
{EF99BD32-C1FB-11D2-892F-0090271D4F88} -
C:\Program
Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Dealio Toolbar -
{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} -
C:\Program Files\Dealio Toolbar\DealioToolbarIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program
Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program
Files\CyberLink\PowerDVD\Language\Language.ex
e"
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program
Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program
Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program
Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [REGSHAVE] C:\Program
Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE
C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [EPSON Stylus CX4200 Series]
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\
E_FATIAEA.EXE /P26 "EPSON Stylus CX4200
Series" /O6 "USB002" /M "Stylus CX4200"
O4 - HKLM\..\Run: [SunJavaUpdateSched]
"C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32
C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DL
L,UPF
O4 - HKLM\..\Run: [My Web Search Bar Search
Scope Monitor]
"C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.ex
e" /m=2 /w
O4 - HKLM\..\Run: [MyWebSearch Email Plugin]
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.ex
e
O4 - HKLM\..\Run: [SiteVacuum] C:\Program
Files\EasySearch\SiteVacuumClient.exe
O4 - HKLM\..\Run: [SearchSettings] C:\Program
Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader
9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite]
"C:\Program Files\DAEMON Tools
Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009]
C:\Program
Files\Uniblue\RegistryBooster\RegistryBooster.exe
/S
O4 - HKCU\..\Run: [swg] C:\Program
Files\Google\GoogleToolbarNotifier\GoogleToolbar
Notifier.exe
O4 - HKCU\..\Run: [MyWebSearch Email Plugin]
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.ex
e
O4 - HKCU\..\Run: [Google Update] "C:\Documents
and Settings\Marco\Local Settings\Application
Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [RoboForm] "C:\Program
Files\Siber Systems\AI
RoboForm\RoboTaskBarIcon.exe"
O4 - Startup: ShoveIt.lnk =
C:\WINDOWS\ShoveIt.exe
O4 - Global Startup: Exif Launcher.lnk = C:\Program
Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: Microsoft Office.lnk =
C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Search -
http://edits.mywebsearch.com/toolbaredits/menuse
arch.jhtml?p=ZJxdm158YYCA
O8 - Extra context menu item: Customize Menu -
file://C:\Program Files\Siber Systems\AI
RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Fill Forms -
file://C:\Program Files\Siber Systems\AI
RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar -
file://C:\Program Files\Siber Systems\AI
RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms -
file://C:\Program Files\Siber Systems\AI
RoboForm\RoboFormComSavePass.html
O9 - Extra button: Fill Forms -
{320AF880-6646-11D3-ABEE-C5DBF3571F46} -
file://C:\Program Files\Siber Systems\AI
RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms -
{320AF880-6646-11D3-ABEE-C5DBF3571F46} -
file://C:\Program Files\Siber Systems\AI
RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save -
{320AF880-6646-11D3-ABEE-C5DBF3571F49} -
file://C:\Program Files\Siber Systems\AI
RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms -
{320AF880-6646-11D3-ABEE-C5DBF3571F49} -
file://C:\Program Files\Siber Systems\AI
RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm -
{724d43aa-0d85-11d4-9908-00400523e39a} -
file://C:\Program Files\Siber Systems\AI
RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar -
{724d43aa-0d85-11d4-9908-00400523e39a} -
file://C:\Program Files\Siber Systems\AI
RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) -
{e2e2dd38-d088-4134-82b7-f2ba38496583} -
C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -
{e2e2dd38-d088-4134-82b7-f2ba38496583} -
C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Playboy Casino USD -
{D62F3523-3F8C-4F1B-B888-FAEE3F4B8CF2} -
http://www.playboycasino.com (file missing)
(HKCU)
O9 - Extra 'Tools' menuitem: Playboy Casino USD -
{D62F3523-3F8C-4F1B-B888-FAEE3F4B8CF2} -
http://www.playboycasino.com (file missing)
(HKCU)
O16 - DPF:
{1E54D648-B804-468d-BC78-4AFFED8E262E}
(System Requirements Lab) -
http://www.srtest.com/srl_bin/sysreqlab_srl.cab
O16 - DPF:
{6E32070A-766D-4EE6-879C-DC1FA91D2FC3}
(MUWebControl Class) -
http://www.update.microsoft.com/microsoftupdate/
v6/V5Controls/en/x86/client/muweb_site.cab?12259
88817937
O16 - DPF:
{D27CDB6E-AE6D-11CF-96B8-444553540000}
(Shockwave Flash Object) -
http://fpdownload2.macromedia.com/get/shockwav
e/cabs/flash/swflash.cab
O18 - Protocol: sacore -
{5513F07E-936B-4E52-9B00-067394E91CC5} -
c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: Forceware Web Interface
(ForcewareWebInterface) - Apache Software
Foundation - C:\Program Files\NVIDIA
Corporation\NetworkAccessManager\Apache
Group\Apache2\bin\apache.exe
O23 - Service: Java Quick Starter
(JavaQuickStarterService) - Sun Microsystems, Inc.
