Hi MrC
Thanks for looking at my logs
Comfix log
ComboFix 07-11-19.3 - Administrator 2007-11-22 21:37:26.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1506 [GMT -6:00]
Running from: C:\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Administrator\g2mdlhlpx.exe
C:\Program Files\Common Files\crosof~1
C:\Program Files\Common Files\crosof~1\??crosoft\
C:\Program Files\Common Files\crosof~1\msconfig.exe
C:\Program Files\Common Files\Yazzle1848OinUninstaller.exe
C:\WINDOWS\icroso~1
C:\WINDOWS\icroso~1\?explore.exe
C:\WINDOWS\system32\Cache
.
((((((((((((((((((((((((( Files Created from 2007-10-23 to 2007-11-23 )))))))))))))))))))))))))))))))
.
2007-11-22 21:35 1,545,623 –a—— C:\ComboFix.exe
2007-11-22 21:29 111,080 –a—— C:\OiUninstaller.exe
2007-11-21 21:32 8,054,112 –a—— C:\drweb-cureit.exe
2007-11-21 21:31 2,725,528 –a—— C:\ccsetup202.exe
2007-11-21 10:16 40,448 –a—— C:\NoLop.exe
2007-11-21 09:38 488,144 –a—— C:\HJTsetup.exe
2007-11-15 21:42 d——– C:\Program Files\MSXML 6.0
2007-11-15 19:53 d——– C:\WINDOWS\Sun
2007-11-14 17:40 d——– C:\Program Files\Microsoft Virtual PC
2007-11-13 21:25 d——– C:\Program Files\Easy
2007-11-13 21:25 d——– C:\Documents and Settings\Administrator\WINDOWS
2007-11-13 21:25 303,616 –a—— C:\WINDOWS\IsUninst.exe
2007-11-13 21:24 5,504 –a—— C:\WINDOWS\system32\drivers\MSTEE.sys
2007-11-13 21:24 5,504 –a–c— C:\WINDOWS\system32\dllcache\mstee.sys
2007-11-13 21:23 85,376 –a—— C:\WINDOWS\system32\drivers\NABTSFEC.sys
2007-11-13 21:23 19,328 –a–c— C:\WINDOWS\system32\dllcache\wstcodec.sys
2007-11-13 21:23 17,024 –a—— C:\WINDOWS\system32\drivers\CCDECODE.sys
2007-11-13 21:23 17,024 –a–c— C:\WINDOWS\system32\dllcache\ccdecode.sys
2007-11-13 21:23 16,384 –a—— C:\WINDOWS\system32\ipsink.ax
2007-11-13 21:23 16,384 –a–c— C:\WINDOWS\system32\dllcache\ipsink.ax
2007-11-13 21:19 36,867 -ra—— C:\WINDOWS\FindCD.exe
2007-11-13 21:19 13,308 -ra—— C:\WINDOWS\system32\drivers\btxbar.sys
2007-11-13 21:16 18,944 -ra—— C:\WINDOWS\system32\drivers\bttuner.sys
2007-11-13 21:13 266,180 -ra—— C:\WINDOWS\system32\drivers\BT848.sys
2007-11-13 21:13 90,624 –a—— C:\WINDOWS\system32\kswdmcap.ax
2007-11-13 21:13 61,952 –a—— C:\WINDOWS\system32\kstvtune.ax
2007-11-13 21:13 53,760 –a—— C:\WINDOWS\system32\vfwwdm32.dll
2007-11-13 21:13 53,760 –a–c— C:\WINDOWS\system32\dllcache\vfwwdm32.dll
2007-11-13 21:13 43,008 –a—— C:\WINDOWS\system32\ksxbar.ax
2007-11-13 21:13 28,672 –a—— C:\WINDOWS\system32\vidcap.ax
2007-11-13 21:13 28,672 –a–c— C:\WINDOWS\system32\dllcache\vidcap.ax
2007-11-13 21:03 d——– C:\Program Files\MSXML 4.0
2007-11-13 17:48 d——– C:\Program Files\Microsoft Virtual Server
2007-11-13 17:44 d——– C:\WINDOWS\IIS Temporary Compressed Files
2007-11-13 17:44 65,536 –a–c— C:\WINDOWS\system32\dllcache\EXCH_mailmsg.dll
2007-11-13 17:44 57,856 –a–c— C:\WINDOWS\system32\dllcache\EXCH_scripto.dll
2007-11-13 17:44 45,056 –a–c— C:\WINDOWS\system32\dllcache\EXCH_aqadmin.dll
2007-11-13 17:44 43,520 –a–c— C:\WINDOWS\system32\dllcache\EXCH_fcachdll.dll
