sachinmi
Topic Starter
hi, find below my Hijack Log file.
also imy nortan antivirus is disabled cant run it throgh EXE also.
im having popups winlogon every minute.
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:46:57, on 03-09-2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Users\Sachin\AppData\Local\Google\Update\1.3.21.65\GoogleCrashHandler.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\explorer.exe
C:\Program Files\Hitman Pro 3.5\HitmanPro35.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Sachin\Downloads\Scanner.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://axl773a18181285.directorio-w.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://me6h1qa2cu52h62.directorio-w.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://s2s551uzp81k37g.directorio-w.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://0bxvhz7241663x1.directorio-w.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://9j8i1vh5ff9xi1p.directorio-w.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://12klb7he13soi2b.directorio-w.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://284m985x5c5z06a.directorio-w.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://q187794uf1k6mz7.directorio-w.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://9t888zk38u9zv10.directorio-w.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://4646823ud79lx1c.directorio-w.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: 173.201.178.105 bn.com.pe
O1 - Hosts: 173.201.178.105 www.bn.com.pe
O1 - Hosts: 190.168.112.213 iniciorapido.info
O1 - Hosts: 166.120.189.240 www.iniciorapido.info
O1 - Hosts: 155.153.90.23 buscalo.in
O1 - Hosts: 157.11.73.143 www.buscalo.in
O1 - Hosts: 52.138.68.88 buscafacil.com
O1 - Hosts: 216.158.145.115 www.buscafacil.com
O1 - Hosts: 205.190.46.154 emsisoft.com
O1 - Hosts: 78.127.101.246 antiy.net
O1 - Hosts: 100.61.42.99 gdata.es
O1 - Hosts: 91.208.182.71 jiangmin.com
O1 - Hosts: 13.136.211.174 nprotect.com
O1 - Hosts: 113.142.123.180 hacksoft.com.pe
O1 - Hosts: 172.33.7.152 anti-virus.by
O1 - Hosts: 161.66.97.191 hauri.net
O1 - Hosts: 58.50.75.1 www.emsisoft.com
O1 - Hosts: 24.103.53.67 www.antivir.es
O1 - Hosts: 26.149.36.187 www.antiy.net
O1 - Hosts: 227.125.243.75 www.quickheal.com
O1 - Hosts: 124.109.221.141 www.comodo.com
O1 - Hosts: 47.83.232.108 www.gdata.es
O1 - Hosts: 107.230.116.12 www.jiangmin.com
O1 - Hosts: 128.164.57.121 www.hacksoft.com.pe
O1 - Hosts: 188.55.130.93 www.anti-virus.by
O1 - Hosts: 15.181.193.38 www.hauri.net
O1 - Hosts: 168.234.171.104 www.emsisoft.com
O1 - Hosts: 238.92.86.224 www.anti-trojan.net
O1 - Hosts: 133.219.149.169 malwarescan.emsisoft.com
O1 - Hosts: 41.171.226.196 forum.emsisoft.com
O1 - Hosts: 30.15.127.235 www.emsisoft.net
O1 - Hosts: 100.61.42.99 www.emsisoft.it
O1 - Hosts: 183.0.106.45 www.emsisoft.de
O1 - Hosts: 91.208.182.71 www.anti-trojan-software.net
O1 - Hosts: 80.241.84.110 mamutu.com
O1 - Hosts: 150.98.254.43 www.emsisoft.es
O1 - Hosts: 45.37.62.176 malwarescan.emsisoft.de
O1 - Hosts: 209.245.138.202 ww.emsisoft.com
O1 - Hosts: 199.22.40.54 www.emsisoft.fr
O1 - Hosts: 13.136.211.174 www.emsisoft.nl
O1 - Hosts: 249.59.184.185 www.emsisoft.org
O1 - Hosts: 63.105.167.49 scan.anti-trojan.net
O1 - Hosts: 146.44.162.250 www.trojaner.info
O1 - Hosts: 113.142.123.180 blitzblank.com
O1 - Hosts: 8.81.119.126 www.emsisoft.at
O1 - Hosts: 172.33.7.152 www.emsisoft.jp
O1 - Hosts: 161.66.97.191 www.mamutu.com
O1 - Hosts: 231.179.79.56 malwarescan.emsisoft.es
O1 - Hosts: 58.50.75.1 www.mamutu.de
O1 - Hosts: 85.39.108.159 www.hackshields.com
O1 - Hosts: 74.72.9.10 www.internationalservicecheck.com
O1 - Hosts: 144.186.248.130 www.irangoals.com
