Thanks for your help.
Combofix log
del - 06-09-25 18:24:55.31 Service Pack 2
ComboFix 06.09.25 - Running from: "C:\Documents and Settings\del\Desktop"
((((((((((((((((((((((((((((((((((((((((((((( Look2Me's Log ))))))))))))))))))))))))))))))))))))))))))))))))))
REGISTRY ENTRIES REMOVED:
[HKEY_CLASSES_ROOT\CLSID\{E71D3B73-7E1C-496B-9072-73EC6191C96E}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E71D3B73-7E1C-496B-9072-73EC6191C96E}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E71D3B73-7E1C-496B-9072-73EC6191C96E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E71D3B73-7E1C-496B-9072-73EC6191C96E}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
[HKEY_CLASSES_ROOT\CLSID\{A00D9765-5B10-4C2D-B0AB-8619D52A4963}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{A00D9765-5B10-4C2D-B0AB-8619D52A4963}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{A00D9765-5B10-4C2D-B0AB-8619D52A4963}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{A00D9765-5B10-4C2D-B0AB-8619D52A4963}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
[HKEY_CLASSES_ROOT\CLSID\{E0DA06E8-A5F7-4A12-8A0A-A5D1DB5BEEE3}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E0DA06E8-A5F7-4A12-8A0A-A5D1DB5BEEE3}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E0DA06E8-A5F7-4A12-8A0A-A5D1DB5BEEE3}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E0DA06E8-A5F7-4A12-8A0A-A5D1DB5BEEE3}\InprocServer32]
@="C:\\WINDOWS\\system32\\nadsapi.dll"
"ThreadingModel"="Apartment"
[HKEY_CLASSES_ROOT\CLSID\{4B235A25-71F2-4CEF-A32B-85BD8B3140DC}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{4B235A25-71F2-4CEF-A32B-85BD8B3140DC}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{4B235A25-71F2-4CEF-A32B-85BD8B3140DC}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{4B235A25-71F2-4CEF-A32B-85BD8B3140DC}\InprocServer32]
@="C:\\WINDOWS\\system32\\mdjint40.dll"
"ThreadingModel"="Apartment"
[HKEY_CLASSES_ROOT\CLSID\{10D2318F-A2C0-43C4-8D3E-6AD70D0D368C}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{10D2318F-A2C0-43C4-8D3E-6AD70D0D368C}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{10D2318F-A2C0-43C4-8D3E-6AD70D0D368C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{10D2318F-A2C0-43C4-8D3E-6AD70D0D368C}\InprocServer32]
@="C:\\WINDOWS\\system32\\sbgtab.dll"
"ThreadingModel"="Apartment"
[HKEY_CLASSES_ROOT\CLSID\{96C1080C-2DE2-4997-B218-8A2FC7ED49E3}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{96C1080C-2DE2-4997-B218-8A2FC7ED49E3}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{96C1080C-2DE2-4997-B218-8A2FC7ED49E3}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{96C1080C-2DE2-4997-B218-8A2FC7ED49E3}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
FILES REMOVED:
C:\WINDOWS\system32\ansldpc.dll
C:\WINDOWS\system32\aza4035qe.dll
C:\WINDOWS\system32\cal3d32.dll
C:\WINDOWS\system32\CannAPI.dll
C:\WINDOWS\system32\dn2401fqe.dll
C:\WINDOWS\system32\dn8s01l7e.dll
C:\WINDOWS\system32\dnpm0171e.dll
C:\WINDOWS\system32\dnr2019oe.dll
C:\WINDOWS\system32\dxconfig.dll
C:\WINDOWS\system32\DxvX.dll
C:\WINDOWS\system32\e8202ifmg82a2.dll
C:\WINDOWS\system32\eosvc.dll
C:\WINDOWS\system32\EQDHTML_1023.dll
C:\WINDOWS\system32\f8l0li3m18.dll
C:\WINDOWS\system32\fpn4035qe.dll
C:\WINDOWS\system32\fpp6037se.dll
C:\WINDOWS\system32\fpr2039oe.dll
C:\WINDOWS\system32\fwserui2.dll
C:\WINDOWS\system32\h22olcf31f2.dll
C:\WINDOWS\system32\i4nm0e51eh.dll
C:\WINDOWS\system32\ifuv_32.dll
C:\WINDOWS\system32\ir6ml5j11.dll
C:\WINDOWS\system32\irnul5591.dll
C:\WINDOWS\system32\irp6l57s1.dll
C:\WINDOWS\system32\irr0l59m1.dll
C:\WINDOWS\system32\j60slgd7160.dll
C:\WINDOWS\system32\j8l40i3qe8.dll
