gappro
Topic Starter
high cpu usage could'n find wats wrong
i suppose svchost be the cause
sys hangs after every 10 mins after which i needed restart
tried antivirus and regstry boosters, but ended in vain
and one more thing
i tried disabling all my startups and services in msconfig
still no good news
HIJACKTHIS LOG
Logfile of HijackThis v1.99.1
Scan saved at 10:22:37 AM, on 6/20/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\kavin\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchgateway.net/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.searchgateway.net/search/%s
F2 - REG:system.ini: Shell=Explorer.exe
O1 - Hosts:
O1 - Hosts: "http://www.w3.org/TR/html4/loose.dtd">
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts: Site Unavailable
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts: [image unavailable: image]http://us.i1.yimg.com/us.yimg.com/i/us/smbiz/b/geo_mast_small2.gi f" alt="Yahoo! GeoCities" border="0" height="15" hspace="0" vspace="0" width="141">
O1 - Hosts:
O1 - Hosts: –>
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts: Get your own web site at
Yahoo! GeoCities
O1 - Hosts: [image unavailable: image]http://us.i1.yimg.com/us.yimg.com/i/us/wh/gr/badge_hostedby_purp_ 2.gif" alt="Hosted by Yahoo! Web Hosting" align="middle" border="0" height="31" width="88">
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts: Copyright ©
O1 - Hosts: 2005 Yahoo! Inc. All rights reserved
O1 - Hosts: http://privacy.yahoo.com/privacy/us/geo/">Privacy Policy
O1 - Hosts: - http://docs.yahoo.com/info/copyright/copyright.html">Copyright Policy
O1 - Hosts: - http://docs.yahoo.com/info/guidelines/community.html">Guidelines
O1 - Hosts: - http://docs.yahoo.com/info/terms/geoterms.html">Terms of Service
O1 - Hosts: - http://help.yahoo.com/help/us/geo/">Help
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts: < /applet>
O1 - Hosts: [image unavailable: image]http://geo.yahoo.com/serv?s=19190039&t=1160482414&f=us-w55" ALT=1 WIDTH=1 HEIGHT=1>
O2 - BHO: IE7pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IE7Pro\IE7Pro.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ChangerBHO Class - {0edc6c20-a31c-11db-8ab9-0800200c9a66} - C:\WINDOWS\system32\olethk32b.dll (file missing)
O2 - BHO: ChangerBHO Class - {1D4C7057-EAD2-44C6-AD18-9092905F28F1} - C:\WINDOWS\system32\olecli32v.dll (file missing)
O2 - BHO: SpoofBHO Class - {385066e0-23f3-11db-a98b-0800200c9a66} - C:\WINDOWS\se_spoof.dll (file missing)
O2 - BHO: ContextualAds Class - {3AAC4C68-AFC8-11DB-80EF-8AF955D89593} - C:\Program Files\TrustIn Contextual\trustincontext.dll (file missing)
O2 - BHO: WeeklyExecuter Class - {590FFB84-6A29-4797-9C0E-B15DF2C4CDCB} - C:\WINDOWS\inetloader.dll (file missing)
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: Clicker Class - {631f7200-642e-11db-bd13-0800200c9a66} - C:\WINDOWS\system32\mscoriezb.dll (file missing)
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Web Replay BHO - {8B57DF7C-9BF9-4D52-B94E-37ACE3893F7D} - C:\Program Files\Deskperience\Web Replay\inetie.dll
O2 - BHO: Clicker Class - {A97B5EF1-CA64-466F-AC40-F770ED52DB92} - C:\WINDOWS\system32\mscoriezz.dll (file missing)
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: IE AutoLogin - {E5CD7155-19C9-4860-84C2-B84CFE6836A5} - C:\Program Files\IE AutoLogin\ieautologinb.dll
O2 - BHO: (no name) - {F3FAF2F7-D2C0-4EA4-8DAD-B4B974371C1E} - C:\WINDOWS\System32\ieuihandler.dll
O2 - BHO: ContextualAds Class - {FE6C16C4-16AD-47B6-B250-26AD1829E49A} - C:\Program Files\TrustIn Contextual\trustincontext.dll (file missing)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: (no name) - {a19ef336-01d4-48e6-926a-fe7e1c747aed} - (no file)
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: IE AutoLogin - {1270B213-5BA9-4A46-B7B2-DFAD48E5E0A3} - C:\Program Files\IE AutoLogin\ieautologin.dll
