Hijack This Log

Logfile of HijackThis v1.98.2
Scan saved at 11:12:21, on 16/12/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\AVENGINE.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\pavProxy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE
C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\pavProxy.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\Office10\EXCEL.EXE
C:\DOCUME~1\Dessie\LOCALS~1\Temp\Temporary Directory 3 for hijackthis hijack this.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.tiscali.co.uk/broadband/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.tiscali.co.uk/broadband/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P40 "EPSON Stylus Photo RX420 Series (Copy 1)" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunOnce: [hhctrl.ocx] C:\WINDOWS\system32\regsvr32 /s C:\WINDOWS\system32\hhctrl.ocx
O4 - HKLM\..\RunOnce: [RegisterLockedFile0] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\Belfast.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile1] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\ImageMosaic.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile2] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\MGIProxyps.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile3] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4ActiveEditorProxy.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile4] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4Analyzer.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile5] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4AnimatedGIF.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile6] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4Arguments.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile7] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4BasicGenerators.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile8] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4BrightAndContrast.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile9] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4BrowserControl.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile10] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4BrushManager.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile11] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4Button.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile12] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4Cartoonize.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile13] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4CatalogChooser.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile14] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4CatalogEditor.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile15] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4CatalogItem2.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile16] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4CatalogItemGenerator.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile17] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4CatalogListbox.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile18] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4CatalogLoader.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile19] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4CatalogStuffer.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile20] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4ColorBalance.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile21] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4ColorGUI.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile22] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4ColorHS.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile23] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4ComboBox.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile24] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4ContextProxy.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile25] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4Convolution.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile26] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4CTFcatalog.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile27] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4DDViewerPreviewWindow.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile28] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4DefaultCommandTarget.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile29] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4DeskewPlugIn.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile30] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4DIBView.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile31] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4DrawToolPlugin.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile32] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4DropShadow.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile33] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4EditPlugin.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile34] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4EmailPhoto.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile35] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4EventProxy.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile36] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4ExportASF.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile37] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4FloatEdit.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile38] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4Fog.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile39] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4FormatLoaderBMP.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile40] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4FormatLoaderEPS.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile41] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4FormatLoaderFPX.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile42] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4FormatLoaderGIF.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile43] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4FormatLoaderIMG.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile44] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4FormatLoaderJPG.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile45] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4FormatLoaderKQP.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile46] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4FormatLoaderMSC.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile47] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4FormatLoaderPCD.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile48] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4FormatLoaderPCX.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile49] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4FormatLoaderPNG.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile50] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4FormatLoaderPSD.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile51] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4FormatLoaderRAS.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile52] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4FormatLoaderSFW.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile53] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4FormatLoaderSTNG.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile54] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4FormatLoaderTemp.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile55] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4FormatLoaderTGA.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile56] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4FormatLoaderTIFF.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile57] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4FormatLoaderWav.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile58] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4FormatLoaderWMF.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile59] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4Glass.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile60] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4HttpProtocolHandler.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile61] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4Image.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile62] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4ImageDeviceProtocolHandler.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile63] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4ImageEdit.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile64] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4ImageFramer.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile65] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4ImagePiece.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile66] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4ImagePiecePlugIn.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile67] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4ImageSaver.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile68] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4ImageTrimPlugIn.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile69] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4ImageViewer.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile70] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4InputDeviceManager.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile71] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4IntegerEdit.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile72] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4IPLCache.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile73] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4Kodak.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile74] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4Kodak210.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile75] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4Kodak220.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile76] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4Layout.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile77] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4LayoutPlugin.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile78] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4LayoutSaver.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile79] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4LayoutStuffer.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile80] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4LogoControl.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile81] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4MagicWand.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile82] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4MGICore.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile83] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4OMImageManager.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile84] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4OMImagePlayer.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile85] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4OMPS4ImageViewer.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile86] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4PenSettingsCtrl.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile87] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4PhotoMotion.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile88] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4Photonet.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile89] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4PhotonetUploader.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile90] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4PhotoShopFilter.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile91] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4PhotoWeb.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile92] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4PSFLoader.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile93] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4PSFPlugin.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile94] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4PVImageManager.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile95] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4PVImageViewer.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile96] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4Sanyo.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile97] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4SanyoCtrl.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile98] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4ScriptedCatalog.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile99] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4ScriptHelper.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile100] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4SelectionDraw.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile101] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4SendEmail.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile102] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4Slider.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile103] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4SmargTestFilter.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile104] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4SmartArgEditor.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile105] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4SmartScissors.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile106] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4SpanArray.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile107] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4SpinControl.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile108] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4StaticPicture.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile109] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4StatusBar.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile110] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4Stitcher.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile111] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4StitchPlugin.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile112] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4StringEdit.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile113] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4Swirl.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile114] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4Tapestry.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile115] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4TapestryPlugIn.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile116] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4TextEditor.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile117] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4TextRenderer.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile118] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4TwainDevice.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile119] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4Warp.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile120] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4WarpPlugin.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile121] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4WarpTool.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile122] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4WebAlbum.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile123] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4WebShare.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile124] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\PS4XPreview.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile125] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\TileMaker.dll"
O4 - HKLM\..\RunOnce: [RegisterLockedFile126] C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files\Common Files\\MGI Shared\Photo\XPreview.dll"
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E99ED54-A762-4E48-A99C-DD0BF8D7182A}: NameServer = 212.74.114.129 212.74.114.193

