What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Abetear A - Remnant Left In Registry, Can't Remove

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I think this pc is clean other than this… Thanks in advance! here's the HT log:


Logfile of HijackThis v1.99.1
Scan saved at 3:42:22 PM, on 23/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Bell\Security Manager\fws.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Bell\Sympatico Security Advisor\SSA.exe
C:\Program Files\Bell\Security Manager\Rps.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
\?\C:\WINDOWS\system32\WBEM\WMIADAP.EXE
C:\WINDOWS\SoftwareDistribution\Download\Install\NDP20-KB922770-X86.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\MsiExec.exe
C:\WINDOWS\system32\MsiExec.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mcmaster.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Bell\Security Manager\pkR.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Form Filler BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\Bell\Security Manager\FBHR.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [LXCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SSA.exe] "C:\Program Files\Bell\Sympatico Security Advisor\SSA.exe"
O4 - HKLM\..\Run: [Security Manager] "C:\Program Files\Bell\Security Manager\Rps.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Clean Access Agent.lnk = C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{926A2433-0C64-4A9E-A3EC-009B8656E9DF}: NameServer = 172.18.2.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: lxcg_device - Unknown owner - C:\WINDOWS\system32\lxcgcoms.exe
O23 - Service: Security Manager Firewall (RP_FWS) - Radialpoint Inc. - C:\Program Files\Bell\Security Manager\fws.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
Post #2
Update….

After downloading combofix, I think the registry item is finally gone. I'm posting the combofix log here too just in case someone wants to have a peek and confirm that the machine is clean.



*snip*

ComboFix 07-08-23.5 - "Melissa *****" 2007-08-23 15:48:23.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.151 [GMT -4:00]


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\Startup


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


——-\LEGACY_DOMAINSERVICE


((((((((((((((((((((((((( Files Created from 2007-07-23 to 2007-08-23 )))))))))))))))))))))))))))))))


2007-08-23 15:47 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-22 14:32 d——– C:\DOCUME~1\MELISS~1\APPLIC~1\FrostWire
2007-08-22 12:00 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-08-22 11:59 d——– C:\Program Files\SUPERAntiSpyware
2007-08-22 11:59 d——– C:\DOCUME~1\MELISS~1\APPLIC~1\SUPERAntiSpyware.com
2007-08-22 11:26 d——– C:\DOCUME~1\MELISS~1\DoctorWeb
2007-08-22 08:33 d——– C:\Program Files\MSXML 6.0
2007-08-22 08:31 d——– C:\Program Files\MSBuild
2007-08-22 08:24 d——– C:\WINDOWS\SYSTEM32\XPSViewer
2007-08-22 08:23 d——– C:\Program Files\Reference Assemblies
2007-08-22 08:22 14,048 ——— C:\WINDOWS\SYSTEM32\spmsg2.dll
2007-08-22 08:21 d——– C:\77fcc751ce7c3ae3a8091dfa05928e2d
2007-08-22 08:20 d——– C:\Program Files\Windows Media Connect 2
2007-08-22 08:17 d——– C:\WINDOWS\SYSTEM32\DRIVERS\UMDF
2007-08-22 08:03 36,352 ——— C:\WINDOWS\SYSTEM32\tsgqec.dll
2007-08-22 08:03 288,768 ——— C:\WINDOWS\SYSTEM32\rhttpaa.dll
2007-08-22 08:03 116,736 ——— C:\WINDOWS\SYSTEM32\aaclient.dll
2007-08-22 07:59 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-08-21 15:23 76,560 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\tmcomm.sys
2007-08-21 14:46 d——– C:\DOCUME~1\MELISS~1\.housecall6.6
2007-08-21 13:30 d——– C:\Program Files\Lavasoft
2007-08-21 13:30 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-08-21 13:23 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-08-21 10:54 24,576 –a—— C:\WINDOWS\SYSTEM32\VundoFixSVC.exe
2007-08-17 10:05 d——– C:\Program Files\FrostWire
2007-08-17 09:51 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-08-14 21:33 d——– C:\2bad25a52ee35cd479ed7d64


