[Resolved] Wireless keyboard missing letters

Wireless keyboard keeps missing letters. Running Vista Home Premium. Driving me nuts! Have changed batteries and it is right next to optical receiver. Have used scans via Norton 360 and ThreatFire but no joy there. Any help gratefully accepted. Files copied and attached as pe instructions. Any other info required just let me know. ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2009/08/30 13:00 Program Version: Version 1.3.5.0 Windows Version: Windows Vista SP2 ================================================== Drivers ——————- Name: catchme.sys Image Path: C:\Users\office\AppData\Local\Temp\catchme.sys Address: 0x933F2000 Size: 31744 File Visible: No Signed: - Status: - Name: crcdisk.sys Image Path: C:\Windows\system32\drivers\crcdisk.sys Address: 0x885C6000 Size: 36864 File Visible: - Signed: - Status: Hidden from the Windows API! Name: dump_iaStor.sys Image Path: C:\Windows\System32\Drivers\dump_iaStor.sys Address: 0x88309000 Size: 815104 File Visible: No Signed: - Status: - Name: mchInjDrv.sys Image Path: C:\Windows\system32\Drivers\mchInjDrv.sys Address: 0xA2802000 Size: 2560 File Visible: No Signed: - Status: - Name: PROCEXP90.SYS Image Path: C:\Windows\system32\Drivers\PROCEXP90.SYS Address: 0xA2800000 Size: 6464 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\Windows\system32\drivers\rootrepeal.sys Address: 0x8C400000 Size: 49152 File Visible: No Signed: - Status: - Processes ——————- Path: System PID: 4 Status: Locked to the Windows API! Path: C:\Windows\System32\audiodg.exe PID: 1172 Status: Locked to the Windows API! SSDT ——————- #: 013 Function Name: NtAlertResumeThread Status: Hooked by "" at address 0x874b0e58 #: 014 Function Name: NtAlertThread Status: Hooked by "" at address 0x873b2df8 #: 018 Function Name: NtAllocateVirtualMemory Status: Hooked by "" at address 0x87f4e1b0 #: 021 Function Name: NtAlpcConnectPort Status: Hooked by "" at address 0x872bc008 #: 042 Function Name: NtAssignProcessToJobObject Status: Hooked by "" at address 0x877fa048 #: 067 Function Name: NtCreateMutant Status: Hooked by "" at address 0x87f56ac0 #: 077 Function Name: NtCreateSymbolicLinkObject Status: Hooked by "" at address 0x87f5bfc0 #: 078 Function Name: NtCreateThread Status: Hooked by "" at address 0x8738f678 #: 116 Function Name: NtDebugActiveProcess Status: Hooked by "" at address 0x87393da8 #: 129 Function Name: NtDuplicateObject Status: Hooked by "" at address 0x87f4e388 #: 147 Function Name: NtFreeVirtualMemory Status: Hooked by "" at address 0x87f4fa30 #: 156 Function Name: NtImpersonateAnonymousToken Status: Hooked by "" at address 0x8736b8e8 #: 158 Function Name: NtImpersonateThread Status: Hooked by "" at address 0x87362468 #: 165 Function Name: NtLoadDriver Status: Hooked by "" at address 0x872b7a78 #: 177 Function Name: NtMapViewOfSection Status: Hooked by "" at address 0x87f4f890 #: 184 Function Name: NtOpenEvent Status: Hooked by "" at address 0x8739f108 #: 194 Function Name: NtOpenProcess Status: Hooked by "" at address 0x87f4e668 #: 195 Function Name: NtOpenProcessToken Status: Hooked by "" at address 0x87332798 #: 197 Function Name: NtOpenSection Status: Hooked by "" at address 0x873b1658 #: 201 Function Name: NtOpenThread Status: Hooked by "" at address 0x87f4e4d8 #: 210 Function Name: NtProtectVirtualMemory Status: Hooked by "" at address 0x87f5acc0 #: 282 Function Name: NtResumeThread Status: Hooked by "" at address 0x87319718 #: 289 Function Name: NtSetContextThread Status: Hooked by "" at address 0x87362108 #: 305 Function Name: NtSetInformationProcess Status: Hooked by "" at address 0x87f4f638 #: 317 Function Name: NtSetSystemInformation Status: Hooked by "" at address 0x87512728 #: 330 Function Name: NtSuspendProcess Status: Hooked by "" at address 0x8738c200 #: 331 Function Name: NtSuspendThread Status: Hooked by "" at address 0x8736b850 #: 334 Function Name: NtTerminateProcess Status: Hooked by "C:\Windows\system32\drivers\TfSysMon.sys" at address 0x8df70adc #: 335 Function Name: NtTerminateThread Status: Hooked by "" at address 0x87365068 #: 348 Function Name: NtUnmapViewOfSection Status: Hooked by "" at address 0x87900810 #: 358 Function Name: NtWriteVirtualMemory Status: Hooked by "" at address 0x87f4fd40 #: 382 Function Name: NtCreateThreadEx Status: Hooked by "" at address 0x87f5a4e0 ==EOF== DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 12:52:24.26 on 30/08/2009 Internet Explorer: 8.0.6001.18813 BrowserJavaVersion: 1.6.0_15 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2046.852 [GMT 1:00] SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\taskeng.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Windows\system32\atashost.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe C:\Program Files\Kontiki\KService.exe c:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Norton 360\Engine\3.0.0.134\ccSvcHst.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\Ralink\Common\RalinkRegistryWriter.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\WUDFHost.exe C:\Program Files\Norton 360\Engine\3.0.0.134\ccSvcHst.exe C:\hp\support\hpsysdrv.exe C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Kontiki\KHost.exe C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe C:\Program Files\D-Link\D-Link Wireless N DWA-140\AirNCFG.exe C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe C:\Program Files\HP\HP Software Update\hpwuschd2.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\ehome\ehsched.exe C:\Windows\ehome\ehRecvr.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\iPod\bin\iPodService.exe C:\hp\kbd\kbd.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\Explorer.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\ThreatFire\TFTray.exe C:\Program Files\ThreatFire\TFService.exe C:\Program Files\Windows Mail\WinMail.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe C:\Windows\system32\Macromed\Flash\FlashUtil10c.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Windows\system32\DllHost.exe C:\Users\office\Desktop\dds.scr C:\Windows\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com/ mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=71&bd=Pavilion&pf=desktop uInternet Settings,ProxyOverride = *.local BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton 360\engine\3.0.0.134\coIEPlg.dll BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton 360\engine\3.0.0.134\IPSBHO.DLL BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.2.4204.1700\swg.dll BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton 360\engine\3.0.0.134\coIEPlg.dll uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun uRun: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe uRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup uRun: [kdx] c:\program files\kontiki\KHost.exe -all uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe uRun: [Sony Ericsson PC Suite] "c:\program files\sony ericsson\sony ericsson pc suite\SEPCSuite.exe" /systray /nologon mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide mRun: [hpsysdrv] c:\hp\support\hpsysdrv.exe mRun: [OsdMaestro] "c:\program files\hewlett-packard\on-screen osd indicator\OSD.exe" mRun: [KBD] c:\hp\kbd\KbdStub.EXE mRun: [RtHDVCpl] RtHDVCpl.exe mRun: [kdx] "c:\program files\kontiki\KHost.exe" -all mRun: [IAAnotif] "c:\program files\intel\intel matrix storage manager\Iaanotif.exe" mRun: [ANIWZCS2Service] c:\program files\ani\aniwzcs2 service\WZCSLDR2.exe mRun: [D-Link D-Link Wireless N DWA-140] c:\program files\d-link\d-link wireless n dwa-140\AirNCFG.exe mRun: [Google Quick Search Box] "c:\program files\google\quick search box\GoogleQuickSearchBox.exe" /autorun mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [ThreatFire] c:\program files\threatfire\TFTray.exe mRunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpoddt~1.lnk - c:\program files\hewlett-packard\digital imaging\bin\hpotdd01.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\ralink~1.lnk - c:\program files\ralink\common\RaUI.exe mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office10\EXCEL.EXE/3000 Trusted Zone: microsoft.com\office DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://www1.snapfish.co.uk/SnapfishUKActivia.cab DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-24-0.cab DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab DPF: {80AEEC0E-A2BE-4B8D-985F-350FE869DC40} - hxxp://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsVista.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-27-0.cab DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - hxxp://www.adobe.com/products/acrobat/nos/gp.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} - hxxps://signin2.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://esignal.webex.com/client/T26L/support/ieatgpc1.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} - hxxps://spinpalace.microgaming.com/spinpalace/FlashAX2.cab Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - c:\program files\norton 360\engine\3.0.0.134\CoIEPlg.dll ================= FIREFOX =================== FF - ProfilePath - c:\users\office\appdata\roaming\mozilla\firefox\profiles\b3clwva2.default\ FF - component: c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\coffplgn\components\coFFPlgn.dll FF - component: c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\ipsffplgn\components\IPSFFPl.dll FF - plugin: c:\program files\mozilla firefox\plugins\npBBCPlugin.dll FF - plugin: c:\program files\mozilla firefox\plugins\npicaN.