C:\WINDOWS\system32\jt2s07f7e.dll
C:\WINDOWS\system32\jtlu0739e.dll
C:\WINDOWS\system32\k6js0g17e6.dll
C:\WINDOWS\system32\kmdsp.dll
C:\WINDOWS\system32\ktj4l71q1.dll
C:\WINDOWS\system32\l06olaj31do.dll
C:\WINDOWS\system32\l2l6lc3s1f.dll
C:\WINDOWS\system32\l4r00e9meh.dll
C:\WINDOWS\system32\l88m0il1e8q.dll
C:\WINDOWS\system32\lv2m09f1e.dll
C:\WINDOWS\system32\m0nqla551d.dll
C:\WINDOWS\system32\m228lcfu1f28.dll
C:\WINDOWS\system32\m646lghs1646.dll
C:\WINDOWS\system32\m6820gloe6qc0.dll
C:\WINDOWS\system32\m6po0g73e6.dll
C:\WINDOWS\system32\mjwdat10.dll
C:\WINDOWS\system32\mlc70.dll
C:\WINDOWS\system32\mv84l9lq1.dll
C:\WINDOWS\system32\n62ulgf9162.dll
C:\WINDOWS\system32\o8660ijse8o60.dll
C:\WINDOWS\system32\owecli.dll
C:\WINDOWS\system32\p68q0gl5e6q.dll
C:\WINDOWS\system32\pechdprf.dll
C:\WINDOWS\system32\pGpnetsh.dll
C:\WINDOWS\system32\pMutoenr.dll
C:\WINDOWS\system32\rIssapi.dll
C:\WINDOWS\system32\rLschap.dll
C:\WINDOWS\system32\sbgtab.dll
C:\WINDOWS\system32\scdpsrv.dll
C:\WINDOWS\system32\smcurity.dll
C:\WINDOWS\system32\turmmgr.dll
C:\WINDOWS\system32\wh2help.dll
C:\WINDOWS\system32\whidx.dll
Granting sedebugprivilege to Administrators … successful
((((((((((((((((((((((((((((((((((((((((((( E-Give / Ssk's Log )))))))))))))))))))))))))))))))))))))))))))))))))
C:\Documents and Settings\del\Application Data\Sskknwrd.dll
C:\Documents and Settings\maureen\Application Data\Sskknwrd.dll
C:\WINDOWS\system32\bk.exe
C:\Program Files\surfsidekick 3\Ssk.exe
C:\Program Files\surfsidekick 3\SskBho.dll
C:\Program Files\surfsidekick 3\SskCore.dll
* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINDOWS\drsmartload2.dat
C:\WINDOWS\teller2.chk
C:\dfndrff_16.exe
C:\dfndrff_17.exe
C:\dfndrff_e.exe
C:\dfndrff_e1.exe
C:\dfndrff_e10.exe
C:\dfndrff_e11.exe
C:\dfndrff_e12.exe
C:\dfndrff_e13.exe
C:\dfndrff_e14.exe
C:\dfndrff_e2.exe
C:\dfndrff_e4.exe
C:\dfndrff_e5.exe
C:\dfndrff_e6.exe
C:\dfndrff_e7.exe
C:\dfndrff_e8.exe
C:\dfndrff_e9.exe
C:\drsmartload.exe
C:\drsmartload45a45a45a.exe
C:\drsmartload45a45a45b.exe
C:\drsmartload45a45a45d.exe
C:\drsmartload45a45a45f.exe
C:\drsmartload45a45a45g.exe
C:\drsmartload45a45a45h.exe
C:\drsmartload45a45p.exe
C:\drsmartload45a45q.exe
C:\drsmartload45a45r.exe
C:\drsmartload45a45t.exe
C:\drsmartload45a45u.exe
C:\drsmartload45a45v.exe
C:\drsmartload45a45w.exe
C:\drsmartload45a45x.exe
C:\drsmartload45a45y.exe
C:\drsmartload45a45z.exe
C:\drsmartload46a46p.exe
C:\drsmartload46a46q.exe
C:\drsmartload46a46r.exe
C:\drsmartload46a46t.exe
C:\drsmartload46a46u.exe
C:\drsmartload46a46v.exe
C:\drsmartload46a46w.exe
C:\drsmartload46a46x.exe
C:\drsmartload46a46y.exe
C:\drsmartload46a46z.exe
C:\drsmartload849a849p.exe
C:\drsmartload849a849q.exe
C:\drsmartload849a849r.exe
C:\drsmartload849a849t.exe
C:\drsmartload849a849u.exe
C:\drsmartload849a849v.exe
C:\drsmartload849a849w.exe
C:\drsmartload849a849x.exe
C:\drsmartload849a849y.exe
C:\drsmartload849a849z.exe
C:\deskbar.exe
C:\deskbar3.exe
C:\deskbar4.exe
C:\deskbar7.exe
C:\deskbar8.exe
C:\deskbar_e10.exe
C:\deskbar_e12.exe
C:\deskbar_e13.exe
C:\deskbar_e9.exe
C:\kybrdff_15.exe
C:\kybrdff_17.exe
C:\kybrdff_18.exe
C:\kybrdff_e10.exe
C:\kybrdff_e11.exe
C:\kybrdff_e12.exe
C:\kybrdff_e13.exe
C:\kybrdff_e14.exe
C:\kybrdff_e4.exe
C:\kybrdff_e5.exe
C:\kybrdff_e6.exe
C:\kybrdff_e7.exe
C:\kybrdff_e8.exe
C:\kybrdff_e9.exe
C:\MTE3NDI6ODoxNg.exe
C:\MTE3NDI6ODoxNgnew.exe
C:\nwnmff_16.exe
C:\nwnmff_17.exe
C:\nwnmff_18.exe
C:\nwnmff_e11.exe
C:\nwnmff_e12.exe
C:\nwnmff_e13.exe
C:\nwnmff_e14.exe
C:\nwnmff_e4.exe
C:\nwnmff_e5.exe
C:\nwnmff_e6.exe
C:\nwnmff_e7.exe
C:\nwnmff_e8.exe
C:\nwnmff_e9.exe
C:\stub_113_4_0_4_0newer.exe
C:\warebundlenewer.exe