2007-11-13 17:44 38,912 –a–c— C:\WINDOWS\system32\dllcache\EXCH_ntfsdrv.dll
2007-11-13 17:44 26,112 –a–c— C:\WINDOWS\system32\dllcache\EXCH_seos.dll
2007-11-13 17:44 23,040 –a–c— C:\WINDOWS\system32\dllcache\EXCH_regtrace.exe
2007-11-13 17:44 12,288 –a–c— C:\WINDOWS\system32\dllcache\EXCH_smtpctrs.dll
2007-11-13 17:44 7,168 –a–c— C:\WINDOWS\system32\dllcache\EXCH_snprfdll.dll
2007-11-13 17:44 5,632 –a–c— C:\WINDOWS\system32\dllcache\EXCH_adsiisex.dll
2007-11-13 17:43 363,520 –a–c— C:\WINDOWS\system32\dllcache\w3svc.dll
2007-11-13 17:43 275,968 –a–c— C:\WINDOWS\system32\dllcache\certwiz.ocx
2007-11-13 17:43 189,440 –a–c— C:\WINDOWS\system32\dllcache\smtpadm.dll
2007-11-13 17:43 94,720 –a–c— C:\WINDOWS\system32\dllcache\certmap.ocx
2007-11-13 17:43 76,800 –a–c— C:\WINDOWS\system32\dllcache\wam51.dll
2007-11-13 17:43 76,288 –a–c— C:\WINDOWS\system32\dllcache\cnfgprts.ocx
2007-11-13 17:43 73,728 –a–c— C:\WINDOWS\system32\dllcache\w3ext.dll
2007-11-13 17:43 56,320 –a–c— C:\WINDOWS\system32\dllcache\convlog.exe
2007-11-13 17:43 53,248 –a–c— C:\WINDOWS\system32\dllcache\wamreg51.dll
2007-11-13 17:43 46,592 –a–c— C:\WINDOWS\system32\dllcache\coadmin.dll
2007-11-13 17:43 43,520 –a—— C:\WINDOWS\system32\admwprox.dll
2007-11-13 17:43 42,496 –a–c— C:\WINDOWS\system32\dllcache\davcdata.exe
2007-11-13 17:43 33,792 –a–c— C:\WINDOWS\system32\dllcache\controt.dll
2007-11-13 17:43 24,064 –a–c— C:\WINDOWS\system32\dllcache\compfilt.dll
2007-11-13 17:43 20,480 –a–c— C:\WINDOWS\system32\dllcache\counters.dll
2007-11-13 17:43 9,216 –a–c— C:\WINDOWS\system32\dllcache\wamps51.dll
2007-11-13 17:43 8,192 –a—— C:\WINDOWS\system32\staxmem.dll
2007-11-13 17:43 7,168 –a–c— C:\WINDOWS\system32\dllcache\wamregps.dll
2007-11-13 17:43 6,144 –a—— C:\WINDOWS\system32\admxprox.dll
2007-11-13 17:43 5,632 –a–c— C:\WINDOWS\system32\dllcache\w3svapi.dll
2007-11-13 17:43 4,608 –a—— C:\WINDOWS\system32\w3ctrs.dll
2007-11-13 17:43 4,608 –a–c— C:\WINDOWS\system32\dllcache\w3ctrs51.dll
2007-11-13 17:42 d——– C:\Inetpub
2007-11-10 07:22 d——– C:\Documents and Settings\NetworkService\Application Data\VMware
2007-11-09 22:10 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2007-11-08 18:37 d——– C:\Documents and Settings\Administrator\Application Data\VMware
2007-11-08 18:36 d——– C:\Documents and Settings\LocalService\Application Data\VMware
2007-11-08 18:35 d——– C:\Documents and Settings\All Users\Application Data\VMware
2007-11-08 18:35 364,621 –a—— C:\WINDOWS\system32\vnetlib.dll
2007-11-08 18:35 147,529 –a—— C:\WINDOWS\system32\vmnat.exe
2007-11-08 18:35 102,480 –a—— C:\WINDOWS\system32\vmnetdhcp.exe
2007-11-08 18:34 d——– C:\Virtual Machines
2007-11-08 18:34 d——– C:\Program Files\VMware
2007-11-08 17:35 d——– C:\Program Files\PowerISO
2007-11-08 16:59 d——– C:\Program Files\Offline Course Player
2007-11-08 16:59 115,920 –a—— C:\WINDOWS\system32\MSINET.OCX
2007-11-07 16:11 d——– C:\Documents and Settings\Administrator\Application Data\SonicWALL
2007-11-07 16:08 d——– C:\Program Files\SonicWALL