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} ============= SERVICES / DRIVERS =============== R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\n360\0300000.086\SymEFA.sys [2009-8-17 310320] R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2009-8-29 51984] R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2009-8-29 46864] R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\n360\0300000.086\BHDrvx86.sys [2009-8-17 258608] R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\n360\0300000.086\cchpx86.sys [2009-8-17 482352] R1 IDSVix86;IDSVix86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\ipsdefs\20090810.001\IDSvix86.sys [2009-8-17 293424] R2 atashost;WebEx Service Host for Support Center;c:\windows\system32\atashost.exe [2008-4-7 19864] R2 DQLWinService;DQLWinService;c:\program files\common files\intel\inteldh\nms\adpplugins\DQLWinService.exe [2006-9-3 208896] R2 N360;Norton 360;c:\program files\norton 360\engine\3.0.0.134\ccSvcHst.exe [2009-8-17 115560] R2 RalinkRegistryWriter;Ralink Registry Writer;c:\program files\ralink\common\RalinkRegistryWriter.exe [2008-11-6 75040] R2 ThreatFire;ThreatFire;c:\program files\threatfire\tfservice.exe service –> c:\program files\threatfire\TFService.exe service [?] R3 3xHybrid;ASUSTek SAA713x PCI Card;c:\windows\system32\drivers\3xHybrid.sys [2007-1-26 2831232] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-8-26 102448] R3 SYMNDISV;Symantec Network Filter Driver;c:\windows\system32\drivers\n360\0300000.086\symndisv.sys [2009-8-17 39984] R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2009-8-29 33552] S2 IntelDHSvcConf;Intel DH Service;c:\program files\intel\inteldh\intel media server\tools\IntelDHSvcConf.exe [2006-5-10 29696] S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2009-8-8 13224] S3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista;c:\windows\system32\drivers\netr28u.sys [2008-11-6 710144] S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [2008-11-5 476416] =============== Created Last 30 ================ 2009-08-29 00:26 –d—– c:\programdata\TEMP 2009-08-29 00:26 51,984 a——- c:\windows\system32\drivers\TfFsMon.sys 2009-08-29 00:26 46,864 a——- c:\windows\system32\drivers\TfSysMon.sys 2009-08-29 00:26 33,552 a——- c:\windows\system32\drivers\TfNetMon.sys 2009-08-29 00:26 –d—– c:\programdata\PC Tools 2009-08-29 00:26 –d—– c:\program files\ThreatFire 2009-08-29 00:26 –d—– c:\progra~2\PC Tools 2009-08-28 16:24 –dsh— C:\$RECYCLE.BIN 2009-08-28 16:13 229,376 a——- c:\windows\PEV.exe 2009-08-28 16:13 161,792 a——- c:\windows\SWREG.exe 2009-08-28 16:13 98,816 a——- c:\windows\sed.exe 2009-08-28 16:12 –ds—- C:\ComboFix 2009-08-27 03:03 2,048 a——- c:\windows\system32\tzres.dll 2009-08-26 08:03 28,672 a——- c:\windows\system32\Apphlpdm.dll 2009-08-26 08:03 4,240,384 a——- c:\windows\system32\GameUXLegacyGDFs.dll 2009-08-25 23:42 –d—– c:\windows\system32\eu-ES 2009-08-25 23:42 –d—– c:\windows\system32\ca-ES 2009-08-25 23:42 –d—– c:\program files\Microsoft Games 2009-08-25 23:42 –d—– c:\windows\system32\vi-VN 2009-08-25 22:39 107,368 a——- c:\windows\system32\GEARAspi.dll 2009-08-25 22:39 23,400 a——- c:\windows\system32\drivers\GEARAspiWDM.sys 2009-08-25 22:39 –d—– c:\program files\iPod 2009-08-25 22:39 –d—– c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} 2009-08-25 22:39 –d—– c:\program files\iTunes 2009-08-25 22:39 –d—– c:\progra~2\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} 2009-08-25 22:38 –d—– c:\program files\Bonjour 2009-08-25 22:09 –d—– c:\windows\system32\EventProviders 2009-08-25 22:07 12,240,896 a——- c:\windows\system32\NlsLexicons0007.dll 2009-08-25 22:07 3,408,896 a——- c:\windows\system32\SLsvc.exe 2009-08-25 22:07 1,081,344 a——- c:\windows\system32\SLCExt.dll 2009-08-25 22:07 2,134,528 a——- c:\windows\system32\FunctionDiscoveryFolder.dll 2009-08-25 22:07 65,536 a——- c:\windows\system32\DevicePairingWizard.exe 2009-08-25 22:05 1,502,720 a——- c:\windows\system32\certmgr.dll 2009-08-25 22:04 247,808 a——- c:\windows\system32\drvstore.dll 2009-08-25 10:15 –d–r– c:\program files\Norton Support 2009-08-22 21:29 122,880 a——- c:\windows\system32\dmdskres32.dll 2009-08-19 21:14 –d—– c:\windows\pss 2009-08-19 17:49 –d—– c:\program files\common files\DivX Shared 2009-08-19 13:13 –d—– c:\program files\My Company Name 2009-08-19 13:03 –d—– c:\windows\system32\AGEIA 2009-08-17 16:38 –d—– c:\users\office\appdata\roaming\LimeWire 2009-08-17 16:37 –d—– c:\program files\LimeWire 2009-08-17 15:29 25,136 a—-r– c:\windows\system32\drivers\SymIMV.sys 2009-08-17 15:29 124,464 a——- c:\windows\system32\drivers\SYMEVENT.SYS 2009-08-17 15:29 7,386 a——- c:\windows\system32\drivers\SYMEVENT.CAT 2009-08-17 15:29 805 a——- c:\windows\system32\drivers\SYMEVENT.INF 2009-08-17 15:29 –d—– c:\program files\Symantec 2009-08-17 15:28 –d—– c:\windows\system32\drivers\N360 2009-08-17 15:28 –d—– c:\program files\Norton 360 2009-08-17 15:28 –d—– c:\program files\NortonInstaller 2009-08-15 12:19 –d—– c:\users\office\appdata\roaming\HpUpdate 2009-08-15 12:19 –d—– c:\windows\Hewlett-Packard 2009-08-13 10:37 1,259,008 a——- c:\windows\system32\lsasrv.dll 2009-08-13 10:37 499,712 a——- c:\windows\system32\kerberos.dll 2009-08-13 10:37 218,624 a——- c:\windows\system32\msv1_0.dll 2009-08-13 10:37 270,848 a——- c:\windows\system32\schannel.dll 2009-08-13 10:37 175,104 a——- c:\windows\system32\wdigest.dll 2009-08-13 10:37 439,864 a——- c:\windows\system32\drivers\ksecdd.sys 2009-08-13 10:37 72,704 a——- c:\windows\system32\secur32.dll 2009-08-13 10:37 9,728 a——- c:\windows\system32\lsass.exe 2009-08-13 10:25 3,840 a——- c:\windows\system32\drivers\BANTExt.sys 2009-08-13 10:25 –d—– c:\program files\Belarc 2009-08-12 15:43 2,066,432 a——- c:\windows\system32\mstscax.dll 2009-08-12 15:43 136,192 a——- c:\windows\system32\aaclient.dll 2009-08-12 15:43 53,248 a——- c:\windows\system32\tsgqec.dll 2009-08-12 15:43 160,256 a——- c:\windows\system32\wkssvc.dll 2009-08-12 15:43 71,680 a——- c:\windows\system32\atl.dll 2009-08-12 15:43 91,136 a——- c:\windows\system32\avifil32.dll 2009-08-12 15:43 71,168 a——- c:\windows\system32\telnet.exe 2009-08-12 15:42 313,344 a——- c:\windows\system32\wmpdxm.dll 2009-08-12 15:42 4,096 a——- c:\windows\system32\msdxm.ocx 2009-08-12 15:42 4,096 a——- c:\windows\system32\dxmasf.dll 2009-08-12 15:42 7,680 a——- c:\windows\system32\spwmp.dll 2009-08-12 15:42 8,147,456 a——- c:\windows\system32\wmploc.DLL 2009-08-12 15:42 43,520 a——- c:\windows\system32\msdxm.tlb 2009-08-12 15:42 18,432 a——- c:\windows\system32\amcompat.tlb 2009-08-08 16:13 1,112,288 a——- c:\windows\system32\WdfCoInstaller01007.dll 2009-08-08 16:13 25,512 a——- c:\windows\system32\drivers\ggsemc.sys 2009-08-08 16:13 13,224 a——- c:\windows\system32\drivers\ggflt.sys ==================== Find3M ==================== 2009-08-25 23:49 143,360 a——- c:\windows\inf\infstrng.dat 2009-08-25 23:49 143,360 a——- c:\windows\inf\infstor.dat 2009-08-25 23:49 51,200 a——- c:\windows\inf\infpub.dat 2009-08-25 23:42 665,600 a——- c:\windows\inf\drvindex.dat 2009-08-22 14:31 26,618 a——- c:\users\office\appdata\roaming\wklnhst.dat 2009-07-25 05:23 411,368 a——- c:\windows\system32\deploytk.dll 2009-07-24 17:48 0 a—h— c:\windows\system32\drivers\Msft_Kernel_ggsemc_01007.Wdf 2009-07-21 22:52 915,456 a——- c:\windows\system32\wininet.dll 2009-07-21 22:47 109,056 a——- c:\windows\system32\iesysprep.dll 2009-07-21 22:47 71,680 a——- c:\windows\system32\iesetup.dll 2009-07-21 21:13 133,632 a——- c:\windows\system32\ieUnatt.exe 2009-06-27 21:13 3,440,038 a——- c:\users\office\hq.exe 2009-06-15 15:53 156,672 a——- c:\windows\system32\t2embed.dll 2009-06-15 15:52 23,552 a——- c:\windows\system32\lpk.dll 2009-06-15 15:52 72,704 a——- c:\windows\system32\fontsub.dll 2009-06-15 15:51 10,240 a——- c:\windows\system32\dciman32.dll 2009-06-15 13:42 289,792 a——- c:\windows\system32\atmfd.dll 2009-06-05 12:56 173,056 a——- c:\windows\apppatch\AcXtrnal.dll 2009-06-05 12:56 2,159,616 a——- c:\windows\apppatch\AcGenral.dll 2009-06-05 12:56 542,720 a——- c:\windows\apppatch\AcLayers.dll 2009-06-05 12:56 458,752 a——- c:\windows\apppatch\AcSpecfc.dll 2009-02-19 16:47 60,744 a——- c:\users\office\g2mdlhlpx.exe 2008-11-13 21:56 69,544 a——- c:\users\office\appdata\roaming\GDIPFONTCACHEV1.DAT 2008-07-23 10:27 174 a–sh— c:\program files\desktop.ini 2007-12-12 20:06 1,786,691 a——- c:\users\office\HiNetRecorderSetup.exe 2006-11-02 13:42 287,440 a——- c:\windows\inf\perflib\0409\perfi.dat 2006-11-02 13:42 287,440 a——- c:\windows\inf\perflib\0409\perfh.dat 2006-11-02 13:42 30,674 a——- c:\windows\inf\perflib\0409\perfd.dat 2006-11-02 13:42 30,674 a——- c:\windows\inf\perflib\0409\perfc.dat 2006-11-02 10:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat 2006-11-02 10:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat 2006-11-02 10:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat 2006-11-02 10:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat 1999-06-25 10:55 149,504 a——- c:\program files\UNWISE.EXE ============= FINISH: 12:53:34.20 ===============