C:\WINDOWS\system32\aaa00000.dll
C:\WINDOWS\system32\aaa00000.sys
C:\WINDOWS\system32\bszip.dll
C:\WINDOWS\system32\cmd.com
C:\WINDOWS\system32\netstat.com
C:\WINDOWS\system32\ping.com
C:\WINDOWS\system32\regedit.com
C:\WINDOWS\system32\taskkill.com
C:\WINDOWS\system32\tasklist.com
C:\WINDOWS\system32\tracert.com
C:\WINDOWS\system32\tsuninst.exe
C:\ac3_0010.exe
C:\Installer3.exe
C:\mte3ndi6odoxng.exe
C:\ucmoreiex.exe
C:\WINDOWS\RDFX4.exe
C:\WINDOWS\uninstall_nmon.vbs
C:\WINDOWS\system32\atmtd.dll
C:\WINDOWS\system32\atmtd.dll._
C:\WINDOWS\system32\w00411af.dll
C:\WINDOWS\system32\w004276a.dll
C:\WINDOWS\system32\w0057d84.dll
C:\WINDOWS\system32\w005bd6b.dll
C:\WINDOWS\system32\w006445e.dll
C:\WINDOWS\system32\w00644eb.dll
C:\WINDOWS\system32\w009f5ed.dll
C:\WINDOWS\system32\w00a324a.dll
C:\WINDOWS\system32\w00b9fb5.dll
C:\WINDOWS\system32\w00bee81.dll
C:\Documents and Settings\LocalService\Application Data\NetMon
C:\Program Files\Common Files\misc002
C:\Program Files\Deskbar
C:\Program Files\Inetget2
C:\Program Files\outlook
C:\Program Files\TheSearchAccelerator
C:\Program Files\ToolBar888
C:\Program Files\winupdates
C:\WINDOWS\system32\crunner
C:\WINDOWS\system32\w02d1002.dll
C:\Program Files\network monitor
C:\Program Files\Common Files\{E40EB415-09DB-2057-0813-02032602002c}
C:\WINDOWS\ZGVs
((((((((((((((((((((((((((((((( Files Created from 2006-08-25 to 2006-09-25 ))))))))))))))))))))))))))))))))))
2006-09-19 23:31 32,768 –a—— C:\DXC1205b.exe
2006-09-18 18:28 50,912 –a—— C:\WINDOWS\iconu.exe
2006-09-15 17:56 578,560 –a—— C:\Installer4.exe
2006-09-08 12:54 30,208 –a—— C:\SS1001newer.exe
2006-09-03 18:46 42,736 –a—— C:\WINDOWS\icont.exe
2006-09-02 01:26 499,712 –a—— C:\WINDOWS\system32\msvcp71.dll
2006-09-02 01:26 348,160 –a—— C:\WINDOWS\system32\msvcr71.dll
2006-09-02 01:26 1,060,864 –a—— C:\WINDOWS\system32\mfc71.dll
2006-09-02 01:25 89,088 –a—— C:\WINDOWS\system32\atl71.dll
2006-09-01 18:01 61,952 –a—— C:\WINDOWS\system32\trse09b8.dll
2006-09-01 18:01 1,233 –a—— C:\WINDOWS\system32\trse09b8.sys
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2006-09-25 19:12 ——– d——– C:\Program Files\Common Files
2006-09-25 18:16 ——– d——– C:\Program Files\Hijackthis
2006-09-25 17:41 ——– d——– C:\Program Files\Plaxo
2006-09-18 18:19 ——– d——– C:\Documents and Settings\del\Application Data\AdobeUM
2006-09-02 01:43 ——– d——– C:\Program Files\Incomplete
2006-09-02 01:16 ——– d——– C:\Program Files\LimeWire
2006-09-01 19:07 ——– d——– C:\Program Files\Common Files\zzko
2006-08-21 21:12 ——– d——– C:\Program Files\Soulseek
2006-08-21 13:21 16896 –a—— C:\WINDOWS\system32\fltlib.dll
2006-08-21 10:14 23040 –a—— C:\WINDOWS\system32\fltmc.exe
2006-08-21 10:14 128896 ——— C:\WINDOWS\system32\drivers\fltmgr.sys
2006-08-10 02:19 ——– d——– C:\Program Files\Internet Explorer
2006-08-09 20:12 ——– d——– C:\Program Files\PPStream
2006-08-09 20:11 ——– d——– C:\Documents and Settings\del\Application Data\ppstream
2006-08-05 17:48 ——– d——– C:\Program Files\Paint Shop Pro 5
2006-07-27 14:24 679424 –a—— C:\WINDOWS\system32\inetcomm.dll
2006-07-21 09:24 72704 –a—— C:\WINDOWS\system32\hlink.dll
2006-07-17 02:00 606848 –a—— C:\WINDOWS\flashax.exe
2006-07-17 02:00 12288 –a—— C:\WINDOWS\impborl.dll
2006-06-07 18:55 3753 –a—— C:\Program Files\html2.htm
2006-06-07 18:55 3626 –a—— C:\Program Files\html1.htm
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries are not shown
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Washer"="C:\\Program Files\\Washer\\washer.exe /0"
"PlaxoUpdate"="C:\\WINDOWS\\Plaxo\\2.1.0.80\\InstallStub.exe -a"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"Desktop Gordon"="C:\\Documents and Settings\\del\\My Documents\\Rippleffect\\Desktop Gordon\\gordon.exe"