2007-11-07 16:08 d——– C:\Program Files\Common Files\Deterministic Networks
2007-11-07 16:08 147,236 –a—— C:\WINDOWS\system32\drivers\dne2000.sys
2007-11-04 21:04 d——– C:\Documents and Settings\Administrator\Application Data\Leadertech
2007-11-04 20:56 d——– C:\Program Files\Common Files\Adobe
2007-11-04 19:32 d——– C:\PerfLogs
2007-11-03 06:17 d——– C:\Program Files\AceBIT
2007-11-02 05:59 d——– C:\Program Files\Citrix
2007-11-02 05:59 d——– C:\Documents and Settings\Administrator\Application Data\ICAClient
2007-11-01 20:04 15,104 –a–c— C:\WINDOWS\system32\dllcache\usbscan.sys
2007-11-01 19:57 d——– C:\Program Files\Macromedia
2007-11-01 19:57 d——– C:\Program Files\Common Files\Macromedia
2007-11-01 17:07 5,387 –a—— C:\WINDOWS\system32\jupdate-1.6.0_03-b05.log
2007-10-31 09:10 d——– C:\Program Files\Pakon
2007-10-31 08:43 25,856 –a–c— C:\WINDOWS\system32\dllcache\usbprint.sys
2007-10-31 08:12 d——– C:\Program Files\Mobile Action
2007-10-31 07:50 55,424 -ra—— C:\WINDOWS\system32\drivers\mam4410u.sys
2007-10-31 07:50 49,867 -ra—— C:\WINDOWS\system32\drivers\mardp2k.sys
2007-10-31 07:50 49,484 -ra—— C:\WINDOWS\system32\drivers\mardpnp.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-23 03:34 ——— d—–w C:\Program Files\Symantec AntiVirus
2007-11-21 04:20 ——— d—–w C:\Documents and Settings\Administrator\Application Data\uTorrent
2007-11-08 22:59 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-11-03 12:17 ——— d—–w C:\Program Files\Common Files\InstallShield
2007-10-21 23:47 ——— d—–w C:\Program Files\Spyware Doctor
2007-10-21 20:33 ——— d—–w C:\Program Files\Webroot
2007-10-21 20:33 ——— d—–w C:\Documents and Settings\NetworkService\Application Data\Webroot
2007-10-21 20:33 ——— d—–w C:\Documents and Settings\All Users\Application Data\Webroot
2007-10-21 20:33 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Webroot
2007-10-21 17:56 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Lavasoft
2007-10-21 15:34 ——— d—–w C:\Documents and Settings\All Users\Application Data\Geek Squad
2007-10-18 03:19 ——— d—–w C:\Program Files\Windows Media Connect 2
2007-10-15 02:19 ——— d—–w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-10-02 01:46 ——— d—–w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-10-02 01:35 ——— d—–w C:\Program Files\Symantec
2007-10-02 01:35 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2007-10-02 01:34 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2007-09-28 02:58 ——— d—–w C:\Program Files\ScreamerR
2007-09-28 02:54 499,712 —-a-w C:\WINDOWS\system32\msvcp71.dll
2007-09-28 02:54 348,160 —-a-w C:\WINDOWS\system32\msvcr71.dll
2007-09-28 02:54 ——— d—–w C:\Program Files\Real
2007-09-28 02:54 ——— d—–w C:\Program Files\Common Files\xing shared
2007-09-28 02:54 ——— d—–w C:\Program Files\Common Files\Real
2007-09-25 02:52 ——— d—–w C:\Program Files\DFX
2007-09-25 01:58 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Ahead
2007-09-25 00:52 ——— d—–w C:\Program Files\Nero
2007-09-25 00:52 ——— d—–w C:\Program Files\Common Files\Ahead