- C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee SiteAdvisor Service -
Unknown owner - C:\Program
Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) -
McAfee, Inc. -
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) -
McAfee, Inc. -
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.e
xe
O23 - Service: McAfee Scanner (McODS) - McAfee,
Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) -
McAfee, Inc. -
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcpro
xy.exe
O23 - Service: McAfee Real-time Scanner (McShield)
- McAfee, Inc. -
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) -
McAfee, Inc. -
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service
(MpfService) - McAfee, Inc. - C:\Program
Files\McAfee\MPF\MPFSrv.exe
O23 - Service: My Web Search Service
(MyWebSearchService) - MyWebSearch.com -
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe
O23 - Service: NBService - Nero AG - C:\Program
Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG -
C:\Program Files\Common
Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ForceWare IP service (nSvcIp) -
NVIDIA Corporation - C:\Program Files\NVIDIA
Corporation\NetworkAccessManager\bin\nSvcIp.ex
e
O23 - Service: ForceWare user log service
(nSvcLog) - NVIDIA Corporation - C:\Program
Files\NVIDIA
Corporation\NetworkAccessManager\bin\nSvcLog.
exe
O23 - Service: NVIDIA Display Driver Service
(NVSvc) - NVIDIA Corporation -
C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS)
(RichVideo) - Unknown owner - C:\Program
Files\CyberLink\Shared Files\RichVideo.exe
--
End of file - 13768 bytes
I installed IE 8 several days ago and reinstalled Roboform 6.9.95 (latest version, which is supposed to be compatible with IE 8).
Can't figure out what's wrong -- any ideas ?
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:06:55, on 2009-07-10
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\
mscorsvw.exe
C:\Program Files\NVIDIA
Corporation\NetworkAccessManager\Apache
Group\Apache2\bin\apache.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program
Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program
Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\NVIDIA
Corporation\NetworkAccessManager\Apache
Group\Apache2\bin\apache.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\
E_FATIAEA.EXE
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.e
xe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcpro
xy.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.ex
e
C:\Program
Files\EasySearch\SiteVacuumClient.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Search
Settings\SearchSettings.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\NVIDIA
Corporation\NetworkAccessManager\bin\nSvcLog.
exe
C:\Program
Files\Google\GoogleToolbarNotifier\GoogleToolbar
Notifier.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared
Files\RichVideo.exe
C:\Program Files\Siber Systems\AI
RoboForm\RoboTaskBarIcon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\NVIDIA
Corporation\NetworkAccessManager\bin\nSvcIp.ex
e
C:\WINDOWS\ShoveIt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Documents and Settings\Marco\Local
Settings\Temporary Internet
Files\Content.IE5\0YJR3OLA\winlogon[1].exe
C:\WINDOWS\system32\notepad.exe
R0 - HKCU\Software\Microsoft\Internet
Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet
Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet
Explorer\Search,SearchAssistant =
http://www.ask.com/web?q={searchTerms}&o=144
82&l=dis
R1 - HKCU\Software\Microsoft\Internet
Explorer\SearchURL,(Default) =
http://search.yahoo.com/search?fr=mcafee&p=%s
R3 - URLSearchHook: (no name) -
{00A6FAF6-072E-44cf-8957-5838F569A31D} -
C:\Program
Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
R3 - URLSearchHook: Yahoo! Barre d'outils -
{EF99BD32-C1FB-11D2-892F-0090271D4F88} -
C:\Program
Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: SearchSettings Class -
{E312764E-7706-43F1-8DAB-FCDD2B1E416D} -
C:\Program Files\Search
Settings\kb128\SearchSettings.dll
O2 - BHO: MyWebSearch Search Assistant BHO -
{00A6FAF1-072E-44cf-8957-5838F569A31D} -
C:\Program
Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
O2 - BHO: Dealio Toolbar -
{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} -
C:\Program Files\Dealio Toolbar\DealioToolbarIE.dll
O2 - BHO: &Yahoo! Toolbar Helper -