O1 - Hosts: 227.125.243.75 ixomodels.com
O1 - Hosts: 135.77.64.34 www.indielisboa.com
O1 - Hosts: 124.109.221.141 www.latin-mass-society.org
O1 - Hosts: 194.223.204.5 www.arpia.be
O1 - Hosts: 89.94.200.207 www.owen.org
O1 - Hosts: 253.114.20.165 www.prdouglas.co.uk
O1 - Hosts: 242.147.178.16 www.zarya.info
O1 - Hosts: 56.4.160.137 www.willsee.com
O1 - Hosts: 139.131.156.82 halmapr.com
O1 - Hosts: 47.83.232.108 karuna-shechen.org
O1 - Hosts: 37.116.134.148 www.barder.com
O1 - Hosts: 107.230.116.12 www.antivir.es
O1 - Hosts: 190.168.112.213 www.buraka.tv
O1 - Hosts: 166.120.189.240 www.dr-bull.com
O1 - Hosts: 155.153.90.23 www.manchester-offices.co.uk
O1 - Hosts: 157.11.73.143 saverssite.com
O1 - Hosts: 52.138.68.88 canada.karuna-shechen.org
O1 - Hosts: 216.158.145.115 developmentdrums.org
O1 - Hosts: 205.190.46.154 www.imddomains.co.uk
O1 - Hosts: 19.48.29.86 cutlines.org
O1 - Hosts: 102.175.25.32 elblogdemanu.com
O1 - Hosts: 78.127.101.246 ruben.bzin.net
O1 - Hosts: 67.160.3.97 welkam.co.jp
O1 - Hosts: 69.17.173.218 www.cambridge-steiner-school.co.uk
O1 - Hosts: 220.212.237.163 naturesimages.net
O1 - Hosts: 128.164.57.121 www.1stavenuelimousines.co.uk
O1 - Hosts: 118.197.215.229 www.mtr-design.com
O1 - Hosts: 188.55.130.93 dev.depeuter.org
O1 - Hosts: 15.181.193.38 www.emeraldclassic.co.uk
O1 - Hosts: 179.201.14.65 www.peterhearnwaste.co.uk
O1 - Hosts: 168.234.171.104 etrr.co.uk
O1 - Hosts: 238.92.86.224 www.avoncourt.com
O1 - Hosts: 133.219.149.169 sarahmcconnellphotography.net
O1 - Hosts: 41.171.226.196 www.ixomodels.com
O1 - Hosts: 30.15.127.235 natsko.com
O1 - Hosts: 100.61.42.99 www.nottinghampoetryseries.com
O1 - Hosts: 183.0.106.45 www.sheffieldmind.co.uk
O1 - Hosts: 91.208.182.71 ixostore.ixomodels.com
O1 - Hosts: 80.241.84.110 www.flairweddings.co.uk
O1 - Hosts: 150.98.254.43 www.fimasys.com
O1 - Hosts: 45.37.62.176 cohartuk.com
O1 - Hosts: 209.245.138.202 qqjkw.net
O1 - Hosts: 199.22.40.54 vivo-austin.com
O1 - Hosts: 13.136.211.174 www.freeality.com
O1 - Hosts: 96.6.18.119 bestofewan.com
O1 - Hosts: 4.26.95.78 www.handwritingforkids.com
O1 - Hosts: 249.59.184.185 cowsmo.com
O1 - Hosts: 63.105.167.49 www.2xlgames.com
O1 - Hosts: 146.44.162.250 kimzimmer.net
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (file missing)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (file missing)
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [3405D2E49484341435] C:\Users\Sachin\E69686361635\winlogon.exe
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [DATBE50.tmp.exe] C:\Users\Sachin\AppData\Local\Temp\DATBE50.tmp.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\Sachin\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [googletalk] C:\Users\Sachin\AppData\Roaming\Google\Google Talk\googletalk.exe /autostart
O4 - HKCU\..\Run: [3405D2E49484341435] C:\Users\Sachin\E69686361635\winlogon.exe
O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Users\Sachin\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" -inv:bootrun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{742F97D8-AC37-42CF-82DD-09351403D8D4}: NameServer = 202.56.250.5,125.47.22.125
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GRA32A~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NitroPDFDriverCreatorReadSpool (NitroDriverReadSpool) - Nitro PDF Software - C:\Program Files\Nitro PDF\Professional\NitroPDFDriverService.exe
O23 - Service: NLS Service (nlsX86cc) - Nalpeiron Ltd. - C:\Windows\system32\NLSSRV32.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
–
End of file - 12665 bytes
also imy nortan antivirus is disabled cant run it throgh EXE also.
im having popups winlogon every minute.