"zzko"="C:\\PROGRA~1\\COMMON~1\\zzko\\zzkom.exe"
"cprocsvc"="C:\\WINDOWS\\system32\\crunner\\cproc.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroCheck"="C:\\WINDOWS\\System32\\NeroCheck.exe"
"NvCplDaemon"="RUNDLL32.EXE NvQTwk,NvCplDaemon initialize"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"TPP Auto Loader"="C:\\WINDOWS\\tppaldr.exe"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"Advanced Tools Check"="C:\\PROGRA~1\\NORTON~2\\AdvTools\\ADVCHK.EXE"
"REGSHAVE"="C:\\Program Files\\REGSHAVE\\REGSHAVE.EXE /AUTORUN"
"HPDJ Taskbar Utility"="C:\\WINDOWS\\System32\\spool\\drivers\\w32x86\\3\\hpztsb09.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"DataLayer"="C:\\Program Files\\Common Files\\PCSuite\\DataLayer\\DataLayer.exe"
"trse09b8"="RUNDLL32.EXE w02d1002.dll,n 003e09b50000000a02d1002"
"KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\
65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00
"nwiz"="nwiz.exe /install"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservicesonce]
"washindex"="C:\\Program Files\\Washer\\washidx.exe \"del\""
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="file:///C:/Documents%20and%20Settings/del/My%20Documents/My%20Webs/Google%20Image%20Search_files/hp0.gif"
"SubscribedURL"="file:///C:/Documents%20and%20Settings/del/My%20Documents/My%20Webs/Google%20Image%20Search_files/hp0.gif"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,72,03,00,00,39,01,00,00,9e,00,00,00,4e,00,00,00,e8,\
03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,00
"OriginalStateInfo"=hex:18,00,00,00,72,03,00,00,39,01,00,00,9e,00,00,00,4e,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:dc,ff,b3,02,86,bb,e9,77,e8,8a,e8,77,ff,ff,ff,ff,1e,7f,\
e7,77,1e,7f,e7,77
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,e6,00,00,00,00,00,00,00,9a,03,00,00,42,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,a0,00,00,00,00,00,00,00,80,02,00,00,3a,02,\
00,00,04,00,00,40
"RestoredStateInfo"=hex:18,00,00,00,a0,00,00,00,00,00,00,00,80,02,00,00,3a,02,\
00,00,01,00,00,00
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]
[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000
[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BlueSoleil.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\BlueSoleil.lnk"
"backup"="C:\\WINDOWS\\pss\\BlueSoleil.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\IVTCOR~1\\BLUESO~1\\BLUESO~1.EXE "
"item"="BlueSoleil"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Gator.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Gator.lnk"
"backup"="C:\\WINDOWS\\pss\\Gator.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\RECYCLER\\NPROTECT\\00172686.exe "
"item"="Gator"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^LG SyncManager.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\LG SyncManager.lnk"
"backup"="C:\\WINDOWS\\pss\\LG SyncManager.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\Program Files\\LG PC Suite\\LG PC Sync\\LGSyncManager.exe "
"item"="LG SyncManager"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^LimeWire 4.0.8.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\LimeWire 4.0.8.lnk"
"backup"="C:\\WINDOWS\\pss\\LimeWire 4.0.8.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\LimeWire\\LIMEWI~1.8\\LimeWire.exe -startup"
"item"="LimeWire 4.0.8"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MyWebSearch Email Plugin.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\MyWebSearch Email Plugin.lnk"
"backup"="C:\\WINDOWS\\pss\\MyWebSearch Email Plugin.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\MYWEBS~1\\bar\\3.bin\\MWSOEMON.EXE "
