Hi,
As requested, here is the comboscan txt:
ComboScan v20070221.16 run by Ben on 2007-02-26 at 19:40:58
Computer is in Normal Mode.
——————————————————————————–
Successfully created restore point.
Performed disk cleanup.
– HijackThis (run as Ben.exe) ————————————————–
Logfile of HijackThis v1.99.1
Scan saved at 19:41:38, on 26/02/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\sony\giga pocket\shwserv.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\sony\vaio media music server\SSSvr.exe
C:\Program Files\sony\photo server\appsrv\PhotoAppSrv.exe
C:\Program Files\sony\giga pocket\GPVSvr.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\wwSecure.exe
C:\Program Files\Common Files\Sony Shared\vaio media platform\sv_httpd.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Common Files\sony shared\vaio media platform\SV_Httpd.exe
C:\Program Files\drag'n drop cd+dvd\BinFiles\DragDrop.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\sony\keyboard closure setup\KSWServ.exe
C:\Program Files\Common Files\sony shared\vaio media platform\SV_Httpd.exe
C:\Program Files\NETGEAR\WG511v2\wlancfg5.exe
C:\Program Files\sony\usbsircs\usbsircs.exe
C:\Program Files\Common Files\Sony Shared\vaio media platform\UPnPFramework.exe
C:\Program Files\sony\giga pocket\ReserveModule.exe
C:\Program Files\Common Files\sony shared\vaio media platform\UPnPFramework.exe
C:\Program Files\Common Files\sony shared\vaio media platform\UPnPFramework.exe
C:\Program Files\Sony\VAIO Action Setup\VAServ.exe
C:\Program Files\sony\giga pocket\RM_SV.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\sony\giga pocket\gps.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Documents and Settings\Ben\Desktop\comboscan.exe
C:\Program Files\Ben.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://uk.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_6_2_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Drag'n Drop CD+DVD] C:\Program Files\drag'n drop cd+dvd\BinFiles\DragDrop.exe /StartUp
O4 - HKLM\..\Run: [MediaFace Integration] C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunServicesOnce: [washindex] C:\Program Files\Washer\washidx.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Keyboard Closure Setup.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NETGEAR Smart Wizard.lnk = ?
O4 - Global Startup: Remocon Driver.lnk = ?
O4 - Global Startup: Timer Recording Manager.lnk = C:\Program Files\sony\giga pocket\ReserveModule.exe
O4 - Global Startup: VAIO Action Setup (Server).lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) -
http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsoftupdat…b?1133618105421
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: Giga Pocket Hardware Detector - Sony Corporation - C:\Program Files\sony\giga pocket\shwserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Sony TV Tuner Controller - Sony Corporation - C:\Program Files\sony\giga pocket\halsv.exe
O23 - Service: Sony TV Tuner Manager - Sony Corporation - C:\Program Files\sony\giga pocket\RM_SV.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: VAIO Media Music Server (VAIOMediaPlatform-MusicServer-AppServer) - Unknown owner - C:\Program Files\sony\vaio media music server\SSSvr.exe" /Service=VAIOMediaPlatform-MusicServer-AppServer /DisplayName="VAIO Media Music Server (file missing)
O23 - Service: VAIO Media Music Server (HTTP) (VAIOMediaPlatform-MusicServer-HTTP) - Unknown owner - C:\Program Files\Common Files\Sony Shared\vaio media platform\sv_httpd.exe" /Service=VAIOMediaPlatform-MusicServer-HTTP /RegRoot="Software\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\MusicServer\HTTP (file missing)
O23 - Service: VAIO Media Music Server (UPnP) (VAIOMediaPlatform-MusicServer-UPnP) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\vaio media platform\UPnPFramework.exe
O23 - Service: VAIO Media Photo Server (VAIOMediaPlatform-PhotoServer-AppServer) - Sony Corporation - C:\Program Files\sony\photo server\appsrv\PhotoAppSrv.exe
O23 - Service: VAIO Media Photo Server (HTTP) (VAIOMediaPlatform-PhotoServer-HTTP) - Unknown owner - C:\Program Files\Common Files\sony shared\vaio media platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-PhotoServer-HTTP /RegRoot="Software\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Applications\PhotoServer\HTTP (file missing)
O23 - Service: VAIO Media Photo Server (UPnP) (VAIOMediaPlatform-PhotoServer-UPnP) - Sony Corporation - C:\Program Files\Common Files\sony shared\vaio media platform\UPnPFramework.exe
O23 - Service: VAIO Media Video Server (VAIOMediaPlatform-VideoServer-AppServer) - Unknown owner - C:\Program Files\sony\giga pocket\GPVSvr.exe" /Service=VAIOMediaPlatform-VideoServer-AppServer /DisplayName="VAIO Media Video Server (file missing)
