MY pc wont shut down

[LeeroyJenkins]

i cant shut down my pc if i press alt+F4 it hands with a busy icon is i try shuttingdown with ctrl+alt+del it hangs. the only way i was able to shut down was to end 2 svchost.exe process PID 1056 and PID 1076 shown below one of them is roughly 2-3kb the other one goes up to 23kb i dont know why these 2 specific processes are hanging my pc i tried spyware scan virus scan neither solved the problem tried running the scans in safe mode didnt work. i only have this problem running windows in normal mode in safe mode i dont have this problem

Process PID

AHQTBU.EXE 1232
cmd.exe 1224
csrss.exe 644
Explorer.EXE 620
gcasDtServ.exe 1612
gcasServ.exe 1260
iexplore.exe 1180
iexplore.exe 1568
lsass.exe 724
NOTEPAD.EXE 1000
PrcView.exe 1756
services.exe 712
smss.exe 588
spoolsv.exe 1336
svchost.exe 904
svchost.exe 956
svchost.exe 1056
svchost.exe 1076
svchost.exe 1992
taskmgr.exe 1728
wbload.exe 1244
wdfmgr.exe 188
winlogon.exe 668

 

[bkrike]

I get a couple of different results when I search prcview.exe. Some sites say it is added by a worm, while others say it is a program. Have you intentionally installed a program called PRC VIEW?

 

[s0121]

Safe mode as you know DOES NOT LOAD DRIVERS...also there is known IEEXPLORER.trojan, and more than one program adds SVCHOST. this can be a trojan/vurii also..recommend that you run more than one adware.trojan.spyware removal program. there are several that are FREE and work very well. I run ad-ware (free), spybot search&destroy(free), spy remover, A square(free), Toolbar cop(free), Counter Spy, Spy Sweeper, Spyware Doctor and XoftSpy. each one will find something that the others misses.

a-squared (a²) HiJackFree - Process info for prcview.exe
Process Details: prcview.exe. a² HiJackFree Process Info:. Filename:, prcview.exe.
Default path:, \. Clsid:. Operating systems:, Win 98/ME, Win NT4, ...

http://www.hijackfree.com/en/processdetails/?id=400

- 21k - Jul 1, 2005 - Cached - Similar pages

Tech Support Forum Archive - SVCHOST error:\\HELP FROM ANYONE
*PrcView=C:\Program Files\Norton SystemWorks\Process Viewer\PrcView.exe »RunOnce »Default
User »Run *Msbb.exe=Msbb.exe *Systesms.exe=Systesms.exe »RunOnce ...

http://www.techsupportforum.com/computer/topic/38442-1.html

- 19k - Cached - Similar pages

Frank Smith irc.dhcnetwork.com

SomeWhere in Kansas Near Dodge City

 

[linney]

ALT+F4 = Close the active item, or quit the active program.
ctrl+alt+del = launch Task Manager.

Neither of the above are Shutdown commands in XP.

What happens if you use Shutdown from the Start Menu?

Why does Task Manager, MSCONFIG, or REGEDIT disappear while opening?

http://windowsxp.mvps.org/ToolsQuit.htm

Removing adware & spyware
faq608-4650

Microsoft (GIANT Antispyware) Beta available
Thread779-979113

General Shutdown troubleshooter.

http://aumha.org/win5/a/shtdwnxp.htm

 

[LeeroyJenkins]

bkrike - no i havent installed anything that your talking about

s0121 - yes i know safe mode doesnt load drivers the reason i said i dont have this issue was because safe mode does load the kernel i wanted to isolate the possibility of the problem being something wrong with the actual kernel. I usually run adaware and the microsoft anti-spyware neither found any spyware on my pc i ran deep scans not the regular intelligent scans. I ran mcafee virus scan and it didnt pick up any virus


linney - with no windows alt+f4 bring up a window to sutdown the pc and in taskmanager one of the menus gives an option to shutdown and yes i have tried using the one on the start menu as well the same thing happens

 

[s0121]

Thanks for the reply info. Have been scanning all my XP Notes, found reference to EZCD and Direct CD, conflicting with other programs. when shut is attempted the computer simply reboots...possible to use:
1. Run Regedt32.exe.
2. Locate the 'UpperFilters' value under the following key in the registry,
and delete it:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11
CE-BFC1-08002BE10318}]
3. Locate the 'LowerFilters' value under the same key, and delete it:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11
CE-BFC1-08002BE10318}]

4. Close the registry editor and restart the computer.
5. For more information please refer the KB article:
CD-ROM Access Is Missing and Messages Cite Error Code 31, Code 32, Code 19,
or Code 39 After You Remove Easy CD Creator in Windows XP:

http://support.microsoft.com/default.aspx?scid=kb;en-us;314060&FR=1&PA=1&SD=HSCH.