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:46:57, on 03-09-2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Users\Sachin\AppData\Local\Google\Update\1.3.21.65\GoogleCrashHandler.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\explorer.exe
C:\Program Files\Hitman Pro 3.5\HitmanPro35.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Sachin\Downloads\Scanner.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://axl773a18181285.directorio-w.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://me6h1qa2cu52h62.directorio-w.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://s2s551uzp81k37g.directorio-w.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://0bxvhz7241663x1.directorio-w.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://9j8i1vh5ff9xi1p.directorio-w.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://12klb7he13soi2b.directorio-w.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://284m985x5c5z06a.directorio-w.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://q187794uf1k6mz7.directorio-w.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://9t888zk38u9zv10.directorio-w.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://4646823ud79lx1c.directorio-w.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: 173.201.178.105 bn.com.pe
O1 - Hosts: 173.201.178.105 www.bn.com.pe
O1 - Hosts: 190.168.112.213 iniciorapido.info
O1 - Hosts: 166.120.189.240 www.iniciorapido.info
O1 - Hosts: 155.153.90.23 buscalo.in
O1 - Hosts: 157.11.73.143 www.buscalo.in
O1 - Hosts: 52.138.68.88 buscafacil.com
O1 - Hosts: 216.158.145.115 www.buscafacil.com
O1 - Hosts: 205.190.46.154 emsisoft.com
O1 - Hosts: 78.127.101.246 antiy.net
O1 - Hosts: 100.61.42.99 gdata.es
O1 - Hosts: 91.208.182.71 jiangmin.com
O1 - Hosts: 13.136.211.174 nprotect.com
O1 - Hosts: 113.142.123.180 hacksoft.com.pe
O1 - Hosts: 172.33.7.152 anti-virus.by
O1 - Hosts: 161.66.97.191 hauri.net
O1 - Hosts: 58.50.75.1 www.emsisoft.com
O1 - Hosts: 24.103.53.67 www.antivir.es
O1 - Hosts: 26.149.36.187 www.antiy.net
O1 - Hosts: 227.125.243.75 www.quickheal.com
O1 - Hosts: 124.109.221.141 www.comodo.com
O1 - Hosts: 47.83.232.108 www.gdata.es
O1 - Hosts: 107.230.116.12 www.jiangmin.com
O1 - Hosts: 128.164.57.121 www.hacksoft.com.pe
O1 - Hosts: 188.55.130.93 www.anti-virus.by
O1 - Hosts: 15.181.193.38 www.hauri.net
O1 - Hosts: 168.234.171.104 www.emsisoft.com
O1 - Hosts: 238.92.86.224 www.anti-trojan.net
O1 - Hosts: 133.219.149.169 malwarescan.emsisoft.com
O1 - Hosts: 41.171.226.196 forum.emsisoft.com
O1 - Hosts: 30.15.127.235 www.emsisoft.net
O1 - Hosts: 100.61.42.99 www.emsisoft.it
O1 - Hosts: 183.0.106.45 www.emsisoft.de
O1 - Hosts: 91.208.182.71 www.anti-trojan-software.net
O1 - Hosts: 80.241.84.110 mamutu.com
O1 - Hosts: 150.98.254.43 www.emsisoft.es
O1 - Hosts: 45.37.62.176 malwarescan.emsisoft.de
O1 - Hosts: 209.245.138.202 ww.emsisoft.com
O1 - Hosts: 199.22.40.54 www.emsisoft.fr
O1 - Hosts: 13.136.211.174 www.emsisoft.nl
O1 - Hosts: 249.59.184.185 www.emsisoft.org
O1 - Hosts: 63.105.167.49 scan.anti-trojan.net
O1 - Hosts: 146.44.162.250 www.trojaner.info
O1 - Hosts: 113.142.123.180 blitzblank.com
O1 - Hosts: 8.81.119.126 www.emsisoft.at
O1 - Hosts: 172.33.7.152 www.emsisoft.jp
O1 - Hosts: 161.66.97.191 www.mamutu.com
O1 - Hosts: 231.179.79.56 malwarescan.emsisoft.es
O1 - Hosts: 58.50.75.1 www.mamutu.de
O1 - Hosts: 85.39.108.159 www.hackshields.com
O1 - Hosts: 74.72.9.10 www.internationalservicecheck.com
O1 - Hosts: 144.186.248.130 www.irangoals.com