Hi, have run combofix see text log below. Still not sure what Hijack this file is or how to do it? PC running ok although after combofix had finished I couldn't access my email or the internet . This was resolved after rebooting.

ComboFix 09-09-03.02 - office 04/09/2009 18:00.2.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2046.1074 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\office\AppData\Roaming\02000000502f5a34660C.manifest
c:\users\office\AppData\Roaming\02000000502f5a34660O.manifest
c:\users\office\AppData\Roaming\02000000502f5a34660P.manifest
c:\users\office\AppData\Roaming\02000000502f5a34660S.manifest

.
((((((((((((((((((((((((( Files Created from 2009-08-04 to 2009-09-04 )))))))))))))))))))))))))))))))
.

2009-09-04 17:09 . 2009-09-04 17:09 ——– d—–w- c:\users\IUSR_NMPR\AppData\Local\temp
2009-09-04 17:09 . 2009-09-04 17:09 ——– d—–w- c:\users\Default\AppData\Local\temp
2009-09-03 17:28 . 2009-09-03 17:28 ——– d—–w- c:\users\office\AppData\Roaming\Malwarebytes
2009-09-03 17:27 . 2009-08-03 12:36 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-03 17:27 . 2009-09-03 17:27 ——– d—–w- c:\programdata\Malwarebytes
2009-09-03 17:27 . 2009-09-03 17:28 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-09-03 17:27 . 2009-08-03 12:36 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-09-02 22:46 . 2009-08-29 00:14 28672 —-a-w- c:\windows\system32\Apphlpdm.dll
2009-09-02 22:46 . 2009-08-29 00:27 4240384 —-a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-09-01 23:15 . 2009-09-01 23:15 ——– d—–w- C:\Kontiki
2009-08-30 10:49 . 2009-08-30 10:49 ——– d—–w- c:\program files\ERUNT
2009-08-28 23:26 . 2009-06-19 13:37 46864 —-a-w- c:\windows\system32\drivers\TfSysMon.sys
2009-08-28 23:26 . 2009-06-19 13:37 33552 —-a-w- c:\windows\system32\drivers\TfNetMon.sys
2009-08-28 23:26 . 2009-06-19 13:37 51984 —-a-w- c:\windows\system32\drivers\TfFsMon.sys
2009-08-28 23:26 . 2009-08-28 23:37 ——– d—–w- c:\program files\ThreatFire
2009-08-28 23:26 . 2009-08-28 23:26 ——– d—–w- c:\programdata\PC Tools
2009-08-27 02:03 . 2009-06-22 10:09 2048 —-a-w- c:\windows\system32\tzres.dll
2009-08-25 22:42 . 2009-08-25 22:42 ——– d—–w- c:\windows\system32\ca-ES
2009-08-25 22:42 . 2009-08-25 22:42 ——– d—–w- c:\windows\system32\eu-ES
2009-08-25 22:42 . 2009-08-25 22:42 ——– d—–w- c:\program files\Microsoft Games
2009-08-25 22:42 . 2009-08-25 22:42 ——– d—–w- c:\windows\system32\vi-VN
2009-08-25 21:40 . 2009-08-25 21:40 ——– d—–w- c:\program files\Apple Software Update
2009-08-25 21:39 . 2009-03-19 15:32 23400 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-08-25 21:39 . 2008-04-17 11:12 107368 —-a-w- c:\windows\system32\GEARAspi.dll
2009-08-25 21:39 . 2009-08-25 21:39 ——– d—–w- c:\program files\iPod
2009-08-25 21:39 . 2009-08-25 21:39 ——– d—–w- c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-08-25 21:39 . 2009-08-25 21:39 ——– d—–w- c:\program files\iTunes
2009-08-25 21:38 . 2009-08-25 21:38 ——– d—–w- c:\program files\Bonjour
2009-08-25 21:37 . 2009-08-25 21:38 ——– d—–w- c:\program files\QuickTime
2009-08-25 21:09 . 2009-08-25 21:09 ——– d—–w- c:\windows\system32\EventProviders
2009-08-25 21:07 . 2009-04-11 05:03 12240896 —-a-w- c:\windows\system32\NlsLexicons0007.dll
2009-08-25 21:07 . 2009-04-11 06:28 1081344 —-a-w- c:\windows\system32\SLCExt.dll
2009-08-25 21:07 . 2009-04-11 06:27 3408896 —-a-w- c:\windows\system32\SLsvc.exe
2009-08-25 21:07 . 2009-04-11 06:28 2134528 —-a-w- c:\windows\system32\FunctionDiscoveryFolder.dll
2009-08-25 21:07 . 2009-04-11 06:27 65536 —-a-w- c:\windows\system32\DevicePairingWizard.exe
2009-08-25 21:05 . 2009-04-11 06:32 43496 —-a-w- c:\windows\system32\drivers\pciidex.sys
2009-08-25 21:04 . 2009-04-11 06:28 247808 —-a-w- c:\windows\system32\drvstore.dll
2009-08-25 09:15 . 2009-08-25 09:15 ——– d—–r- c:\program files\Norton Support
2009-08-25 07:26 . 2009-08-25 07:26 ——– d—–w- c:\users\office\AppData\Local\Symantec
2009-08-19 16:49 . 2009-08-25 08:42 ——– d—–w- c:\program files\Common Files\DivX Shared
2009-08-19 12:13 . 2009-08-19 12:13 ——– d—–w- c:\program files\My Company Name
2009-08-19 12:03 . 2009-08-25 08:42 ——– d—–w- c:\windows\system32\AGEIA
2009-08-19 12:03 . 2009-08-25 08:42 ——– d—–w- c:\program files\AGEIA Technologies
2009-08-17 15:38 . 2009-08-23 22:07 ——– d—–w- c:\users\office\AppData\Roaming\LimeWire
2009-08-17 15:37 . 2009-08-25 08:42 ——– d—–w- c:\program files\LimeWire
2009-08-17 14:29 . 2009-08-17 14:29 25136 —-a-r- c:\windows\system32\drivers\SymIMV.sys
2009-08-17 14:29 . 2009-08-25 08:42 ——– d—–w- c:\program files\Symantec
2009-08-17 14:29 . 2009-08-17 14:29 124464 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-08-17 14:28 . 2009-08-31 22:29 ——– d—–w- c:\windows\system32\drivers\N360
2009-08-17 14:28 . 2009-08-25 08:42 ——– d—–w- c:\program files\Norton 360
2009-08-17 14:28 . 2009-08-17 14:28 ——– d—–w- c:\program files\NortonInstaller
2009-08-15 11:19 . 2009-08-25 08:28 ——– d—–w- c:\users\office\AppData\Roaming\HpUpdate
2009-08-15 11:19 . 2009-08-25 08:42 ——– d—–w- c:\windows\Hewlett-Packard
2009-08-13 09:37 . 2009-06-15 14:52 1259008 —-a-w- c:\windows\system32\lsasrv.dll
2009-08-13 09:37 . 2009-06-15 14:52 499712 —-a-w- c:\windows\system32\kerberos.dll
2009-08-13 09:37 . 2009-06-15 14:53 218624 —-a-w- c:\windows\system32\msv1_0.dll
2009-08-13 09:37 . 2009-06-15 14:54 175104 —-a-w- c:\windows\system32\wdigest.dll
2009-08-13 09:37 . 2009-06-15 14:53 270848 —-a-w- c:\windows\system32\schannel.dll
2009-08-13 09:37 . 2009-06-15 23:15 439864 —-a-w- c:\windows\system32\drivers\ksecdd.sys
2009-08-13 09:37 . 2009-06-15 14:53 72704 —-a-w- c:\windows\system32\secur32.dll
2009-08-13 09:37 . 2009-06-15 12:48 9728 —-a-w- c:\windows\system32\lsass.exe
2009-08-13 09:25 . 2009-08-13 09:25 ——– d—–w- c:\program files\Belarc
2009-08-13 09:25 . 2005-04-07 16:18 3840 —-a-w- c:\windows\system32\drivers\BANTExt.sys
2009-08-12 14:43 . 2009-06-04 12:07 2066432 —-a-w- c:\windows\system32\mstscax.dll
2009-08-12 14:43 . 2009-04-11 06:28 53248 —-a-w- c:\windows\system32\tsgqec.dll
2009-08-12 14:43 . 2009-04-11 06:28 136192 —-a-w- c:\windows\system32\aaclient.dll
2009-08-12 14:43 . 2009-06-10 11:42 160256 —-a-w- c:\windows\system32\wkssvc.dll
2009-08-12 14:43 . 2009-07-17 13:54 71680 —-a-w- c:\windows\system32\atl.dll
2009-08-12 14:43 . 2009-06-10 11:38 91136 —-a-w- c:\windows\system32\avifil32.dll
2009-08-12 14:43 . 2009-06-10 09:43 71168 —-a-w- c:\windows\system32\telnet.exe
2009-08-12 14:42 . 2009-07-15 12:39 313344 —-a-w- c:\windows\system32\wmpdxm.dll
2009-08-12 14:42 . 2009-07-15 12:39 4096 —-a-w- c:\windows\system32\dxmasf.dll