O23 - Service: VAIO Media Video Server (HTTP) (VAIOMediaPlatform-VideoServer-HTTP) - Unknown owner - C:\Program Files\Common Files\sony shared\vaio media platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-VideoServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Applications\VideoServer\HTTP (file missing)
O23 - Service: VAIO Media Video Server (UPnP) (VAIOMediaPlatform-VideoServer-UPnP) - Sony Corporation - C:\Program Files\Common Files\sony shared\vaio media platform\UPnPFramework.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe
– HijackThis Fixed Entries (C:\Program Files\backups\) ————————-
backup-20040917-120526-569 O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
backup-20040917-120526-652 O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"
backup-20041128-230020-183 O4 - HKLM\..\Run: [CashBack] C:\Program Files\CashBack\bin\cashback.exe
backup-20050105-133345-123 O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} -
http://download.overpro.com/WildAppNonUS.cab
backup-20050510-175832-394 O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} (CR64Loader Object) -
http://www.miniclip.com/inflaterball/miniclipGameLoader.dll
backup-20050510-175833-103 O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) -
http://www5.incredimail.com/contents/setup…er/imloader.cab
backup-20050510-175833-445 O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) -
https://myauctiontrainerevents.webex.com/cl…bex/ieatgpc.cab
backup-20050623-201109-951 O16 - DPF: {B9A296D4-38AC-4566-8168-F7ACAF7D35E6} (Eyeball Video Session Control) -
http://imlive.com/ChatSource/gVideoContol.cab
backup-20050627-113738-997 O4 - HKLM\..\Run: [iyppaj] c:\windows\system32\kbdqbje.exe r
backup-20051021-121324-661 O16 - DPF: RaptisoftGameLoader -
http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
backup-20070211-162814-288 O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
backup-20070211-162814-289 O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) -
http://www.miniclip.com/zenpuzzlegarden/mi…pGameLoader.dll
backup-20070211-162814-329 O9 - Extra button: WH GBP Casino - {37236812-C1A2-4529-A9CE-CFE04E3DF08A} - C:\Documents and Settings\Ben\Desktop\WH GBP Casino.lnk (file missing)
backup-20070211-162814-425 O9 - Extra 'Tools' menuitem: WH GBP Casino - {37236812-C1A2-4529-A9CE-CFE04E3DF08A} - C:\Documents and Settings\Ben\Desktop\WH GBP Casino.lnk (file missing)
backup-20070211-162814-641 O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
backup-20070212-201037-213 O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
backup-20070212-201037-480 O11 - Options group: [INTERNATIONAL] International*
backup-20070212-201037-548 O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
backup-20070212-201037-997 O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
backup-20070212-201326-969 O16 - DPF: {26CBF141-7D0F-46E1-AA06-718958B6E4D2} -
http://download.ebay.com/turbo_lister/UK/install.cab
backup-20070212-201327-820 O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) -
http://www.miniclip.com/zenpuzzlegarden/mi…pGameLoader.dll
backup-20070212-201327-900 O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
backup-20070212-201328-276 O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) -
http://static.photobox.co.uk/sg/common/uploader.cab
backup-20070212-201328-511 O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) -
http://secure2.comned.com/signuptemplates/…login-devel.cab
backup-20070212-201328-973 O16 - DPF: {75D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin.SecureControl) -
http://secure2.comned.com/signuptemplates/ActiveSecurity.cab
backup-20070215-150359-592 O23 - Service: COM+ Messages - Unknown owner - C:\WINDOWS\system32\svchosts.exe" -e mc-110-12-0000272 (file missing)
backup-20070215-150359-813 O4 - HKLM\..\Run: [DllRunning] rundll32.exe "C:\WINDOWS\system32\ffhmpcmk.dll",setvm
backup-20070215-150359-833 O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe
backup-20070215-150359-988 O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
backup-20070226-132628-122 O20 - Winlogon Notify: gebyy - C:\WINDOWS\system32\gebyy.dll (file missing)
backup-20070226-132628-656 O2 - BHO: (no name) - {D9B17975-CAB9-484E-B33A-DEEB12F56300} - C:\WINDOWS\system32\gebyy.dll (file missing)
backup-20070226-132628-660 O20 - Winlogon Notify: winhqc32 - winhqc32.dll (file missing)
backup-20070226-132628-686 O2 - BHO: (no name) - {4090CCBD-7E49-B399-7D43-0936073563EB} - C:\WINDOWS\system32\tsjsru.dll
backup-20070226-132628-834 O2 - BHO: (no name) - {A22BEDA9-E441-44DD-8007-8FC47C451237} - C:\WINDOWS\system32\ljjjhig.dll (file missing)
backup-20070226-132628-907 O2 - BHO: (no name) - {08773F4E-75A7-4538-94E5-02FD22807E7E} - C:\WINDOWS\system32\awvvv.dll (file missing)
