Annoying popups!

[alankuik]

as previously mentioned.
try microsoft's anti-spyware.

it's been able to remove some that i can't remove with spybot.

 

[webstop]

as previously mentioned.
try microsoft's anti-spyware.

it's been able to remove some that i can't remove with spybot.

I agree on this. Somemore it's free, and with great user interface. Since using it I have dumped ad-aware and spybot.

 

[Pokka]

I agree on this. Somemore it's free, and with great user interface. Since using it I have dumped ad-aware and spybot.

Thank you all! I've downloaded Microsoft Antispyware and I've to say I'm very impressed!

Certainly the best anti-spyware program so far IMO. Just wanna say thanks to everyone here. :thumbsup:

PS: My PC should be ok now.

 

[akane]

try hijackthis, probably will show u more stuffs.

 

[webstop]

http://windowssecrets.com/050127/

 

[Pokka]

Hi all...
After I re*tarte* my PC, I fin* that the *pyware ha* automatically 'in*talle*' it*elf into my *y*tem.
Can anyone tell me how *o I automatically loa* up Micro*oft Anti*pyware on boot up?
I've trie* fi**ling aroun* with the option* in*i*e but ju*t coul*nt fin* help on thi*.

An*, ju*t to make *ure, after I *canne* u*ing Micro*oft *nti*pyware, I *i* a *can with *pybot *earch an* *e*troy an* to my *i*may, 8 a*ware* have manife*te* them*elve* into my PC again?!
What'* happening here? I thought the Micro*oft Anti*pyware program i* *trong enough? Certainly it impre**e* me the mo*t...

 

[Pokka]

Hi all...
After I re*tarte* my PC, I fin* that the *pyware ha* automatically 'in*talle*' it*elf into my *y*tem.
Can anyone tell me how *o I automatically loa* up Micro*oft Anti*pyware on boot up?
I've trie* fi**ling aroun* with the option* in*i*e but ju*t coul*nt fin* help on thi*.

An*, ju*t to make *ure, after I *canne* u*ing Micro*oft *nti*pyware, I *i* a *can with *pybot *earch an* *e*troy an* to my *i*may, 8 a*ware* have manife*te* them*elve* into my PC again?!
What'* happening here? I thought the Micro*oft Anti*pyware program i* *trong enough? Certainly it impre**e* me the mo*t...

I've no idea what happened to the above post. What with all the ** ? But anyway, I will post again.



After I restarted my PC, I find that the spyware had automatically 'installed' itself into my system.
Can anyone tell me how do I automatically load up Microsoft Antispyware on boot up?
I've tried fiddling around with the options inside but just couldnt find help on this.

And, just to make sure, after I scanned using Microsoft antispyware, I did a scan with spybot search and destroy and to my dismay, 8 adwares have manifested themselves into my PC again?!
What's happening here? I thought the Microsoft Antispyware program is strong enough? Certainly it impresses me the most...[/

 

[webstop]

What spyware is it? How you know it's installed again?

I've no idea what happened to the above post. What with all the ** ? But anyway, I will post again.



After I restarted my PC, I find that the spyware had automatically 'installed' itself into my system.
Can anyone tell me how do I automatically load up Microsoft Antispyware on boot up?
I've tried fiddling around with the options inside but just couldnt find help on this.

And, just to make sure, after I scanned using Microsoft antispyware, I did a scan with spybot search and destroy and to my dismay, 8 adwares have manifested themselves into my PC again?!
What's happening here? I thought the Microsoft Antispyware program is strong enough? Certainly it impresses me the most...[/

 

[Pokka]

Hi

Detected Spyware on your system:
SearchMiracle.AdDownloader Trojan Downloader (3 signatures).
SearchMiracle.EliteBar(browser plug in)

Its always been this. I've scanned and removed it countless times but it always installs itself back when I boot up my comp.
How do I know? Because when I power on my comp, I open up the MS Antispyware program immediately, and I got an alert, saying this spyware is trying to change settings on my IE etc etc.
How do I permanently get rid of this?

I've also instructed MS Antispyware to load itself on bootup, but it seems its not loading itself after bootup. Could it be this is a trial beta version, hence it didnt load up?

PS:While typing this reply, I got a grand total of 5 popups. They''re from:
http://ads1.revenue.net
http://ads1.searchmiracle.com
http://ads1.searchmiracle.com
http://ads1.searchmiracle.com
http://ads1.searchmiracle.com

Help! :sweat:

 

[Pokka]

Just for your info, I'm typing this reply immediately after my previous post.

I've just scanned and removed the threats stated in my previous post using MS Antispyware.
ALmost immediately, I got an alert saying the spyware(the one just removed) is trying to install itself back to my windows registry. Of course I clicked "Remove" when prompted.
After I've 'removed' it, MS Antispyware prompted me to do a system scan which I clicked OK.
And the threat is back!
Exact same thing even though I clicked "Remove" when prompted. :dunno:
:sweat:

This is a tough one to fight. All the IT specialists, how do I combat this ?

