Hi
Scan logs as requested
Combofix scan
"dan" - 2007-07-11 12:49:00 - ComboFix 07-07-10.1 - Service Pack 2
FAT32
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINDOWS\system32\_000004_.tmp.dll
C:\WINDOWS\system32\_000005_.tmp.dll
C:\WINDOWS\system32\_000006_.tmp.dll
C:\WINDOWS\system32\_000007_.tmp.dll
C:\WINDOWS\system32\_000008_.tmp.dll
C:\WINDOWS\system32\_000009_.tmp.dll
C:\WINDOWS\system32\_000010_.tmp.dll
((((((((((((((((((((((((( Files Created from 2007-06-11 to 2007-07-11 )))))))))))))))))))))))))))))))
2007-07-10 22:34 d——– C:\Program Files\Common Files\Adobe Systems Shared
2007-07-10 22:34 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Macrovision
2007-07-08 03:51 d——– C:\VundoFix Backups
2007-07-08 02:31 d–hs—- C:\FOUND.000
2007-07-04 14:23 d——– C:\DOCUME~1\dan\APPLIC~1\HouseCall 6.6
2007-07-04 14:14 d——– C:\DOCUME~1\dan\.housecall6.6
2007-07-02 20:41 524,288 –a—— C:\WINDOWS\system32\DivXsm.exe
2007-07-02 20:41 3,596,288 –a—— C:\WINDOWS\system32\qt-dx331.dll
2007-07-02 20:41 200,704 –a—— C:\WINDOWS\system32\ssldivx.dll
2007-07-02 20:41 1,044,480 –a—— C:\WINDOWS\system32\libdivx.dll
2007-07-02 20:37 823,296 –a—— C:\WINDOWS\system32\divx_xx0c.dll
2007-07-02 20:37 823,296 –a—— C:\WINDOWS\system32\divx_xx07.dll
2007-07-02 20:37 802,816 –a—— C:\WINDOWS\system32\divx_xx11.dll
2007-07-02 20:37 740,442 –a—— C:\WINDOWS\system32\DivX.dll
2007-07-02 20:37 73,728 –a—— C:\WINDOWS\system32\dpl100.dll
2007-07-02 20:37 593,920 –a—— C:\WINDOWS\system32\dpuGUI11.dll
2007-07-02 20:37 57,344 –a—— C:\WINDOWS\system32\dpv11.dll
2007-07-02 20:37 53,248 –a—— C:\WINDOWS\system32\dpuGUI10.dll
2007-07-02 20:37 344,064 –a—— C:\WINDOWS\system32\dpus11.dll
2007-07-02 20:37 294,912 –a—— C:\WINDOWS\system32\dpu11.dll
2007-07-02 20:37 294,912 –a—— C:\WINDOWS\system32\dpu10.dll
2007-07-02 20:37 196,608 –a—— C:\WINDOWS\system32\dtu100.dll
2007-07-02 20:36 124,472 –a—— C:\WINDOWS\system32\DivXCodecUpdateChecker.exe
2007-07-02 20:36 12,288 –a—— C:\WINDOWS\system32\DivXWMPExtType.dll
2007-07-02 09:30 68,888 –a—— C:\WINDOWS\system32\xinput1_3.dll
2007-07-02 09:30 62,744 –a—— C:\WINDOWS\system32\xinput1_2.dll
2007-07-02 09:30 3,426,072 –a—— C:\WINDOWS\system32\d3dx9_32.dll
2007-07-02 09:30 255,848 –a—— C:\WINDOWS\system32\xactengine2_6.dll
2007-07-02 09:30 251,672 –a—— C:\WINDOWS\system32\xactengine2_5.dll
2007-07-02 09:30 237,848 –a—— C:\WINDOWS\system32\xactengine2_4.dll
2007-07-02 09:30 236,824 –a—— C:\WINDOWS\system32\xactengine2_3.dll
2007-07-02 09:30 2,414,360 –a—— C:\WINDOWS\system32\d3dx9_31.dll
2007-07-02 09:30 2,297,552 –a—— C:\WINDOWS\system32\d3dx9_26.dll
2007-07-02 09:30 15,128 –a—— C:\WINDOWS\system32\x3daudio1_1.dll
2007-07-01 17:52 d——– C:\Program Files\Activision
2007-07-01 17:39 d–hs—- C:\WINDOWS\ftpcache
2007-06-30 22:29 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-06-30 22:28 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-06-30 20:52 d——– C:\Program Files\Lavasoft
2007-06-29 23:49 d——– C:\Program Files\DivX
2007-06-29 20:42 80,512 –a—— C:\WINDOWS\system32\drivers\NVTCAMD2.SYS
2007-06-29 20:42 79,872 –a—— C:\WINDOWS\system32\drivers\nvtcam.sys
2007-06-29 20:42 d——– C:\Program Files\Digital Camera
2007-06-27 15:03 40,960 –a—— C:\WINDOWS\system32\SSubTmr6.dll
2007-06-27 15:03 3,120 –a—— C:\WINDOWS\system32\e5240ae0-e423-4488-8813-78efff827bf4.dll