2007-09-25 00:33 ——— d—–w C:\Program Files\Intel Desktop Board Audio Driver
2007-09-25 00:33 ——— d—–w C:\Program Files\Analog Devices
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 22:56]
"Wise-FTP Scheduler"="C:\Program Files\AceBIT\WISE-FTP\WF_Scheduler.exe" [2003-08-29 15:35]
"Asoo"="C:\PROGRA~1\COMMON~1\CROSOF~1\msconfig.exe" []
"Bbqut"="C:\WINDOWS\?icrosoft\?explore.exe" []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2007-01-13 09:47]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-01-13 09:47]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-01-13 09:46]
"LayoutM"="KLayMgr.exe" [2004-08-26 13:17 C:\WINDOWS\KLayMgr.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-10-11 17:36 C:\WINDOWS\RTHDCPL.exe]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-07-27 12:48]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2004-08-06 07:27]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-09-27 20:54]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-07-19 18:26]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2006-09-27 19:33]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" []
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]
"OLPSYNCH"="C:\Program Files\Offline Course Player\OlpSynch.exe" [2007-07-13 04:00]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-08-06 18:05]
"DWPersistentQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\DWTRIG20.exe" [2007-02-26 08:01]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
TV Capture Remote Control.lnk - C:\Program Files\Easy\TV Capture\RemoteCtl.exe [2007-11-13 21:25:18]
C:\WINDOWS\system32\NavLogon.dll 2006-09-27 19:33 43760 C:\WINDOWS\system32\NavLogon.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NWEReboot]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Wise-FTP Scheduler]
R1 RCFOX;SonicWALL IPsec Driver;\??\C:\WINDOWS\system32\Drivers\RCFOX.sys
R2 BT848;MPEG.TV, WDM Video Capture;C:\WINDOWS\system32\drivers\BT848.sys
R2 BTTUNER;MPEG.TV, WDM TvTuner;C:\WINDOWS\system32\drivers\BTTUNER.sys
R2 BTXBAR;MPEG.TV, WDM Crossbar;C:\WINDOWS\system32\drivers\BTXBAR.sys
R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\system32\inetsrv\inetinfo.exe
R2 Virtual Server;Virtual Server;"C:\Program Files\Microsoft Virtual Server\vssrvc.exe"
R2 vmserverdWin32;VMware Registration Service;C:\Program Files\VMware\VMware GSX Server\vmserverdWin32.exe
R3 rcvpn;SonicWALL VPN Adapter;C:\WINDOWS\system32\DRIVERS\rcvpn.sys
R3 vmh;Virtual Machine Helper;"C:\Program Files\Microsoft Virtual Server\vmh.exe" -service
S3 eltima_usb_stub;ELTIMA Usb Stub;C:\WINDOWS\system32\DRIVERS\usbstub.sys
S3 HPKBCCID;HP Keyboard Smart Card Driver;C:\WINDOWS\system32\DRIVERS\HPKBCCID.sys
S3 mam4410u;mam4410u;C:\WINDOWS\system32\Drivers\mam4410u.sys
S3 MaRdPnp;MaRdPnp;C:\WINDOWS\system32\DRIVERS\MaRdP2K.sys
S3 STC2DFU;STCII DFU Adapter;C:\WINDOWS\system32\DRIVERS\Stc2Dfu.SYS
S3 vuhub;Virtual Usb Hub;C:\WINDOWS\system32\DRIVERS\vuhub.sys
*Newly Created Service* - CATCHME
.
