Logfile of HijackThis v1.99.1
Scan saved at 12:40:08, on 20/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows

Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec

Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec

Shared\AppCore\AppSvc32.exe
C:\Program Files\Common Files\Symantec

Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec

Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program

Files\Symantec\LiveUpdate\ALUSchedulerSvc.ex

e
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\KMaestro\KMaestro.exe
C:\Program Files\btbb_wcm\McciTrayApp.exe
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Symantec

Shared\ccApp.exe
C:\Program Files\BT Broadband Desktop

Help\bin\BTHelpNotifier.exe
C:\Program Files\Windows

Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\cisvc.exe
C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\xtras\m

ssysmgr.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\Microsoft

Shared\VS7Debug\mdm.exe
C:\Program Files\PC Connectivity

Solution\ServiceLayer.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\wupdmgr.exe
C:\Program Files\Internet

Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Yahoo!\browser\ybrowser.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.E

XE
C:\DOCUME~1\WILKOS~1\LOCALS~1\Temp\Temp

orary Directory 1 for

hijackthis[1].zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet

Explorer\Main,Search Bar =

http://uk.red.clientapps.yahoo.com/customize/bt

yahoo/defaults/sb/*http://uk.docs.yahoo.com/info

/bt_side.html
R1 - HKCU\Software\Microsoft\Internet

Explorer\Main,Search Page =

http://uk.red.clientapps.yahoo.com/customize/bt

yahoo/defaults/sp/*http://uk.search.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet

Explorer\Main,Start Page =

http://home.bt.yahoo.com
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Page_URL =

http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Search_URL =

http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Search Bar =

http://uk.red.clientapps.yahoo.com/customize/bt

yahoo/defaults/sb/*http://uk.docs.yahoo.com/info

/bt_side.html
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Search Page =

http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet

Explorer\Main,Start Page =

http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet

Explorer\SearchURL,(Default) =

http://uk.red.clientapps.yahoo.com/customize/bt

yahoo/defaults/su/*http://uk.search.yahoo.com/
R3 - URLSearchHook: Yahoo! Toolbar -

{EF99BD32-C1FB-11D2-892F-0090271D4F88} -

C:\Program

Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper -

{02478D38-C3F9-4EFB-9B51-7695ECA05670} -

C:\Program

Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -

C:\Program Files\Adobe\Acrobat

7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) -

{1E8A6170-7264-4D0F-BEAE-D42A53123C75} -

C:\Program Files\Common Files\Symantec

Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: (no name) -

{53707962-6F74-2D53-2644-206D7942484F} -

C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button -

{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} -

C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class -

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -

C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper -

{9030D464-4C02-4ABF-8ECC-5164760863C6} -

C:\Program Files\Common Files\Microsoft

Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SidebarAutoLaunch Class -

{F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} -

C:\Program

Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Yahoo! Toolbar -

{EF99BD32-C1FB-11D2-892F-0090271D4F88} -

C:\Program

Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Show Norton Toolbar -

{90222687-F593-4738-B738-FBEE9C7B26DF} -

C:\Program Files\Common Files\Symantec

Shared\coShared\Browser\1.5\UIBHO.dll
O4 - HKLM\..\Run: [YBrowser]

C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Recguard]

C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPHUPD08] C:\Program

Files\HP\Digital

Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3

729}\hphupd08.exe
O4 - HKLM\..\Run: [High Definition Audio Property

Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [ehTray]

C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [BtcMaestro] C:\Program

Files\KMaestro\KMaestro.exe
O4 - HKLM\..\Run: [btbb_wcm_McciTrayApp]

C:\Program Files\btbb_wcm\McciTrayApp.exe
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run:

[BluetoothAuthenticationAgent] rundll32.exe

bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ccApp] "C:\Program

Files\Common Files\Symantec

Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program

Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication]

C:\Program Files\Nokia\Nokia PC Suite

6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [btbb_McciTrayApp]

C:\Program Files\BT Broadband Desktop

Help\bin\BTHelpNotifier.exe
O4 - HKLM\..\Run: [Windows Defender]

"C:\Program Files\Windows

Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ctfmon.exe]

C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program

Files\MSN Messenger\MsnMsgr.Exe"

/background
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program

Files\Creative\Sync Manager

Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [Simple Star PhotoShow Media

Manager]

