BEARDIAG ISSUES - brief summary: (Extracted on 2006/07/24 17:04:45) 

Physical Memory size of 255.5Mb may be an issue.
BearShare installation unable to be verified. Information extracted so far by BearDiag will be reported


More technical diagnostic troubleshooting information follows:

BEARDIAG: Bearcare for BearShare.
Details collected on 2006/07/24 17:03:40, BEARDIAG Version 01.99.5.0 beta, expires 2006/11/30 (129 days), running from C:\Documents and Settings\waggi\Local Settings\Temporary Internet Files\Content.IE5\2GDZ5KWN\BearDiag[1].exe

System Hardware Information
CPU Type is: Intel(R) Pentium(R) 4 CPU 2.80GHz, CPU speed is approx: 2800Mhz, System BIOS date is: 2004/05/13
OS Version is: WIN_XP, Service pack: Service Pack 2, OS Build: 2600, Computer Name: GREENHALGH
Browser name: C:\Program Files\Internet Explorer\IEXPLORE.EXE, version: 7.0.5346.5, Admin user? YES

System Memory Parameters: 	Memory in use: 	89%
Total Physical RAM: 	255.5Mb	Available Physical RAM: 	26.3Mb
Total Pagefile:   		617.0Mb	Available Pagefile: 		194.0Mb

Internet IP Address 84.66.xxx.xxx 
Sorry! It appears that BearShare is not correctly installed on your system.

This may be due to other peer-to-peer file sharing software overwriting important information.

This may also be due to rogue anti-spyware incorrectly giving a false positive detection on BearShare. (The beta tester version of Microsoft anti-spyware is one example)

You should re-install the latest version of BearShare to fix this.

This program will now exit
Diagnostic code: INSTALL 
[/SIZE]

StartupList report, 24/07/2006, 17:04:15
StartupList version: 1.52
Started from : C:\Documents and Settings\waggi\Local Settings\Temporary Internet Files\Content.IE5\2GDZ5KWN\StartupList.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v7.00 (7.00.5346.0005)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\KService\KService.exe
C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\mHotkey.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Akidthaine\fss.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\DropBox\DropBox\DropBox.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpeedTouch\Dr SpeedTouch\drst.exe
C:\WINDOWS\NCLAUNCH.EXe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\WINDOWS\kdx\KHost.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Documents and Settings\waggi\Local Settings\Temporary Internet Files\Content.IE5\RICTIQ34\HijackThis.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\waggi\Local Settings\Temporary Internet Files\Content.IE5\2GDZ5KWN\BearDiag[1].exe
C:\Documents and Settings\waggi\Local Settings\Temporary Internet Files\Content.IE5\2GDZ5KWN\StartupList.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\waggi\Start Menu\Programs\Startup]
Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

CHotkey = mHotkey.exe
NeroFilterCheck = C:\WINDOWS\system32\NeroCheck.exe
Cmaudio = RunDll32 cmicnfg.cpl,CMICtrlWnd
ATIPTA = C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
BTopenworld = "c:\program files\bt yahoo! internet\DialBTYahoo.exe" /ReInstallAutoDial
Lexmark X1100 Series = "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
SpeedTouch USB Diagnostics = "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
Microsoft Works Update Detection = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
fss = C:\Program Files\Akidthaine\fss.exe
Picasa Media Detector = C:\Program Files\Picasa2\PicasaMediaDetector.exe
HP Component Manager = "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
CaISSDT = "C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe"
CaAvTray = "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe"
CAVRID = "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe"
QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime
Windows Defender = "C:\Program Files\Windows Defender\MSASCui.exe" -hide
SunJavaUpdateSched = C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run OnceEx

(Default) =

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
MoneyAgent = "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
STManager = "C:\Program Files\SpeedTouch\Dr SpeedTouch\drst.exe" -b
NCLaunch = C:\WINDOWS\NCLAUNCH.EXe
balamory screen saver = "C:\Program Files\balamory\Screen Saver\TaskTray.exe"
IncrediMail = C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
KazaGold = C:\Program Files\Kaza Gold 3.2\KazaGold3.2.exe /hide
SweetIM = C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
kdx = C:\WINDOWS\kdx\KHost.exe -all
BitTorrent = "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\THOMAS~1.SCR
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll - {02478D38-C3F9-4EFB-9B51-7695ECA05670}
(no name) - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\Program Files\Etomi\Plugins\RazaWebHook.dll (file missing) - {0EEDB912-C5FA-486F-8334-57288578C627}
(no name) - C:\PROGRA~1\wanadoo1\wanadoo1.dll - {4E7BD74F-2B8D-469E-A3F1-F068B59BBB2A}
(no name) - (no file) - {549B5CA7-4A86-11D7-A4DF-000874180BB3}
(no name) - (no file) - {77701e16-9bfe-4b63-a5b4-7bd156758a37}
(no name) - (no file) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Disk Cleanup.job
eTrust Antivirus.job
Microsoft AntiSpyware.job
MP Scheduled Scan.job

