Help Needed - Microsoft Messenger Launched At Start Up

Hello,

2 weeks ago, I was on a Net meeting session, when suddenly, the control was taken away from me.

The cursor went to the start menu and clicked on run then it typed into the run box and ran something like this :
%comspec% /c echo Repairing user32.dll

It was also doing some ftp as well. After a couple of minutes, I could get the control back again.

After this episode, I noticed that Microsoft Messenger was launched with every restart of the machine. With "Startup Inspector", I could see 2 entries. One was pointed to a.exe which it warned as a file not available anymore. The other was an entry regarding Microsoft messenger. I tried to clean up both, but did not really succeed.

The a.exe is not seen anymore. However, there is the entry corresponding to Microsoft messenger and even after trying to remove each time with Start up Inspector, I do not succeed.


An extract from my F-Secure anti virus log is given below as also the HijackThis log. Can anybody help? Many thanks!

Sekhar
—————————- begin F secure log extract ——————————————
2 2007-07-29 21:20:10+05:30 yellow YELLOW\Sekhar F-Secure Anti-Virus 1.3.6.1.4.1.2213.11.1.12
Malicious code found in file C:\WINDOWS\SYSTEM32\A.EXE.

Infection: Backdoor.Win32.Bifrose.acs


3 2007-07-29 21:20:12+05:30 yellow YELLOW\Sekhar F-Secure Anti-Virus 1.3.6.1.4.1.2213.11.1.12
Malicious code found in file C:\WINDOWS\SYSTEM32\A.EXE.

Infection: Backdoor.Win32.Bifrose.acs


4 2007-07-29 21:20:12+05:30 yellow YELLOW\Sekhar F-Secure Anti-Virus 1.3.6.1.4.1.2213.11.1.12
Malicious code found in file C:\WINDOWS\SYSTEM32\BEORHT.EXE.

Infection: Trojan-Downloader.Win32.Tiny.ho


5 2007-07-29 21:20:59+05:30 yellow YELLOW\Sekhar F-Secure Anti-Virus 1.3.6.1.4.1.2213.11.1.12
Malicious code found in file C:\WINDOWS\SYSTEM32\A.EXE.

Infection: Backdoor.Win32.Bifrose.acs


1 2007-07-29 22:37:15+05:30 yellow YELLOW\Sekhar F-Secure Anti-Virus 1.3.6.1.4.1.2213.12
Manual scanning was finished - workstation was found infected!
1 2007-07-30 08:48:14+05:30 yellow YELLOW\Sekhar F-Secure Anti-Virus 1.3.6.1.4.1.2213.12
Virus definition database(s) daily.avc dailyc.avc fa001.avc updated successfully.
2 2007-07-30 09:44:29+05:30 yellow YELLOW\Sekhar F-Secure Anti-Virus 1.3.6.1.4.1.2213.12
Manual scanning was finished - no infection was detected.

———————— end of F Secure log ————————————-

————————– Start of Hijackthis log ————————————
Logfile of HijackThis v1.99.1
Scan saved at 11:13:14, on 05.08.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Programme\F-Secure\Anti-Virus\fsgk32st.exe
C:\Programme\F-Secure\Anti-Virus\FSGK32.EXE
C:\Programme\F-Secure\Anti-Virus\fssm32.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\F-Secure\Common\FSMA32.EXE
C:\Programme\F-Secure\Common\FSMB32.EXE
C:\Programme\F-Secure\Common\FCH32.EXE
C:\Programme\F-Secure\Common\FAMEH32.EXE
C:\Programme\F-Secure\Common\FNRB32.EXE
C:\Programme\F-Secure\Common\FIH32.EXE
C:\Programme\F-Secure\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\F-Secure\Common\FSM32.EXE
C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\SpywareGuard\sgmain.exe
C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe
C:\Programme\SpywareGuard\sgbhp.exe
C:\Programme\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
C:\Programme\Audacity\audacity.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\DOKUMENTE UND EINSTELLUNGEN\SEKHAR\DESKTOP\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hindu.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.medion.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.de/0SEDEDE/SAOS01
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hindu.com/
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Programme\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Desktop Search Capture - {7c1ce531-09e9-4fc5-9803-1c2956615786} - C:\Programme\Google\Google Desktop Search\GoogleDesktopIE.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar3.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\MSN Toolbar1.01.1629.0\de\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar3.dll
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Programme\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Programme\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - Startup: SpywareGuard.lnk = C:\Programme\SpywareGuard\sgmain.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Programme\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Programme\Yahoo!\Common/ycsrch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Programme\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Programme\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra button: MedionShop - {01E9CF82-AE9D-42BA-A629-B23D51A4B86B} - http://www.medionshop.de/ (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.medion.com/
O15 - Trusted Zone: http://*.update.microsoft.com
O15 - Trusted Zone: http://*.windowsupdate.microsoft.com
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/068906d44c766a…ip/RdxIE601.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1155613067218
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/…/ymmapi_416.dll
O16 - DPF: {D702FBF4-EE60-11D0-BD5B-00A0C91F4635} (CFForm Runtime) - http://slave.ciberdimensao.com/CFIDE/classes/CFJava.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

————————– End of Hijackthis log ————————————
,

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Programme\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Programme\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Programme\F-Secure\Common\FNRB32.EXE
O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Programme\F-Secure\Common\FSAA.EXE
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Programme\F-Secure\Common\FSMA32.EXE
O23 - Service: GoogleDesktopManager - Google - C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Hello,

I installed Spyware Terminator and let it scan the entire system. It reported the following:

- Vcatch (remaining items of Adware)
- WeatherCheck (Adware Bundler)
- SlimShield()
-YourKeyloggerProgramName(Keylogger)

I could not see any option to remove/quarantine!