backup-20070226-132628-923 O2 - BHO: (no name) - {E03C740E-BB24-4d3c-B92A-6F84DE1DD99C} - C:\WINDOWS\system32\lahbvonk.dll (file missing)
– File Associations ————————————————————
.bat - batfile - "%1" %*
.chm - chm.file - "C:\WINDOWS\hh.exe" %1
.cmd - cmdfile - "%1" %*
.com - comfile - "%1" %*
.exe - exefile - "%1" %*
.hlp - hlpfile - %SystemRoot%\System32\winhlp32.exe %1
.inf - inffile - %SystemRoot%\System32\NOTEPAD.EXE %1
.ini - inifile - %SystemRoot%\System32\NOTEPAD.EXE %1
.js - JSFile - %SystemRoot%\System32\WScript.exe "%1" %*
.lnk - lnkfile - {00021401-0000-0000-C000-000000000046}
.pif - piffile - "%1" %*
.reg - regfile - regedit.exe "%1"
.scr - scrfile - "%1" /S
.txt - txtfile - %SystemRoot%\system32\NOTEPAD.EXE %1
.vbs - VBSFile - %SystemRoot%\System32\WScript.exe "%1" %*
– Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ———————-
3R aeaudio - C:\WINDOWS\system32\drivers\aeaudio.sys
3R AgereSoftModem (Agere Systems Soft Modem) - C:\WINDOWS\system32\drivers\AGRSM.sys
3S alcan5wn (SpeedTouch USB ADSL PPP Networking Driver (NDISWAN)) - C:\WINDOWS\system32\drivers\alcan5wn.sys
3S alcaudsl (SpeedTouch ADSL Modem ATM Transport) - C:\WINDOWS\system32\drivers\alcaudsl.sys
3R Arp1394 (1394 ARP Client Protocol) - C:\WINDOWS\system32\drivers\arp1394.sys
1R AVG Anti-Spyware Driver - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys
1R Avg7Core (AVG7 Kernel) - C:\WINDOWS\system32\drivers\avg7core.sys
1R Avg7RsW (AVG7 Wrap Driver) - C:\WINDOWS\system32\drivers\avg7rsw.sys
1R Avg7RsXP (AVG7 Rezident Driver) - C:\WINDOWS\system32\drivers\avg7rsxp.sys
1R AvgAsCln (AVG Anti-Spyware Clean Driver) - C:\WINDOWS\system32\drivers\AvgAsCln.sys
1R AvgClean (AVG7 Clean Driver) - C:\WINDOWS\system32\drivers\avgclean.sys
2R AvgTdi (AVG Network Redirector) - C:\WINDOWS\system32\drivers\avgtdi.sys
3S CCDECODE (Closed Caption Decoder) - C:\WINDOWS\system32\drivers\ccdecode.sys
3S ComFiltr (Panda Anti-Dialer) - C:\WINDOWS\System32\DRIVERS\COMFiltr.sys (not found)
1R DCCAM (Kodak Camera Proxy) - C:\WINDOWS\system32\drivers\DcCam.sys
3S DcFpoint - C:\WINDOWS\system32\drivers\DcFpoint.sys
2R DCFS2K (Kodak DCFS2K Driver) - C:\WINDOWS\system32\drivers\DCFS2k.sys
3S DcLps (Legacy Polling Service) - C:\WINDOWS\system32\drivers\DcLps.sys
3S DcPTP - C:\WINDOWS\system32\drivers\DcPtp.sys
1R DMICall (Sony DMI Call service) - C:\WINDOWS\system32\drivers\DMICall.sys
1S Exportit - C:\WINDOWS\system32\drivers\ExportIt.sys
3R GEARAspiWDM (GEAR CDRom Filter) - C:\WINDOWS\system32\drivers\GEARAspiWDM.sys
3R hidusb (Microsoft HID Class Driver) - C:\WINDOWS\system32\drivers\hidusb.sys
1R intelppm (Intel Processor Driver) - C:\WINDOWS\system32\drivers\intelppm.sys
1R kbdhid (Keyboard HID Driver) - C:\WINDOWS\system32\drivers\kbdhid.sys
3R mouhid (Mouse HID Driver) - C:\WINDOWS\system32\drivers\mouhid.sys
3S MSTEE (Microsoft Streaming Tee/Sink-to-Sink Converter) - C:\WINDOWS\system32\drivers\mstee.sys
3S NABTSFEC (NABTS/FEC VBI Codec) - C:\WINDOWS\system32\drivers\nabtsfec.sys
3S NdisIP (Microsoft TV/Video Connection) - C:\WINDOWS\system32\drivers\ndisip.sys
1R NetworkX - C:\WINDOWS\system32\Ckldrv.sys
3R NIC1394 (1394 Net Driver) - C:\WINDOWS\system32\drivers\nic1394.sys
0R ohci1394 (Texas Instruments OHCI Compliant IEEE 1394 Host Controller) - C:\WINDOWS\system32\drivers\ohci1394.sys
0R PxHelp20 - C:\WINDOWS\system32\drivers\pxhelp20.sys
3R rtl8139 (Realtek RTL8139/810x Family Fast Ethernet NIC NT Driver) - C:\WINDOWS\system32\drivers\R8139n51.sys
3R SiS315 - C:\WINDOWS\system32\drivers\sisgrp.sys
0R sisagp (SiS AGP Filter) - C:\WINDOWS\system32\drivers\SISAGPX.SYS
1R SiSkp - C:\WINDOWS\system32\drivers\srvkp.sys
3S SLIP (BDA Slip De-Framer) - C:\WINDOWS\system32\drivers\slip.sys
3R smrt (Sony MPEG RealTime encoder board) - C:\WINDOWS\system32\drivers\smrt.sys
3R smwdm - C:\WINDOWS\system32\drivers\smwdm.sys
2R SonyKBS (Keyboard State Detection Service) - C:\WINDOWS\system32\drivers\SonyKBS.sys
3R SONYWBMS (Sony Memory Stick controller(WB)) - C:\WINDOWS\system32\drivers\SonyWBMS.sys
0R srescan - C:\WINDOWS\system32\ZoneLabs\srescan.sys
3S ss_bus (Samsung Mobile USB Device 1.0 driver (WDM)) - C:\WINDOWS\system32\drivers\ss_bus.sys
3S ss_mdfl (SAMSUNG Mobile USB Modem 1.0 Filter) - C:\WINDOWS\system32\drivers\ss_mdfl.sys
3S ss_mdm (SAMSUNG Mobile USB Modem 1.0 Drivers) - C:\WINDOWS\system32\drivers\ss_mdm.sys
3S streamip (BDA IPSink) - C:\WINDOWS\system32\drivers\streamip.sys
3S SYMIDSCO - C:\WINDOWS\system32\Drivers\SYMIDSCO.SYS (not found)
3R usbehci (Microsoft USB 2.0 Enhanced Host Controller Miniport Driver) - C:\WINDOWS\system32\drivers\usbehci.sys
3R usbohci (Microsoft USB Open Host Controller Miniport Driver) - C:\WINDOWS\system32\drivers\usbohci.sys
3S usbprint (Microsoft USB PRINTER Class) - C:\WINDOWS\system32\drivers\usbprint.sys