O3 - Toolbar: AutoFiller - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\Program Files\AutoFiller\Bin\AFiller.dll
O3 - Toolbar: Web Replay Toolbar - {756727E5-1E5C-4284-B2DA-C21D3A283A38} - C:\Program Files\Deskperience\Web Replay\inetieui.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\RunServices: [WINTASK] msmgrxp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: &WebReplay Fill Login - res://C:\Program Files\Deskperience\Web Replay\inetieui.dll/292
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: IE7pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll
O9 - Extra 'Tools' menuitem: IE7pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll
O9 - Extra button: iOpus iMacros - {0483894E-2422-45E0-8384-021AFF1AF3CD} - C:\Program Files\iMacros\imacros.dll
O9 - Extra 'Tools' menuitem: iMacros Web Automation - {0483894E-2422-45E0-8384-021AFF1AF3CD} - C:\Program Files\iMacros\imacros.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Web Replay - {3401B8CC-95A4-4dbe-B73F-00E2D23F2B73} - C:\Program Files\Deskperience\Web Replay\ShowToolbar.dll
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.kumudam.com/wfplayer/tdserver.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/18b697ba4ac3ce…ip/RdxIE601.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…ls/en/x86/clien t/muweb_site.cab?1068268296514
O16 - DPF: {B7E76C25-791F-432E-BDB7-748D01A93FC2} (VacPro.int_ver30) - http://advnt01.com/dialer/int_ver30.CAB
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = EARTH_DOMAIN
O17 - HKLM\Software\..\Telephony: DomainName = EARTH_DOMAIN
O17 - HKLM\System\CCS\Services\Tcpip\..\{54F4B658-8C5F-431D-BF93-5F05C6A4DFA 4}: NameServer = 218.248.240.23 218.248.240.135
O17 - HKLM\System\CCS\Services\Tcpip\..\{FA84C8A8-ED07-4467-97B0-AF2CE230DD4 9}: NameServer = 10.200.1.11
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = EARTH_DOMAIN
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: rpcc - C:\WINDOWS\System32\rpcc.dll
O20 - Winlogon Notify: tcpG4T - tcpG4T.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:\WINDOWS\System32\vbsys2.dll (file missing)
O21 - SSODL: Internet Explorer - {F28A40D7-AD0E-034A-C651-5F0ED76232E6} - C:\WINDOWS\System32\Kebbje32.dll (file missing)
O21 - SSODL: SysTray.Excn - {1722ECFF-4356-4f5b-B534-E67294FE75E9} - C:\WINDOWS\System32\nkjemhkc.dll (file missing)
O21 - SSODL: SysTray.Exsh - {1768ECFC-4F5C-4f5b-B134-D67294FC78E9} - C:\WINDOWS\System32\doonoimg.dll (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
[external image: Posted Image]
[external image: Posted Image]
i suppose svchost be the cause
sys hangs after every 10 mins after which i needed restart
tried antivirus and regstry boosters, but ended in vain
and one more thing
i tried disabling all my startups and services in msconfig
still no good news
HIJACKTHIS LOG
Logfile of HijackThis v1.99.1
Scan saved at 10:22:37 AM, on 6/20/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\kavin\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchgateway.net/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.searchgateway.net/search/%s
F2 - REG:system.ini: Shell=Explorer.exe
O1 - Hosts:
O1 - Hosts: "http://www.w3.org/TR/html4/loose.dtd">
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts: Site Unavailable
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
[image unavailable: Yahoo! GeoCities]http://us.i1.yimg.com/us.yimg.com/i/us/nt/ma/ma_geo_1.gif" width=259 border=0>
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
Sorry, this GeoCities site is currently unavailable.
O1 - Hosts:
The GeoCities web site you were trying to view has temporarily exceeded its data transfer limit. Please try again later.
O1 - Hosts:
Are you the site owner?
O1 - Hosts: Avoid service interruptions in the future by increasing your data transfer limit!
O1 - Hosts: Find out how.
O1 - Hosts:
Learn more about data transfer.