--------------------------------------------------

Enumerating Download Program Files:

[YExplorer1_8US.CAB]
CODEBASE = http://photos.groups.yahoo.com/ocx/u...lorer1_8us.cab
OSD = C:\WINDOWS\Downloaded Program Files\YExplorer1_8US.CAB.osd

[Checkers Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\msgrchkr.dll
CODEBASE = http://messenger.zone.msn.com/binary...r.cab31267.cab

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\system32\macromed\Shockwave 10\Download.dll
CODEBASE = http://fpdownload.macromedia.com/get...irector/sw.cab

[Windows Genuine Advantage Validation Tool]
InProcServer32 = C:\WINDOWS\system32\legitcheckcontrol.dll
CODEBASE = http://go.microsoft.com/fwlink/?linkid=39204

[{205FF73B-CA67-11D5-99DD-444553540000}]
CODEBASE = http://www.spywarestormer.com/files2/Install.cab

[{233C1507-6A77-46A4-9443-F871F945D258}]
CODEBASE = http://download.macromedia.com/pub/s...irector/sw.cab

[Citrix ICA Client]
InProcServer32 = C:\Progra~1\Citrix\icaweb32\WFICA.OCX
CODEBASE = http://www.uclan.ac.uk/other/iss/remote/wficat.cab

[YInstStarter Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\yinsthelper.dll
CODEBASE = http://download.yahoo.com/dl/installs/yinst0401.cab

[Office Update Installation Engine]
InProcServer32 = C:\WINDOWS\opuc.dll
CODEBASE = http://office.microsoft.com/officeup...ntent/opuc.cab

[MSN Photo Upload Tool]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\MsnPUpld.dll
CODEBASE = http://spaces.msn.com//PhotoUpload/MsnPUpld.cab

[MUWebControl Class]
InProcServer32 = C:\WINDOWS\system32\muweb.dll
CODEBASE = http://update.microsoft.com/microsof...?1125234078125

[MessengerStatsClient Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\messengerstatsclient.dll
CODEBASE = http://messenger.zone.msn.com/binary...t.cab31267.cab

[Seekford Solutions, Inc.'s ssiPictureUploader Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\SSIPIC~1.OCX
CODEBASE = http://img.funtigo.com/images/upload...reUploader.cab

[Get_ActiveX Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\HPGETD~1.OCX
CODEBASE = https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx

[MsnMessengerSetupDownloadControl Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\MsnMessengerSetupDownloader.ocx
CODEBASE = http://messenger.msn.com/download/Ms...Downloader.cab

[{B9191F79-5613-4C76-AA2A-398534BB8999}]
CODEBASE = http://us.dl1.yimg.com/download.yaho...tocomplete.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx
CODEBASE = http://fpdownload.macromedia.com/get...sh/swflash.cab

[QDiagHUpdateObj Class]
InProcServer32 = C:\WINDOWS\system32\qdiagh.ocx
CODEBASE = http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326

[MSN Chat Control 4.5]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\MSNChat45.ocx
CODEBASE = http://chat.msn.com/controls/msnchat45.cab

[Solitaire Showdown Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\solitaireshowdown.dll
CODEBASE = http://messenger.zone.msn.com/binary...n.cab31267.cab

--------------------------------------------------

Enumerating Winsock LSP files:

Protocol #1: C:\WINDOWS\system32\VetRedir.dll
Protocol #2: C:\WINDOWS\system32\VetRedir.dll
Protocol #3: C:\WINDOWS\system32\VetRedir.dll
Protocol #23: C:\WINDOWS\system32\VetRedir.dll

--------------------------------------------------

Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*

Windows NT checkdisk command:
BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':
PendingFileRenameOperations: C:\DOCUME~1\waggi\LOCALS~1\Temp\~nsu.tmp\Au_.ex e||C:\DOCUME~1\waggi\LOCALS~1\Temp\nsd1B.tmp\Sy stem.dll||C:\DOCUME~1\waggi\LOCALS~1\Temp\nsd1B .tmp\||C:\Config.Msi\f898f.rbf||C:\Config.Msi\f8b9 a.rbf|||l

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll

--------------------------------------------------
End of report, 12,529 bytes
Report generated in 1.000 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only