2009-08-12 14:42 . 2009-07-15 12:39 7680 —-a-w- c:\windows\system32\spwmp.dll
2009-08-12 14:42 . 2009-07-15 12:40 8147456 —-a-w- c:\windows\system32\wmploc.DLL
2009-08-08 15:13 . 2009-08-08 15:13 25512 —-a-w- c:\windows\system32\drivers\ggsemc.sys
2009-08-08 15:13 . 2009-08-08 15:13 13224 —-a-w- c:\windows\system32\drivers\ggflt.sys
2009-08-08 15:13 . 2009-08-08 15:13 1112288 —-a-w- c:\windows\system32\WdfCoInstaller01007.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-04 17:09 . 2008-01-31 00:24 ——– d—–w- c:\programdata\Kontiki
2009-09-03 23:17 . 2007-08-22 13:16 27070 —-a-w- c:\users\office\AppData\Roaming\wklnhst.dat
2009-08-26 07:35 . 2007-01-25 08:39 ——– d—–w- c:\program files\HP
2009-08-25 23:03 . 2007-08-28 09:18 ——– d—–w- c:\program files\Java
2009-08-25 22:42 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Sidebar
2009-08-25 22:42 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Journal
2009-08-25 22:42 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Collaboration
2009-08-25 22:42 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Calendar
2009-08-25 22:42 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2009-08-25 22:42 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Photo Gallery
2009-08-25 22:42 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Defender
2009-08-25 21:39 . 2008-02-08 12:42 ——– d—–w- c:\program files\Common Files\Apple
2009-08-25 08:47 . 2007-08-06 11:39 ——– d—–w- c:\programdata\NVIDIA
2009-08-25 08:42 . 2009-02-26 08:30 ——– d—–w- c:\programdata\{7B6BA59A-FB0E-4499-8536-A7420338BF3B}
2009-08-25 08:42 . 2009-03-09 17:44 ——– d—–w- c:\program files\Microsoft Money
2009-08-25 08:42 . 2007-01-25 08:40 ——– d—–w- c:\program files\Microsoft Works
2009-08-25 08:42 . 2007-11-06 19:20 ——– d—–w- c:\program files\DivX
2009-08-25 08:42 . 2007-08-21 12:07 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-08-25 08:42 . 2007-01-25 08:44 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-08-25 08:42 . 2007-01-25 08:38 ——– d—–w- c:\program files\Common Files\SureThing Shared
2009-08-25 07:30 . 2007-09-16 16:00 2032 —-a-w- c:\users\office\AppData\Local\d3d9caps.dat
2009-08-25 07:21 . 2009-01-27 12:32 ——– d—–w- c:\programdata\Norton
2009-08-19 12:13 . 2007-01-25 08:35 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-08-17 14:29 . 2009-08-17 14:29 805 —-a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-08-17 14:29 . 2009-08-17 14:29 7386 —-a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-08-17 14:28 . 2009-01-27 13:04 ——– d—–w- c:\programdata\Symantec
2009-08-08 15:09 . 2009-07-24 15:47 ——– d—–w- c:\program files\Sony Ericsson
2009-08-05 13:04 . 2009-03-29 10:56 ——– d—–w- c:\program files\Microsoft Silverlight
2009-07-29 07:43 . 2009-07-24 15:51 ——– d—–w- c:\program files\Avanquest update
2009-07-27 22:30 . 2009-07-27 22:30 ——– d—–w- c:\program files\NetObjects
2009-07-25 15:34 . 2007-01-25 08:43 ——– d—–w- c:\program files\Google
2009-07-25 04:23 . 2008-12-18 22:00 411368 —-a-w- c:\windows\system32\deploytk.dll
2009-07-24 16:48 . 2009-07-24 16:48 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_ggsemc_01007.Wdf
2009-07-24 15:51 . 2009-07-24 15:51 ——– d—–w- c:\programdata\BVRP Software
2009-07-24 15:47 . 2009-07-24 15:47 ——– d—–w- c:\programdata\Sony Ericsson
2009-07-21 21:52 . 2009-07-29 10:45 915456 —-a-w- c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-07-29 10:45 109056 —-a-w- c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-07-29 10:45 71680 —-a-w- c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-07-29 10:45 133632 —-a-w- c:\windows\system32\ieUnatt.exe
2009-07-19 23:59 . 2009-07-19 23:59 ——– d—–w- c:\users\office\AppData\Roaming\aerix
2009-07-16 02:12 . 2009-07-15 12:44 ——– d—–w- c:\programdata\NOS
2009-07-16 02:12 . 2009-07-15 12:44 ——– d—–w- c:\program files\NOS
2009-06-27 20:13 . 2009-06-27 20:13 3440038 —-a-w- c:\users\office\hq.exe
2009-06-15 14:53 . 2009-07-15 10:12 156672 —-a-w- c:\windows\system32\t2embed.dll
2009-06-15 14:52 . 2009-07-15 10:12 23552 —-a-w- c:\windows\system32\lpk.dll
2009-06-15 14:52 . 2009-07-15 10:12 72704 —-a-w- c:\windows\system32\fontsub.dll
2009-06-15 14:51 . 2009-07-15 10:12 10240 —-a-w- c:\windows\system32\dciman32.dll
2009-06-15 12:42 . 2009-07-15 10:12 289792 —-a-w- c:\windows\system32\atmfd.dll
1999-06-25 09:55 . 2007-08-06 15:13 149504 —-a-w- c:\program files\UNWISE.EXE
2008-02-24 02:08 . 2008-08-14 13:40 324976 —-a-w- c:\program files\mozilla firefox\components\coFFPlgn.dll
2007-11-09 16:10 . 2007-11-09 16:10 30288 —-a-w- c:\program files\mozilla firefox\plugins\cgpcfg.dll
2007-11-09 16:10 . 2007-11-09 16:10 79440 —-a-w- c:\program files\mozilla firefox\plugins\CgpCore.dll
2007-11-09 16:10 . 2007-11-09 16:10 75344 —-a-w- c:\program files\mozilla firefox\plugins\confmgr.dll
2007-11-09 16:10 . 2007-11-09 16:10 140880 —-a-w- c:\program files\mozilla firefox\plugins\ctxmui.dll
2007-11-09 16:10 . 2007-11-09 16:10 42576 —-a-w- c:\program files\mozilla firefox\plugins\icafile.dll
2007-11-09 16:10 . 2007-11-09 16:10 50768 —-a-w- c:\program files\mozilla firefox\plugins\icalogon.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 —-a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2007-11-09 16:10 . 2007-11-09 16:10 34384 —-a-w- c:\program files\mozilla firefox\plugins\logging.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 —-a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2007-06-21 17:39 . 2007-06-21 17:39 685640 —-a-w- c:\program files\mozilla firefox\plugins\sslsdk_b.dll
2007-11-09 16:11 . 2007-11-09 16:11 30288 —-a-w- c:\program files\mozilla firefox\plugins\TcpPServ.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-08-28_15.21.59 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-09-02 22:46 . 2009-08-29 00:19 28672 c:\windows\winsxs\x86_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_6.0.6002.22213_none_846a2103770ca798\Apphlpdm.dll
+ 2009-09-02 22:46 . 2009-08-29 00:14 28672 c:\windows\winsxs\x86_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_6.0.6002.18101_none_83e953905de8b92f\Apphlpdm.dll
+ 2009-09-02 22:46 . 2009-08-28 12:24 28672 c:\windows\winsxs\x86_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_6.0.6001.22509_none_829480c379d8ce8d\Apphlpdm.dll
+ 2009-09-02 22:46 . 2009-08-28 12:39 28672 c:\windows\winsxs\x86_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_6.0.6001.18320_none_81ec3fa060d3856f\Apphlpdm.dll
+ 2009-09-02 22:46 . 2009-08-29 03:32 28672 c:\windows\winsxs\x86_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_6.0.6000.21117_none_80a147d97cbc5cfa\Apphlpdm.dll