O1 - Hosts:
O1 - Hosts:
O1 - Hosts: [image unavailable: image]http://us.i1.yimg.com/us.yimg.com/i/us/smbiz/b/geo_mast_small2.gi f" alt="Yahoo! GeoCities" border="0" height="15" hspace="0" vspace="0" width="141">
O1 - Hosts:
SPONSORED LINKS
O1 - Hosts: –>
O1 - Hosts:
O1 - Hosts:
http://pa.yahoo.com/*http://us.rd.yahoo.com/evt=27166/*http://sm allbusiness.yahoo.com/webhosting" target="_blank">Yahoo! Web Hosting
O1 - Hosts: $25 Setup Waived
O1 - Hosts: $25 Setup Waived
O1 - Hosts:
Reliable plans include domain & 24x7 support.
O1 - Hosts:
http://pa.yahoo.com/*http://us.rd.yahoo.com/evt=27166/*http://sm allbusiness.yahoo.com/webhosting" target="_blank">webhosting.yahoo.com
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
http://pa.yahoo.com/*http://us.rd.yahoo.com/evt=27176/*http://sm allbusiness.yahoo.com/domains/" target="_blank">Domain Names from Yahoo! only $9.95/yr
O1 - Hosts:
Includes starter web page, email & domain forwarding, 24x7 support.
O1 - Hosts:
http://pa.yahoo.com/*http://us.rd.yahoo.com/evt=27176/*http://sm allbusiness.yahoo.com/domains/" target="_blank">domains.yahoo.com
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
http://pa.yahoo.com/*http://us.rd.yahoo.com/evt=27184/*http://sm allbusiness.yahoo.com/mail" target="_blank">Yahoo! Business Email
Domain Included
Domain Included
O1 - Hosts:
Setup fee waived. Up to 10 emails, SpamGuard, forwarding & virus scanning.
O1 - Hosts:
http://pa.yahoo.com/*http://us.rd.yahoo.com/evt=27184/*http://sm allbusiness.yahoo.com/mail" target="_blank">smallbusiness.yahoo.com
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
http://pa.yahoo.com/*http://us.rd.yahoo.com/evt=/27190/*http://s mallbusiness.yahoo.com/merchant" target="_blank">Ecommerce from Yahoo!
1 Month Free
1 Month Free
O1 - Hosts:
$50 setup fee waived. A reliable ecommerce plan, 24x7 support.
O1 - Hosts:
http://pa.yahoo.com/*http://us.rd.yahoo.com/evt=/27190/*http://s mallbusiness.yahoo.com/merchant" target="_blank">smallbusiness.yahoo.com
O1 - Hosts:
O1 - Hosts:
O1 - Hosts: Get your own web site at
Yahoo! GeoCities
O1 - Hosts: [image unavailable: image]http://us.i1.yimg.com/us.yimg.com/i/us/wh/gr/badge_hostedby_purp_ 2.gif" alt="Hosted by Yahoo! Web Hosting" align="middle" border="0" height="31" width="88">
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts: Copyright ©
O1 - Hosts: 2005 Yahoo! Inc. All rights reserved
O1 - Hosts: http://privacy.yahoo.com/privacy/us/geo/">Privacy Policy
O1 - Hosts: - http://docs.yahoo.com/info/copyright/copyright.html">Copyright Policy
O1 - Hosts: - http://docs.yahoo.com/info/guidelines/community.html">Guidelines
O1 - Hosts: - http://docs.yahoo.com/info/terms/geoterms.html">Terms of Service
O1 - Hosts: - http://help.yahoo.com/help/us/geo/">Help
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts: < /applet>
O1 - Hosts: [image unavailable: image]http://geo.yahoo.com/serv?s=19190039&t=1160482414&f=us-w55" ALT=1 WIDTH=1 HEIGHT=1>
O2 - BHO: IE7pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IE7Pro\IE7Pro.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ChangerBHO Class - {0edc6c20-a31c-11db-8ab9-0800200c9a66} - C:\WINDOWS\system32\olethk32b.dll (file missing)
O2 - BHO: ChangerBHO Class - {1D4C7057-EAD2-44C6-AD18-9092905F28F1} - C:\WINDOWS\system32\olecli32v.dll (file missing)
O2 - BHO: SpoofBHO Class - {385066e0-23f3-11db-a98b-0800200c9a66} - C:\WINDOWS\se_spoof.dll (file missing)
O2 - BHO: ContextualAds Class - {3AAC4C68-AFC8-11DB-80EF-8AF955D89593} - C:\Program Files\TrustIn Contextual\trustincontext.dll (file missing)
O2 - BHO: WeeklyExecuter Class - {590FFB84-6A29-4797-9C0E-B15DF2C4CDCB} - C:\WINDOWS\inetloader.dll (file missing)