{02478D38-C3F9-4efb-9B51-7695ECA05670} -
C:\Program
Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: mwsBar BHO -
{07B18EA1-A523-4961-B6BB-170DE4475CCA} -
C:\Program
Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O2 - BHO: AcroIEHelperStub -
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} -
C:\Program Files\Common
Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RoboForm -
{724d43a9-0d85-11d4-9908-00400523e39a} -
C:\Program Files\Siber Systems\AI
RoboForm\roboform.dll
O2 - BHO: scriptproxy -
{7DB2D5A0-7241-4E79-B68D-6309F01C5231} -
c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll
O2 - BHO: Google Toolbar Helper -
{AA58ED58-01DD-4d91-8333-CF10577473F7} -
c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO -
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -
C:\Program
Files\Google\GoogleToolbarNotifier\3.1.807.1746\sw
g.dll
O2 - BHO: McAfee SiteAdvisor BHO -
{B164E929-A1B6-4A06-B104-2CD0E90A88FF} -
c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper -
{DBC80044-A445-435b-BC74-9C25C1C588A9} -
C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SearchSettings Class -
{E312764E-7706-43F1-8DAB-FCDD2B1E416D} -
C:\Program Files\Search
Settings\kb128\SearchSettings.dll
O2 - BHO: JQSIEStartDetectorImpl -
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} -
C:\Program
Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class -
{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} -
C:\Program
Files\Yahoo!\Companion\Installs\cpn\YTSingleInsta
nce.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar -
{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} -
c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: &Google -
{2318C2B1-4965-11d4-9B18-009027A5CD4F} -
c:\program files\google\googletoolbar1.dll
O3 - Toolbar: My Web Search -
{07B18EA9-A523-4961-B6BB-170DE4475CCA} -
C:\Program
Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O3 - Toolbar: &RoboForm -
{724d43a0-0d85-11d4-9908-00400523e39a} -
C:\Program Files\Siber Systems\AI
RoboForm\roboform.dll
O3 - Toolbar: Yahoo! Barre d'outils -
{EF99BD32-C1FB-11D2-892F-0090271D4F88} -
C:\Program
Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Dealio Toolbar -
{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} -
C:\Program Files\Dealio Toolbar\DealioToolbarIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program
Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program
Files\CyberLink\PowerDVD\Language\Language.ex
e"
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program
Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program
Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program
Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [REGSHAVE] C:\Program
Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE
C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [EPSON Stylus CX4200 Series]
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\
E_FATIAEA.EXE /P26 "EPSON Stylus CX4200
Series" /O6 "USB002" /M "Stylus CX4200"
O4 - HKLM\..\Run: [SunJavaUpdateSched]
"C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32
C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DL
L,UPF
O4 - HKLM\..\Run: [My Web Search Bar Search
Scope Monitor]
"C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.ex
e" /m=2 /w
O4 - HKLM\..\Run: [MyWebSearch Email Plugin]
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.ex
e
O4 - HKLM\..\Run: [SiteVacuum] C:\Program
Files\EasySearch\SiteVacuumClient.exe
O4 - HKLM\..\Run: [SearchSettings] C:\Program
Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader
9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite]
"C:\Program Files\DAEMON Tools
Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009]
C:\Program
Files\Uniblue\RegistryBooster\RegistryBooster.exe
/S
O4 - HKCU\..\Run: [swg] C:\Program
Files\Google\GoogleToolbarNotifier\GoogleToolbar
Notifier.exe
O4 - HKCU\..\Run: [MyWebSearch Email Plugin]
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.ex
e
O4 - HKCU\..\Run: [Google Update] "C:\Documents
and Settings\Marco\Local Settings\Application
Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [RoboForm] "C:\Program
Files\Siber Systems\AI
RoboForm\RoboTaskBarIcon.exe"
O4 - Startup: ShoveIt.lnk =
C:\WINDOWS\ShoveIt.exe
O4 - Global Startup: Exif Launcher.lnk = C:\Program
Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: Microsoft Office.lnk =