If this corrects the problem then it is in the CD-DVD burning programs...
(more notes) ZoneAlarm, BlackIce (firewalls) and Dr Divx (installed a EncodeDivXExt.dll) also caused a simular problem.



Frank Smith irc.dhcnetwork.com

SomeWhere in Kansas Near Dodge City

 

[bkrike]

As I stated above: there are multiple listings for prcview.
s0121 listed the "good explanation" that would show up if you installed the program. But there are also listings that designate it as malware, such as:

http://www.bleepingcomputer.com/startups/prcview.exe-8814.html

http://castlecops.com/s8226-prcview_exe.html

So, if you did not install it, I would remove that.

 

[s0121]

ahqtb is Spyware
Remove with XoftSpy Remover (aff)
Free Scan. Clean your Computer Now!

http://www.paretologic.com/xoftspy/

then I'd get HIJACKTHIS (free) and run it..then I'd try if you have not already:
Spybot Search & Destroy (Free)
AdAware v1.06 (Free)
A square (Free)
AVG AV (Free) yes, even tho ur running MS Antispyware. I dropped it and went to "Xoftspy" when MS bought Giant..
Then I'd remove " WindowsBlinds Stardock " yes remove..not just turn off- REMOVE... then try rebooting...let us know.


Frank Smith irc.dhcnetwork.com

SomeWhere in Kansas Near Dodge City

 

[linney]

310353 - How to Perform a Clean Boot in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;310353&FR=1&PA=1&SD=HSCH

316434 - HOW TO: Perform Advanced Clean-Boot Troubleshooting in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;316434&FR=1&PA=1&SD=HSCH

310560 - How to Troubleshoot By Using the Msconfig Utility in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;310560&FR=1&PA=1&SD=HSCH

See if you can isolate what loads in Normal Mode but doesn't load in Safe Mode.

Are there any clues in your Event Viewer?

A second opinion to McAfee via the linked online virus scans is always a worthwhile exercise.

Removing adware & spyware
FAQ608-4650

 

[LeeroyJenkins]

ok i removed procview tried those other spyware scanners still having same problem i dont have an burning software currently installed either

 

[linney]

You may need something a bit stronger than Adware or Spyware scanners, that is why I suggested using one of the Online Virus Scanners linked to the following FAQ.

Removing adware & spyware
FAQ608-4650

At least try the Trend Micro scanner, too often we have seen examples of problems caused by only using one brand of virus scanner to remove malware. A virus scanner is only as good as its loaded definitions.

 

[Jump1ng]

A great site for shutdown problems is the Windows XP Shutdown troubleshooter found over at Aumha
Shutdown help for Windows XP

But as the other guys have said its very possible to be some kind of spyware thats causing your problem.

P.S do you play WOW?

Take care and good luck!

---
Make the best use of what is in your power, and take the rest as it happens.

 

[LeeroyJenkins]

i tried mcafees online scanner it didnt pick up anything ill check out that link and try trend micro scanner

and yes i play wow

 

[Spitaro]

Thumbs up lets do this, LEEEEEEEROOOY JENKINS!

some funny stuff there

 

[linney]

Try running ChkDsk to check your drive for errors. Right click your Drive icon/ Properties/ Tools/ Error Checking.

Run the System File Checker program from the Run Box by typing.....Sfc /Scannow in it and have your XP CD handy.

HOW TO: Verify Unsigned Device Drivers in Windows XP

http://support.microsoft.com/support/kb/articles/q308/5/14.asp

If they don't work you could try repairing windows by running it over itself. You will lose all your windows updates but your files will be untouched.

How to Perform an In-Place Upgrade (Reinstallation) of Windows XP (Q315341)

http://support.microsoft.com/support/kb/articles/q315/3/41.asp

 

[LeeroyJenkins]

linney i already ran both of those didnt come up with any problems

 

[linney]

Well, if Trend Micro doesn't help you, let everyone have a look at your "Hijack This" log as it stands now.

 

[Jump1ng]

Have you looked at the aumha link about shutdown problems? If you have run all of these scanners and they havent found any malicious software it might not be due to spyware. Test the things from the Aumha page.

P.S are you THE LeeroyJenkins?

---
Make the best use of what is in your power, and take the rest as it happens.

 

[garebo]

linney, by me reading what was above i am not sure that
LeeroyJenkins was saying he ran the trend micro online scan. I could be wrong, and if so i apologize, and the only reason i am jumping in here is i have read the list of items in the task mgr and i also believe there is a trojan there, somewhere. I believe in the end a trojan will be found. If not, something similar.