2007-06-27 15:03 159,744 –a—— C:\WINDOWS\system32\cNewMenu6.dll
2007-06-27 14:08 d——– C:\Program Files\Thomson
2007-06-27 00:17 d——– C:\Program Files\VideoLAN
2007-06-24 13:13 d——– C:\Deckard
2007-06-24 02:02 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-06-24 00:17 d——– C:\WINDOWS\TEM
2007-06-24 00:16 d——– C:\DOCUME~1\dan\APPLIC~1\Comodo
2007-06-21 03:17 12 –a—— C:\WINDOWS\bthservsdp.dat
2007-06-19 13:50 46,080 –a—— C:\WINDOWS\system32\escimgd.dll
2007-06-19 13:50 29,696 –a—— C:\WINDOWS\system32\escwiad.dll
2007-06-19 13:50 22,016 –a—— C:\WINDOWS\system32\esccmd.dll
2007-06-17 22:11 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Comodo
2007-06-17 22:06 d——– C:\Program Files\Comodo
2007-06-17 21:42 d——– C:\DOCUME~1\dan\APPLIC~1\OfficeUpdate12
2007-06-17 21:40 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Office Genuine Advantage
2007-06-16 20:16 d——– C:\WINDOWS\Internet Logs
2007-06-16 18:41 d——– C:\Program Files\SpywareBlaster
2007-06-16 02:21 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-06-14 18:35 966,144 –a—— C:\WINDOWS\system32\NCTAudioInformation2.dll
2007-06-14 18:35 877,568 –a—— C:\WINDOWS\system32\NCTAudioFile2.dll
2007-06-14 18:35 643,072 –a—— C:\WINDOWS\system32\DVDProX2.dll
2007-06-14 18:35 634,880 –a—— C:\WINDOWS\system32\NCTAudioEditor2.dll
2007-06-14 18:35 522,752 –a—— C:\WINDOWS\system32\NCTAudioTransform2.dll
2007-06-14 18:35 479,744 –a—— C:\WINDOWS\system32\NCTAudioCDGrabber2.dll
2007-06-14 18:35 478,208 –a—— C:\WINDOWS\system32\NCTAudioVisualization2.dll
2007-06-14 18:35 467,968 –a—— C:\WINDOWS\system32\NCTAudioRecord2.dll
2007-06-14 18:35 467,456 –a—— C:\WINDOWS\system32\NCTAudioPlayer2.dll
2007-06-14 18:35 403,968 –a—— C:\WINDOWS\system32\NCTWMAFile2.dll
2007-06-14 18:35 344,064 –a—— C:\WINDOWS\system32\msvcr70.dll
2007-06-14 18:35 237,568 –a—— C:\WINDOWS\system32\lame_enc.dll
2007-06-14 18:01 d——– C:\Program Files\Okoker All to Mp3 Converter
2007-06-14 08:48 d——– C:\Program Files\Windows Live Safety Center
2007-06-13 20:53 d——– C:\Program Files\Audacity
2007-06-13 13:14 d——– C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-06-13 01:42 d——– C:\WINDOWS\system32\CatRoot2
2007-06-12 21:50 d——– C:\DOCUME~1\dan\APPLIC~1\WinRAR
2007-06-12 20:59 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
2007-06-12 20:44 d——– C:\Program Files\CCleaner
2007-06-12 20:15 d——– C:\WINDOWS\SHELLNEW
2007-06-12 20:15 d——– C:\Program Files\Microsoft ActiveSync
2007-06-12 20:14 d——– C:\Program Files\Microsoft.NET
2007-06-11 01:18 d——– C:\Program Files\Common Files\Real
2007-06-11 01:18 d——– C:\DOCUME~1\dan\APPLIC~1\Real
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-06-30 10:56:32 40,320 —-a-w C:\WINDOWS\system32\GDIPFONTCACHEV1.DAT
2007-06-29 23:11:52 1,290 —-a-w C:\WINDOWS\mozver.dat
2007-06-10 02:26:00 ——– d—–w C:\Program Files\ACW
2007-06-10 02:20:40 ——– d—–w C:\Program Files\Trojan Remover
2007-06-10 01:10:10 ——– d—–w C:\Program Files\QuickTime
2007-06-06 23:54:56 ——– d—–w C:\Program Files\ToniArts
2007-06-04 14:18:48 9,344 —-a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2007-06-04 14:17:02 8,320 —-a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-06-04 14:14:56 6,272 —-a-w C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-05-27 18:34:24 88 –sh–r C:\WINDOWS\system32\C440268A3F.sys