"item"="MyWebSearch Email Plugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Watch.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Watch.lnk"
"backup"="C:\\WINDOWS\\pss\\Watch.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\WINDOWS\\twain_32\\S6U12BX\\WATCH.exe "
"item"="Watch"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^del^Start Menu^Programs^Startup^BitTorrent.lnk]
"path"="C:\\Documents and Settings\\del\\Start Menu\\Programs\\Startup\\BitTorrent.lnk"
"backup"="C:\\WINDOWS\\pss\\BitTorrent.lnkStartup"
"location"="Startup"
"command"="C:\\PROGRA~1\\BITTOR~1\\BITTOR~1.EXE "
"item"="BitTorrent"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^del^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
"path"="C:\\Documents and Settings\\del\\Start Menu\\Programs\\Startup\\LimeWire On Startup.lnk"
"backup"="C:\\WINDOWS\\pss\\LimeWire On Startup.lnkStartup"
"location"="Startup"
"command"="C:\\PROGRA~1\\LimeWire\\LimeWire.exe -startup"
"item"="LimeWire On Startup"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^del^Start Menu^Programs^Startup^MyWebSearch Email Plugin.lnk]
"path"="C:\\Documents and Settings\\del\\Start Menu\\Programs\\Startup\\MyWebSearch Email Plugin.lnk"
"backup"="C:\\WINDOWS\\pss\\MyWebSearch Email Plugin.lnkStartup"
"location"="Startup"
"command"="C:\\PROGRA~1\\MYWEBS~1\\bar\\3.bin\\MWSOEMON.EXE "
"item"="MyWebSearch Email Plugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\ares]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Ares"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Ares\\Ares.exe\" -h"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\BullsEye Network]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="bargains"
"hkey"="HKLM"
"command"="C:\\Program Files\\BullsEye Network\\bin\\bargains.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\DeviceDiscovery]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="hpotdd01"
"hkey"="HKLM"
"command"="C:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpotdd01.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\HP Component Manager]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="hpcmpmgr"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\HP Software Update]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="HPWuSchd2"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWuSchd2.exe\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\IncrediMail]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="IncMail"
"hkey"="HKCU"
"command"="C:\\PROGRA~1\\INCRED~1\\bin\\IncMail.exe /c"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\MSMSGS]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msmsgs"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\MyWebSearch Email Plugin]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="mwsoemon"
"hkey"="HKCU"
"command"="C:\\PROGRA~1\\MYWEBS~1\\bar\\3.bin\\mwsoemon.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\PCSuiteTrayApplication]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="LaunchApplication"
"hkey"="HKLM"
"command"="C:\\Program Files\\Nokia\\Nokia PC Suite 6\\LaunchApplication.exe -onlytray"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\PcSync]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="PcSync2"
"hkey"="HKCU"
"command"="C:\\Program Files\\Nokia\\Nokia PC Suite 6\\PcSync2.exe /NoDialog"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Picasa Media Detector]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="PicasaMediaDetector"
"hkey"="HKLM"