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-23 14:35 ——— d——– C:\Program Files\Common Files\Command Software
2007-08-22 11:08 ——— d——– C:\Program Files\WordPerfect Office 12
2007-08-22 11:08 ——— d——– C:\Program Files\OfficeUpdate11
2007-08-22 11:08 ——— d——– C:\Program Files\NetAssistant
2007-08-22 11:08 ——— d——– C:\Program Files\Modem Helper
2007-08-22 11:08 ——— d——– C:\Program Files\Common Files\AOL
2007-08-22 11:08 ——— d——– C:\Program Files\Audible
2007-08-22 08:16 ——— d——– C:\Program Files\Windows Media Connect
2007-08-22 07:56 ——— d——– C:\Program Files\Common Files\PestPatrol
2007-08-21 13:57 9344 –a—— C:\WINDOWS\system32\drivers\NSDriver.sys
2007-08-21 13:57 8320 –a—— C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\dllcache\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\dllcache\wucltui.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\dllcache\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\wups.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\dllcache\wups.dll
2007-07-24 20:32 ——— d——– C:\Program Files\Lx_cats
2007-06-26 11:13 851968 ——— C:\WINDOWS\system32\dllcache\vgx.dll
2007-06-26 10:35 665600 ——— C:\WINDOWS\system32\dllcache\wininet.dll
2007-06-26 02:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-26 02:08 1104896 ——— C:\WINDOWS\system32\dllcache\msxml3.dll
2007-06-19 09:31 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-19 09:31 282112 ——— C:\WINDOWS\system32\dllcache\gdi32.dll
2007-06-15 04:12 96256 ——— C:\WINDOWS\system32\dllcache\inseng.dll
2007-06-15 04:12 616960 ——— C:\WINDOWS\system32\dllcache\urlmon.dll
2007-06-15 04:12 55808 ——— C:\WINDOWS\system32\dllcache\extmgr.dll
2007-06-15 04:12 532480 ——— C:\WINDOWS\system32\dllcache\mstime.dll
2007-06-15 04:12 474112 ——— C:\WINDOWS\system32\dllcache\shlwapi.dll
2007-06-15 04:12 449024 ——— C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-06-15 04:12 39424 ——— C:\WINDOWS\system32\dllcache\pngfilt.dll
2007-06-15 04:12 357888 ——— C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-06-15 04:12 3064320 ——— C:\WINDOWS\system32\dllcache\mshtml.dll
2007-06-15 04:12 251904 ——— C:\WINDOWS\system32\dllcache\iepeers.dll
2007-06-15 04:12 205824 ——— C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-06-15 04:12 16384 ——— C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-06-15 04:12 151040 ——— C:\WINDOWS\system32\dllcache\cdfview.dll
2007-06-15 04:12 1498112 ——— C:\WINDOWS\system32\dllcache\shdocvw.dll
2007-06-15 04:12 146432 ——— C:\WINDOWS\system32\dllcache\msrating.dll
2007-06-15 04:12 1054208 ——— C:\WINDOWS\system32\dllcache\danim.dll
2007-06-15 04:12 1022976 ——— C:\WINDOWS\system32\dllcache\browseui.dll
2007-06-14 06:32 18432 ——— C:\WINDOWS\system32\dllcache\iedw.exe
2007-06-13 06:23 1033216 –a—— C:\WINDOWS\explorer.exe
2007-06-13 06:23 1033216 ——— C:\WINDOWS\system32\dllcache\explorer.exe
2007-06-11 23:51 10834944 –a—— C:\WINDOWS\system32\dllcache\wmp.dll
2005-05-12 19:32 596 –a—— C:\Program Files\INSTALL.LOG
2003-01-31 13:08 65536 ——— C:\WINDOWS\inf\setup\bcr.exe
2003-01-31 13:08 50934 ——— C:\WINDOWS\inf\ssdsl3x\drivers\vvpciusb.sys
2003-01-31 13:08 50911 ——— C:\WINDOWS\inf\ssdsl3x\drivers\vvbususb.sys
2003-01-31 13:08 49296 ——— C:\WINDOWS\inf\setup\efnt16.dll
2003-01-31 13:08 49152 ——— C:\WINDOWS\inf\enclss32.dll
2003-01-31 13:08 3690496 ——— C:\WINDOWS\inf\setup.exe
2003-01-31 13:08 32768 ——— C:\WINDOWS\inf\setup\efnt32.dll
2003-01-31 13:08 28005 ——— C:\WINDOWS\inf\ssdsl3x\drivers\enethusb.sys
2003-01-31 13:08 241664 ——— C:\WINDOWS\inf\setup\bohica.dll
2003-01-31 13:08 23560 ——— C:\WINDOWS\inf\enclss16.dll
2003-01-31 13:08 163840 ——— C:\WINDOWS\inf\setup\enisnmp.dll
2003-01-31 13:08 163840 ——— C:\WINDOWS\inf\setup\efntsw.dll
2003-01-31 13:08 159744 ——— C:\WINDOWS\inf\setup\l2xpdrv.dll
2003-01-31 13:08 159744 ——— C:\WINDOWS\inf\setup\csshim.dll
2003-01-31 13:08 155648 ——— C:\WINDOWS\inf\setup\prox.dll
2003-01-31 13:08 155648 ——— C:\WINDOWS\inf\setup\efntos2k.dll
2003-01-31 13:08 155648 ——— C:\WINDOWS\inf\setup\ClearMB.exe
2003-01-31 13:08 15332 ——— C:\WINDOWS\inf\ssdsl3x\drivers\vvbeth.sys
2003-01-31 13:08 15309 ——— C:\WINDOWS\inf\ssdsl3x\drivers\vvbetht.sys
2003-01-31 13:08 147456 ——— C:\WINDOWS\inf\setup\efntos9x.dll
2003-01-31 13:08 139264 ——— C:\WINDOWS\inf\setup\enicommon.dll
2003-01-31 13:08 135168 ——— C:\WINDOWS\inf\setup\EnCmnSvr.exe
2003-01-31 13:08 122880 ——— C:\WINDOWS\inf\setup\efntos.dll
2003-01-31 13:08 122880 ——— C:\WINDOWS\inf\setup\efntnio.dll
2003-01-31 13:08 118784 ——— C:\WINDOWS\inf\setup\defdel.exe
2002-06-04 06:06 65536 ——— C:\WINDOWS\inf\copyinf.exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LXCGCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll" [2005-04-27 10:21]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 09:35]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 09:32]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 09:36]
"SSA.exe"="C:\Program Files\Bell\Sympatico Security Advisor\SSA.exe" [2006-05-15 10:41]
"Security Manager"="C:\Program Files\Bell\Security Manager\Rps.exe" [2006-06-20 14:30]

