com9.hri; Baseline

I am a new user and will gladly support the site for a a bit of assistance. I just downloaded the latest Symantec pattern file (after a 2 week vacation) and immediately began receiving the following message: —————— Scan type: Auto-Protect Scan Event: Threat Found! Threat: Trojan.Linkoptimizer File: C:\WINDOWS\com9 Location: C:\WINDOWS Computer: L3HM277 User: peliades Action taken: Clean failed : Quarantine failed : Access denied Date found: Wednesday, September 20, 2006 1:39:58 PM —————— I have downloaded and run the latest hijackthis executable (shown in subsequent posting). Can someone tell me which lines I need to delete? Thanks, regards, phil e. —————— Logfile of HijackThis v1.99.1 Scan saved at 12:40:58 PM, on 9/20/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Here is the hijackthis log related to my previous post:
——————
Logfile of HijackThis v1.99.1
Scan saved at 12:40:58 PM, on 9/20/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Chevron\GIL Tools\GILExec.exe
C:\Program Files\Altiris\eXpress\Credentials\AeXCredRun.exe
C:\Program Files\Chevron\GIL Tools\GILAppMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\PROGRA~1\Chevron\GILTOO~1\MYDOCU~1\My_Docs.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Mindjet\MindManager 6\MMReminderService.exe
C:\Program Files\Nokia\Nokia PC Suite 6\Launch Application 2.exe
C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\WorkPace 3.0\workpace.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\PROGRA~1\Chevron\GILTOO~1\GSCE\GSCE.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\peliades\My Documents\Files\ZProgram Data\hjt\hjt2\hjt3\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://myinside.chevron.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://myinside.chevron.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Global Information Link
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://www.inet.co.th/proxy.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.unocal.com;*.ptcpi.com;*.gulflubes.com;*.chevrontexacocards.com;*.oronite.com;*.chevroncreditcard.com;*.tengizchevroil.net;*.tengizchevroil.com;*.knowledgeplanet.com;*.chevrontexaco.net;*.chevrontexaco.com;*.chevron.net;*.chevron.com;*.bkk.unocal.com;*.ad.unocal.com;
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Program Files\Passlogix\v-GO SSO\ssoshell.exe /background
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Class - {D4F458C6-0265-A02C-6181-2E9EFC4FB556} - C:\WINDOWS\hwnod1.dll (file missing)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [WiseUser] C:\Program Files\Chevron\WiseUser\WiseUser.exe
O4 - HKLM\..\Run: [GIL Application Manager] C:\Program Files\Chevron\GIL Tools\GILAppMgr.exe
O4 - HKLM\..\Run: [ScCertProp] C:\Program Files\Schlumberger\Smart Cards and Terminals\ScCertProp\CertDeprop.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [NewProf] "C:\Program Files\Chevron\GIL Tools\newprof.exe"
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Executive Software\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [SMS Logon Server Batch File] C:\WINDOWS\system32\runquiet.exe C:\WINDOWS\system32\cmd.exe /c %logonserver%\netlogon\smsls.bat
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [MMReminderService] C:\Program Files\Mindjet\MindManager 6\MMReminderService.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\Launch Application 2.exe -onlytray
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [newbreed] PasswdMon.exe
O4 - HKCU\..\Run: [bnui] driver64.exe
O4 - HKCU\..\Run: [runload32] wormexe.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: WorkPace 3.0.lnk = C:\Program Files\WorkPace 3.0\workpace.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Send to Mindjet MindManager - {531B9DC0-D8EE-4c76-A6EE-6C1E50569655} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://myinside.chevron.com
O16 - DPF: Expense Report Solutions - http://tea.gap.chevrontexaco.com/cgi-bin/ERSSSO/Exc.cab
O16 - DPF: {002F9EE1-55C9-4B92-BB02-FD1C256B89DF} - http://gromozon.com/0470641d/sm/50305/1/xp/FreeAccess.ocx
O16 - DPF: {134F7664-943D-3BB9-65F5-70B91DF46C86} - http://www.v-codec.com/getcodec/SVideoCodec4_01a.exe
O16 - DPF: {6C5FF3D2-5978-4728-A4FE-A7714B94A6AF} (ChvCITCOPLocal.OPLocal) - http://gilop.chevrontexaco.com/ChvCITCOPLocal.CAB
O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - https://smartbadgeportal.chevrontexaco.com/msrdp.cab
O16 - DPF: {8535D1E6-5BDD-4A29-B488-C0A553FAF29D} (ChvCITCOPLocal.OPLocal) - http://gilop.chevrontexaco.com/ChvCITCOPLocal.CAB
O16 - DPF: {8B20416D-2FA4-11D7-84A0-0050BAC66AC4} (eBook.usrdoc) - file://C:\Documents and Settings\peliades\My Documents\Files\ZProgram Data\Zachman\eBook2004\Zachman eBook Release 1.8\eBook.CAB
O16 - DPF: {8FA85E15-012B-420F-A4E7-FF2B7AA9F9D6} (ChvCITCNetGILLocal.OPNetGIL) - http://gilop.gap.chevrontexaco.com/ChvCITCNetGILLocal.CAB
O16 - DPF: {A1B8A30B-8AAA-4A3E-8869-1DA509E8A011} (Crystal ActiveX Report Viewer Control 10.0) - http://crystalent.chevrontexaco.com/crysta…tiveXViewer.cab
O16 - DPF: {C25CD630-5DEC-48C3-BE22-A9EA59464F1B} (ChvCITCWAMLocal.WAMLocal) - http://wam.chevrontexaco.com/ChvCITCWAMLocal.CAB
O16 - DPF: {DF6A03A8-52FE-11D7-84BA-0050BAC66AC4} (eBook.usrdoc) - file://D:\Zachman eBook Release 1.8\eBook.CAB
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = bkkhq.chevrontexaco.net
O17 - HKLM\Software\..\Telephony: DomainName = bkkhq.chevrontexaco.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = bkkhq.chevrontexaco.net
O20 - Winlogon Notify: GILNotify - C:\Program Files\Chevron\GIL Tools\GILNotify.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: Altiris Credentials Service - Altiris Inc. - C:\Program Files\Altiris\eXpress\Credentials\AeXCredSvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: SMS Agent Host (CcmExec) - Unknown owner - C:\WINDOWS\system32\CCM\CcmExec.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN 3000 Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: GIL Automated Signatures Service (GILGasSV) - - c:\navdef\gilgassv\gilgassv.exe
O23 - Service: GIL Security Compliance Enforcer (GSCEService) - ChevronTexaco - c:\program files\chevron\gil tools\gsce\gsceservice.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