3S usbser (Motorola USB Modem Driver) - C:\WINDOWS\system32\drivers\usbser.sys
3S USBSTOR (USB Mass Storage Driver) - C:\WINDOWS\system32\drivers\usbstor.sys
3S v800bus (Sony Ericsson V800-Vodafone 802SE driver (WDM)) - C:\WINDOWS\system32\drivers\v800bus.sys
3S v800mdfl (Sony Ericsson V800-Vodafone 802SE USB WMC Modem Filter) - C:\WINDOWS\system32\drivers\v800mdfl.sys
3S v800mdm (Sony Ericsson V800-Vodafone 802SE USB WMC Modem Driver) - C:\WINDOWS\system32\drivers\v800mdm.sys
3S v800mgmt (Sony Ericsson V800-Vodafone 802SE USB WMC Device Management Drivers (WDM)) - C:\WINDOWS\system32\drivers\v800mgmt.sys
3S v800obex (Sony Ericsson V800-Vodafone 802SE USB WMC OBEX Interface) - C:\WINDOWS\system32\drivers\v800obex.sys
1R vsdatant - C:\WINDOWS\system32\vsdatant.sys
3R W8335XP (NETGEAR WG511v2 54 Mbps Wireless PC Card for Windows XP (8335)) - C:\WINDOWS\system32\drivers\WG511v2XP.sys
3S WSTCODEC (World Standard Teletext Codec) - C:\WINDOWS\system32\drivers\wstcodec.sys
3S WudfPf (Windows Driver Foundation - User-mode Driver Framework Platform Driver) - C:\WINDOWS\system32\drivers\WudfPf.sys
3S WudfRd (Windows Driver Foundation - User-mode Driver Framework Reflector) - C:\WINDOWS\system32\drivers\WudfRd.sys
– Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ———————
4S Alerter - C:\WINDOWS\System32\svchost.exe -k LocalService
3R ALG (Application Layer Gateway Service) - C:\WINDOWS\System32\alg.exe
3S AppMgmt (Application Management) - C:\WINDOWS\system32\svchost.exe -k netsvcs
3S aspnet_state (ASP.NET State Service) - C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
2R AudioSrv (Windows Audio) - C:\WINDOWS\System32\svchost.exe -k netsvcs
2R AVG Anti-Spyware Guard - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
2R Avg7Alrt (AVG7 Alert Manager Server) - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
2R Avg7UpdSvc (AVG7 Update Service) - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
2R AVGEMS (AVG E-mail Scanner) - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
2R BITS (Background Intelligent Transfer Service) - C:\WINDOWS\System32\svchost.exe -k netsvcs
2R Browser (Computer Browser) - C:\WINDOWS\System32\svchost.exe -k netsvcs
3S CiSvc (Indexing Service) - C:\WINDOWS\system32\cisvc.exe
4S ClipSrv (ClipBook) - C:\WINDOWS\system32\clipsrv.exe
4S COM+ Messages - "C:\WINDOWS\system32\svchosts.exe" -e mc-110-12-0000272
3S COMSysApp (COM+ System Application) - C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
2R Crypkey License - crypserv.exe
2R CryptSvc (Cryptographic Services) - C:\WINDOWS\system32\svchost.exe -k netsvcs
2R DcomLaunch (DCOM Server Process Launcher) - C:\WINDOWS\system32\svchost -k DcomLaunch
2R Dhcp (DHCP Client) - C:\WINDOWS\System32\svchost.exe -k netsvcs
3S dmadmin (Logical Disk Manager Administrative Service) - C:\WINDOWS\System32\dmadmin.exe /com
3S dmserver (Logical Disk Manager) - C:\WINDOWS\System32\svchost.exe -k netsvcs
2R Dnscache (DNS Client) - C:\WINDOWS\System32\svchost.exe -k NetworkService
2R ERSvc (Error Reporting Service) - C:\WINDOWS\System32\svchost.exe -k netsvcs
2R Eventlog (Event Log) - C:\WINDOWS\system32\services.exe
3R EventSystem (COM+ Event System) - C:\WINDOWS\System32\svchost.exe -k netsvcs
3R FastUserSwitchingCompatibility (Fast User Switching Compatibility) - C:\WINDOWS\System32\svchost.exe -k netsvcs
2R Giga Pocket Hardware Detector - C:\Program Files\sony\giga pocket\shwserv.exe
2R helpsvc (Help and Support) - C:\WINDOWS\System32\svchost.exe -k netsvcs
4S HidServ (Human Interface Device Access) - C:\WINDOWS\System32\svchost.exe -k netsvcs
3S HTTPFilter (HTTP SSL) - C:\WINDOWS\System32\svchost.exe -k HTTPFilter
3S IDriverT (InstallDriver Table Manager) - "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe"
3S ImapiService (IMAPI CD-Burning COM Service) - C:\WINDOWS\System32\imapi.exe
3R iPod Service - "C:\Program Files\iPod\bin\iPodService.exe"
2R KodakCCS (Kodak Camera Connection Software) - C:\WINDOWS\system32\drivers\KodakCCS.exe
2R lanmanserver (Server) - C:\WINDOWS\System32\svchost.exe -k netsvcs
2R lanmanworkstation (Workstation) - C:\WINDOWS\System32\svchost.exe -k netsvcs
2R LmHosts (TCP/IP NetBIOS Helper) - C:\WINDOWS\System32\svchost.exe -k LocalService
4S Messenger - C:\WINDOWS\System32\svchost.exe -k netsvcs
3S mnmsrvc (NetMeeting Remote Desktop Sharing) - C:\WINDOWS\System32\mnmsrvc.exe
3S MSDTC (Distributed Transaction Coordinator) - C:\WINDOWS\System32\msdtc.exe
3S MSIServer (Windows Installer) - C:\WINDOWS\system32\msiexec.exe /V
4S NetDDE (Network DDE) - C:\WINDOWS\system32\netdde.exe
4S NetDDEdsdm (Network DDE DSDM) - C:\WINDOWS\system32\netdde.exe
3S Netlogon (Net Logon) - C:\WINDOWS\System32\lsass.exe
3R Netman (Network Connections) - C:\WINDOWS\System32\svchost.exe -k netsvcs