LeeroyJenkins, have you completed the online scan at trend micro? And run some or most of the programs listed above, especially m\soft antispyware and come up with nothing?

If so, then i would try hijack this and post the results.
I am certain you have a trojan or some other malware.
I'm not an expert at this but when you dont know why that AHQ and the extra iexplorer and the Prcview are there, something seems to be wrong with all or some of these.

One last thing, is windows xp giving you any other problems, even small issues that are a bit weird?





Good advice + great people = tek-tips

 

[LeeroyJenkins]

i ran trend micro complete scan came up with nothing also microfts scanner same ran hijackthis here are the results of that scan

Logfile of HijackThis v1.99.1
Scan saved at 10:34:45 AM, on 7/7/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Creative\SBLive\AudioHQ\AHQTBU.EXE
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\EXPLOREr.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Isak Aronov\Local Settings\Temporary Internet Files\Content.IE5\8J6XAT6B\HijackThis1991[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.rr.com/flash/

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O1 - Hosts: 62.75.224.159

http://www.bns1.net

O1 - Hosts: 62.75.224.159

http://www.bns2.net

O1 - Hosts: 62.75.224.159

http://www.bns3.net

O1 - Hosts: 62.75.224.159

http://www.bns4.net

O1 - Hosts: 62.75.224.159

http://www.bns5.net

O1 - Hosts: 62.75.224.159

http://www.bns6.net

O1 - Hosts: 62.75.224.159

http://www.bns7.net

O1 - Hosts: 62.75.224.159

http://www.bns8.net

O1 - Hosts: 62.75.224.159

http://www.cms1.net

O1 - Hosts: 62.75.224.159

http://www.cms2.net

O1 - Hosts: 62.75.224.159

http://www.cms3.net

O1 - Hosts: 62.75.224.159

http://www.cms4.net

O1 - Hosts: 62.75.224.159

http://www.cms5.net

O1 - Hosts: 62.75.224.159

http://www.cms6.net

O1 - Hosts: 62.75.224.159

http://www.cms7.net

O1 - Hosts: 62.75.224.159

http://www.cms8.net

O1 - Hosts: 62.75.224.159

http://www.rg1.com

O1 - Hosts: 62.75.224.159

http://www.rg2.com

O1 - Hosts: 62.75.224.159

http://www.rg3.com

O1 - Hosts: 62.75.224.159

http://www.rg4.com

O1 - Hosts: 62.75.224.159

http://www.rg5.com

O1 - Hosts: 62.75.224.159

http://www.rg6.com

O1 - Hosts: 62.75.224.159

http://www.rg7.com

O1 - Hosts: 62.75.224.159

http://www.rg8.com

O1 - Hosts: 62.75.224.159

http://www.cjt1.net

O1 - Hosts: 62.75.224.159

http://www.rgs1.net

O1 - Hosts: 62.75.224.159

http://www.rgs2.net

O1 - Hosts: 62.75.224.159 bns1.net
O1 - Hosts: 62.75.224.159 bns2.net
O1 - Hosts: 62.75.224.159 bns3.net
O1 - Hosts: 62.75.224.159 bns4.net
O1 - Hosts: 62.75.224.159 bns5.net
O1 - Hosts: 62.75.224.159 bns6.net
O1 - Hosts: 62.75.224.159 bns7.net
O1 - Hosts: 62.75.224.159 bns8.net
O1 - Hosts: 62.75.224.159 cms1.net
O1 - Hosts: 62.75.224.159 cms2.net
O1 - Hosts: 62.75.224.159 cms3.net
O1 - Hosts: 62.75.224.159 cms4.net
O1 - Hosts: 62.75.224.159 cms5.net
O1 - Hosts: 62.75.224.159 cms6.net
O1 - Hosts: 62.75.224.159 cms7.net
O1 - Hosts: 62.75.224.159 cms8.net
O1 - Hosts: 62.75.224.159 rg1.com
O1 - Hosts: 62.75.224.159 rg2.com
O1 - Hosts: 62.75.224.159 rg3.com
O1 - Hosts: 62.75.224.159 rg4.com
O1 - Hosts: 62.75.224.159 rg5.com
O1 - Hosts: 62.75.224.159 rg6.com
O1 - Hosts: 62.75.224.159 rg7.com
O1 - Hosts: 62.75.224.159 rg8.com
O1 - Hosts: 62.75.224.159 cjt1.net
O1 - Hosts: 62.75.224.159 rgs1.net
O1 - Hosts: 62.75.224.159 rgs2.net
O1 - Hosts: 62.75.224.159 j800banners.cjt1.net
O1 - Hosts: 62.75.224.159 jadlogix.cjt1.net