C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Search -
http://edits.mywebsearch.com/toolbaredits/menuse
arch.jhtml?p=ZJxdm158YYCA
O8 - Extra context menu item: Customize Menu -
file://C:\Program Files\Siber Systems\AI
RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Fill Forms -
file://C:\Program Files\Siber Systems\AI
RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar -
file://C:\Program Files\Siber Systems\AI
RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms -
file://C:\Program Files\Siber Systems\AI
RoboForm\RoboFormComSavePass.html
O9 - Extra button: Fill Forms -
{320AF880-6646-11D3-ABEE-C5DBF3571F46} -
file://C:\Program Files\Siber Systems\AI
RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms -
{320AF880-6646-11D3-ABEE-C5DBF3571F46} -
file://C:\Program Files\Siber Systems\AI
RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save -
{320AF880-6646-11D3-ABEE-C5DBF3571F49} -
file://C:\Program Files\Siber Systems\AI
RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms -
{320AF880-6646-11D3-ABEE-C5DBF3571F49} -
file://C:\Program Files\Siber Systems\AI
RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm -
{724d43aa-0d85-11d4-9908-00400523e39a} -
file://C:\Program Files\Siber Systems\AI
RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar -
{724d43aa-0d85-11d4-9908-00400523e39a} -
file://C:\Program Files\Siber Systems\AI
RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) -
{e2e2dd38-d088-4134-82b7-f2ba38496583} -
C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -
{e2e2dd38-d088-4134-82b7-f2ba38496583} -
C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Playboy Casino USD -
{D62F3523-3F8C-4F1B-B888-FAEE3F4B8CF2} -
http://www.playboycasino.com (file missing)
(HKCU)
O9 - Extra 'Tools' menuitem: Playboy Casino USD -
{D62F3523-3F8C-4F1B-B888-FAEE3F4B8CF2} -
http://www.playboycasino.com (file missing)
(HKCU)
O16 - DPF:
{1E54D648-B804-468d-BC78-4AFFED8E262E}
(System Requirements Lab) -
http://www.srtest.com/srl_bin/sysreqlab_srl.cab
O16 - DPF:
{6E32070A-766D-4EE6-879C-DC1FA91D2FC3}
(MUWebControl Class) -
http://www.update.microsoft.com/microsoftupdate/
v6/V5Controls/en/x86/client/muweb_site.cab?12259
88817937
O16 - DPF:
{D27CDB6E-AE6D-11CF-96B8-444553540000}
(Shockwave Flash Object) -
http://fpdownload2.macromedia.com/get/shockwav
e/cabs/flash/swflash.cab
O18 - Protocol: sacore -
{5513F07E-936B-4E52-9B00-067394E91CC5} -
c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: Forceware Web Interface
(ForcewareWebInterface) - Apache Software
Foundation - C:\Program Files\NVIDIA
Corporation\NetworkAccessManager\Apache
Group\Apache2\bin\apache.exe
O23 - Service: Java Quick Starter
(JavaQuickStarterService) - Sun Microsystems, Inc.
- C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee SiteAdvisor Service -
Unknown owner - C:\Program
Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) -
McAfee, Inc. -
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) -
McAfee, Inc. -
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.e
xe
O23 - Service: McAfee Scanner (McODS) - McAfee,
Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) -
McAfee, Inc. -
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcpro
xy.exe
O23 - Service: McAfee Real-time Scanner (McShield)
- McAfee, Inc. -
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) -
McAfee, Inc. -
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service
(MpfService) - McAfee, Inc. - C:\Program
Files\McAfee\MPF\MPFSrv.exe
O23 - Service: My Web Search Service
(MyWebSearchService) - MyWebSearch.com -
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe
O23 - Service: NBService - Nero AG - C:\Program
Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG -
C:\Program Files\Common
Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ForceWare IP service (nSvcIp) -
NVIDIA Corporation - C:\Program Files\NVIDIA
Corporation\NetworkAccessManager\bin\nSvcIp.ex
e
O23 - Service: ForceWare user log service
(nSvcLog) - NVIDIA Corporation - C:\Program
Files\NVIDIA
Corporation\NetworkAccessManager\bin\nSvcLog.
exe
O23 - Service: NVIDIA Display Driver Service
(NVSvc) - NVIDIA Corporation -
C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS)
(RichVideo) - Unknown owner - C:\Program
Files\CyberLink\Shared Files\RichVideo.exe
--
End of file - 13768 bytes