3R Nla (Network Location Awareness (NLA)) - C:\WINDOWS\System32\svchost.exe -k netsvcs
3S NtLmSsp (NT LM Security Support Provider) - C:\WINDOWS\System32\lsass.exe
3S NtmsSvc (Removable Storage) - C:\WINDOWS\system32\svchost.exe -k netsvcs
3S PACSPTISVR - "C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe"
2R PlugPlay (Plug and Play) - C:\WINDOWS\system32\services.exe
2R PolicyAgent (IPSEC Services) - C:\WINDOWS\System32\lsass.exe
2R ProtectedStorage (Protected Storage) - C:\WINDOWS\system32\lsass.exe
3S RasAuto (Remote Access Auto Connection Manager) - C:\WINDOWS\System32\svchost.exe -k netsvcs
3R RasMan (Remote Access Connection Manager) - C:\WINDOWS\System32\svchost.exe -k netsvcs
3S RDSessMgr (Remote Desktop Help Session Manager) - C:\WINDOWS\system32\sessmgr.exe
4S RemoteAccess (Routing and Remote Access) - C:\WINDOWS\System32\svchost.exe -k netsvcs
3S RpcLocator (Remote Procedure Call (RPC) Locator) - C:\WINDOWS\System32\locator.exe
2R RpcSs (Remote Procedure Call (RPC)) - C:\WINDOWS\system32\svchost -k rpcss
3S RSVP (QoS RSVP) - C:\WINDOWS\System32\rsvp.exe
2R SamSs (Security Accounts Manager) - C:\WINDOWS\system32\lsass.exe
3S SCardSvr (Smart Card) - C:\WINDOWS\System32\SCardSvr.exe
2R Schedule (Task Scheduler) - C:\WINDOWS\System32\svchost.exe -k netsvcs
2R seclogon (Secondary Logon) - C:\WINDOWS\System32\svchost.exe -k netsvcs
2R SENS (System Event Notification) - C:\WINDOWS\system32\svchost.exe -k netsvcs
2R SharedAccess (Windows Firewall/Internet Connection Sharing (ICS)) - C:\WINDOWS\System32\svchost.exe -k netsvcs
2R ShellHWDetection (Shell Hardware Detection) - C:\WINDOWS\System32\svchost.exe -k netsvcs
3S SNDSrvc (Symantec Network Drivers Service) - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
3S Sony TV Tuner Controller - C:\Program Files\sony\giga pocket\halsv.exe
3R Sony TV Tuner Manager - C:\Program Files\sony\giga pocket\RM_SV.exe
2R Spooler (Print Spooler) - C:\WINDOWS\system32\spoolsv.exe
3S SPTISRV (Sony SPTI Service) - "C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe"
2R srservice (System Restore Service) - C:\WINDOWS\System32\svchost.exe -k netsvcs
3R SSDPSRV (SSDP Discovery Service) - C:\WINDOWS\System32\svchost.exe -k LocalService
3S stisvc (Windows Image Acquisition (WIA)) - C:\WINDOWS\System32\svchost.exe -k imgsvc
3S SwPrv (MS Software Shadow Copy Provider) - C:\WINDOWS\System32\dllhost.exe /Processid:{E98AC3F2-A6A9-474B-B7B9-085EF54A025D}
3S SysmonLog (Performance Logs and Alerts) - C:\WINDOWS\system32\smlogsvc.exe
3R TapiSrv (Telephony) - C:\WINDOWS\System32\svchost.exe -k netsvcs
3R TermService (Terminal Services) - C:\WINDOWS\System32\svchost -k DComLaunch
2R Themes - C:\WINDOWS\System32\svchost.exe -k netsvcs
2R TrkWks (Distributed Link Tracking Client) - C:\WINDOWS\system32\svchost.exe -k netsvcs
3S upnphost (Universal Plug and Play Device Host) - C:\WINDOWS\System32\svchost.exe -k LocalService
3S UPS (Uninterruptible Power Supply) - C:\WINDOWS\System32\ups.exe
2R VAIOMediaPlatform-MusicServer-AppServer (VAIO Media Music Server) - "C:\Program Files\sony\vaio media music server\SSSvr.exe" /Service=VAIOMediaPlatform-MusicServer-AppServer /DisplayName="VAIO Media Music Server"
2R VAIOMediaPlatform-MusicServer-HTTP (VAIO Media Music Server (HTTP)) - "C:\Program Files\Common Files\Sony Shared\vaio media platform\sv_httpd.exe" /Service=VAIOMediaPlatform-MusicServer-HTTP /RegRoot="Software\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\MusicServer\HTTP"
2R VAIOMediaPlatform-MusicServer-UPnP (VAIO Media Music Server (UPnP)) - C:\Program Files\Common Files\Sony Shared\vaio media platform\UPnPFramework.exe
2R VAIOMediaPlatform-PhotoServer-AppServer (VAIO Media Photo Server) - C:\Program Files\sony\photo server\appsrv\PhotoAppSrv.exe
2R VAIOMediaPlatform-PhotoServer-HTTP (VAIO Media Photo Server (HTTP)) - "C:\Program Files\Common Files\sony shared\vaio media platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-PhotoServer-HTTP /RegRoot="Software\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Applications\PhotoServer\HTTP"
2R VAIOMediaPlatform-PhotoServer-UPnP (VAIO Media Photo Server (UPnP)) - C:\Program Files\Common Files\sony shared\vaio media platform\UPnPFramework.exe
2R VAIOMediaPlatform-VideoServer-AppServer (VAIO Media Video Server) - "C:\Program Files\sony\giga pocket\GPVSvr.exe" /Service=VAIOMediaPlatform-VideoServer-AppServer /DisplayName="VAIO Media Video Server"
2R VAIOMediaPlatform-VideoServer-HTTP (VAIO Media Video Server (HTTP)) - "C:\Program Files\Common Files\sony shared\vaio media platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-VideoServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Applications\VideoServer\HTTP"
2R VAIOMediaPlatform-VideoServer-UPnP (VAIO Media Video Server (UPnP)) - C:\Program Files\Common Files\sony shared\vaio media platform\UPnPFramework.exe