+ 2009-09-02 22:46 . 2009-08-29 03:40 28672 c:\windows\winsxs\x86_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_6.0.6000.16917_none_8017d2ec639e89ee\Apphlpdm.dll
+ 2007-01-25 08:35 . 2009-09-03 17:53 59694 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2009-09-03 17:53 78368 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2007-08-06 13:23 . 2009-09-03 17:53 12446 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1843872254-2617603050-881824495-1001_UserData.bin
+ 2009-08-31 22:29 . 2009-08-22 08:14 48688 c:\windows\System32\drivers\N360\0305020.00B\symndisv.sys
+ 2009-08-31 22:29 . 2009-08-22 08:14 36400 c:\windows\System32\drivers\N360\0305020.00B\symndis.sys
+ 2009-08-31 22:29 . 2009-08-22 08:14 33072 c:\windows\System32\drivers\N360\0305020.00B\symids.sys
+ 2009-08-31 22:29 . 2009-08-22 08:14 89904 c:\windows\System32\drivers\N360\0305020.00B\symfw.sys
+ 2009-08-31 22:29 . 2009-08-22 08:14 43696 c:\windows\System32\drivers\N360\0305020.00B\srtspx.sys
- 2007-03-18 21:23 . 2009-08-28 15:08 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2007-03-18 21:23 . 2009-09-04 16:55 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2007-03-18 21:23 . 2009-08-28 15:08 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2007-03-18 21:23 . 2009-09-04 16:55 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2007-08-06 11:24 . 2009-08-18 21:15 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2007-08-06 11:24 . 2009-09-01 08:07 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2007-08-06 11:24 . 2009-08-18 21:15 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2007-08-06 11:24 . 2009-09-01 08:07 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2007-08-06 11:24 . 2009-09-01 08:07 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2007-08-06 11:24 . 2009-08-18 21:15 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-09-02 22:46 . 2009-08-29 00:24 2560 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c1_31bf3856ad364e35_6.0.6002.22213_none_0e8a7f670895bd4d\AcRes.dll
+ 2006-11-02 07:11 . 2006-11-02 07:11 2560 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c1_31bf3856ad364e35_6.0.6002.18101_none_0e09b1f3ef71cee4\AcRes.dll
+ 2009-09-02 22:46 . 2009-08-28 10:09 2560 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c1_31bf3856ad364e35_6.0.6001.22509_none_0cb4df270b61e442\AcRes.dll
+ 2008-05-28 03:08 . 2008-03-08 01:58 2560 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c1_31bf3856ad364e35_6.0.6001.18320_none_0c0c9e03f25c9b24\AcRes.dll
+ 2009-09-02 22:46 . 2009-08-28 23:11 2560 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c1_31bf3856ad364e35_6.0.6000.21117_none_0ac1a63d0e4572af\AcRes.dll
+ 2009-09-02 22:46 . 2009-08-28 23:15 2560 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c1_31bf3856ad364e35_6.0.6000.16917_none_0a38314ff5279fa3\AcRes.dll
- 2007-08-23 13:44 . 2009-08-27 05:23 4434 c:\windows\System32\WDI\ERCQueuedResolutions.dat
+ 2007-08-23 13:44 . 2009-09-03 02:08 4434 c:\windows\System32\WDI\ERCQueuedResolutions.dat
- 2009-08-27 05:25 . 2009-08-27 05:25 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-09-03 17:51 . 2009-09-03 17:51 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-09-03 17:51 . 2009-09-03 17:51 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-08-27 05:25 . 2009-08-27 05:25 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-09-02 22:46 . 2009-08-29 02:46 173056 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6002.22213_none_0e8e808f089222a9\AcXtrnal.dll
+ 2009-09-02 22:46 . 2009-08-29 02:46 542720 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6002.22213_none_0e8e808f089222a9\AcLayers.dll
+ 2009-09-02 22:46 . 2009-08-29 02:30 173056 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6002.18101_none_0e0db31bef6e3440\AcXtrnal.dll
+ 2009-09-02 22:46 . 2009-08-29 02:30 542720 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6002.18101_none_0e0db31bef6e3440\AcLayers.dll
+ 2009-09-02 22:46 . 2009-08-28 12:24 173056 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6001.22509_none_0cb8e04f0b5e499e\AcXtrnal.dll
+ 2009-09-02 22:46 . 2009-08-28 12:24 541696 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6001.22509_none_0cb8e04f0b5e499e\AcLayers.dll
+ 2009-09-02 22:46 . 2009-08-28 12:39 173056 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6001.18320_none_0c109f2bf2590080\AcXtrnal.dll
+ 2009-09-02 22:46 . 2009-08-28 12:38 541696 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6001.18320_none_0c109f2bf2590080\AcLayers.dll
+ 2009-09-02 22:46 . 2009-08-29 03:31 173056 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6000.21117_none_0ac5a7650e41d80b\AcXtrnal.dll
+ 2009-09-02 22:46 . 2009-08-29 03:31 537600 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6000.21117_none_0ac5a7650e41d80b\AcLayers.dll
+ 2009-09-02 22:46 . 2009-08-29 03:40 173056 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6000.16917_none_0a3c3277f52404ff\AcXtrnal.dll
+ 2009-09-02 22:46 . 2009-08-29 03:40 537600 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.0.6000.16917_none_0a3c3277f52404ff\AcLayers.dll
+ 2009-09-02 22:46 . 2009-08-29 02:46 458752 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c4_31bf3856ad364e35_6.0.6002.22213_none_0e8d804508930952\AcSpecfc.dll
+ 2009-09-02 22:46 . 2009-08-29 02:30 458752 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c4_31bf3856ad364e35_6.0.6002.18101_none_0e0cb2d1ef6f1ae9\AcSpecfc.dll
+ 2009-09-02 22:46 . 2009-08-28 12:24 459776 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c4_31bf3856ad364e35_6.0.6001.22509_none_0cb7e0050b5f3047\AcSpecfc.dll
+ 2009-09-02 22:46 . 2009-08-28 12:38 459776 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c4_31bf3856ad364e35_6.0.6001.18320_none_0c0f9ee1f259e729\AcSpecfc.dll
+ 2009-09-02 22:46 . 2009-08-29 03:31 450560 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c4_31bf3856ad364e35_6.0.6000.21117_none_0ac4a71b0e42beb4\AcSpecfc.dll
+ 2009-09-02 22:46 . 2009-08-29 03:40 449024 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c4_31bf3856ad364e35_6.0.6000.16917_none_0a3b322df524eba8\AcSpecfc.dll
+ 2008-07-23 12:08 . 2009-09-04 05:39 411772 c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_FastS4.bin
+ 2006-11-02 10:33 . 2009-09-03 17:56 600602 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2009-08-27 05:30 600602 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2009-08-27 05:30 106004 c:\windows\System32\perfc009.dat