C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\xtras\m

ssysmgr.exe
O4 - Global Startup: BT Broadband Desktop

Help.lnk = C:\Program Files\BT Broadband

Desktop Help\bin\matcli.exe
O8 - Extra context menu item: &ieSpell Options -

res://C:\Program

Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Check &Spelling -

res://C:\Program

Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: Lookup on

Merriam Webster - file://C:\Program

Files\ieSpell\Merriam Webster.HTM
O8 - Extra context menu item: Lookup on

Wikipedia - file://C:\Program

Files\ieSpell\wikipedia.HTM
O9 - Extra button: (no name) -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: ieSpell -

{0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} -

C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell -

{0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} -

C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) -

{1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} -

C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options -

{1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} -

C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: BT Yahoo! Services -

{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} -

C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows

Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL]

International*
O16 - DPF: Yahoo! Chess -

http://download2.games.yahoo.com/games/client

s/y/ct5_x.cab
O16 - DPF:

{0A43D7AC-D6C1-4622-B309-BF975F427C0E}

(first direct internet banking plus digital safe) -

https://internetbankingplus1.firstdirect.com/ibpl

us/frontdoorFD.cab
O16 - DPF:

{30528230-99f7-4bb4-88d8-fa1d4f56a2ab}

(Installation Support) - C:\Program

Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF:

{34F12AFD-E9B5-492A-85D2-40FA4535BE83}

(AxProdInfoCtl Class) -

http://www.symantec.com/techsupp/activedata/n

prdtinf.cab
O16 - DPF:

{4F1E5B1A-2A80-42CA-8532-2D05CB959537}

(MSN Photo Upload Tool) -

http://by107fd.bay107.hotmail.msn.com/resource

s/MsnPUpld.cab
O16 - DPF:

{6A344D34-5231-452A-8A57-D064AC9B7862}

(Symantec Download Manager) -

https://webdl.symantec.com/activex/symdlmgr.c

ab
O16 - DPF:

{6E32070A-766D-4EE6-879C-DC1FA91D2FC3}

(MUWebControl Class) -

http://update.microsoft.com/microsoftupdate/v6/

V5Controls/en/x86/client/muweb_site.cab?11816

66309875
O16 - DPF:

{D27CDB6E-AE6D-11CF-96B8-444553540000}

(Shockwave Flash Object) -

http://fpdownload2.macromedia.com/get/shockw

ave/cabs/flash/swflash.cab
O18 - Protocol: livecall -

{828030A1-22C1-4009-854F-8E305202313F} -

C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim -

{828030A1-22C1-4009-854F-8E305202313F} -

C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon -

C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI

Technologies Inc. -

C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner -

C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler -

Symantec Corporation - C:\Program

Files\Symantec\LiveUpdate\ALUSchedulerSvc.ex

e
O23 - Service: Symantec Event Manager

(ccEvtMgr) - Unknown owner - C:\Program

Files\Common Files\Symantec

Shared\ccSvcHst.exe" /h ccCommon (file

missing)
O23 - Service: Symantec Network Proxy

(ccProxy) - Symantec Corporation - C:\Program

Files\Common Files\Symantec

Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager

(ccSetMgr) - Unknown owner - C:\Program

Files\Common Files\Symantec

Shared\ccSvcHst.exe" /h ccCommon (file

missing)
O23 - Service: Symantec Lic NetConnect service

(CLTNetCnService) - Unknown owner -

C:\Program Files\Common Files\Symantec

Shared\ccSvcHst.exe" /h ccCommon (file

missing)
O23 - Service: COM Host (comHost) - Symantec

Corporation - C:\Program Files\Common

Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Creative Service for CDROM

Access - Creative Technology Ltd -

C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Symantec IS Password Validation

(ISPwdSvc) - Symantec Corporation - C:\Program

Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec

Corporation -

C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.E

XE
O23 - Service: Macromedia Licensing Service -

Unknown owner - C:\Program Files\Common

Files\Macromedia Shared\Service\Macromedia

Licensing.exe
O23 - Service: Pml Driver HPZ12 - HP -

C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program

Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec Core LC - Symantec

Corporation - C:\Program Files\Common

Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service

(SymAppCore) - Symantec Corporation -

C:\Program Files\Common Files\Symantec

Shared\AppCore\AppSvc32.exe