2R vsmon (TrueVector Internet Monitor) - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service
3S VSS (Volume Shadow Copy) - C:\WINDOWS\System32\vssvc.exe
2R W32Time (Windows Time) - C:\WINDOWS\System32\svchost.exe -k netsvcs
2R WebClient - C:\WINDOWS\System32\svchost.exe -k LocalService
2R winmgmt (Windows Management Instrumentation) - C:\WINDOWS\system32\svchost.exe -k netsvcs
3S WmdmPmSN (Portable Media Serial Number Service) - C:\WINDOWS\System32\svchost.exe -k netsvcs
3S WmiApSrv (WMI Performance Adapter) - C:\WINDOWS\System32\wbem\wmiapsrv.exe
3S WMPNetworkSvc (Windows Media Player Network Sharing Service) - "C:\Program Files\Windows Media Player\WMPNetwk.exe"
2R wscsvc (Security Center) - C:\WINDOWS\System32\svchost.exe -k netsvcs
2R wuauserv (Automatic Updates) - C:\WINDOWS\system32\svchost.exe -k netsvcs
3S WudfSvc (Windows Driver Foundation - User-mode Driver Framework) - C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
2R wwSecSvc (Washer Security Access) - C:\WINDOWS\system32\wwSecure.exe
2R WZCSVC (Wireless Zero Configuration) - C:\WINDOWS\System32\svchost.exe -k netsvcs
3S xmlprov (Network Provisioning Service) - C:\WINDOWS\System32\svchost.exe -k netsvcs
– Scheduled Tasks ————————————————————–
2007-01-14 17:03:48 526 –a—— C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Ben.job
2006-10-16 22:59:25 284 –a—— C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
– Files created between 2007-01-26 and 2007-02-26 ——————————
2007-02-26 19:41:20 218112 –a—— C:\Program Files\Ben.exe
2007-02-26 13:09:42 3968 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-02-25 21:22:13 0 d——– C:\VundoFix Backups
2007-02-21 20:32:20 0 d——– C:\Documents and Settings\Ben\Application Data\Lavasoft
2007-02-15 15:00:46 218112 –a—— C:\Program Files\Scanner.exe
2007-02-12 21:36:59 0 d——– C:\Program Files\Windows Media Connect 2
2007-02-12 21:33:22 0 d——– C:\WINDOWS\system32\LogFiles
2007-02-12 21:33:22 0 d——– C:\WINDOWS\system32\drivers\UMDF
2007-02-12 15:51:51 3968 –a—— C:\WINDOWS\system32\drivers\avgclean.sys
2007-02-12 15:51:50 18432 –a—— C:\WINDOWS\system32\drivers\avgmfx86.sys
2007-02-12 15:06:21 0 d——– C:\Program Files\InetGet2
2007-02-11 17:41:54 0 d——– C:\Program Files\Ultimate Cleaner
2007-02-11 17:41:38 0 d——– C:\Program Files\S?mantec
2007-02-11 17:41:30 94720 –a—— C:\WINDOWS\system32\ifhcawn.dll
2007-02-11 17:07:48 0 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2007-02-11 16:32:58 0 d——– C:\Documents and Settings\All Users\Application Data\Adobe
2007-02-11 16:31:24 0 d——– C:\KPCMS
2007-02-11 16:31:22 0 d——– C:\Program Files\Common Files\Kodak
2007-02-11 16:31:17 0 d——– C:\WINDOWS\system32\wins
2007-02-11 16:31:17 0 d——– C:\WINDOWS\system32\dhcp
2007-02-11 16:31:17 0 d——– C:\WINDOWS\system32\3com_dmi
2007-02-11 16:31:17 0 d——– C:\WINDOWS\system32\2052
2007-02-11 16:31:17 0 d——– C:\WINDOWS\system32\1042
2007-02-11 16:31:17 0 d——– C:\WINDOWS\system32\1037
2007-02-11 16:31:17 0 d——– C:\WINDOWS\system32\1028
2007-02-11 16:31:17 0 d–h—– C:\WINDOWS\PIF
2007-02-11 16:31:17 0 d–h—– C:\WINDOWS\msdownld.tmp
2007-02-11 16:31:16 0 d–hs—- C:\WINDOWS\ftpcache
2007-02-11 16:31:16 0 d——– C:\WINDOWS\Connection Wizard
2007-02-11 16:31:16 0 d——– C:\WINDOWS\addins
2007-02-11 16:31:16 0 d——– C:\Program Files\WRS Software
2007-02-11 16:31:16 0 d——– C:\Program Files\eBay
2007-02-11 16:31:16 0 d——– C:\Program Files\Common Files\ReGet Shared
2007-02-11 16:31:16 0 d——– C:\MPEGTmp
2007-02-11 16:31:15 0 d——– C:\Documents and Settings\NetworkService\Application Data\AVG7
2007-02-11 16:31:15 0 d——– C:\Documents and Settings\Ben\Incomplete
2007-02-11 16:31:14 0 d——– C:\Converted Music
2007-02-11 16:31:14 0 dr-h—– C:\$VAULT$.AVG
2007-02-11 16:31:13 0 d——– C:\Documents and Settings\All Users\Application Data\VAIO Media Platform
2007-02-11 16:31:12 0 d——– C:\Documents and Settings\LocalService\Application Data\AVG7
2007-02-11 16:31:11 0 d——– C:\Program Files\cache
2007-02-11 16:31:11 0 d——– C:\Downloads
2007-02-11 16:31:10 0 d——– C:\WINDOWS\Config
2007-02-11 16:31:10 0 d——– C:\Program Files\VideoLAN
2007-02-11 16:31:10 0 d——– C:\Program Files\TomTom DesktopSuite
2007-02-11 16:31:09 0 d——– C:\WINDOWS\system32\ShellExt
2007-02-11 16:31:09 0 d——– C:\WINDOWS\system32\export
2007-02-11 16:31:09 0 d——– C:\WINDOWS\system32\3076
2007-02-11 16:31:09 0 d——– C:\WINDOWS\system32\1054
2007-02-11 16:31:09 0 d——– C:\WINDOWS\system32\1041
2007-02-11 16:31:09 0 d——– C:\WINDOWS\system32\1031
2007-02-11 16:31:09 0 d——– C:\WINDOWS\system32\1025
2007-02-11 16:31:09 0 d——– C:\WINDOWS\SiSInf
2007-02-11 16:31:09 0 d——– C:\WINDOWS\mui
2007-02-11 16:31:01 0 d——– C:\Program Files\Business Planner v3
2007-02-11 15:27:37 0 d——– C:\Documents and Settings\Ben\Application Data\URSoft