+ 2006-11-02 10:33 . 2009-09-03 17:56 106004 c:\windows\System32\perfc009.dat
+ 2009-08-31 22:29 . 2009-08-22 08:14 217136 c:\windows\System32\drivers\N360\0305020.00B\symtdi.sys
+ 2009-08-31 22:29 . 2009-08-22 08:14 310320 c:\windows\System32\drivers\N360\0305020.00B\SymEFA.sys
+ 2009-08-31 22:29 . 2009-08-22 08:14 308272 c:\windows\System32\drivers\N360\0305020.00B\srtsp.sys
+ 2009-08-31 22:29 . 2009-08-22 08:14 482432 c:\windows\System32\drivers\N360\0305020.00B\cchpx86.sys
+ 2009-08-31 22:29 . 2009-08-22 08:14 259632 c:\windows\System32\drivers\N360\0305020.00B\BHDrvx86.sys
+ 2009-06-16 14:09 . 2009-09-04 09:31 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2009-06-16 14:09 . 2009-08-28 09:41 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2007-03-18 21:23 . 2009-09-04 16:55 163840 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2007-03-18 21:23 . 2009-08-28 15:08 163840 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-08-30 10:50 . 2005-10-20 11:02 163328 c:\windows\ERDNT\30-08-2009\ERDNT.EXE
- 2009-08-26 07:03 . 2009-06-05 11:56 173056 c:\windows\AppPatch\AcXtrnal.dll
+ 2009-09-02 22:46 . 2009-08-29 02:30 173056 c:\windows\AppPatch\AcXtrnal.dll
- 2009-08-26 07:03 . 2009-06-05 11:56 458752 c:\windows\AppPatch\AcSpecfc.dll
+ 2009-09-02 22:46 . 2009-08-29 02:30 458752 c:\windows\AppPatch\AcSpecfc.dll
+ 2009-09-02 22:46 . 2009-08-29 02:30 542720 c:\windows\AppPatch\AcLayers.dll
- 2009-08-26 07:03 . 2009-06-05 11:56 542720 c:\windows\AppPatch\AcLayers.dll
+ 2009-09-02 22:46 . 2009-08-29 00:34 4240384 c:\windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6002.22213_none_4468964bd78652fb\GameUXLegacyGDFs.dll
+ 2009-09-02 22:46 . 2009-08-29 02:47 1696256 c:\windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6002.22213_none_4468964bd78652fb\gameux.dll
+ 2009-09-02 22:46 . 2009-08-29 00:27 4240384 c:\windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6002.18101_none_43e7c8d8be626492\GameUXLegacyGDFs.dll
+ 2009-08-25 21:06 . 2009-04-11 06:28 1696768 c:\windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6002.18101_none_43e7c8d8be626492\gameux.dll
+ 2009-09-02 22:46 . 2009-08-28 10:19 4240384 c:\windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6001.22509_none_4292f60bda5279f0\GameUXLegacyGDFs.dll
+ 2009-09-02 22:46 . 2009-08-28 12:25 1695744 c:\windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6001.22509_none_4292f60bda5279f0\gameux.dll
+ 2009-09-02 22:46 . 2009-08-28 10:15 4240384 c:\windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6001.18320_none_41eab4e8c14d30d2\GameUXLegacyGDFs.dll
+ 2008-05-28 03:08 . 2008-03-08 04:21 1695744 c:\windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6001.18320_none_41eab4e8c14d30d2\gameux.dll
+ 2009-09-02 22:46 . 2009-08-28 23:26 4247552 c:\windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6000.21117_none_409fbd21dd36085d\GameUXLegacyGDFs.dll
+ 2009-09-02 22:46 . 2009-08-29 03:33 1686528 c:\windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6000.21117_none_409fbd21dd36085d\gameux.dll
+ 2009-09-02 22:46 . 2009-08-28 23:31 4247552 c:\windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6000.16917_none_40164834c4183551\GameUXLegacyGDFs.dll
+ 2009-09-02 22:46 . 2009-08-29 03:41 1686528 c:\windows\winsxs\x86_microsoft-windows-gameexplorer_31bf3856ad364e35_6.0.6000.16917_none_40164834c4183551\gameux.dll
+ 2009-09-02 22:46 . 2009-08-29 02:46 2159616 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c3_31bf3856ad364e35_6.0.6002.22213_none_0e8c7ffb0893effb\AcGenral.dll
+ 2009-09-02 22:46 . 2009-08-29 02:30 2159616 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c3_31bf3856ad364e35_6.0.6002.18101_none_0e0bb287ef700192\AcGenral.dll
+ 2009-09-02 22:46 . 2009-08-28 12:24 2157056 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c3_31bf3856ad364e35_6.0.6001.22509_none_0cb6dfbb0b6016f0\AcGenral.dll
+ 2009-09-02 22:46 . 2009-08-28 12:38 2153984 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c3_31bf3856ad364e35_6.0.6001.18320_none_0c0e9e97f25acdd2\AcGenral.dll
+ 2009-09-02 22:46 . 2009-08-29 03:31 2144768 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c3_31bf3856ad364e35_6.0.6000.21117_none_0ac3a6d10e43a55d\AcGenral.dll
+ 2009-09-02 22:46 . 2009-08-29 03:40 2143744 c:\windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c3_31bf3856ad364e35_6.0.6000.16917_none_0a3a31e3f525d251\AcGenral.dll
+ 2006-11-02 10:22 . 2009-09-03 17:49 6553600 c:\windows\System32\SMI\Store\Machine\schema.dat
- 2006-11-02 10:22 . 2009-08-27 02:12 6553600 c:\windows\System32\SMI\Store\Machine\schema.dat
+ 2009-08-30 10:50 . 2009-08-30 10:50 3080192 c:\windows\ERDNT\30-08-2009\Users\00000002\UsrClass.dat
+ 2009-08-30 10:50 . 2009-08-30 10:50 4767744 c:\windows\ERDNT\30-08-2009\Users\00000001\ntuser.dat
- 2009-08-26 07:03 . 2009-06-05 11:56 2159616 c:\windows\AppPatch\AcGenral.dll
+ 2009-09-02 22:46 . 2009-08-29 02:30 2159616 c:\windows\AppPatch\AcGenral.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2005-02-17 221184]
"kdx"="c:\program files\Kontiki\KHost.exe" [2008-02-27 1032376]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-23 39408]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-07-02 393216]
"WindowsWelcomeCenter"="oobefldr.dll" - c:\windows\System32\oobefldr.dll [2009-04-11 2153472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2006-09-28 65536]
"OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2006-11-20 155648]
"KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]
"kdx"="c:\program files\Kontiki\KHost.exe" [2008-02-27 1032376]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2008-06-02 178712]
"ANIWZCS2Service"="c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2007-01-19 49152]
"D-Link D-Link Wireless N DWA-140"="c:\program files\D-Link\D-Link Wireless N DWA-140\AirNCFG.exe" [2007-08-20 1671168]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-07-25 122368]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-27 13687328]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-27 92704]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"ThreatFire"="c:\program files\ThreatFire\TFTray.exe" [2009-06-19 259344]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-01-15 4874240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-25 44136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Program Neighborhood Agent.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Program Neighborhood Agent.lnk
backup=c:\windows\pss\Program Neighborhood Agent.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(:bf,9d,37,84,d6,25,ca,01