"command"="C:\\Program Files\\Picasa2\\PicasaMediaDetector.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\RealPlayer]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="realplay"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Real\\RealOne Player\\realplay.exe\" /RunUPGToolCommandReBoot"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\ShellEx]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ShellEx"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\System32\\ShellEx.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Ulead Memory Card Detector]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Monitor"
"hkey"="HKLM"
"command"="C:\\Program Files\\Ulead Systems\\Ulead Photo Explorer 8.0 Trial\\Monitor.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Yahoo! Pager]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ypager"
"hkey"="HKCU"
"command"="C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe -quiet"
"inimapping"="0"
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll
Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer.job
C:\WINDOWS\tasks\Symantec NetDetect.job
Completion time: 25/09/2006 19:13:09.71
ComboFix.txt
New HJT log
Logfile of HijackThis v1.99.1
Scan saved at 19:17:07, on 25/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Panasonic\SD-JukeboxV3\sdjbmgr.exe
C:\WINDOWS\System32\sdpasvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cscript.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\tppaldr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Washer\washer.exe
C:\WINDOWS\Plaxo\2.1.0.80\InstallStub.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\del\My Documents\Rippleffect\Desktop Gordon\gordon.exe
C:\PROGRA~1\COMMON~1\zzko\zzkom.exe
C:\PROGRA~1\COMMON~1\zzko\zzkoa.exe
C:\WINDOWS\msagent\AgentSvr.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\Hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = www.msn.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.medion.co.uk
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\tppaldr.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~2\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [trse09b8] RUNDLL32.EXE w02d1002.dll,n 003e09b50000000a02d1002
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\RunServicesOnce: [washindex] C:\Program Files\Washer\washidx.exe "del"
O4 - HKCU\..\Run: [Washer] C:\Program Files\Washer\washer.exe /0
O4 - HKCU\..\Run: [PlaxoUpdate] C:\WINDOWS\Plaxo\2.1.0.80\InstallStub.exe -a
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Desktop Gordon] C:\Documents and Settings\del\My Documents\Rippleffect\Desktop Gordon\gordon.exe
O4 - HKCU\..\Run: [zzko] C:\PROGRA~1\COMMON~1\zzko\zzkom.exe
O4 - HKCU\..\Run: [cprocsvc] C:\WINDOWS\system32\crunner\cproc.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .3gp: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin5.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.medion.co.uk
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://www.drivecleaner.com/.freeware/inst…leanerstart.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://download.cdn.winsoftware.com/files/…FreeInstall.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Companion) -
http://us.dl1.yimg.com/download.yahoo.com/…ebio5_0_2_7.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup…er/imloader.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SDJB Manager - ?????????? - C:\Program Files\Panasonic\SD-JukeboxV3\sdjbmgr.exe
O23 - Service: SDPAUMS server service (SDPASVC) - Matsushita Electric Industrial Co.,Ltd. - C:\WINDOWS\System32\sdpasvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
You can go to where you had the old version and delete the whole folder.