2007-02-11 15:27:34 0 d——– C:\Program Files\Your Uninstaller 2006
2007-01-29 08:58:06 60416 —–n— C:\WINDOWS\system32\tzchange.exe
2007-01-27 00:13:31 0 d——– C:\Program Files\William Hill Poker
2007-01-26 16:57:55 0 d——– C:\Documents and Settings\All Users\Application Data\Adobe(2)
– Find3M Report —————————————————————-
2007-02-26 19:41:38 10892 –a—— C:\Program Files\hijackthis.log
2007-02-26 13:26:28 0 d——– C:\Program Files\backups
2007-02-26 13:09:38 0 d——– C:\Program Files\Grisoft
2007-02-21 20:32:09 0 d——– C:\Program Files\Lavasoft
2007-02-15 15:09:58 10255 –a—— C:\Program Files\logfile.txt
2007-02-12 15:51:36 0 d—s—- C:\Documents and Settings\Ben\Application Data\Microsoft
2007-02-11 17:50:02 0 d——– C:\Program Files\Common Files\Symantec Shared
2007-02-11 16:31:23 0 d——– C:\Program Files\Kodak
2007-02-11 16:31:16 0 d——– C:\Program Files\Microsoft AntiSpyware
2007-02-11 16:31:16 0 d–h—– C:\Program Files\InstallShield Installation Information
2007-02-11 16:31:16 0 d——– C:\Program Files\Hewlett-Packard
2007-02-11 16:31:16 0 d——– C:\Program Files\CyberLink
2007-02-11 16:31:16 0 d——– C:\Program Files\Ahead
2007-02-11 16:31:11 0 d——– C:\Program Files\QuickTime
2007-02-11 16:31:11 0 d——– C:\Program Files\DivX
2007-02-11 16:31:11 0 d——– C:\Program Files\Common Files\ODBC
2007-02-11 15:40:11 0 d——– C:\Program Files\Microsoft Works
2007-01-26 16:55:52 0 d——– C:\Documents and Settings\Ben\Application Data\AdobeUM
2007-01-14 19:36:20 0 d——– C:\Program Files\Common Files\Webroot Shared
2007-01-14 19:36:16 0 d——– C:\Documents and Settings\Ben\Application Data\Webroot
2007-01-14 19:36:14 0 d——– C:\Program Files\Webroot
2007-01-14 19:35:02 0 d——– C:\Program Files\Washer
2007-01-14 17:49:24 0 d——– C:\Program Files\Java
2007-01-14 17:36:06 0 d——– C:\Documents and Settings\Ben\Application Data\AVG7
2007-01-14 17:35:48 0 d——– C:\Program Files\Norton AntiVirus
2007-01-12 09:27:42 232960 –a—— C:\WINDOWS\system32\webcheck.dll
2007-01-12 09:27:42 51712 –a—— C:\WINDOWS\system32\msfeedsbs.dll
2007-01-12 09:27:42 458752 –a—— C:\WINDOWS\system32\msfeeds.dll
2007-01-12 09:27:42 6054400 –a—— C:\WINDOWS\system32\ieframe.dll
2007-01-08 19:04:54 105984 –a—— C:\WINDOWS\system32\url.dll
2007-01-08 19:04:08 102400 –a—— C:\WINDOWS\system32\occache.dll
2007-01-08 19:02:04 266752 –a—— C:\WINDOWS\system32\iertutil.dll
2007-01-08 19:02:04 44544 –a—— C:\WINDOWS\system32\iernonce.dll
2007-01-08 19:02:02 384000 –a—— C:\WINDOWS\system32\iedkcs32.dll
2007-01-08 19:02:02 383488 –a—— C:\WINDOWS\system32\ieapfltr.dll
2007-01-08 19:02:02 161792 –a—— C:\WINDOWS\system32\ieakui.dll
2007-01-08 19:02:02 230400 –a—— C:\WINDOWS\system32\ieaksie.dll
2007-01-08 19:02:02 153088 –a—— C:\WINDOWS\system32\ieakeng.dll
2007-01-08 19:01:14 17408 –a—— C:\WINDOWS\system32\corpol.dll
2007-01-08 19:00:48 124928 –a—— C:\WINDOWS\system32\advpack.dll
2007-01-08 18:08:14 56832 –a—— C:\WINDOWS\system32\ie4uinit.exe
2007-01-08 18:08:10 13824 –a—— C:\WINDOWS\system32\ieudinit.exe
2006-12-19 21:52:18 134656 –a—— C:\WINDOWS\system32\shsvcs.dll
2006-12-19 18:16:47 333824 –a—— C:\WINDOWS\system32\wiaservc.dll
2006-11-27 14:54:06 433152 –a—— C:\WINDOWS\system32\riched20.dll
2006-11-27 14:54:06 539136 –a—— C:\WINDOWS\system32\msftedit.dll
– Registry Dump —————————————————————-
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runservicesonce]
"washindex"="C:\\Program Files\\Washer\\washidx.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SiS Tray"=""
"AGRSMMSG"="AGRSMMSG.exe"
"Drag'n Drop CD+DVD"="C:\\Program Files\\drag'n drop cd+dvd\\BinFiles\\DragDrop.exe /StartUp"
"MediaFace Integration"="C:\\Program Files\\Fellowes\\MediaFACE 4.0\\SetHook.exe"
"HPDJ Taskbar Utility"="C:\\WINDOWS\\System32\\spool\\drivers\\w32x86\\3\\hpztsb09.exe"
"HP Software Update"="\"C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWuSchd.exe\""
"HP Component Manager"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\""
"DeviceDiscovery"="C:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpotdd01.exe"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\""
"Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex]
@=""
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{A22BEDA9-E441-44DD-8007-8FC47C451237}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgw.exe /RUNONCE"
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgw.exe /RUNONCE"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=dword:00000000
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a2fcbcf3-4cbe-11db-ac76-000c6ed2a697}]
Shell\AutoRun\command G:\InstallTomTomHOME.exe
– End of ComboScan: finished at 2007-02-26 at 19:42:16 ————————-
And Here is the supplementary txt:
ComboScan v20070221.16 run by Ben on 2007-02-26 at 19:40:58
Supplementary logfile - please post this as an attachment with your post.