Hi Elrond i restored my progs in MSCONFIG.I recently unsuccessfully tried to install MGI photosuite 4.I am running Zonealarm MS firewall Panda Avg Spybot Adaware. Please advise which ones to turn off. Please see my new log.Logfile of HijackThis v1.99.0
Scan saved at 15:32:26, on 23/12/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\AVENGINE.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\VVSN\VVSN.exe
C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\pavProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.tiscali.co.uk/broadband/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.tiscali.co.uk/broadband/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P40 "EPSON Stylus Photo RX420 Series (Copy 1)" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [VVSN] C:\Program Files\VVSN\VVSN.exe
O4 - HKLM\..\Run: [Smart Start UP] C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe /Automation
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Antivirus Platinum\Inicio.exe"
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE" /s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E99ED54-A762-4E48-A99C-DD0BF8D7182A}: NameServer = 212.74.114.129 212.74.114.193
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Panda Firewall Service - Unknown - C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
O23 - Service: Panda anti-virus service - Unknown - C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Hi i have followed your instructione. Please see my new log.Logfile of HijackThis v1.99.0
Scan saved at 14:04:21, on 26/12/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\AVENGINE.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\pavProxy.exe
C:\Program Files\HijackThis\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.tiscali.co.uk/broadband/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.tiscali.co.uk/broadband/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P40 "EPSON Stylus Photo RX420 Series (Copy 1)" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Smart Start UP] C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe /Automation
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Antivirus Platinum\Inicio.exe"
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE" /s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E99ED54-A762-4E48-A99C-DD0BF8D7182A}: NameServer = 212.74.114.129 212.74.114.193
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Panda Firewall Service - Unknown - C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
O23 - Service: Panda anti-virus service - Unknown - C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Hi Elrond see my latest logLogfile of HijackThis v1.99.0
Scan saved at 15:10:18, on 03/01/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
C:\Program Files\Panda Software\Panda Antivirus Platinum\AVENGINE.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\SpamPal\spampal.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\pavProxy.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.tiscali.co.uk/broadband/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.tiscali.co.uk/broadband/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P40 "EPSON Stylus Photo RX420 Series (Copy 1)" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE" /s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpamPal.lnk = C:\Program Files\SpamPal\spampal.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E99ED54-A762-4E48-A99C-DD0BF8D7182A}: NameServer = 212.74.114.129 212.74.114.193
O23 - Service: Panda Firewall Service - Unknown - C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
O23 - Service: Panda anti-virus service - Unknown - C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Happy New Year Desmond

Congratulations

Your computer is free of malware, and now I want you to take some precautions to avoid being infected again.

Settings and maintenance

1. Clean out temporary files.
Go to "Start" > "Run" and type cleanmgr
Make sure the following are selected:
* Temporary Internet Files
* Recycle Bin
* Temporary Files
Click "OK'.
Repeat for each user account on the computer.
You should do this every few weeks to avoid buildup of unnecessary junk.