O1 - Hosts: 62.75.224.159 jadtegrity.cjt1.net
O1 - Hosts: 62.75.224.159 jaimmedia.cjt1.net
O1 - Hosts: 62.75.224.159 javatar.cjt1.net
O1 - Hosts: 62.75.224.159 jbeet.cjt1.net
O1 - Hosts: 62.75.224.159 jbigpops.cjt1.net
O1 - Hosts: 62.75.224.159 jbouncetek.cjt1.net
O1 - Hosts: 62.75.224.159 jbravenet.cjt1.net
O1 - Hosts: 62.75.224.159 jcdcover.cjt1.net
O1 - Hosts: 62.75.224.159 jclickspring.cjt1.net
O1 - Hosts: 62.75.224.159 jcollegehumor.cjt1.net
O1 - Hosts: 62.75.224.159 jdownloadacc.cjt1.net
O1 - Hosts: 62.75.224.159 jedonkey.cjt1.net
O1 - Hosts: 62.75.224.159 jeuniverse.cjt1.net
O1 - Hosts: 62.75.224.159 jhot.cjt1.net
O1 - Hosts: 62.75.224.159 jicmedia.cjt1.net
O1 - Hosts: 62.75.224.159 jicq.cjt1.net
O1 - Hosts: 62.75.224.159 jieplugin.cjt1.net
O1 - Hosts: 62.75.224.159 jinternetoptimizer.cjt1.net
O1 - Hosts: 62.75.224.159 jmediabuy1.cjt1.net
O1 - Hosts: 62.75.224.159 jmediabuyad.cjt1.net
O1 - Hosts: 62.75.224.159 jmindset.cjt1.net
O1 - Hosts: 62.75.224.159 jmindsettest.cjt1.net
O1 - Hosts: 62.75.224.159 jnictech.cjt1.net
O1 - Hosts: 62.75.224.159 jnova.cjt1.net
O1 - Hosts: 62.75.224.159 jpiolet.cjt1.net
O1 - Hosts: 62.75.224.159 jsanboxer.cjt1.net
O1 - Hosts: 62.75.224.159 jsercee.cjt1.net
O1 - Hosts: 62.75.224.159 jthedelfin.cjt1.net
O1 - Hosts: 62.75.224.159 jwarezp2p.cjt1.net
O1 - Hosts: 62.75.224.159 jwildmedia.cjt1.net
O1 - Hosts: 62.75.224.159 mediabuy-nic.cjt1.net
O1 - Hosts: 62.75.224.159

http://www.m7z.net

O1 - Hosts: 62.75.224.159 m7z.net
O1 - Hosts: 62.75.224.159 jcms.cydoor.com
O1 - Hosts: 62.75.224.159 cydoor.com
O1 - Hosts: 62.75.224.159

http://www.cydoor.com

O1 - Hosts: 62.75.224.159 jcontent.bns1.m7z.net
O1 - Hosts: 62.75.224.159 j.2004CMS.com
O1 - Hosts: 62.75.224.159 2004CMS.com
O1 - Hosts: 62.75.224.159 bns1.m7z.net
O1 - Hosts: 62.75.224.159 jcontent.bns1.net
O1 - Hosts: 62.75.224.159 jbns2.cydoor.com
O1 - Hosts: 62.75.224.159 ct.cydoor.com
O1 - Hosts: 62.75.224.159 redirect.cydoor.com
O1 - Hosts: 62.75.224.159 client.exeem.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [AudioHQU] C:\Program Files\Creative\SBLive\AudioHQ\AHQTBU.EXE
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\appz\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Microsoft WFC Forms Designer - file://F:\VJ98\wfcforms.cab
O16 - DPF: Visual Studio 6 Extensibility Libraries - file://F:\VJ98\vstudio6.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) -

http://housecall60.trendmicro.com/housecall/xscan60.cab

O16 - DPF: {1C955F3B-5B32-4393-A05D-24B4970CD2A1} -

http://stream10k.redhotnetworks.com/cabs/videox.cab

O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} -

http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v43/yacscom.cab

O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) -

http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) -

http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -

http://a1540.g.akamai.net/7/1540/52...pple.com/borris/us/win/QuickTimeInstaller.exe

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) -

http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} -

http://chat.yahoo.com/cab/yacsui.cab

O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) -

http://download.zonelabs.com/bin/promotions/spywaredetector/WebAAS.cab

O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) -

http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab

O16 - DPF: {FF0C042C-98E9-4C36-B2EC-E21FDFDCEF75} -

http://download.redswoosh.com/Installer/rsinstaller.cab

O20 - Winlogon Notify: WB - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe