I was unable to disable AVG (I even tried to uninstall it and it wouldn't let me). Ran ComboFix and it took about 30-40 minutes. Once it was finished, I had to reboot the system because every .exe file that I clicked on said that the registry key was scheduled for deletion. Once I rebooted everything seemed fine. Had to make Firefox default browser again.
——-
ComboFix 09-07-28.01 - Pirath 07/29/2009 1:50.1.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2941.1494 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: AVG Anti-Virus Free *enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\$recycle.bin\S-1-5-21-2175489178-680292354-854438968-500
c:\users\Pirath\AppData\Local\Microsoft\Windows\Temporary Internet Files\fbk.sts
c:\users\Pirath\AppData\Roaming\inst.exe
c:\windows\Installer\WMEncoder.msi
c:\windows\system32\clubboxuninstall.exe
.
((((((((((((((((((((((((( Files Created from 2009-06-28 to 2009-07-29 )))))))))))))))))))))))))))))))
.
2009-07-29 07:07 . 2009-07-29 07:15 ——– d—–w- c:\users\Pirath\AppData\Local\temp
2009-07-28 05:00 . 2009-07-28 05:00 ——– d—–w- c:\users\Pirath\AppData\Roaming\Malwarebytes
2009-07-28 04:59 . 2009-07-13 18:36 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-28 04:59 . 2009-07-28 05:00 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-07-28 04:59 . 2009-07-28 04:59 ——– d—–w- c:\programdata\Malwarebytes
2009-07-28 04:59 . 2009-07-13 18:36 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-07-26 18:11 . 2006-08-26 04:34 385100 —-a-w- c:\windows\system32\MSVCRTD.DLL
2009-07-26 18:11 . 2006-08-26 04:33 798773 —-a-w- c:\windows\system32\MFCO42D.DLL
2009-07-26 18:11 . 2006-08-26 04:33 929844 —-a-w- c:\windows\system32\MFC42D.DLL
2009-07-26 18:11 . 2009-07-26 18:11 ——– d—–w- c:\program files\PayPal Payment Request Wizard
2009-07-26 16:58 . 2009-07-26 16:58 8854 —-a-r- c:\users\Pirath\AppData\Roaming\Microsoft\Installer\{C2D159E6-FD6E-417D-9D57-7D9EA74C9CFC}\New_Shortcut_575D7D29F4A245C3A8379AD784A14F19.exe
2009-07-26 16:58 . 2009-07-26 16:58 40960 —-a-r- c:\users\Pirath\AppData\Roaming\Microsoft\Installer\{C2D159E6-FD6E-417D-9D57-7D9EA74C9CFC}\NewShortcut30_416FBDFD164744FD88626C8CAD539C5F.exe
2009-07-26 16:58 . 2009-07-26 16:58 40960 —-a-r- c:\users\Pirath\AppData\Roaming\Microsoft\Installer\{C2D159E6-FD6E-417D-9D57-7D9EA74C9CFC}\NewShortcut1_173F395AE65A4A898CDFC0EEED0D0FEF.exe
2009-07-26 16:58 . 2009-07-26 16:58 2998 —-a-r- c:\users\Pirath\AppData\Roaming\Microsoft\Installer\{C2D159E6-FD6E-417D-9D57-7D9EA74C9CFC}\ARPPRODUCTICON.exe
2009-07-26 16:56 . 2009-07-26 16:56 ——– d—–w- c:\program files\StarMicronics
2009-07-26 16:55 . 2009-07-26 16:55 49152 —-a-r- c:\users\Pirath\AppData\Roaming\Microsoft\Installer\{7658436D-C2DA-4E5B-BCA7-47DA42188FFA}\ARPPRODUCTICON.exe
2009-07-26 16:55 . 2009-07-26 16:55 ——– d—–w- c:\program files\CITIZEN
2009-07-26 16:53 . 2009-07-26 16:53 ——– d—–w- c:\program files\CITIZEN SYSTEMS JAPAN
2009-07-26 03:56 . 2009-07-03 14:49 15688 —-a-w- c:\windows\system32\lsdelete.exe
2009-07-25 22:15 . 2009-07-03 14:49 64160 —-a-w- c:\windows\system32\drivers\Lbd.sys
2009-07-25 22:13 . 2009-07-25 22:13 ——– dc-h–w- c:\programdata\{EF63305C-BAD7-4144-9208-D65528260864}
2009-07-25 22:13 . 2009-07-08 17:28 2920112 -c–a-w- c:\programdata\{EF63305C-BAD7-4144-9208-D65528260864}\Ad-AwareAE.exe
2009-07-25 22:12 . 2009-07-25 22:15 ——– d—–w- c:\programdata\Lavasoft
2009-07-25 22:12 . 2009-07-25 22:12 ——– d—–w- c:\program files\Lavasoft
2009-07-25 22:09 . 2005-05-26 20:34 2297552 —-a-w- c:\windows\system32\d3dx9_26.dll
2009-07-25 22:07 . 2009-07-25 22:07 ——– d—–w- c:\programdata\Media Center Programs
2009-07-25 22:00 . 2009-07-25 22:00 ——– d—–w- c:\program files\Paradox Interactive
2009-07-25 08:56 . 2009-07-25 08:56 ——– d—–w- c:\users\QBDataServiceUser19
2009-07-25 08:45 . 2009-07-25 08:45 ——– d—–w- c:\windows\Sun
2009-07-25 05:32 . 2009-07-25 05:31 849184 —-a-w- c:\programdata\Intuit\QuickBooks 2008\Components\DownloadQB18\Patch\qbpatch.exe
2009-07-25 05:32 . 2009-07-25 05:31 499712 —-a-w- c:\programdata\Intuit\QuickBooks 2008\Components\DownloadQB18\Patch\msvcp71.dll
2009-07-25 05:32 . 2009-07-25 05:31 348160 —-a-w- c:\programdata\Intuit\QuickBooks 2008\Components\DownloadQB18\Patch\msvcr71.dll
2009-07-25 04:04 . 2009-07-25 04:04 ——– d—–w- c:\program files\MagicISO
2009-07-20 16:37 . 2009-07-23 01:35 ——– d—–w- c:\users\Pirath\AppData\Roaming\vlc
2009-07-16 22:50 . 2009-05-04 20:07 2298680 —-a-w- c:\users\Pirath\AppData\Roaming\Mozilla\Firefox\Profiles\jtw9cp8w.default\extensions\[removed]\plugins\npTVUAx.dll
2009-07-16 22:50 . 2006-10-18 22:32 499712 —-a-w- c:\users\Pirath\AppData\Roaming\Mozilla\Firefox\Profiles\jtw9cp8w.default\extensions\[removed]\plugins\msvcp71.dll
2009-07-16 22:50 . 2006-10-16 23:44 196608 —-a-w- c:\users\Pirath\AppData\Roaming\Mozilla\Firefox\Profiles\jtw9cp8w.default\extensions\[removed]\plugins\ssleay32.dll