2. Clean Out System Restore.
Malware could get backed up in System Restore.
For Win XP follow these instructions to delete all restore points.
1. Go to "Start" > "Control Panel".
2. Make sure the Control Panel is in "Classic View". If it is not, click "Switch to Classic View" towards the top-left of the screen.
3. Double-click "System" and go to the "System Restore" tab.
4. Check "Turn off System Restore" and click "OK" and then "Yes".

After restarting your computer you should turn it back on by following the above procedure and uncheck "Turn off System Restore".

You can find out more about this subject at
Managing Windows Millennium System Restore

or at

How to turn off or turn on Windows XP System Restore


3. Make your Internet Explorer more secure
This can be done by following these simple instructions that apply to all "Windows" except "Windows XP with SP2". In SP2 many of those setting are the default settings but check your settings anyhow. The settings can become restrictive but you should use them anyhow. If there are sites that will not show up right with those settings and that you rely on to be free of malware place them in the trusted zone.

1. Click "Start". Open "Control Panel".
2. Select the "Internet Options"
3. Select "Security" Tab and select the following settings.

* ActiveX controls and plug-ins
• Download signed ActiveX controls: Disable
• Download unsigned ActiveX controls: Disable
• Initialize and script ActiveX controls not marked as safe: Disable
• Run ActiveX controls and plug-ins: Disable
• Script ActiveX controls marked safe for scripting: Disable

* Downloads
• Font Download: Disable

* Microsoft VM
• Java permissions: Disable Java

* Miscellaneous
• Allow META REFRESH: Disable
• Display mixed content: Disable
• Drag and drop or copy and paste files: Disable
• Installation of desktop items: Disable
• Launching programs and files in an IFRAME: Disable
• Navigate sub-frames across different domains: Disable
• Software channel permissions: High Safety
• Userdata persistence: Disable

* Scripting
• Active scripting: Disable
• Allow paste operations via script: Disable
• Scripting of Java applets: Disable

* User Authentication
• Logon: Prompt for username and password
4. When all these settings have been made, click on the OK button.
5. If it prompts you as to whether or not you want to save the settings, press the Yes button.
6. Next press the Apply button and then the OK to exit the Internet Properties page.


These are a must to protect yourself from malware.

1. Always use one good antivirus program and keep it updated

2. Always use a good firewall.

3. MOST IMPORTANT: You Need to keep “Windows” and "Internet Explorer” updated. Open ‘Internet Explorer” and go to”Start”> "Tools" > "Windows Update" or go to Microsoft Windows and Internet Explorer Updates to get the critical updates.

If you are running Microsoft Office, or any portion thereof you must keep it updated as well. Go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed. Update MS Office here.

4. Download and install “SpywareBlaster”
Run it. Click "Updates" at the left and click "Check for Updates". After updating click "Protection" at the left and towards the bottom click "Enable All Protection". You should now be protected from all known bad ActiveX. You should occasionally check for updates.

5. Download and install "Spywareblocker"

Further tools

I highly recommend downloading and installing the newest versions of “AdAware SE Personal” and “Spybot Search and Destroy”
After installing remember to update the definition files for each program.
I also suggest that you visit this website and follow the instructions on how to configure both programs for best detection.

There are many other programs that will add extra layers of protection to your computer as well.
I recommend “IE-Spyad” By default, it is unzipped to "C:\ie-spyad". Find out how to install it by going to the "ReadMe.txt". You should occasionally get updates by using the bat file or by uninstalling and deleting the old files and returning to the site to get the new version.

A Trojan scanner would be also be helpful. You can download a trial version of “Trojan Hunter” and run it to remove any traces of trojans.

The”a Squared” trojan Scanner has a free version. It is an onboard trojan scanner that is installed much like Spybot/AdAware but handles trojans. Nice to add to your armor if you wish.
Download free from “a Squared” (The download button is at the bottom of the page). Install it.
Run and activate your free version with a Squared and then select
Scan your computer for malware infections .
Then select any/all drives.
Finally Scan selected folders.

It is worth while to take a look at "So how did I get infected in the first place? for some good advice.


If you want to update Windows XP with SP2, you should know that there has been a small group of users who have had problems with it. The risks are the least if your computer is clean of malware and you are running an updated software firewall such as ZoneAlarm. You can download SP2 from http://support.microsoft.com/kb/322389
If you have a high-speed internet connection, you can let Windows Update do it. However if you have a dialup connection I would advise you to order the CD as the download is huge and will take a VERY long time to download. There has also been some reports that there is less problems when SP2 is installed from a CD.
You can get the CD here .


Update all protective programs regularly - Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.

Best of luck and clean computing
Elrond