**************************************************************************
catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-11-22 21:38:40
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-11-22 21:39:06
.
— E O F —
SAS log
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 11/22/2007 at 10:08 PM
Application Version : 3.9.1008
Core Rules Database Version : 3348
Trace Rules Database Version: 1349
Scan type : Complete Scan
Total Scan Time : 00:19:20
Memory items scanned : 462
Memory threats detected : 1
Registry items scanned : 5545
Registry threats detected : 0
File items scanned : 25082
File threats detected : 209
Adware.ClickSpring/Resident
C:\WINDOWS\?ICROSOFT\?EXPLORE.EXE
C:\WINDOWS\?ICROSOFT\?EXPLORE.EXE
C:\qoobox\Quarantine\C\WINDOWS\ICROSO~1\EXPLOR~1.VIR
C:\SYSTEM VOLUME INFORMATION\_RESTORE{62ED832D-AC7E-4ACE-916F-EB20F16DF01E}\RP2\A0000008.EXE
Adware.Tracking Cookie
C:\Documents and Settings\Administrator\Cookies\administrator@atdmt[2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@apmebf[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@clicksor[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@adsrevenue[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@clickbank[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@maturesex365[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@sex-cherry[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@crazyxxx3dworld[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@clickaider[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@altastat[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@adbrite[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@dealtime[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@sextracker[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@revsci[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@free-porno-archive[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@clickntrack[2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@tribalfusion[2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@yadro[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@sex-lemon[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@crazyxxx3dworld[3].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@adrevolver[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@hotlog[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@imrworldwide[2].txt
C:\Documents and Settings\Administrator\Cookies\[removed]-sys[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@atwola[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@teensexmovs[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@sexlist[2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@mediagrif.112.2o7[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@nextag[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@interclick[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@chokertraffic[2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@doubleclick[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@warez[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@realsexcash[2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@questionmarket[2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@statcounter[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@trafficmp[2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@precisionclick[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@screensavers[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@xxxfolder[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@fastclick[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@adlegend[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@clicktorrent[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@www.xxx69[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@mediaplex[2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@advertising[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@www.101sexsecret[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@pornpics-online[2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@xxxpower[2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@zedo[2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@heavycom.122.2o7[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@toplist[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@classicporngalleries[2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@upspiral[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@plumpteens[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@hitbox[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@tacoda[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][3].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@directtrack[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@login.tracking101[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@passwords4freeporn[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@extremepornpass[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@bluestreak[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@paypal.112.2o7[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@buycom.122.2o7[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@lovefuckk[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@specificclick[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@2o7[2].txt