Warm regards,
Sekhar
Additional info from Spyware Terminator log
================================
Logfile of Spyware Terminator v2.0.0.187 (db:1.0.871.629)
Scan Time: 05.08.2007 11:19:43 length: 2863 s
Platform: Windows XP Home Service Pack 2 (WINNT 5.1.2600)
User: Limited
Boot Mode: Normal
Scan type: Full_Spyware_Scan
Scanned Objects: 152280 (Critical:23)
Filter: No System items, No Safe items, No Invalid items

Running Processes
Ati2evxx.exe [ATI Technologies Inc.] : C:\WINDOWS\system32\Ati2evxx.exe
ServiceWrapper-7681197.exe : C:\Programme\F-Secure\BackWeb\7681197\Program\ServiceWrapper-7681197.exe
fsgk32st.exe [F-Secure Corp.] : C:\Programme\F-Secure\Anti-Virus\fsgk32st.exe
FSGK32.EXE [F-Secure Corp.] : C:\Programme\F-Secure\Anti-Virus\FSGK32.EXE
fssm32.exe [F-Secure Corp.] : C:\Programme\F-Secure\Anti-Virus\fssm32.exe
mdm.exe [Microsoft Corporation] : C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
FSMA32.EXE [F-Secure Corporation] : C:\Programme\F-Secure\Common\FSMA32.EXE
FSMB32.EXE [F-Secure Corporation] : C:\Programme\F-Secure\Common\FSMB32.EXE
FCH32.EXE [F-Secure Corporation] : C:\Programme\F-Secure\Common\FCH32.EXE
FAMEH32.EXE [F-Secure Corporation] : C:\Programme\F-Secure\Common\FAMEH32.EXE
FNRB32.EXE [F-Secure Corporation] : C:\Programme\F-Secure\Common\FNRB32.EXE
FIH32.EXE [F-Secure Corporation] : C:\Programme\F-Secure\Common\FIH32.EXE
fsav32.exe [F-Secure Corporation] : C:\Programme\F-Secure\Anti-Virus\fsav32.exe
Ati2evxx.exe [ATI Technologies Inc.] : C:\WINDOWS\system32\Ati2evxx.exe
sgmain.exe : C:\Programme\SpywareGuard\sgmain.exe
sgbhp.exe : C:\Programme\SpywareGuard\sgbhp.exe
BackWeb-7681197.exe : C:\Programme\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
audacity.exe : C:\Programme\Audacity\audacity.exe

Internet Settings
R - HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar = http://www.google.com/ie
R - HKLM\Software\Microsoft\Internet Explorer\Main, Start Page = http://www.hindu.com/
R - HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant = http://www.google.com/ie
R - HKLM\Software\Microsoft\Internet Explorer\Search, CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
R - HKLM\System\CurrentControlSet\Services\Tcpip\Parameters, Domain =
R - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Telephony, DomainName =

BHO
02 - BHO: &Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - [Yahoo! Inc.] : C:\Programme\Yahoo!\Messenger\yhexbmes0411.dll
02 - BHO: &Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - [Yahoo! Inc.] : C:\Programme\Yahoo!\Messenger\yhexbmes0411.dll
02 - BHO: &Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - [Yahoo! Inc.] : C:\Programme\Yahoo!\Messenger\yhexbmes0411.dll

StartUps
04 - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, AppInit_DLLs : [Google] : C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll
04 - Startup: %START_PROGRAMS%\Autostart\SpywareGuard.lnk : C:\Programme\SpywareGuard\sgmain.exe

Explorer Bars
&Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - [Yahoo! Inc.] : C:\Programme\Yahoo!\Messenger\yhexbmes0411.dll
&Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - [Yahoo! Inc.] : C:\Programme\Yahoo!\Messenger\yhexbmes0411.dll