2007-05-27 18:34:24 2,828 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-05-22 21:20:56 ——– d—–w C:\Program Files\Vectorworks11
2007-05-21 10:36:16 524,288 —-a-w C:\WINDOWS\opuc.dll
2007-05-21 00:57:34 356 —-a-w C:\drmHeader.bin
2007-05-16 15:12:02 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-12 23:32:06 ——– d—–w C:\DOCUME~1\dan\APPLIC~1\EPSON
2007-05-11 18:10:42 ——– d—–w C:\Program Files\epson
2007-04-28 18:57:02 927 —-a-w C:\WINDOWS\CLEANUP.CMD
2007-04-28 18:57:00 9 —-a-w C:\WINDOWS\HotFix.bat
2007-04-28 13:48:38 0 —-a-w C:\WINDOWS\nsreg.dat
2007-04-25 14:21:16 144,896 —-a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:12:24 2,854,400 —-a-w C:\WINDOWS\system32\msi.dll
2007-04-16 21:47:36 33,624 ——w C:\WINDOWS\system32\wups.dll
2007-04-16 21:45:54 1,710,936 ——w C:\WINDOWS\system32\wuaueng.dll
2007-04-16 21:45:48 549,720 ——w C:\WINDOWS\system32\wuapi.dll
2007-04-16 21:45:42 325,976 ——w C:\WINDOWS\system32\wucltui.dll
2007-04-16 21:45:36 203,096 ——w C:\WINDOWS\system32\wuweb.dll
2007-04-16 21:45:28 92,504 —-a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 21:45:20 53,080 ——w C:\WINDOWS\system32\wuauclt.exe
2007-04-16 21:45:20 43,352 —-a-w C:\WINDOWS\system32\wups2.dll
2007-04-16 21:44:20 271,224 —-a-w C:\WINDOWS\system32\mucltui.dll
2007-04-16 21:43:40 208,248 —-a-w C:\WINDOWS\system32\muweb.dll
2007-04-13 14:19:52 7,680 —-a-w C:\WINDOWS\system32\lsdelete.exe
2007-04-13 02:21:14 271,360 —-a-w C:\WINDOWS\system32\mscoree.dll
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-10-22 23:08 62080 –a—— C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
2005-05-31 01:04 853672 –a—— C:\PROGRA~1\SPYBOT~1\SDHelper.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43 501400 –a—— C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
2006-08-31 20:33 322368 –a—— C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
2007-06-12 20:59 2403392 -ra—— c:\program files\google\googletoolbar1.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
2007-06-30 22:47 325048 –a—— C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]
2006-09-27 17:45 544032 –a—— C:\Program Files\Windows Live Toolbar\msntb.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" []
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 14:54 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 18:04 C:\WINDOWS\SkyTel.exe]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2005-12-21 15:02]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 13:07]
"ADMTray.exe"="C:\Acer\Empowering Technology\admtray.exe" [2005-10-24 16:45]
"eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2005-12-27 15:50]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 05:00 C:\WINDOWS\system32\bthprops.cpl]
"ePower_DMC"="C:\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-08-10 19:29]
"Acer ePower Management"="C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe" [2006-05-22 12:54]
"LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2006-07-20 22:15]
"eRecoveryService"="C:\Acer\Empowering Technology\eRecovery\Monitor.exe" [2006-01-24 18:00]
"WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-09-23 13:08]
"itype"="C:\Program Files\Microsoft IntelliType Pro\itype.exe" [2006-07-08 00:14]
"Realtime Monitor"="C:\PROGRA~1\CA\ETRUST~1\realmon.exe" [2004-04-06 17:14]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]
"COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2007-06-17 22:41]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38]
"@"="" []
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-12 20:59]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 13:29]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages :\WINDOWS\system32\srrstr.dll cecli scecli scecli
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
C:\WINDOWS\system32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\MSN Messenger\msnmsgr.exe" /background
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ntiMUI]
C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs BthServ
*Newly Created Service* - INT15.SYS
Contents of the 'Scheduled Tasks' folder
2007-07-11 11:24:06 C:\WINDOWS\tasks\Check Updates for Windows Live Toolbar.job
2007-06-14 08:16:16 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
**************************************************************************
catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-07-11 12:51:04
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 2007-07-11 12:51:59
C:\ComboFix3.txt … 2007-06-24 03:06
C:\ComboFix2.txt … 2007-06-24 03:10
C:\ComboFix-quarantined-files.txt … 2007-07-11 12:52
— E O F —
HijackThis scan
Logfile of HijackThis v1.99.1
Scan saved at 12:56:30, on 11/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Acer\Empowering Technology\admServ.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
C:\Program Files\CA\eTrust Antivirus\InoRT.exe
C:\Program Files\CA\eTrust Antivirus\InoTask.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\admtray.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\PROGRA~1\CA\ETRUST~1\realmon.exe
C:\WINDOWS\system32\igfxext.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\dan\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tiscali.co.uk/broadband
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ADMTray.exe] "C:\Acer\Empowering Technology\admtray.exe"
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Acer ePower Management] C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe /normal-run1
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Open with WordPerfect - C:\Program Files\WordPerfect Office X3\Programs\WPLauncher.hta
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O11 - Options group: Tabbed Browsing
O15 - Trusted Zone:
http://download.windowsupdate.com
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) -
https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) -
http://www.ca.com/us/securityadvisor/pestscan/pestscan.cab
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) -
http://test.catalog.update.microsoft.com/v…b?1178326138753
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} -
http://www.bitdefender.co.uk/scan_uk/scan8/oscan8.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase8300.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://update.microsoft.com/windowsupdate/…b?1178376081921
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://www.update.microsoft.com/microsoftu…b?1181675377890
O17 - HKLM\System\CCS\Services\Tcpip\..\{9DD8BF9A-06BC-4B5C-9F92-AB5DD0DA4939}: NameServer = 212.139.132.11 212.139.132.10
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
Thanks