C:\Documents and Settings\Administrator\Cookies\[removed]-max[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][4].txt
C:\Documents and Settings\Administrator\Cookies\administrator@shysex[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@overture[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@xxx-porno-young[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@livesexlist[2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][5].txt
C:\Documents and Settings\Administrator\Cookies\administrator@eyewonder[2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][7].txt
C:\Documents and Settings\Administrator\Cookies\administrator@sex-banana[2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@findwhat[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][6].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@xxxcounter[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@shopping.112.2o7[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@serving-sys[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@burstnet[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@sex-mango[2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@sex-kiwi[2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@paycounter[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][3].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@bizrate[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@fuckmeplz[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@fuckfamily[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][3].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@realmedia[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@classifiedventures1.112.2o7[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@casalemedia[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@besthairyporn[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@realteenpictureclub[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@linkstattrack[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
Adware.ClickSpring/Outer Info Network
C:\OIUNINSTALLER.EXE
C:\WINDOWS\Prefetch\OIUNINSTALLER.EXE-2788C926.pf
Trojan.Unknown Origin
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\COMMON FILES\CROSOF~1\MSCONFIG.EXE.VIR
C:\SYSTEM VOLUME INFORMATION\_RESTORE{62ED832D-AC7E-4ACE-916F-EB20F16DF01E}\RP2\A0000006.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{62ED832D-AC7E-4ACE-916F-EB20F16DF01E}\RP2\A0000007.EXE
Adware.ClickSpring/Yazzle
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\COMMON FILES\YAZZLE1848OINUNINSTALLER.EXE.VIR
HJT log
Logfile of HijackThis v1.99.1
Scan saved at 22:12, on 2007-11-22
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\VMware\VMware GSX Server\vmware-authd.exe
C:\Program Files\Microsoft Virtual Server\vmh.exe
C:\Program Files\VMware\VMware GSX Server\vmserverdWin32.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Offline Course Player\OlpSynch.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\AceBIT\WISE-FTP\WF_Scheduler.exe
C:\PROGRA~1\COMMON~1\CROSOF~1\msconfig.exe
C:\WINDOWS\?icrosoft\?explore.exe
C:\Program Files\Easy\TV Capture\RemoteCtl.exe
C:\WINDOWS\explorer.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [LayoutM] KLayMgr.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [OLPSYNCH] C:\Program Files\Offline Course Player\OlpSynch.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [DWPersistentQueuedReporting] C:\PROGRA~1\COMMON~1\MICROS~1\DW\DWTRIG20.EXE -a
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Wise-FTP Scheduler] C:\Program Files\AceBIT\WISE-FTP\WF_Scheduler.exe
O4 - HKCU\..\Run: [Asoo] "C:\PROGRA~1\COMMON~1\CROSOF~1\msconfig.exe" –ru -vt yazb
O4 - HKCU\..\Run: [Bbqut] C:\WINDOWS\?icrosoft\?explore.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: TV Capture Remote Control.lnk = C:\Program Files\Easy\TV Capture\RemoteCtl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {44C1E3A2-B594-401C-B27A-D1B4476E4797} (XTSAC Control) -
https://portal.clearnorthtech.com/XTSAC.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://www.update.microsoft.com/windowsupd…b?1188509930796
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://www.update.microsoft.com/microsoftu…b?1188510192812
O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) -
https://portal.clearnorthtech.com/msrdp.cab
O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} (DLC Class) - https://transfers.ds.microsoft.com/FTM/Tran…ransferCtrl.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{069F020E-AB06-4E25-AB4C-AB5FEB0178AE}: NameServer = 205.171.3.65,4.2.2.1
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: SonicWall VPN Client Service (RampartSvc) - SonicWALL, Inc. - C:\Program Files\SonicWALL\SonicWALL Global VPN Client\RampartSvc.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware GSX Server\vmware-authd.exe
O23 - Service: Virtual Machine Helper (vmh) - Unknown owner - C:\Program Files\Microsoft Virtual Server\vmh.exe" -service (file missing)
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Registration Service (vmserverdWin32) - VMware, Inc. - C:\Program Files\VMware\VMware GSX Server\vmserverdWin32.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
Thanks
Vic
Vic