O1 - Hosts: 227.125.243.75 ixomodels.com
O1 - Hosts: 135.77.64.34 www.indielisboa.com
O1 - Hosts: 124.109.221.141 www.latin-mass-society.org
O1 - Hosts: 194.223.204.5 www.arpia.be
O1 - Hosts: 89.94.200.207 www.owen.org
O1 - Hosts: 253.114.20.165 www.prdouglas.co.uk
O1 - Hosts: 242.147.178.16 www.zarya.info
O1 - Hosts: 56.4.160.137 www.willsee.com
O1 - Hosts: 139.131.156.82 halmapr.com
O1 - Hosts: 47.83.232.108 karuna-shechen.org
O1 - Hosts: 37.116.134.148 www.barder.com
O1 - Hosts: 107.230.116.12 www.antivir.es
O1 - Hosts: 190.168.112.213 www.buraka.tv
O1 - Hosts: 166.120.189.240 www.dr-bull.com
O1 - Hosts: 155.153.90.23 www.manchester-offices.co.uk
O1 - Hosts: 157.11.73.143 saverssite.com
O1 - Hosts: 52.138.68.88 canada.karuna-shechen.org
O1 - Hosts: 216.158.145.115 developmentdrums.org
O1 - Hosts: 205.190.46.154 www.imddomains.co.uk
O1 - Hosts: 19.48.29.86 cutlines.org
O1 - Hosts: 102.175.25.32 elblogdemanu.com
O1 - Hosts: 78.127.101.246 ruben.bzin.net
O1 - Hosts: 67.160.3.97 welkam.co.jp
O1 - Hosts: 69.17.173.218 www.cambridge-steiner-school.co.uk
O1 - Hosts: 220.212.237.163 naturesimages.net
O1 - Hosts: 128.164.57.121 www.1stavenuelimousines.co.uk
O1 - Hosts: 118.197.215.229 www.mtr-design.com
O1 - Hosts: 188.55.130.93 dev.depeuter.org
O1 - Hosts: 15.181.193.38 www.emeraldclassic.co.uk
O1 - Hosts: 179.201.14.65 www.peterhearnwaste.co.uk
O1 - Hosts: 168.234.171.104 etrr.co.uk
O1 - Hosts: 238.92.86.224 www.avoncourt.com
O1 - Hosts: 133.219.149.169 sarahmcconnellphotography.net
O1 - Hosts: 41.171.226.196 www.ixomodels.com
O1 - Hosts: 30.15.127.235 natsko.com
O1 - Hosts: 100.61.42.99 www.nottinghampoetryseries.com
O1 - Hosts: 183.0.106.45 www.sheffieldmind.co.uk
O1 - Hosts: 91.208.182.71 ixostore.ixomodels.com
O1 - Hosts: 80.241.84.110 www.flairweddings.co.uk
O1 - Hosts: 150.98.254.43 www.fimasys.com
O1 - Hosts: 45.37.62.176 cohartuk.com
O1 - Hosts: 209.245.138.202 qqjkw.net
O1 - Hosts: 199.22.40.54 vivo-austin.com
O1 - Hosts: 13.136.211.174 www.freeality.com
O1 - Hosts: 96.6.18.119 bestofewan.com
O1 - Hosts: 4.26.95.78 www.handwritingforkids.com
O1 - Hosts: 249.59.184.185 cowsmo.com
O1 - Hosts: 63.105.167.49 www.2xlgames.com
O1 - Hosts: 146.44.162.250 kimzimmer.net
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (file missing)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (file missing)
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [3405D2E49484341435] C:\Users\Sachin\E69686361635\winlogon.exe
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [DATBE50.tmp.exe] C:\Users\Sachin\AppData\Local\Temp\DATBE50.tmp.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\Sachin\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [googletalk] C:\Users\Sachin\AppData\Roaming\Google\Google Talk\googletalk.exe /autostart
O4 - HKCU\..\Run: [3405D2E49484341435] C:\Users\Sachin\E69686361635\winlogon.exe
O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Users\Sachin\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" -inv:bootrun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{742F97D8-AC37-42CF-82DD-09351403D8D4}: NameServer = 202.56.250.5,125.47.22.125
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GRA32A~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NitroPDFDriverCreatorReadSpool (NitroDriverReadSpool) - Nitro PDF Software - C:\Program Files\Nitro PDF\Professional\NitroPDFDriverService.exe
O23 - Service: NLS Service (nlsX86cc) - Nalpeiron Ltd. - C:\Windows\system32\NLSSRV32.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
–
End of file - 12665 bytes