Thanks very much for your help. It appears that my problem has been solved using the removal tool.
I have pasted the most recent hjt log below. If there is something further that required, plesae let me know.
Thanks again!
–Phil
————————
Logfile of HijackThis v1.99.1
Scan saved at 4:34:38 PM, on 9/22/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Chevron\GIL Tools\GILExec.exe
C:\Program Files\Altiris\eXpress\Credentials\AeXCredRun.exe
C:\Program Files\Chevron\GIL Tools\GILAppMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\Chevron\GILTOO~1\MYDOCU~1\My_Docs.exe
C:\WINDOWS\system32\TpShocks.exe
C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\Mindjet\MindManager 6\MMReminderService.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\Chevron\GILTOO~1\GSCE\GSCE.exe
C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\peliades\My Documents\Files\ZProgram Data\hjt\hjt3\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://Findandsearch.chevrontexaco.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://inside.chevrontexaco.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://inside.chevrontexaco.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Global Information Link
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.oronite.com;*.chevroncreditcard.com;*.tengizchevroil.net;*.tengizchevroil.com;*.knowledgeplanet.com;*.*.texaco.com;*.chevrontexaco.net;*.chevrontexaco.com;*.chevron.net;*.chevron.com;*.bkk.unocal.com;*.ad.unocal.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: DeXa.Badge EPM IE SSO Module - {801BF87E-A000-11D3-81FE-00902741DE09} - C:\Program Files\Schlumberger\DeXa.Badge EPM\WebSSO.dll (file missing)
O2 - BHO: CmjBrowserHelperObject Object - {AC41D38F-B56D-40AD-94E0-B493D130C959} - C:\Program Files\Mindjet\MindManager 6\Mm6InternetExplorer.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [WiseUser] C:\Program Files\Chevron\WiseUser\WiseUser.exe
O4 - HKLM\..\Run: [GIL Application Manager] C:\Program Files\Chevron\GIL Tools\GILAppMgr.exe
O4 - HKLM\..\Run: [ScCertProp] C:\Program Files\Schlumberger\Smart Cards and Terminals\ScCertProp\CertDeprop.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [NewProf] "C:\Program Files\Chevron\GIL Tools\newprof.exe"
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Executive Software\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [SMS Logon Server Batch File] C:\WINDOWS\system32\runquiet.exe C:\WINDOWS\system32\cmd.exe /c %logonserver%\netlogon\smsls.bat
O4 - HKLM\..\Run: [MMReminderService] C:\Program Files\Mindjet\MindManager 6\MMReminderService.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: WorkPace 3.0.lnk = C:\Program Files\WorkPace 3.0\workpace.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Send to Mindjet MindManager - {531B9DC0-D8EE-4c76-A6EE-6C1E50569655} - C:\Program Files\Mindjet\MindManager 6\Mm6InternetExplorer.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://myinside.chevron.com
O16 - DPF: {6C5FF3D2-5978-4728-A4FE-A7714B94A6AF} (ChvCITCOPLocal.OPLocal) - http://gilop.chevrontexaco.com/ChvCITCOPLocal.CAB
O16 - DPF: {8535D1E6-5BDD-4A29-B488-C0A553FAF29D} (ChvCITCOPLocal.OPLocal) - http://gilop.chevrontexaco.com/ChvCITCOPLocal.CAB
O16 - DPF: {8FA85E15-012B-420F-A4E7-FF2B7AA9F9D6} (ChvCITCNetGILLocal.OPNetGIL) - http://gilop.gap.chevrontexaco.com/ChvCITCNetGILLocal.CAB
O16 - DPF: {C25CD630-5DEC-48C3-BE22-A9EA59464F1B} (ChvCITCWAMLocal.WAMLocal) - http://wam.chevrontexaco.com/ChvCITCWAMLocal.CAB
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = bkkhq.chevrontexaco.net
O17 - HKLM\Software\..\Telephony: DomainName = bkkhq.chevrontexaco.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = bkkhq.chevrontexaco.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = bkkhq.chevrontexaco.net
O20 - Winlogon Notify: GILNotify - C:\Program Files\Chevron\GIL Tools\GILNotify.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: tpfnf2 - C:\WINDOWS\SYSTEM32\notifyf2.dll
O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
O23 - Service: Altiris Credentials Service - Altiris Inc. - C:\Program Files\Altiris\eXpress\Credentials\AeXCredSvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: SMS Agent Host (CcmExec) - Unknown owner - C:\WINDOWS\system32\CCM\CcmExec.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: GIL Automated Signatures Service (GILGasSV) - - c:\navdef\gilgassv\gilgassv.exe
O23 - Service: GIL Security Compliance Enforcer (GSCEService) - ChevronTexaco - c:\program files\chevron\gil tools\gsce\gsceservice.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.EXE

————