 

[webstop]

copy from other forum, not sure how it works, think u need to boot into safe mode...

http://research.sunbelt-software.com/threat_display.cfm?name=SearchMiracle.AdDownloader
http://www.bullguard.com/forum/9/Elitebar-removal-assistance---_6047.html

 

[akane]

Seems like you have Elitebar...it's quite a difficult spyware to clean.

find this file winbvk32.exe and delete it
delete the entire directory C:\windows\elitebar (provided your windows is in c:\windows) and c:\windows\elitetoolbar

search in the registry for kalvsys and searchassistant
and delete those keys.

not too sure if adaware/m$ antispyware/spybot combined together will clean elitebar or not.

after deleting those stuffs.
try to run those 3 freewares in safemode and clean.

not many spyware programs can kill elitebar.
FYI, there's no THE ONE spyware program in the market. it's a different field to antivirus. so you will need a combination of anti-spyware program to keep your system clean. one of the most important thing, use firefox and don't anyhow click yes/ok to install crap.

 

[Pokka]

Hi

thanks for all your help. I've successfully rid the irritating spyware!
But I still have 1 problem - I still cant access www.symantec.com
I receive this error page

Please try the following:

Open the home page, and then look for links to the information you want.

If you typed the page address in the Address bar, make sure that it is spelled correctly.

If you still cannot open the page, click the Internet Explorer
Search button to look for similar sites.




Internet Explorer

And the URL of that page changes to http:///? www.symantec.com .

ANyone has any advice?

 

[Drudkh]

Hi

thanks for all your help. I've successfully rid the irritating spyware!
But I still have 1 problem - I still cant access www.symantec.com
I receive this error page

Please try the following:

Open the home page, and then look for links to the information you want.

If you typed the page address in the Address bar, make sure that it is spelled correctly.

If you still cannot open the page, click the Internet Explorer
Search button to look for similar sites.




Internet Explorer

And the URL of that page changes to http:///? www.symantec.com .

ANyone has any advice?

I would like you to do a little test. Close all Internet Explorer browsers. Open up a Windows Explorer and type the Symantec URL and see if you can load the page.

 

[akane]

any problems getting to mcafee website? try other antivirus websites like sophos.com if u are prevented from going then something else is hidding in your system..might be virus might be spyware.

try doing a hijackthis and then u can either put up the log here or pm me.
will like to take a look.

 

[Pokka]

any problems getting to mcafee website? try other antivirus websites like sophos.com if u are prevented from going then something else is hidding in your system..might be virus might be spyware.

try doing a hijackthis and then u can either put up the log here or pm me.
will like to take a look.

Same thing for sophos.com
I get the same thing.
URL changed to http:///? www.sophos.com
Title of the page is: Invalid syntax error
Ok, will try hijackthis and report back with the log.

 

[Pokka]

I would like you to do a little test. Close all Internet Explorer browsers. Open up a Windows Explorer and type the Symantec URL and see if you can load the page.

How do I type the URL in Windows Explorer? Pls advice me..

 

[Pokka]

Hi, pasted below is the log.



Logfile of Browser Hijack Recover(BHR) v2.0
http://www.browser-hijack.com/
Log created on 19/03/2005 11:07:33
Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)
Internet Explorer v6.0.2900.2180 Update Versions: ;SP2;

[Process Manager] - [Process]
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\CTSvcCDA.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\system32\cthelper.exe
C:\WINDOWS\system32\PCsync.exe
C:\WINDOWS\system32\hotkeysvc.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmjb.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\MMDiag.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Browser Hijack Recover\bhr.exe

[IE Options] - [Normal]
R0 - HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com.sg/
R0 - HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.yahoo.com.sg
R0 - HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main,Window Title =
R1 - HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main,Search Page = www.yahoo.com.sg

[IE Options] - [IE Menu]

[IE Options] - [Internet Options]

[IE Options] - [IE Search Hooks]

[IE Add-Ons] - [Toolbars]

[IE Add-Ons] - [Explorer Bars]
O9 - Extra "View" Explorer Bars: Search Band - {30D02401-6A81-11D0-8274-00C04FD5AE38} - C:\WINDOWS\System32\browseui.dll
O9 - Extra "View" Explorer Bars: hp toolkit - {8F4902B6-6C04-4ADE-8052-AA58578A21BD} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra "View" Explorer Bars: Favorites Band - {EFA24E61-B078-11D0-89E4-00C04FC9E26E} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra "View" Explorer Bars: Explorer Band - {EFA24E64-B078-11D0-89E4-00C04FC9E26E} - C:\WINDOWS\System32\shdocvw.dll

[IE Add-Ons] - [Context Menu]
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000

[IE Add-Ons] - [BHOs]
O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll

[IE Add-Ons] - [Tools Menu]
O9 - Extra "Tool" Menu Item: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra "Tool" Menu Item: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra "Tool" Menu Item: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