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{7A3E9912-D848-4727-9ACC-376C4055D583}"= UDP:c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{84C3BD21-0B58-4907-8B0A-6720A4E70F04}"= TCP:c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{004C7F7E-D35B-42C0-9E50-AE86A732FC6F}"= UDP:c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel® Viiv™ Media Server
"{B7960510-EB4B-4CA6-A2E0-70E0F5422EBB}"= TCP:c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel® Viiv™ Media Server
"{1F2B0747-62FC-41DA-BF45-A7DCAC9DB779}"= UDP:c:\program files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel® Remoting Service
"{9EF95DEB-A9C2-4E73-BB25-57797EDDBFE1}"= TCP:c:\program files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel® Remoting Service
"{84F9DDBD-6935-4EC3-9BDA-F14FD566751C}"= TCP:9442:127.0.0.1:Intel® Viiv™ Media Server Discovery
"{63FFBDD4-F009-487A-B519-9B69C4DE2D48}"= TCP:1900:LocalSubnet:LocalSubnet:Intel® Viiv™ Media Server UPnP Discovery
"TCP Query User{FA317F24-1122-4EFF-84C8-DD2F287FC57A}c:\\program files\\esignal\\winros.exe"= UDP:c:\program files\esignal\winros.exe:eSignal Data Manager
"UDP Query User{2DB4E061-3461-47FE-A211-813FA9540D9B}c:\\program files\\esignal\\winros.exe"= TCP:c:\program files\esignal\winros.exe:eSignal Data Manager
"TCP Query User{98AC7DB1-837A-4583-A72D-54755C71C20D}c:\\program files\\esignal\\winros.exe"= UDP:c:\program files\esignal\winros.exe:eSignal Data Manager
"UDP Query User{45247529-0012-40CE-8AEE-DD5D30EB12F8}c:\\program files\\esignal\\winros.exe"= TCP:c:\program files\esignal\winros.exe:eSignal Data Manager
"{8DED92A3-5D21-499B-9686-5D6825C85DEB}"= UDP:c:\program files\Kontiki\KService.exe:Delivery Manager Service
"{0C5F83F5-D0F9-47A6-AE57-0E67151A64D5}"= TCP:c:\program files\Kontiki\KService.exe:Delivery Manager Service
"{02CAAE61-7745-417F-8180-35683D66C48B}"= UDP:c:\program files\Kontiki\KService.exe:Delivery Manager Service
"{FDDC67A2-12EC-412E-A57D-07EF43E8F577}"= TCP:c:\program files\Kontiki\KService.exe:Delivery Manager Service
"{1DB37034-0B89-4068-BC71-65BE6D81AB6E}"= UDP:c:\program files\1stWORKS\hotCommCL\BIN\HotComm.exe:hotComm CL
"{29FE9F96-ED01-4F85-B329-EEB53C1D1983}"= TCP:c:\program files\1stWORKS\hotCommCL\BIN\HotComm.exe:hotComm CL
"{D1021F7E-1BC4-4885-AA19-10BCD78CC2BB}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{75E26C5F-ED45-4A1B-BE17-955270541CE6}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{F6C94AEF-C4EE-4AD2-AF86-756E6C858915}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{B945C925-D459-41F3-830B-6E1792CD5C54}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R0 SymEFA;Symantec Extended File Attributes;c:\windows\System32\drivers\N360\0300000.086\SymEFA.sys [17/08/2009 15:29 310320]
R0 TfFsMon;TfFsMon;c:\windows\System32\drivers\TfFsMon.sys [29/08/2009 00:26 51984]
R0 TfSysMon;TfSysMon;c:\windows\System32\drivers\TfSysMon.sys [29/08/2009 00:26 46864]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\System32\drivers\N360\0300000.086\BHDrvx86.sys [17/08/2009 15:29 258608]
R1 ccHP;Symantec Hash Provider;c:\windows\System32\drivers\N360\0300000.086\cchpx86.sys [17/08/2009 15:29 482352]
R1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090810.001\IDSvix86.sys [17/08/2009 17:15 293424]
R2 atashost;WebEx Service Host for Support Center;c:\windows\System32\atashost.exe [07/04/2008 16:15 19864]
R2 DQLWinService;DQLWinService;c:\program files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe [03/09/2006 19:32 208896]
R2 N360;Norton 360;c:\program files\Norton 360\Engine\3.0.0.134\ccSvcHst.exe [17/08/2009 15:29 115560]
R2 RalinkRegistryWriter;Ralink Registry Writer;c:\program files\Ralink\Common\RalinkRegistryWriter.exe [06/11/2008 20:17 75040]
R2 ThreatFire;ThreatFire;c:\program files\ThreatFire\TFService.exe service –> c:\program files\ThreatFire\TFService.exe service [?]
R3 3xHybrid;ASUSTek SAA713x PCI Card;c:\windows\System32\drivers\3xHybrid.sys [26/01/2007 11:42 2831232]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [26/08/2009 09:00 102448]
R3 SYMNDISV;Symantec Network Filter Driver;c:\windows\System32\drivers\N360\0300000.086\symndisv.sys [17/08/2009 15:29 39984]
R3 TfNetMon;TfNetMon;c:\windows\System32\drivers\TfNetMon.sys [29/08/2009 00:26 33552]
S2 IntelDHSvcConf;Intel DH Service;c:\program files\Intel\IntelDH\Intel Media Server\tools\IntelDHSvcConf.exe [10/05/2006 18:13 29696]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\System32\drivers\ggflt.sys [08/08/2009 16:13 13224]
S3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista;c:\windows\System32\drivers\netr28u.sys [06/11/2008 19:11 710144]
S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\System32\drivers\rt2870.sys [05/11/2008 19:20 476416]