Shell Extensions
CD Copy Shell Extension - {F5D92341-0A64-11D0-9956-0000E8096023} - [VoB Computersysteme GmbH] : C:\WINDOWS\system32\Shellext\CDWshext.dll
CD Wizard Shell Extension - {F5D92342-0A64-11D0-9956-0000E8096023} - [VoB Computersysteme GmbH] : C:\WINDOWS\system32\Shellext\CDWshext.dll
YMailShellExt Class - {5464D816-CF16-4784-B9F3-75C0DB52B499} - [Yahoo! Inc.] : C:\WINDOWS\Downloaded Program Files\ymmapi.dll
RealOne Player Context Menu Class - {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} - [RealNetworks, Inc.] : C:\Programme\Real\RealPlayer\rpshell.dll
SpywareGuard.Handler - {81559C35-8464-49F7-BB0E-07A383BEF910} - : C:\Programme\SpywareGuard\spywareguard.dll
- {63542C48-9552-494A-84F7-73AA6A7C99C1} - [Sun Microsystems, Inc.] : C:\Programme\OpenOffice.org 2.1\program\shlxthdl.dll
- {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} - [Sun Microsystems, Inc.] : C:\Programme\OpenOffice.org 2.1\program\shlxthdl.dll
- {087B3AE3-E237-4467-B8DB-5A38AB959AC9} - [Sun Microsystems, Inc.] : C:\Programme\OpenOffice.org 2.1\program\shlxthdl.dll
- {3B092F0C-7696-40E3-A80F-68D74DA84210} - [Sun Microsystems, Inc.] : C:\Programme\OpenOffice.org 2.1\program\shlxthdl.dll
Microsoft Office Outlook - {00020D75-0000-0000-C000-000000000046} - [Microsoft Corporation] : C:\Programme\Microsoft Office\OFFICE11\MLSHEXT.DLL
Outlook File Icon Extension - {0006F045-0000-0000-C000-000000000046} - [Microsoft Corporation] : C:\Programme\Microsoft Office\OFFICE11\OLKFSTUB.DLL
- {42042206-2D85-11D3-8CFF-005004838597} - [Microsoft Corporation] : C:\Programme\Microsoft Office\OFFICE11\msohev.dll

Protocol Filters
- {807553E5-5146-11D5-A672-00B0D022E945} - [Microsoft Corporation] : C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL

Protocol Handler
mctp: Asynchronous Pluggable Protocol Handler - {d7b95390-b1c5-11d0-b111-0080c712fe82} - [Microsoft Corporation] : C:\Programme\Microsoft ActiveSync\aatp.dll
Microsoft Infotech Storage Protocol for IE 4.0 - {0A9007C0-4076-11D3-8789-0000F8105754} - [Microsoft Corporation] : C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll
Data Page Pluggable Protocol mso-offdap Handler - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - [Microsoft Corporation] : C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL
Data Page Plugable Protocal mso-offdap11 Handler - {32505114-5902-49B2-880A-1F7738E5A384} - [Microsoft Corporation] : C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL
IEProtocolHandler Class - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - [Skype Technologies] : C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll

Services
23 - [Realtek Semiconductor Corp.] : C:\WINDOWS\system32\drivers\ALCXWDM.SYS
23 - [VOB Computersysteme GmbH] : C:\WINDOWS\system32\Drivers\ASAPIW2K.sys
23 - [ATI Technologies Inc.] : C:\WINDOWS\system32\Ati2evxx.exe
23 - : C:\Programme\F-Secure\BackWeb\7681197\Program\ServiceWrapper-7681197.exe
23 - [Philips Semiconductors] : C:\WINDOWS\system32\DRIVERS\Cap7134.sys
23 - [F-Secure Corporation] : C:\Programme\F-SECURE\ANTI-VIRUS\WIN2K\FSFILTER.SYS
23 - [F-Secure Corporation] : C:\Programme\F-SECURE\ANTI-VIRUS\WIN2K\FSGK.SYS
23 - [F-Secure Corp.] : C:\Programme\F-Secure\Anti-Virus\fsgk32st.exe
23 - [F-Secure Corporation] : C:\Programme\F-Secure\Common\FNRB32.EXE
23 - [F-Secure Corporation] : C:\Programme\F-SECURE\ANTI-VIRUS\WIN2K\FSREC.SYS
23 - [F-Secure Corporation] : C:\Programme\F-Secure\Common\FSMA32.EXE
23 - [F-Secure Corporation] : C:\Programme\F-SECURE\COMMON\FSPM.SYS
23 - [Intel Corporation] : C:\WINDOWS\system32\DRIVERS\ctxs51.sys
23 - [Microsoft Corporation] : C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
23 - [Creative Technology Ltd.] : C:\WINDOWS\system32\DRIVERS\P101bVid.sys
23 - [Padus, Inc.] : C:\WINDOWS\system32\drivers\pfc.sys
23 - [Philips Semiconductors] : C:\WINDOWS\system32\DRIVERS\PhTVTune.sys
23 - [Silicon Integrated Systems Corporation] : C:\WINDOWS\system32\DRIVERS\SISAGPX.sys
23 - [SiS Corporation] : C:\WINDOWS\system32\DRIVERS\sisnic.sys
23 - [Trend Micro Inc.] : C:\WINDOWS\system32\DRIVERS\TMCOMM.SYS

Winlogon Notify
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent, DLLName : [ATI Technologies Inc.] : C:\WINDOWS\system32\Ati2evxx.dll

Thread Files
[X10 Wireless Technology, Inc.] : C:\Programme\Common Files\X10\Common\x10net.dll
: C:\WINDOWS\system32\actskn43.ocx