2009-07-16 22:50 . 2008-03-04 23:52 286720 —-a-w- c:\users\Pirath\AppData\Roaming\Mozilla\Firefox\Profiles\jtw9cp8w.default\extensions\[removed]\plugins\libcurl.dll
2009-07-16 22:50 . 2007-10-31 14:39 59904 —-a-w- c:\users\Pirath\AppData\Roaming\Mozilla\Firefox\Profiles\jtw9cp8w.default\extensions\[removed]\plugins\zlib1.dll
2009-07-16 22:50 . 2007-05-17 18:58 143360 —-a-w- c:\users\Pirath\AppData\Roaming\Mozilla\Firefox\Profiles\jtw9cp8w.default\extensions\[removed]\plugins\libexpatw.dll
2009-07-16 22:50 . 2006-10-18 22:32 348160 —-a-w- c:\users\Pirath\AppData\Roaming\Mozilla\Firefox\Profiles\jtw9cp8w.default\extensions\[removed]\plugins\msvcr71.dll
2009-07-16 22:50 . 2006-10-16 23:44 1028096 —-a-w- c:\users\Pirath\AppData\Roaming\Mozilla\Firefox\Profiles\jtw9cp8w.default\extensions\[removed]\plugins\libeay32.dll
2009-07-14 18:17 . 2009-07-28 23:51 ——– d—–w- C:\New Folder2
2009-07-13 12:45 . 2009-07-13 12:45 ——– d—–w- c:\users\Pirath\AppData\Roaming\Mchid
2009-07-13 12:44 . 2009-07-13 12:44 ——– d—–w- c:\program files\Livestation
2009-07-13 11:36 . 2009-07-13 11:36 ——– d—–w- c:\programdata\TVU Networks
2009-07-12 17:28 . 2009-07-12 17:28 ——– d—–w- c:\users\Pirath\AppData\Roaming\TVU networks
2009-07-11 18:41 . 2009-07-11 18:42 ——– d—–w- C:\New Folder
2009-07-11 03:57 . 2009-07-11 03:56 869664 —-a-w- c:\programdata\Intuit\QuickBooks 2009\Components\DownloadQB19\Patch\qbpatch.exe
2009-07-11 03:57 . 2009-07-11 03:56 499712 —-a-w- c:\programdata\Intuit\QuickBooks 2009\Components\DownloadQB19\Patch\msvcp71.dll
2009-07-11 03:57 . 2009-07-11 03:56 348160 —-a-w- c:\programdata\Intuit\QuickBooks 2009\Components\DownloadQB19\Patch\msvcr71.dll
2009-07-11 03:06 . 2009-07-26 00:16 ——– d—–w- c:\program files\Sims2Pack Clean Installer
2009-07-11 02:48 . 2009-07-11 02:48 ——– d—–w- c:\programdata\Electronic Arts
2009-07-11 02:40 . 2009-07-11 02:40 10134 —-a-r- c:\users\Pirath\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2009-07-11 02:40 . 2009-07-11 02:40 ——– d—–w- c:\program files\Microsoft WSE
2009-07-11 02:40 . 2006-09-28 21:05 2414360 —-a-w- c:\windows\system32\d3dx9_31.dll
2009-07-11 02:24 . 2009-07-26 00:45 ——– d—–w- c:\program files\Electronic Arts
2009-07-11 02:10 . 2009-07-11 02:10 ——– d—–w- c:\programdata\DAEMON Tools Pro
2009-07-11 02:10 . 2009-07-11 02:17 ——– d—–w- c:\program files\DAEMON Tools Pro
2009-07-11 01:16 . 2009-07-11 01:16 721904 —-a-w- c:\windows\system32\drivers\sptd.sys
2009-07-11 01:15 . 2009-07-11 02:19 ——– d—–w- c:\users\Pirath\AppData\Roaming\DAEMON Tools Pro
2009-07-10 23:24 . 2009-07-10 23:23 865544 —-a-w- c:\programdata\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\IntuitSyncManager.exe
2009-07-10 23:24 . 2009-07-10 23:23 38664 —-a-w- c:\programdata\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\IntuitSyncManagerPatch.exe
2009-07-10 23:24 . 2009-07-10 23:23 34056 —-a-w- c:\programdata\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\Interop.QBInstanceFinder.dll
2009-07-10 23:24 . 2009-07-10 23:23 192512 —-a-w- c:\programdata\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\ICSharpCode.SharpZipLib.dll
2009-07-10 01:34 . 2009-07-10 01:40 ——– d—–w- c:\users\Pirath\AppData\Roaming\Trillian
2009-07-09 22:21 . 2009-07-09 22:21 ——– d—–w- c:\program files\Elaborate Bytes
2009-07-06 23:16 . 2009-07-06 23:25 ——– d—–w- c:\program files\The Omega Stone
2009-07-06 22:56 . 2009-07-06 22:56 ——– d—–w- c:\program files\Viva Media
2009-07-06 22:47 . 2009-07-26 18:05 2286 —-a-w- c:\programdata\Intuit\QuickBooks 2009\qbbackup.sys
2009-07-06 21:42 . 2009-07-06 21:42 ——– d—–w- c:\program files\Common Files\SWF Studio
2009-07-06 20:59 . 2009-07-25 09:18 ——– d—–w- c:\programdata\SQL Anywhere 10
2009-07-06 20:46 . 2009-07-26 16:51 ——– d—–w- c:\users\Pirath\AppData\Roaming\Download Manager
2009-07-06 20:45 . 2009-07-06 20:45 ——– d—–w- c:\program files\Akamai
2009-07-06 04:33 . 2009-07-09 23:08 ——– d—–w- c:\programdata\eMule
2009-07-06 04:30 . 2009-07-09 23:08 ——– d—–w- c:\users\Pirath\AppData\Local\eMule
2009-07-05 14:51 . 2009-07-05 14:47 2054424 —-a-w- c:\programdata\avg8\update\backup\avgcorex.dll
2009-07-05 14:50 . 2009-07-05 14:47 2167576 —-a-w- c:\programdata\avg8\update\backup\avgresf.dll
2009-07-05 14:50 . 2009-07-05 14:47 3403032 —-a-w- c:\programdata\avg8\update\backup\avgui.exe
2009-07-05 04:40 . 2009-07-13 23:41 ——– d—–w- c:\windows\system32\crc
2009-07-05 00:36 . 2009-07-05 00:36 77824 —-a-w- c:\windows\system32\nod.dll
2009-07-03 20:28 . 2009-07-03 20:28 640240 —-a-w- c:\windows\system32\NowUpdate.exe
2009-06-29 22:37 . 2009-06-14 21:07 1004800 —-a-w- c:\programdata\AVG Security Toolbar\IEToolbar.dll
2009-06-29 21:50 . 2009-06-29 21:50 56 —ha-w- c:\windows\system32\ezsidmv.dat
2009-06-29 21:50 . 2009-07-18 16:15 ——– d—–w- c:\users\Pirath\AppData\Roaming\skypePM
2009-06-29 21:49 . 2009-07-18 16:25 ——– d—–w- c:\users\Pirath\AppData\Roaming\Skype
2009-06-29 21:49 . 2009-06-29 21:49 ——– d—–w- c:\program files\Common Files\Skype
2009-06-29 21:48 . 2009-06-29 21:49 ——– d—–r- c:\program files\Skype
2009-06-29 21:48 . 2009-06-29 21:49 ——– d—–w- c:\programdata\Skype
2009-06-29 20:55 . 2009-04-23 12:42 636928 —-a-w- c:\windows\system32\localspl.dll
2009-06-29 20:18 . 2009-06-29 20:22 ——– d—–w- c:\program files\The KMPlayer
2009-06-29 18:45 . 2009-06-29 18:46 ——– d—–w- c:\program files\ProjectX_Portable
2009-06-29 17:25 . 2009-07-13 19:46 ——– d—–w- C:\Downloads
2009-06-29 17:25 . 2009-06-29 17:25 ——– d—–w- c:\program files\NamiRobot
2009-06-29 17:04 . 2008-07-19 21:47 86016 —-a-w- c:\users\Pirath\AppData\Roaming\Mozilla\Firefox\Profiles\jtw9cp8w.default\extensions\{6f7ae34f-ec7d-4ecd-871f-6efe8bf131df}\RobotWrapper.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-29 07:16 . 2009-05-09 22:43 ——– d—–w- c:\program files\Trillian
2009-07-29 07:13 . 2009-05-02 21:40 ——– d—–w- c:\program files\DNA
2009-07-29 07:13 . 2008-11-25 00:50 ——– d—–w- c:\users\Pirath\AppData\Roaming\DNA
2009-07-29 06:43 . 2008-10-18 01:47 ——– d—–w- c:\programdata\avg8
2009-07-28 20:13 . 2008-10-12 18:14 ——– d—–w- c:\users\Pirath\AppData\Roaming\uTorrent
2009-07-28 00:02 . 2008-10-18 01:06 ——– d—–w- c:\users\Pirath\AppData\Roaming\FileZilla
2009-07-26 18:32 . 2008-10-05 01:45 132312 —-a-w- c:\users\Pirath\AppData\Local\GDIPFONTCACHEV1.DAT
2009-07-26 18:11 . 2008-02-13 01:48 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-07-26 17:04 . 2008-10-30 04:49 ——– d—–w- c:\program files\Common Files\Intuit
2009-07-26 17:03 . 2008-10-30 04:49 ——– d—–w- c:\programdata\Intuit
2009-07-26 17:03 . 2008-10-30 04:49 ——– d—–w- c:\program files\Intuit
2009-07-26 16:57 . 2009-07-26 16:57 0 —ha-w- c:\windows\system32\drivers\Msft_User_SmjVirtualPortDriverTsp100u_01_00_00.Wdf
2009-07-25 15:38 . 2009-07-25 15:38 ——– d—–w- c:\program files\Trend Micro
2009-07-25 15:25 . 2009-03-08 06:05 ——– d—–w- c:\program files\Spyware Doctor
2009-07-25 11:17 . 2009-07-25 11:17 746760 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-07-25 10:32 . 2009-03-08 06:06 130936 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2009-07-13 18:56 . 2009-07-05 00:40 157 —-a-w- c:\windows\system32\fscflist.ini.tmp
2009-07-13 18:54 . 2009-07-05 00:34 78 —-a-w- c:\windows\system32\fscagent.ini.tmp
2009-07-13 12:44 . 2009-01-10 07:26 413696 —-a-w- c:\windows\system32\wrap_oal.dll
2009-07-13 12:44 . 2009-01-10 07:26 110592 —-a-w- c:\windows\system32\OpenAL32.dll
2009-07-13 12:37 . 2009-01-10 07:48 ——– d—–w- c:\program files\KeyHoleTV
2009-07-13 11:36 . 2009-01-10 07:43 ——– d—–w- c:\program files\TVUPlayer
2009-07-11 03:02 . 2009-06-25 14:00 ——– d—–w- c:\programdata\AVG Security Toolbar
2009-07-05 14:47 . 2008-10-18 01:47 335752 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2009-07-05 07:21 . 2009-05-02 07:20 1356 —-a-w- c:\users\Pirath\AppData\Local\d3d9caps.dat
2009-07-02 02:56 . 2009-06-08 08:56 167936 —-a-w- c:\windows\system32\fscagent.exe
2009-07-02 02:53 . 2009-06-08 08:56 1626112 —-a-w- c:\windows\system32\clubbox.exe
2009-06-29 21:10 . 2008-09-01 01:56 ——– d—–w- c:\programdata\Microsoft Help
2009-06-25 13:58 . 2009-02-06 15:57 11952 —-a-w- c:\windows\system32\avgrsstx.dll
2009-06-25 13:58 . 2008-10-18 01:47 27784 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-06-25 02:50 . 2009-06-25 02:50 ——– d—–w- c:\users\Pirath\AppData\Roaming\EuroTalk
2009-06-25 02:50 . 2009-06-25 02:50 ——– d—–w- c:\program files\EuroTalk Interactive
2009-06-24 16:34 . 2008-11-02 00:37 ——– d—–w- c:\programdata\Dl_cats
2009-06-14 19:51 . 2009-06-14 19:48 ——– d—–w- c:\program files\QuickTime
2009-06-06 01:30 . 2008-10-25 19:17 ——– d—–w- c:\program files\Microsoft Works
2009-06-05 05:54 . 2009-06-05 01:46 ——– d—–w- c:\programdata\Grid
2009-06-05 01:55 . 2009-06-05 01:46 ——– d—–w- c:\program files\RaySource
2009-06-05 01:46 . 2009-06-05 01:46 ——– d—–w- c:\program files\GridService
2009-06-01 12:19 . 2009-06-01 05:57 ——– d—–w- c:\users\Pirath\AppData\Roaming\Thai2English
2009-06-01 05:57 . 2009-06-01 05:57 ——– d—–w- c:\program files\Thai2English
2009-05-25 12:01 . 2009-05-25 12:01 89256 —-a-w- c:\windows\system32\ElbyCDIO.dll
2009-05-22 23:08 . 2009-05-22 23:08 29696 —-a-w- c:\windows\system32\drivers\VClone.sys
2009-05-16 08:08 . 2009-05-16 08:08 416128 —-a-w- c:\programdata\Microsoft\eHome\Packages\NetTV\Browse\NetTVResources.dll
2009-05-11 01:14 . 2009-05-11 01:14 2738 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp DirectShow Decoder.dat
2009-05-11 01:12 . 2009-02-12 04:16 229752 —-a-w- c:\windows\system32\SpoonUninstall.exe
2009-05-11 01:11 . 2009-05-11 01:11 11473 —-a-w- c:\windows\system32\SpoonUninstall-dBpoweramp Real Audio (Helix) Encoder.dat
2009-05-09 05:50 . 2009-06-29 20:54 915456 —-a-w- c:\windows\system32\wininet.dll
2009-05-09 05:34 . 2009-06-29 20:54 71680 —-a-w- c:\windows\system32\iesetup.dll
2009-05-07 14:36 . 2009-05-07 14:36 155648 —-a-r- c:\windows\system32\downengine.dll
2009-05-01 22:31 . 2009-05-02 06:51 51200 —-a-w- c:\users\Pirath\AppData\Roaming\Mozilla\Firefox\Profiles\jtw9cp8w.default\extensions\{9cf9e3fd-dab1-40d6-9754-1de1eaa7dc1e}\components\FFExternalAlert.dll
2009-05-01 22:31 . 2009-05-02 06:51 114688 —-a-w- c:\users\Pirath\AppData\Roaming\Mozilla\Firefox\Profiles\jtw9cp8w.default\extensions\{9cf9e3fd-dab1-40d6-9754-1de1eaa7dc1e}\components\npmozax.dll
2009-04-30 12:37 . 2009-06-29 20:54 293376 —-a-w- c:\windows\system32\psisdecd.dll
2009-04-30 12:37 . 2009-06-29 20:54 428544 —-a-w- c:\windows\system32\EncDec.dll
2004-01-08 17:38 . 2008-11-06 05:40 208896 —-a-w- c:\program files\lame_enc.dll
2009-07-23 06:13 . 2008-10-05 02:17 134648 —-a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2008-10-05 01:45 . 2008-10-05 01:45 13 –sh–r- c:\windows\System32\drivers\fbd.sys
2008-10-05 01:45 . 2008-10-05 01:45 4 –sh–r- c:\windows\System32\drivers\taishop.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-06-26 1008896]
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-06-26 15:36 1008896 —-a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-06-26 1008896]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-06-26 1008896]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\NBHShellExt]
@="{8D2223A2-B3C6-4e32-B096-CDD11F628C60}"
[HKEY_CLASSES_ROOT\CLSID\{8D2223A2-B3C6-4e32-B096-CDD11F628C60}]
2008-09-19 21:53 98328 —-a-w- c:\program files\Nero\Nero 9\InCD\NBHshx.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"googletalk"="c:\users\Pirath\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-05-02 342848]
"WindowsWelcomeCenter"="oobefldr.dll" - c:\windows\System32\oobefldr.dll [2008-01-21 2153472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-07 1029416]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-01-17 431456]
"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2007-11-01 54608]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2007-06-16 448080]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-01-22 712704]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-06-25 1948440]
"dldfmon.exe"="c:\program files\Dell AIO Printer 948\dldfmon.exe" [2007-07-03 455304]
"MemoryCardManager"="c:\program files\Dell AIO Printer 948\memcard.exe" [2007-07-03 410248]
"Dell AIO Printer 948 Fax Server"="c:\program files\Dell AIO Printer 948\fm3032.exe" [2007-07-03 307848]
"Grid Service"="c:\program files\GridService\peer.exe" [2008-12-30 4993024]
"Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2009-07-10 865544]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-01-30 4911104]
"NDSTray.exe"="NDSTray.exe" [BU]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 443968]
c:\users\Pirath\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Trillian.lnk - c:\program files\Trillian\trillian.exe [2009-7-24 1885024]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
QuickBooks US Plugin.lnk - c:\program files\PayPal Payment Request Wizard\QB US edition\OEHook.exe [2009-7-26 888987]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Event Reminder.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Event Reminder.lnk
backup=c:\windows\pss\Event Reminder.lnk.CommonStartup
backupExtension=.CommonStartup
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{DE1D66EC-E297-4584-9E5F-8CEDC3C9465D}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{3D01E3DB-D36C-431E-9019-73E8564805F8}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"{CB56B235-0007-4614-B423-45202A478924}"= UDP:c:\program files\FileZilla FTP Client\filezilla.exe:FileZilla
"{27DB4117-CCF0-4858-B287-C4B6699D3C21}"= TCP:c:\program files\FileZilla FTP Client\filezilla.exe:FileZilla
"{260B6F22-0F2E-490E-A414-FE1945E89C46}"= UDP:21:ftp
"{C3DCCAC7-5643-4060-BA25-E55C5DA20DBD}"= TCP:21:ftp2
"TCP Query User{89BF9825-8982-49FB-AB26-5B1ADB8B8201}c:\\users\\pirath\\appdata\\local\\yahoo!\\messenger for vista\\yahoo.messenger.ymapp.exe"= UDP:c:\users\pirath\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe:yahoo.messenger.ymapp.exe
"UDP Query User{E8C47ABB-7CFF-4F1B-8C97-0AA64561F412}c:\\users\\pirath\\appdata\\local\\yahoo!\\messenger for vista\\yahoo.messenger.ymapp.exe"= TCP:c:\users\pirath\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe:yahoo.messenger.ymapp.exe
"{BC5CE69C-FC39-4EE9-B8D7-9804F991C55B}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
"TCP Query User{AC0CA481-4DFD-4D4E-A9E2-C6FA78EE7C8C}c:\\users\\pirath\\appdata\\local\\yahoo!\\messenger for vista\\yahoo.messenger.ymapp.exe"= UDP:c:\users\pirath\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe:yahoo.messenger.ymapp.exe
"UDP Query User{C54520BF-148C-4498-B505-7BF30746C664}c:\\users\\pirath\\appdata\\local\\yahoo!\\messenger for vista\\yahoo.messenger.ymapp.exe"= TCP:c:\users\pirath\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe:yahoo.messenger.ymapp.exe
"{A39F9338-3AA8-45F9-B846-969A972CB873}"= UDP:40809:40809
"{A0958E12-D090-4B58-9F4C-109CA6B7CD31}"= TCP:40809:40809b
"{7A95A0B9-06D8-4371-9A87-D6FC6BC66A62}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{8DF50312-E290-4B70-B954-40B6471594F1}"= UDP:c:\windows\System32\dldfcoms.exe:Dell Communications System
"{3345AEB6-7184-4A23-99C2-BE2024755E1F}"= TCP:c:\windows\System32\dldfcoms.exe:Dell Communications System
"{7FA75DB3-DC3E-472C-8A42-296D304AA601}"= UDP:c:\program files\Dell AIO Printer 948\memcard.exe:Memory Card Manager
"{C8673FAA-5AB6-4054-BBF9-3EFEF1F7A305}"= TCP:c:\program files\Dell AIO Printer 948\memcard.exe:Memory Card Manager
"{5EE34DD7-EAF0-4B41-8332-9E966BB13A97}"= UDP:c:\program files\Dell AIO Printer 948\dldfmon.exe:Printer Device Monitor
"{9479DE37-B7EC-4AB0-B4B2-29FA71CF5152}"= TCP:c:\program files\Dell AIO Printer 948\dldfmon.exe:Printer Device Monitor
"{6DC40FAA-52B2-4D04-8D61-5E995673955B}"= UDP:c:\windows\System32\spool\drivers\w32x86\3\dldfpswx.exe:Printer Status Window Interface
"{ED08CB77-9008-4938-A6B1-6C95742AF6AD}"= TCP:c:\windows\System32\spool\drivers\w32x86\3\dldfpswx.exe:Printer Status Window Interface
"{A7C7290C-4DA6-4F98-9C3D-175E07FE8840}"= UDP:c:\windows\System32\spool\drivers\w32x86\3\dldftime.exe:Time Executable
"{CE4164F5-C59E-480E-BC0C-24A2314C8A0C}"= TCP:c:\windows\System32\spool\drivers\w32x86\3\dldftime.exe:Time Executable
"{4BE83A6E-2DE3-421E-ADC8-8316D47A2A29}"= UDP:c:\program files\Dell AIO Printer 948\dldfaiox.exe:AIOC exe
"{9C8517AE-697E-4F64-8BB0-9A2DCD3C9306}"= TCP:c:\program files\Dell AIO Printer 948\dldfaiox.exe:AIOC exe
"TCP Query User{A1D553F0-01F0-4C38-80F8-9704A119038C}c:\\program files\\dell aio printer 948\\dldfmon.exe"= UDP:c:\program files\dell aio printer 948\dldfmon.exe:Printer Device Monitor
"UDP Query User{B11F65CF-0D34-4C07-9661-473E7E362761}c:\\program files\\dell aio printer 948\\dldfmon.exe"= TCP:c:\program files\dell aio printer 948\dldfmon.exe:Printer Device Monitor
"{D80900E0-8442-44B2-B64A-91CBD5BF8FBE}"= UDP:c:\program files\Mozilla Firefox\firefox.exe:Mozilla Firefox
"{B9E742F2-9988-4BE5-9D26-551CA944CAED}"= TCP:c:\program files\Mozilla Firefox\firefox.exe:Mozilla Firefox
"{4C128706-FF93-401C-B705-85EB6B4159C7}"= UDP:c:\program files\Megaupload\Mega Manager\MegaManager.exe:Mega Manager
"{E285749E-0760-4AF5-952B-3F3B0AAEF0A4}"= TCP:c:\program files\Megaupload\Mega Manager\MegaManager.exe:Mega Manager
"{7C02D854-7EC7-4862-9E45-BA112A8C2470}"= UDP:800:megaupload1
"{157B4C88-5D3A-4E7B-8F61-3BB4F5692C1C}"= TCP:800:megaupload1.1
"{3AA1D0BD-2DF0-4916-9160-36D277934121}"= UDP:1723:megaupload2
"{C114647B-5EC0-4682-8DC7-360E1038B307}"= TCP:1723:megaupload2.2
"{7AC90A3B-6469-4403-B5B5-2CF5ECE0E454}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{1257D8D5-617B-4ACC-B96D-21D6027EB528}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{5B16F64D-A608-4429-B0A5-031791FC9DCC}"= UDP:c:\program files\AIM6\aim6.exe:AIM
"{D39FB4E2-8B06-4AE4-B10C-E853D18A8795}"= TCP:c:\program files\AIM6\aim6.exe:AIM
"TCP Query User{47B3427D-39C6-4931-BF14-FB15E9D7D4C3}c:\\windows\\system32\\spool\\drivers\\w32x86\\3\\dldfpswx.exe"= UDP:c:\windows\system32\spool\drivers\w32x86\3\dldfpswx.exe:Printer Status Window Interface
"UDP Query User{785C63F3-1EAC-4C87-8927-70EBCF40F61B}c:\\windows\\system32\\spool\\drivers\\w32x86\\3\\dldfpswx.exe"= TCP:c:\windows\system32\spool\drivers\w32x86\3\dldfpswx.exe:Printer Status Window Interface
"TCP Query User{42FB9D77-5441-4538-A906-27D020F05766}c:\\program files\\aim6\\aim6.exe"= UDP:c:\program files\aim6\aim6.exe:AIM
"UDP Query User{61B2126D-C9BC-4699-9BCA-5E0B85FCA5D3}c:\\program files\\aim6\\aim6.exe"= TCP:c:\program files\aim6\aim6.exe:AIM
"TCP Query User{A93E1469-482F-4429-802E-7FDF4C16E834}c:\\program files\\pitney bowes\\mailstation 2\\mailstationassistant.exe"= UDP:c:\program files\pitney bowes\mailstation 2\mailstationassistant.exe:mailstation assistant™
"UDP Query User{C0F8E9CF-5DC6-4FF6-AE61-D9600B3752E2}c:\\program files\\pitney bowes\\mailstation 2\\mailstationassistant.exe"= TCP:c:\program files\pitney bowes\mailstation 2\mailstationassistant.exe:mailstation assistant™
"TCP Query User{81C429D4-D341-46B1-B706-86BF9BBFD3D2}c:\\users\\pirath\\program files\\dna\\btdna.exe"= UDP:c:\users\pirath\program files\dna\btdna.exe:btdna.exe
"UDP Query User{A37F91D2-4183-4005-A7C3-F4FACC3BE95A}c:\\users\\pirath\\program files\\dna\\btdna.exe"= TCP:c:\users\pirath\program files\dna\btdna.exe:btdna.exe
"TCP Query User{AD7F13A6-4F25-443F-A3CD-B2E68C47DCAE}c:\\program files\\xfire\\xfire.exe"= UDP:c:\program files\xfire\xfire.exe:Xfire
"UDP Query User{EB5CF0FA-D926-4306-BFD2-F768D151CEF8}c:\\program files\\xfire\\xfire.exe"= TCP:c:\program files\xfire\xfire.exe:Xfire
"{CACF4066-439A-45F7-AB7D-620E75D5BDE5}"= UDP:40809:bt
"{1E8E24D9-A9E1-425B-9EF4-0DABDE8D2634}"= TCP:40809:bt
"TCP Query User{8D2DDADD-9438-4A20-8001-859DE4EC6329}c:\\users\\pirath\\program files\\dna\\btdna.exe"= UDP:c:\users\pirath\program files\dna\btdna.exe:btdna.exe
"UDP Query User{FAA5F0D2-25B5-4B85-ACBD-0C5D8728376E}c:\\users\\pirath\\program files\\dna\\btdna.exe"= TCP:c:\users\pirath\program files\dna\btdna.exe:btdna.exe
"TCP Query User{73DB8D7B-5801-46F5-86B7-49CA4AE4CC9C}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:µTorrent
"UDP Query User{60972C3A-CFB0-43C2-B592-8A74A9773951}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:µTorrent
"{3EFB784A-4327-4EE5-92F1-47FACD413C9E}"= UDP:14594:14594tcp
"{FAF5FAD3-5855-4810-8AD1-7DB769DB8FDE}"= TCP:14594:14594udp
"TCP Query User{EDA4058C-1FE1-47D8-A49A-6F5D1750F6B9}c:\\program files\\tvuplayer\\tvuplayer.exe"= UDP:c:\program files\tvuplayer\tvuplayer.exe:TVUPlayer Component
"UDP Query User{FB064DF7-6371-433B-BD95-6F4E9CE5C85B}c:\\program files\\tvuplayer\\tvuplayer.exe"= TCP:c:\program files\tvuplayer\tvuplayer.exe:TVUPlayer Component
"TCP Query User{D2DD6FAB-0EF3-4131-9865-B60EBD452F3D}c:\\program files\\keyholetv\\keyholetv.exe"= UDP:c:\program files\keyholetv\keyholetv.exe:KeyHole TV Main Application
"UDP Query User{F37A7920-17AF-426D-9867-9F338DD54602}c:\\program files\\keyholetv\\keyholetv.exe"= TCP:c:\program files\keyholetv\keyholetv.exe:KeyHole TV Main Application
"{E80B43F0-901B-4796-A5D8-42B7EA785A7A}"= UDP:51600:51600t
"{1BD88F09-7304-440C-B29A-1B711D592882}"= TCP:51600:51600u
"TCP Query User{1BA04ECF-7E46-451E-8822-5FDF54DC22B6}c:\\program files\\adobe\\adobe photoshop cs3\\photoshop.exe"= UDP:c:\program files\adobe\adobe photoshop cs3\photoshop.exe:Adobe Photoshop CS3
"UDP Query User{01029938-5926-4BB4-AD1B-3463276DAE0C}c:\\program files\\adobe\\adobe photoshop cs3\\photoshop.exe"= TCP:c:\program files\adobe\adobe photoshop cs3\photoshop.exe:Adobe Photoshop CS3
"TCP Query User{4CF37153-5C7E-4A91-AA28-1B7E38204446}c:\\program files\\pitney bowes\\mailstation 2\\mailstationassistant.exe"= UDP:c:\program files\pitney bowes\mailstation 2\mailstationassistant.exe:mailstation assistant™
"UDP Query User{D0207D66-9A24-4849-B969-C0E3B8D946D1}c:\\program files\\pitney bowes\\mailstation 2\\mailstationassistant.exe"= TCP:c:\program files\pitney bowes\mailstation 2\mailstationassistant.exe:mailstation assistant™
"{C0D7535D-8F2C-460F-ACD2-42AA2C7190A4}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"{6F58246E-3A1D-43EB-A889-0B27DC6EC9B1}"= UDP:c:\program files\DNA\btdna.exe:DNA (TCP-In)
"{BE8BF889-CE32-41F6-8BA3-6E84CF1618EF}"= TCP:c:\program files\DNA\btdna.exe:DNA (UDP-In)
"{063CD6B0-ABD3-49FD-BD01-4761746B830B}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{E0C43C17-5F50-49ED-A99A-36E6C45AF734}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{535B9F45-A255-4BA8-A594-9C6908CFCFB4}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{FA6238E3-5FBE-4733-B4AB-2CE2CE05909B}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{1C1A779D-8F43-4C9F-9C1B-5D0E1A744508}"= UDP:c:\program files\GridService\peer.exe:muse peer
"{8E8ED2AD-69B6-4316-AA94-BEA02EBF544C}"= TCP:c:\program files\GridService\peer.exe:muse peer
"{71104C06-D6B4-4836-8EE2-A225E841B0A3}"= UDP:c:\program files\GridService\peer.exe:muse peer
"{71886A85-4C39-4506-AA6F-3A6DFEE1112A}"= TCP:c:\program files\GridService\peer.exe:muse peer
"TCP Query User{08FBD835-2746-45D6-89A0-1D8C64BE8277}c:\\program files\\trillian\\trillian.exe"= UDP:c:\program files\trillian\trillian.exe:Trillian
"UDP Query User{E2C51404-1FEF-4B27-983C-37D5D7FB2E90}c:\\program files\\trillian\\trillian.exe"= TCP:c:\program files\trillian\trillian.exe:Trillian
"TCP Query User{CE62D9C4-5322-4018-8A95-CE6D4AD9C2B7}c:\\program files\\namirobot\\dutool.exe"= UDP:c:\program files\namirobot\dutool.exe:??
"UDP Query User{5F4FE3DE-F58C-4FBA-A370-B5519DF957DC}c:\\program files\\namirobot\\dutool.exe"= TCP:c:\program files\namirobot\dutool.exe:??
"{B47B69B3-78DF-4DFC-9219-506DA0AB603E}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{E23BBD06-9D7A-4D3A-9B7A-3A4BB0C38ABC}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{66372A54-8B2B-4FB7-9AB1-72C84C81727D}"= UDP:c:\windows\System32\fscagent.exe:???? ???? ??
"{090498F8-42EC-477B-BFBD-8795B953D465}"= TCP:c:\windows\System32\fscagent.exe:???? ???? ??
"TCP Query User{03898FBF-DFC0-4669-95D2-C09288C580BD}c:\\windows\\system32\\grdmgr.exe"= UDP:c:\windows\system32\grdmgr.exe:??? ?? ???
"UDP Query User{6DF64A7B-68B5-4826-9127-AE66E405B6E2}c:\\windows\\system32\\grdmgr.exe"= TCP:c:\windows\system32\grdmgr.exe:??? ?? ???
"TCP Query User{5326C078-6CB7-48D7-ADDD-8235055477E5}c:\\windows\\system32\\clubbox.exe"= UDP:c:\windows\system32\clubbox.exe:CLUBBOX File Transfer Manager V2
"UDP Query User{85953C31-F547-42D9-919F-807D45E36970}c:\\windows\\system32\\clubbox.exe"= TCP:c:\windows\system32\clubbox.exe:CLUBBOX File Transfer Manager V2
"TCP Query User{4C8B8FB2-BF53-4365-BFC7-697C0F90E838}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{21A0CC28-FB43-4C36-A74D-AA9E88EA33B9}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"TCP Query User{12ED9021-3CD1-43CC-B2F8-3B6CCC770C87}c:\\program files\\electronic arts\\eadm\\core.exe"= UDP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager
"UDP Query User{17158147-6689-4B3B-A66E-9C1BFB170D5A}c:\\program files\\electronic arts\\eadm\\core.exe"= TCP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager
"TCP Query User{6F2ABCC8-7559-4B4F-A5B8-00A353EEA245}c:\\program files\\keyholetv\\keyholetv.exe"= UDP:c:\program files\keyholetv\keyholetv.exe:KeyHole TV Main Application
"UDP Query User{689699E7-5845-49AF-8889-BE99B31F900F}c:\\program files\\keyholetv\\keyholetv.exe"= TCP:c:\program files\keyholetv\keyholetv.exe:KeyHole TV Main Application
"TCP Query User{0A12E7B9-3B76-41FD-87A7-F737B6A37DF6}c:\\program files\\tvuplayer\\tvuplayer.exe"= UDP:c:\program files\tvuplayer\tvuplayer.exe:TVUPlayer Component
"UDP Query User{43A9CDB2-FECC-4832-8A72-69C1F603BB27}c:\\program files\\tvuplayer\\tvuplayer.exe"= TCP:c:\program files\tvuplayer\tvuplayer.exe:TVUPlayer Component
"{E1CE13EE-AB32-44B8-91A0-DB0AC1E8F499}"= c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{3BC0D35F-32B5-44C0-A3BA-FAFFD27C1141}c:\\program files\\electronic arts\\eadm\\core.exe"= UDP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager
"UDP Query User{EB643B7C-38DE-48C2-BB09-B8523AA61DA9}c:\\program files\\electronic arts\\eadm\\core.exe"= TCP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager
"{E144B14E-2E7D-4F75-B18A-0B969796FD22}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{81AD0E5A-EAF2-495B-A7E6-584A2C7F2A31}"= UDP:c:\program files\Paradox Interactive\Elven Legacy\ElvenLegacy.exe:Elven Legacy
"{C909857B-9445-4791-AE4D-AC666007A717}"= TCP:c:\program files\Paradox Interactive\Elven Legacy\ElvenLegacy.exe:Elven Legacy
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\TOSHIBA\\ivp\\NetInt\\Netint.exe"= c:\toshiba\ivp\NetInt\Netint.exe:*:Enabled:NIE - Toshiba Software Upgrades Engine
"c:\\TOSHIBA\\Ivp\\ISM\\pinger.exe"= c:\toshiba\Ivp\ISM\pinger.exe:*:Enabled:Toshiba Software Upgrades Pinger
"c:\\Program Files\\River Past\\Video Cleaner\\VideoCleaner.exe"= c:\program files\River Past\Video Cleaner\VideoCleaner.exe:*:Enabled:River Past Video Cleaner
R0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys [7/25/2009 5:15 PM 64160]
R0 PCTCore;PCTools KDS;c:\windows\System32\drivers\PCTCore.sys [3/8/2009 1:06 AM 130936]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [10/17/2008 8:47 PM 335752]
R1 jswpslwf;JumpStart Wireless Filter Driver;c:\windows\System32\drivers\jswpslwf.sys [8/31/2008 9:22 PM 20352]
R2 ConfigFree Service;ConfigFree Service;c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe [12/25/2007 4:07 PM 40960]
R2 dldf_device;dldf_device;c:\windows\system32\dldfcoms.exe -service –> c:\windows\system32\dldfcoms.exe -service [?]
R2 Intuit Entitlement Service v5.3;Intuit Entitlement Service v5.3;c:\program files\Common Files\Intuit\Entitlement Client\v5.3\Server\Intuit.Spc.Map.EntitlementClient.Server.Service.exe [7/29/2008 11:26 AM 20480]
R2 IntuitUpdateService;Intuit Update Service;c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe [8/18/2008 6:55 PM 13088]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/3/2009 9:49 AM 1029456]
R2 NeroRegInCDSrv;Nero Registry InCD Service;c:\program files\Nero\Nero 9\InCD\NBHRegInCDSrv.exe [9/19/2008 4:53 PM 108568]
R2 QBCRPDBService2009;QBCRPDBService2009;c:\program files\Intuit\QuickBooks Cash Register Plus 2009\bin\database\CRP1DBMgr10.exe [9/2/2007 7:08 PM 131072]
R2 QBCRPPDBService2009;QBCRPPDBService2009;c:\program files\Intuit\QuickBooks Cash Register Plus 2009\bin\database\CRP1DBMgr10.exe [9/2/2007 7:08 PM 131072]
R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [12/3/2007 7:03 PM 126976]
R3 FwLnk;FwLnk Driver;c:\windows\System32\drivers\FwLnk.sys [2/12/2008 8:55 PM 7168]
R3 QuickBooksDB19;QuickBooksDB19;c:\progra~1\Intuit\QUICKB~2\QBDBMgrN.exe -hvQuickBooksDB19 –> c:\progra~1\Intuit\QUICKB~2\QBDBMgrN.exe -hvQuickBooksDB19 [?]
S2 dldfCATSCustConnectService;dldfCATSCustConnectService;c:\windows\System32\spool\drivers\w32x86\3\dldfserv.exe [6/26/2007 1:56 AM 98952]
S3 DM150Drv;DM150Drv;c:\windows\System32\drivers\DM150Drv.sys [11/20/2008 6:10 PM 20600]
S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\Jumpstart\jswpsapi.exe [8/31/2008 9:22 PM 937984]
S3 PortEmulator;Port Emulator (Star);c:\program files\StarMicronics\TSP100\Software\20070601\portemu_umdf_tsp100u.exe [5/27/2007 1:25 PM 114688]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [3/8/2009 1:05 AM 348752]
S4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2/6/2009 10:57 AM 298776]
S4 TabletServicePen;TabletServicePen;c:\windows\System32\Pen_Tablet.exe [10/15/2008 6:16 PM 1373480]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
2009-07-27 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 14:49]
2009-07-29 c:\windows\Tasks\NeroLiveEpgUpdate-GolfMike_Pirath.job
- c:\program files\Nero\Nero 9\Nero Live\NeroLive.exe [2008-09-18 18:51]
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-TOSCDSPD - TOSCDSPD.EXE
HKCU-Run-Aim6 - (no file)
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.toshibadirect.com/dpdstart
uInternet Settings,ProxyOverride = *.local
IE: &U;ʹÓÃÄÉÃ×»úÆ÷ÈËÏÂÔز¢ÊÕ²Ø - c:\program files\NamiRobot\Data\du.html
IE: &U;????????? - c:\program files\NamiRobot\Data\du.html
IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200
IE: Download Link Using Mega Manager… - c:\program files\Megaupload\Mega Manager\mm_file.htm
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: modthesims.info
Handler: intu-help-qb2 - {84D77A00-41B5-4b8b-8ADF-86486D72E749} - c:\program files\Intuit\QuickBooks 2009\HelpAsyncPluggableProtocol.dll
DPF: {0349EF81-B9C1-4B97-86F7-7B931D0E2532} - hxxp://sticube.clubbox.co.kr/sticubeupdate/cab/NowStarter2.cab
DPF: {CBC33687-4040-49D7-A17E-F3CDF9F1D2FA} - hxxps://portal-customermanager.intuit.com/QBUpload/jsp/MobilinkSyncActiveXNew.CAB
DPF: {F6E361B4-40F3-4C90-8A95-D95E0D8CBCD4} - hxxp://www.clubbox.co.kr/neo.fld/MultiUpload.cab
FF - ProfilePath - c:\users\Pirath\AppData\Roaming\Mozilla\Firefox\Profiles\jtw9cp8w.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2231251&SearchSource;=3&q;={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://suboshiyui.livejournal.com/friends
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - component: c:\program files\MOZILLA FIREFOX\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\users\Pirath\AppData\Roaming\Mozilla\Firefox\Profiles\jtw9cp8w.default\extensions\{9cf9e3fd-dab1-40d6-9754-1de1eaa7dc1e}\components\FFExternalAlert.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Picasa2\npPicasa3.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\users\Pirath\AppData\Roaming\Mozilla\Firefox\Profiles\jtw9cp8w.default\extensions\[removed]\plugins\npTVUAx.dll
FF - plugin: c:\users\Pirath\AppData\Roaming\Mozilla\Firefox\Profiles\jtw9cp8w.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071303000006.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
**************************************************************************
catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2009-07-29 02:13
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
c:\users\Pirath\AppData\Local\Temp\catchme.dll 53248 bytes executable
c:\windows\TEMP\TMP00000001F19081E509CC45E4
scan completed successfully
hidden files: 2
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'Explorer.exe'(4460)
c:\program files\Nero\Nero 9\InCD\NBHshx.dll
c:\program files\Nero\Nero 9\InCD\NBHStr.dll
c:\program files\Common Files\Nero\AdvrCntr4\AdvrCntr4.dll
.