——————————————————————————–
– System Information ———————————————————–
Microsoft Windows XP Home Edition (build 2600) SP 2.0
Architecture: X86; Language: English
CPU 0: Intel® Pentium® 4 CPU 2.80GHz
Percentage of Memory in Use: 74%
Physical Memory (total/avail): 479.53 MiB / 123.36 MiB
Pagefile Memory (total/avail): 1124.42 MiB / 750.84 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1993.69 MiB
C: is Fixed (NTFS) - 27.95 GiB total, 9.09 GiB free.
D: is Fixed (NTFS) - 121.1 GiB total, 95.68 GiB free.
E: is Removable (FAT)
F: is CDROM (No Media)
– Security Center ————————————————————–
AUOptions is scheduled to auto-install.
Windows Internal Firewall is disabled.
FW: ZoneAlarm Firewall v6.5.737.000 (Zone Labs, Inc.)
AV: AVG 7.5.441 v7.5.441 (GRISOFT)
– Environment Variables ——————————————————–
ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Ben\Application Data
CLASSPATH=.;C:\Program Files\Java\jre1.5.0_09\lib\ext\QTJava.zip
CLIENTNAME=Console
COLLECTIONID=wuclient
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=CHRISTINE
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HMSERVER=https://h30083.www3.hp.com/wuss/servlet/WUSSServlet
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Ben
ITEMID=wuclienten
LANG=2057
LOGONSERVER=\\CHRISTINE
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
OSVER=winXPH
Path=C:\WINDOWS\SYSTEM32;C:\WINDOWS;C:\WINDOWS\SYSTEM32\WBEM;C:\PROGRA~1\ThriXXX\3D SexVilla;C:\Program Files\QuickTime\QTSystem\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 2 Stepping 9, GenuineIntel
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=0209
ProgramFiles=C:\Program Files
PROMPT=$P$G
QTJAVA=C:\Program Files\Java\jre1.5.0_09\lib\ext\QTJava.zip
SESSIONID=1092867666071wuws06-l1d32e45:fe98141c68:3365
SESSIONNAME=Console
SWUTVER=1.0.18.30716
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\Ben\LOCALS~1\Temp
TIMEOUT=0
TMP=C:\DOCUME~1\Ben\LOCALS~1\Temp
TOOLPATH=/C:\Program%20Files\Hewlett-Packard\HP%20Software%20Update\install.htm
tvdumpflags=8
UPDATEDIR=C:\DOCUME~1\Ben\LOCALS~1\Temp\rad8DD07.tmp
USERDOMAIN=CHRISTINE
USERNAME=Ben
USERPROFILE=C:\Documents and Settings\Ben
VERSION=2.0.35
windir=C:\WINDOWS
__COMPAT_LAYER=EnableNXShowUI
– User Profiles —————————————————————-
Ben
(admin)
Spare
(admin)
Spare.CHRISTINE
(admin)
Administrator
(admin)
– Add/Remove Programs ———————————————————-
–> "C:\WINDOWS\ie7updates\KB929969\spuninst\spuninst.exe"
–> C:\Program Files\Anti-Leech\ALIE_1.0.2.2\iesetup2.exe uninstall
–> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
–> C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\orun32.isu
–> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{93B80FB1-7A23-11D3-B250-00105A1F4184}\setup.exe"
–> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Ad-Aware SE Personal –> C:\PROGRA~1\Lavasoft\AD-AWA~2\UNWISE.EXE C:\PROGRA~1\Lavasoft\AD-AWA~2\INSTALL.LOG
Adobe Acrobat 5.0 –> C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.isu" -c"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.dll"
Adobe Reader 7.0.8 –> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70500000002}
Agere Systems AC'97 Modem –> agrsmdel
Ahead ImageDrive –> C:\WINDOWS\UNIDRV.exe /UNINSTALL
Ahead Nero - Burning Rom –> C:\WINDOWS\UNNERO.exe /UNINSTALL
Apple Software Update –> MsiExec.exe /I{A50C25D7-62E9-4511-AD70-8E2DA5E79B7D}
AVG 7.5 –> C:\Program Files\Grisoft\AVG7\setup.exe /UNINSTALL
AVG Anti-Spyware 7.5 –> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe
BitTornado 0.3.7 –> C:\Program Files\BitTornado\uninst.exe
CCHelp –> MsiExec.exe /I{9D1CF8B6-17B3-4832-B062-2C2DD0B57B04}
CCScore –> MsiExec.exe /I{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}
Click to DVD 1.2 –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7C2F71B2-6C73-11D6-B659-00C04F790F76}\setup.exe"
Cucusoft MPEG to DVD Author 1.06 –> "C:\Program Files\Cucusoft\DVD-Author\unins000.exe"
Cucusoft MPEG/AVI to DVD/VCD/SVCD/MPEG Converter Pro 5.12 –> "C:\Program Files\Cucusoft\avi-dvd-pro\unins000.exe"
Cucusoft MPEG/MOV/RM/DivX/AVI to DVD/VCD/SVCD Converter Pro 7.0 –> "C:\Program Files\Cucusoft\avi-dvd-pro\unins001.exe"
Cucusoft MPEG/MOV/RM/DivX/AVI to DVD/VCD/SVCD Creator Pro 7.07 –> "C:\Program Files\Cucusoft\avi-dvd-pro\unins002.exe"
dBpowerAMP Music Converter –> "C:\WINDOWS\System32\SpoonUninstall.exe" C:\WINDOWS\System32\SpoonUninstall-dBpowerAMP Music Converter.dat
dBpowerAMP Ogg Vorbis Codec –> "C:\WINDOWS\System32\Spoo
You're infected…
Rename HijackThis.exe to Scanner.exe
Post a fresh HijacKThis (scanner.exe) log to here.
Couple of things not quite right:
1) Windows update symbol constantly appears in the taskbar but never moves from 0%
2) Computer seems slow whilst booting up
3) When using the internet, if I click a link that opens a new window, it opens the new window but closes the window I had open previously.
Any ideas how to solve the above of why they are happening?
Ben