[IE Add-Ons] - [Tools Button]
O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra Button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

[System Options]

[StartUp]
04 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices CPQHotKeys = hotkeysvc.exe
04 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices CTHelper = cthelper.exe
04 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices PcSync = PCsync.exe
04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices CPQHotKeys = hotkeysvc.exe
04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices CTHelper = cthelper.exe
04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices PcSync = PCsync.exe
04 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run CTHelper = cthelper.exe
04 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run PcSync = PCsync.exe
04 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run CPQHotKeys = hotkeysvc.exe
04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run IgfxTray = C:\WINDOWS\System32\igfxtray.exe
04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run HotKeysCmds = C:\WINDOWS\System32\hkcmd.exe
04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run CamMonitor = c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run StorageGuard = C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run CPQHotKeys = hotkeysvc.exe
04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run CTHelper = cthelper.exe
04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run PcSync = PCsync.exe
04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run DAEMON Tools-1033 = C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - C:\Documents and Settings\Owner\Start Menu\Programs\Startup\SpywareGuard.lnk = C:\PROGRA~1\SPYWAR~2\sgmain.exe
O4 - C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE
O4 - C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Exif Launcher.lnk = C:\PROGRA~1\FINEPI~1\QuickDCF.exe
O4 - C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
O4 - C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\PROGRA~1\MICROS~4\Office10\OSA.EXE

 

[akane]

You are not using Hijackthis? Hmm..because this log doesn't tell anything about BHO. From the looks of it, your PC seems clean but since there's no information on BHO hard to tell. Do a hijackthis and send the log again.

Did you run norton and see if it detects any virus activities?

 

[Drudkh]

Hi, pasted below is the log.



Logfile of Browser Hijack Recover(BHR) v2.0
http://www.browser-hijack.com/
Log created on 19/03/2005 11:07:33
Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)
Internet Explorer v6.0.2900.2180 Update Versions: ;SP2;

[Process Manager] - [Process]
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\CTSvcCDA.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\system32\cthelper.exe
C:\WINDOWS\system32\PCsync.exe
C:\WINDOWS\system32\hotkeysvc.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmjb.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\MMDiag.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Browser Hijack Recover\bhr.exe

[IE Options] - [Normal]
R0 - HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com.sg/
R0 - HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.yahoo.com.sg
R0 - HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main,Window Title =
R1 - HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main,Search Page = www.yahoo.com.sg

[IE Options] - [IE Menu]

[IE Options] - [Internet Options]

[IE Options] - [IE Search Hooks]

[IE Add-Ons] - [Toolbars]

[IE Add-Ons] - [Explorer Bars]
O9 - Extra "View" Explorer Bars: Search Band - {30D02401-6A81-11D0-8274-00C04FD5AE38} - C:\WINDOWS\System32\browseui.dll
O9 - Extra "View" Explorer Bars: hp toolkit - {8F4902B6-6C04-4ADE-8052-AA58578A21BD} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra "View" Explorer Bars: Favorites Band - {EFA24E61-B078-11D0-89E4-00C04FC9E26E} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra "View" Explorer Bars: Explorer Band - {EFA24E64-B078-11D0-89E4-00C04FC9E26E} - C:\WINDOWS\System32\shdocvw.dll

[IE Add-Ons] - [Context Menu]
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000

[IE Add-Ons] - [BHOs]
O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll

[IE Add-Ons] - [Tools Menu]
O9 - Extra "Tool" Menu Item: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra "Tool" Menu Item: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra "Tool" Menu Item: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

[IE Add-Ons] - [Tools Button]
O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra Button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

[System Options]

[StartUp]
04 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices CPQHotKeys = hotkeysvc.exe
04 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices CTHelper = cthelper.exe
04 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices PcSync = PCsync.exe
04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices CPQHotKeys = hotkeysvc.exe
04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices CTHelper = cthelper.exe
04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices PcSync = PCsync.exe
04 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run CTHelper = cthelper.exe
04 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run PcSync = PCsync.exe
04 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run CPQHotKeys = hotkeysvc.exe
04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run IgfxTray = C:\WINDOWS\System32\igfxtray.exe
04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run HotKeysCmds = C:\WINDOWS\System32\hkcmd.exe
04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run CamMonitor = c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run StorageGuard = C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run CPQHotKeys = hotkeysvc.exe
04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run CTHelper = cthelper.exe
04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run PcSync = PCsync.exe
04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run DAEMON Tools-1033 = C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - C:\Documents and Settings\Owner\Start Menu\Programs\Startup\SpywareGuard.lnk = C:\PROGRA~1\SPYWAR~2\sgmain.exe
O4 - C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE
O4 - C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Exif Launcher.lnk = C:\PROGRA~1\FINEPI~1\QuickDCF.exe
O4 - C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
O4 - C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\PROGRA~1\MICROS~4\Office10\OSA.EXE

Did you tried to use the restore function of this program and see if you still get the same problem?