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: Clicker Class - {631f7200-642e-11db-bd13-0800200c9a66} - C:\WINDOWS\system32\mscoriezb.dll (file missing)
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Web Replay BHO - {8B57DF7C-9BF9-4D52-B94E-37ACE3893F7D} - C:\Program Files\Deskperience\Web Replay\inetie.dll
O2 - BHO: Clicker Class - {A97B5EF1-CA64-466F-AC40-F770ED52DB92} - C:\WINDOWS\system32\mscoriezz.dll (file missing)
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: IE AutoLogin - {E5CD7155-19C9-4860-84C2-B84CFE6836A5} - C:\Program Files\IE AutoLogin\ieautologinb.dll
O2 - BHO: (no name) - {F3FAF2F7-D2C0-4EA4-8DAD-B4B974371C1E} - C:\WINDOWS\System32\ieuihandler.dll
O2 - BHO: ContextualAds Class - {FE6C16C4-16AD-47B6-B250-26AD1829E49A} - C:\Program Files\TrustIn Contextual\trustincontext.dll (file missing)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: (no name) - {a19ef336-01d4-48e6-926a-fe7e1c747aed} - (no file)
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: IE AutoLogin - {1270B213-5BA9-4A46-B7B2-DFAD48E5E0A3} - C:\Program Files\IE AutoLogin\ieautologin.dll
O3 - Toolbar: AutoFiller - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\Program Files\AutoFiller\Bin\AFiller.dll
O3 - Toolbar: Web Replay Toolbar - {756727E5-1E5C-4284-B2DA-C21D3A283A38} - C:\Program Files\Deskperience\Web Replay\inetieui.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\RunServices: [WINTASK] msmgrxp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: &WebReplay Fill Login - res://C:\Program Files\Deskperience\Web Replay\inetieui.dll/292
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: IE7pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll
O9 - Extra 'Tools' menuitem: IE7pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll
O9 - Extra button: iOpus iMacros - {0483894E-2422-45E0-8384-021AFF1AF3CD} - C:\Program Files\iMacros\imacros.dll
O9 - Extra 'Tools' menuitem: iMacros Web Automation - {0483894E-2422-45E0-8384-021AFF1AF3CD} - C:\Program Files\iMacros\imacros.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Web Replay - {3401B8CC-95A4-4dbe-B73F-00E2D23F2B73} - C:\Program Files\Deskperience\Web Replay\ShowToolbar.dll
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.kumudam.com/wfplayer/tdserver.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/18b697ba4ac3ce…ip/RdxIE601.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…ls/en/x86/clien t/muweb_site.cab?1068268296514
O16 - DPF: {B7E76C25-791F-432E-BDB7-748D01A93FC2} (VacPro.int_ver30) - http://advnt01.com/dialer/int_ver30.CAB
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = EARTH_DOMAIN
O17 - HKLM\Software\..\Telephony: DomainName = EARTH_DOMAIN
O17 - HKLM\System\CCS\Services\Tcpip\..\{54F4B658-8C5F-431D-BF93-5F05C6A4DFA 4}: NameServer = 218.248.240.23 218.248.240.135
O17 - HKLM\System\CCS\Services\Tcpip\..\{FA84C8A8-ED07-4467-97B0-AF2CE230DD4 9}: NameServer = 10.200.1.11
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = EARTH_DOMAIN
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: rpcc - C:\WINDOWS\System32\rpcc.dll
O20 - Winlogon Notify: tcpG4T - tcpG4T.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:\WINDOWS\System32\vbsys2.dll (file missing)
O21 - SSODL: Internet Explorer - {F28A40D7-AD0E-034A-C651-5F0ED76232E6} - C:\WINDOWS\System32\Kebbje32.dll (file missing)
O21 - SSODL: SysTray.Excn - {1722ECFF-4356-4f5b-B534-E67294FE75E9} - C:\WINDOWS\System32\nkjemhkc.dll (file missing)
O21 - SSODL: SysTray.Exsh - {1768ECFC-4F5C-4f5b-B134-D67294FC78E9} - C:\WINDOWS\System32\doonoimg.dll (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
[external image: Posted Image]
[external image: Posted Image]