———————— Other Running Processes ————————
.
c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
c:\windows\System32\Ati2evxx.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\WUDFHost.exe
c:\windows\System32\Ati2evxx.exe
c:\windows\System32\agrsmsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\System32\dldfcoms.exe
c:\program files\Nero\Nero 9\InCD\InCDSrv.exe
c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\toshiba\IVP\ISM\pinger.exe
c:\program files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
c:\toshiba\IVP\swupdate\swupdtmr.exe
c:\program files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
c:\windows\System32\TODDSrv.exe
c:\program files\TOSHIBA\Power Saver\TosCoSrv.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\windows\System32\wbem\unsecapp.exe
c:\program files\TOSHIBA\ConfigFree\NDSTray.exe
c:\program files\AVG\AVG8\avgtray.exe
c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\progra~1\Intuit\QUICKB~2\QBDBMgrN.exe
c:\program files\Common Files\microsoft shared\ink\InputPersonalization.exe
c:\windows\System32\wbem\unsecapp.exe
c:\program files\TOSHIBA\ConfigFree\CFSwMgr.exe
c:\program files\Windows Defender\MpCmdRun.exe
.
**************************************************************************
.
Completion time: 2009-07-29 2:29 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-29 07:28
Pre-Run: 104,912,707,584 bytes free
Post-Run: 105,428,697,088 bytes free
Current=1 Default=1 Failed=0 LastKnownGood=16 Sets=1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16
490 — E O F — 2009-06-29 21:13
————
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:38:30 AM, on 7/29/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Dell AIO Printer 948\dldfmon.exe
C:\Program Files\Dell AIO Printer 948\memcard.exe
C:\Program Files\GridService\peer.exe
C:\Program Files\Common Files\Intuit\Sync\IntuitSyncManager.exe
C:\Users\Pirath\AppData\Roaming\Google\Google Talk\googletalk.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\PayPal Payment Request Wizard\QB US edition\OEHook.exe
C:\Program Files\Trillian\trillian.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\WerCon.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.toshibadirect.com/dpdstart
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: MegaIEMn - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [00TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [dldfmon.exe] "C:\Program Files\Dell AIO Printer 948\dldfmon.exe"
O4 - HKLM\..\Run: [MemoryCardManager] "C:\Program Files\Dell AIO Printer 948\memcard.exe"
O4 - HKLM\..\Run: [Dell AIO Printer 948 Fax Server] "C:\Program Files\Dell AIO Printer 948\fm3032.exe" /s
O4 - HKLM\..\Run: [Grid Service] "C:\Program Files\GridService\peer.exe" -n Grid
O4 - HKLM\..\Run: [Intuit SyncManager] C:\Program Files\Common Files\Intuit\Sync\IntuitSyncManager.exe startup
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [googletalk] C:\Users\Pirath\AppData\Roaming\Google\Google Talk\googletalk.exe /autostart
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKUS\S-1-5-21-2175489178-680292354-854438968-1005\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'QBPOSDBSrvUser')
O4 - HKUS\S-1-5-21-2175489178-680292354-854438968-1005\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'QBPOSDBSrvUser')
O4 - HKUS\S-1-5-21-2175489178-680292354-854438968-1005\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe (User 'QBPOSDBSrvUser')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: QuickBooks US Plugin.lnk = ?
O8 - Extra context menu item: &U;ʹÓÃÄÉÃ×»úÆ÷ÈËÏÂÔز¢ÊÕ²Ø - C:\Program Files\NamiRobot\Data\du.html
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Download Link Using Mega Manager… - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {0349EF81-B9C1-4B97-86F7-7B931D0E2532} (NowStarter2 Control) -
http://sticube.clubbox.co.kr/sticubeupdate…NowStarter2.cab
O16 - DPF: {CBC33687-4040-49D7-A17E-F3CDF9F1D2FA} (IntuitQBSync.MobilinkSyncActiveX) -
https://portal-customermanager.intuit.com/Q…cActiveXNew.CAB
O16 - DPF: {F6E361B4-40F3-4C90-8A95-D95E0D8CBCD4} (MultiUpload Control) - http://www.clubbox.co.kr/neo.fld/MultiUpload.cab
O18 - Protocol: intu-help-qb2 - {84D77A00-41B5-4B8B-8ADF-86486D72E749} - C:\Program Files\Intuit\QuickBooks 2009\HelpAsyncPluggableProtocol.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\Windows\System32\avgrsstx.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: ConfigFree Service - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: dldfCATSCustConnectService - Unknown owner - C:\Windows\system32\spool\DRIVERS\W32X86\3\\dldfserv.exe
O23 - Service: dldf_device - - C:\Windows\system32\dldfcoms.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDSrv) - Nero AG - C:\Program Files\Nero\Nero 9\InCD\InCDSrv.exe
O23 - Service: Intuit Entitlement Service v5.3 - Intuit, Inc. - C:\Program Files\Common Files\Intuit\Entitlement Client\v5.3\Server\Intuit.Spc.Map.EntitlementClient.Server.Service.exe
O23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\Jumpstart\jswpsapi.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: Nero Registry InCD Service (NeroRegInCDSrv) - Nero AG - C:\Program Files\Nero\Nero 9\InCD\NBHRegInCDSrv.exe
O23 - Service: pinger - Unknown owner - C:\TOSHIBA\IVP\ISM\pinger.exe
O23 - Service: Port Emulator (Star) (PortEmulator) - Star Micronics Co., Ltd. - C:\Program Files\StarMicronics\TSP100\Software\20070601\portemu_umdf_tsp100u.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: QBCRPDBService2009 - iAnywhere Solutions, Inc. - C:\Program Files\Intuit\QuickBooks Cash Register Plus 2009\bin\database\CRP1DBMgr10.exe
O23 - Service: QBCRPPDBService2009 - iAnywhere Solutions, Inc. - C:\Program Files\Intuit\QuickBooks Cash Register Plus 2009\bin\database\CRP1DBMgr10.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: QuickBooksDB19 - Intuit, Inc. - C:\PROGRA~1\Intuit\QUICKB~2\QBDBMgrN.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA SMART Log Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
–
End of file - 11958 bytes