— Other Services/Drivers In Memory —

*Deregistered* - mchInjDrv

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-09-04 c:\windows\Tasks\User_Feed_Synchronization-{6D0AFEC5-1C68-4D4C-A072-379E11F2518A}.job
- c:\windows\system32\msfeedssync.exe [2009-07-29 20:13]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=EN_GB&c;=71&bd;=Pavilion&pf;=desktop
uInternet Settings,ProxyOverride = *.local
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
Trusted Zone: microsoft.com\office
DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-27-0.cab
FF - ProfilePath - c:\users\office\AppData\Roaming\Mozilla\Firefox\Profiles\b3clwva2.default\
FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll
FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npBBCPlugin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npicaN.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-04 18:09
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\N360]
"ImagePath"="\"c:\program files\Norton 360\Engine\3.0.0.134\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360\Engine\3.0.0.134\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(644)
c:\program files\ThreatFire\TFWAH.dll

- - - - - - - > 'lsass.exe'(692)
c:\program files\ThreatFire\TFWAH.dll
.
Completion time: 2009-09-04 18:14
ComboFix-quarantined-files.txt 2009-09-04 17:14
ComboFix2.txt 2009-08-28 15:24

Pre-Run: 275,256,774,656 bytes free
Post-Run: 275,188,523,008 bytes free

423 — E O F — 2009-09-03 02:02

Found out what Hijack This is, have downloaded and run a scan a copy of the log is below.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:25:53, on 04/09/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Windows\system32\atashost.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Kontiki\KService.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Norton 360\Engine\3.0.0.134\ccSvcHst.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Ralink\Common\RalinkRegistryWriter.exe
C:\Windows\system32\svchost.exe
C:\Program Files\ThreatFire\TFService.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\SMINST\remind.exe
C:\Program Files\Norton 360\Engine\3.0.0.134\ccSvcHst.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\D-Link\D-Link Wireless N DWA-140\AirNCFG.exe
C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
C:\Program Files\HP\HP Software Update\hpwuschd2.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\ThreatFire\TFTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\ehome\ehsched.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Kontiki\KHost.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
C:\Program Files\Ralink\Common\RaUI.exe
C:\Windows\ehome\ehRecvr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\hp\kbd\kbd.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10c.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O1 - Hosts: 74.208.77.54 hcurltest1
O1 - Hosts: 82.165.161.232 hcurltest2
O1 - Hosts: 255.255.255.255 hcurltest5
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\3.0.0.134\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\3.0.0.134\IPSBHO.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.0.0.134\coIEPlg.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [kdx] "C:\Program Files\Kontiki\KHost.exe" -all
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [D-Link D-Link Wireless N DWA-140] C:\Program Files\D-Link\D-Link Wireless N DWA-140\AirNCFG.exe
O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe" /autorun
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\Ralink\Common\RaUI.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.co.uk/SnapfishUKActivia.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-24-0.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {80AEEC0E-A2BE-4B8D-985F-350FE869DC40} (HPDDClientExec Class) - http://h20264.www2.hp.com/ediags/dd/instal…osticsVista.cab
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-27-0.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flas…ent/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin2.valueactive.com/Register/Br…018/flashax.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://esignal.webex.com/client/T26L/support/ieatgpc1.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Object) - https://spinpalace.microgaming.com/spinpalace/FlashAX2.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360\Engine\3.0.0.134\coIEPlg.dll
O23 - Service: Intel® Alert Service (AlertService) - Intel® Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: WebEx Service Host for Support Center (atashost) - WebEx Communications, Inc. - C:\Windows\system32\atashost.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intel DH Service (IntelDHSvcConf) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel® Software Services Manager (ISSM) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Intel® Viiv™ Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: Intel® Application Tracker (MCLServiceATL) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360\Engine\3.0.0.134\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Ralink Registry Writer (RalinkRegistryWriter) - Ralink Technology, Corp. - C:\Program Files\Ralink\Common\RalinkRegistryWriter.exe
O23 - Service: Intel® Remoting Service (Remote UI Service) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe

–
End of file - 13130 bytes

Hi, have done that and below is copy of new Hijack This file. Computer behaving normally except only difference I have noted is that when I hover my mouse arrow over say the Google logo depicting some special event it normally brings up a text box telling you all about it. I no longer get this?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:13:07, on 05/09/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Windows\system32\atashost.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Kontiki\KService.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Norton 360\Engine\3.0.0.134\ccSvcHst.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Ralink\Common\RalinkRegistryWriter.exe
C:\Windows\system32\svchost.exe
C:\Program Files\ThreatFire\TFService.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Norton 360\Engine\3.0.0.134\ccSvcHst.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Kontiki\KHost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\D-Link\D-Link Wireless N DWA-140\AirNCFG.exe
C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\HP\HP Software Update\hpwuschd2.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\ThreatFire\TFTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Ralink\Common\RaUI.exe
C:\Windows\ehome\ehsched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\ehome\ehRecvr.exe
C:\hp\kbd\kbd.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10c.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\3.0.0.134\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\3.0.0.134\IPSBHO.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.0.0.134\coIEPlg.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [kdx] "C:\Program Files\Kontiki\KHost.exe" -all
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [D-Link D-Link Wireless N DWA-140] C:\Program Files\D-Link\D-Link Wireless N DWA-140\AirNCFG.exe
O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe" /autorun
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\Ralink\Common\RaUI.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.co.uk/SnapfishUKActivia.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-24-0.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {80AEEC0E-A2BE-4B8D-985F-350FE869DC40} (HPDDClientExec Class) - http://h20264.www2.hp.com/ediags/dd/instal…osticsVista.cab
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-27-0.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flas…ent/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin2.valueactive.com/Register/Br…018/flashax.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://esignal.webex.com/client/T26L/support/ieatgpc1.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Object) - https://spinpalace.microgaming.com/spinpalace/FlashAX2.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360\Engine\3.0.0.134\coIEPlg.dll
O23 - Service: Intel® Alert Service (AlertService) - Intel® Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: WebEx Service Host for Support Center (atashost) - WebEx Communications, Inc. - C:\Windows\system32\atashost.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intel DH Service (IntelDHSvcConf) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel® Software Services Manager (ISSM) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Intel® Viiv™ Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: Intel® Application Tracker (MCLServiceATL) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360\Engine\3.0.0.134\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Ralink Registry Writer (RalinkRegistryWriter) - Ralink Technology, Corp. - C:\Program Files\Ralink\Common\RalinkRegistryWriter.exe
O23 - Service: Intel® Remoting Service (Remote UI Service) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe

–
End of file - 12810 bytes