C:\DOCUME~1\DEFAUL~1\STARTM~1\Programs\Startup\
DESKTOP.INI [2004-08-10 15:04:12]

C:\DOCUME~1\MELISS~1\STARTM~1\Programs\Startup\
DESKTOP.INI [2004-08-10 15:04:12]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Cisco Systems VPN Client.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Cisco Systems VPN Client.lnk
backup=C:\WINDOWS\pss\Cisco Systems VPN Client.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NetAssistant.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NetAssistant.lnk
backup=C:\WINDOWS\pss\NetAssistant.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DadApp]
C:\Program Files\Dell\AccessDirect\dadapp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
C:\Program Files\Dell\QuickSet\quickset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell Wireless Manager UI]
C:\WINDOWS\system32\WLTRAY

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
"C:\Program Files\Dell Support\DSAgnt.exe" /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
C:\WINDOWS\system32\dla\tfswctrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
"C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]
"C:\Program Files\Lexmark 2300 Series\ezprint.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer]
"C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Freedom]
C:\Program Files\Zero Knowledge\Freedom\Freedom.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
C:\WINDOWS\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
C:\WINDOWS\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxcgmon.exe]
"C:\Program Files\Lexmark 2300 Series\lxcgmon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]
C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StandardInstall]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
"C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r

S3 CVirtA;Cisco Systems VPN Adapter;C:\WINDOWS\system32\DRIVERS\CVirtA.sys


Contents of the 'Scheduled Tasks' folder
2005-03-18 19:56:29 C:\WINDOWS\Tasks\ISP signup reminder 1.job - C:\WINDOWS\system32\OOBE\OOBEBALN.EXE
2007-08-22 17:48:20 C:\WINDOWS\Tasks\Symantec NetDetect.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-23 15:53:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-23 15:55:50 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-08-23 15:55

— E O F —

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI