Hi,

The other day I got infected with irc/flood back door trojan according to my AV. I currently use Internet Security Pro - trend micro. Unfortunately my AV didn't catch the virus in time. I did online scans with Housecall, CA virus scan, Kaspersky and Panda. All of them picked few malware and viruses. So it seams s that everything should be working now, however every time I try to do windows update using IE it hangs. I've read that irc/ backdoor affect windowsupdate.exe process. Could someone please have a look at my Hijackthis log and let me know if I'm still infected?


hijackthis.log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:09:22 AM, on 3/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
  • C:\WINDOWS\System32\smss.exe
  • C:\WINDOWS\system32\winlogon.exe
  • C:\WINDOWS\system32\services.exe
  • C:\WINDOWS\system32\lsass.exe
  • C:\WINDOWS\system32\svchost.exe
  • C:\WINDOWS\System32\svchost.exe
  • C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  • C:\Program Files\Common Files\Logitech\Bluetooth\LBTSERV.EXE
  • C:\WINDOWS\system32\spoolsv.exe
  • C:\WINDOWS\arservice.exe
  • C:\WINDOWS\eHome\ehRecvr.exe
  • C:\WINDOWS\eHome\ehSched.exe
  • C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  • C:\Program Files\Logitech\Easy Synchronization\servicestub.exe
  • C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe
  • C:\WINDOWS\system32\nvsvc32.exe
  • C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
  • C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
  • C:\WINDOWS\system32\svchost.exe
  • C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
  • C:\WINDOWS\Explorer.EXE
  • C:\WINDOWS\system32\vmnat.exe
  • C:\Program Files\RealVNC\VNC4\WinVNC4.exe
  • C:\WINDOWS\system32\SearchIndexer.exe
  • C:\Program Files\Trend Micro\BM\TMBMSRV.exe
  • C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
  • C:\WINDOWS\system32\vmnetdhcp.exe
  • C:\WINDOWS\system32\dllhost.exe
  • C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
  • C:\WINDOWS\ehome\ehtray.exe
  • C:\WINDOWS\ARPWRMSG.EXE
  • C:\WINDOWS\eHome\ehmsas.exe
  • C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe
  • C:\WINDOWS\system32\ctfmon.exe
  • C:\WINDOWS\System32\svchost.exe
  • C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
  • C:\WINDOWS\system32\rundll32.exe
  • C:\WINDOWS\RTHDCPL.EXE
  • C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
  • C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe
  • C:\Program Files\Logitech\SetPoint\LBTWiz.exe
  • C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
  • C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe
  • C:\Program Files\VoipCheapCom\VoipCheapCom.exe
  • C:\Program Files\Messenger\msmsgs.exe
  • C:\Program Files\Codebox\BitMeter\BitMeter2.exe
  • C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
  • C:\Program Files\Logitech\SetPoint\SetPoint.exe
  • C:\Program Files\Windows Desktop Search\WindowsSearch.exe
  • C:\WINDOWS\system32\wuauclt.exe
  • C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
  • C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
  • C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
  • C:\WINDOWS\system32\SearchProtocolHost.exe
  • C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  • C:\Program Files\Trend Micro\TrendSecure\TSCFCommander.exe
  • R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
  • R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  • R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  • R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
  • R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  • R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
  • O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  • O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
  • O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  • O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  • O2 - BHO: TransactionProtector BHO - {C1656CCA-D2EA-4A32-94AE-AE0B180E6449} - C:\Program Files\Trend Micro\TrendSecure\TransactionProtector\TSToolbar.dll
  • O3 - Toolbar: Transaction Protector - {E7620C98-FCCC-40E5-92EC-C7685D2E1E40} - C:\Program Files\Trend Micro\TrendSecure\TransactionProtector\TSToolbar.dll
  • O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
  • O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
  • O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
  • O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  • O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
  • O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
  • O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
  • O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
  • O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
  • O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
  • O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
  • O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
  • O4 - HKLM\..\Run: [Easy Synchronization] C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe
  • O4 - HKLM\..\Run: [Bluetooth Connection Assistant] LBTWIZ.EXE -silent
  • O4 - HKLM\..\RunOnce: [Easy Synchronization] C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe –ports
  • O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  • O4 - HKCU\..\Run: [OE] "C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe"
  • O4 - HKCU\..\Run: [VoipCheapCom] "C:\Program Files\VoipCheapCom\VoipCheapCom.exe" -nosplash -minimized
  • O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  • O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
  • O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
  • O4 - S-1-5-18 Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'SYSTEM')
  • O4 - .DEFAULT Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
  • O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
  • O4 - Global Startup: Bitmeter2.lnk = C:\Program Files\Codebox\BitMeter\BitMeter2.exe
  • O4 - Global Startup: Bluetooth.lnk = ?
  • O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
  • O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
  • O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
  • O8 - Extra context menu item: Send to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
  • O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  • O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  • O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
  • O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
  • O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  • O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  • O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  • O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  • O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
  • O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
  • O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  • O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  • O15 - Trusted Zone: http://citrix.cofcqld.com.au
  • O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
  • O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
  • O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
  • O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
  • O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1193745264187
  • O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
  • O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1204291929734
  • O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://ca.com/us/securityadvisor/virusinfo/webscan.cab
  • O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…241/mcfscan.cab
  • O17 - HKLM\System\CCS\Services\Tcpip\..\{F5C2CE95-1E6B-48F6-8F89-D0A4888548E4}: NameServer = 10.1.1.1
  • O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
  • O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  • O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
  • O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTSERV.EXE
  • O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  • O23 - Service: Logitech Easy Synchronization - Unknown owner - C:\Program Files\Logitech\Easy Synchronization\servicestub.exe
  • O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
  • O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  • O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
  • O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
  • O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
  • O23 - Service: spoolsv.exe - Unknown owner - C:\WINDOWS\system\dcache\data\scan\Service.exe (file missing)
  • O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
  • O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
  • O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
  • O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe
  • O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
  • O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
  • O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
  • O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
  • O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

–
End of file - 12636 bytes

startuplist.log
  • StartupList report, 3/03/2008, 7:10:42 AM
  • StartupList version: 1.52.2
  • Started from : C:\Program Files\Trend Micro\HijackThis\HijackThis.EXE
  • Detected: Windows XP SP2 (WinNT 5.01.2600)
  • Detected: Internet Explorer v7.00 (7.00.6000.16608)
  • * Using default options
  • ==================================================
  • Running processes:
  • C:\WINDOWS\System32\smss.exe
  • C:\WINDOWS\system32\winlogon.exe
  • C:\WINDOWS\system32\services.exe
  • C:\WINDOWS\system32\lsass.exe
  • C:\WINDOWS\system32\svchost.exe
  • C:\WINDOWS\System32\svchost.exe
  • C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  • C:\Program Files\Common Files\Logitech\Bluetooth\LBTSERV.EXE
  • C:\WINDOWS\system32\spoolsv.exe
  • C:\WINDOWS\arservice.exe
  • C:\WINDOWS\eHome\ehRecvr.exe
  • C:\WINDOWS\eHome\ehSched.exe
  • C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  • C:\Program Files\Logitech\Easy Synchronization\servicestub.exe
  • C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe
  • C:\WINDOWS\system32\nvsvc32.exe
  • C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
  • C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
  • C:\WINDOWS\system32\svchost.exe
  • C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
  • C:\WINDOWS\Explorer.EXE
  • C:\WINDOWS\system32\vmnat.exe
  • C:\Program Files\RealVNC\VNC4\WinVNC4.exe
  • C:\WINDOWS\system32\SearchIndexer.exe
  • C:\Program Files\Trend Micro\BM\TMBMSRV.exe
  • C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
  • C:\WINDOWS\system32\vmnetdhcp.exe
  • C:\WINDOWS\system32\dllhost.exe
  • C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
  • C:\WINDOWS\ehome\ehtray.exe
  • C:\WINDOWS\ARPWRMSG.EXE
  • C:\WINDOWS\eHome\ehmsas.exe
  • C:\WINDOWS\system32\ctfmon.exe
  • C:\WINDOWS\System32\svchost.exe
  • C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
  • C:\WINDOWS\system32\rundll32.exe
  • C:\WINDOWS\RTHDCPL.EXE
  • C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
  • C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe
  • C:\Program Files\Logitech\SetPoint\LBTWiz.exe
  • C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
  • C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe
  • C:\Program Files\VoipCheapCom\VoipCheapCom.exe
  • C:\Program Files\Messenger\msmsgs.exe
  • C:\Program Files\Codebox\BitMeter\BitMeter2.exe
  • C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
  • C:\Program Files\Logitech\SetPoint\SetPoint.exe
  • C:\Program Files\Windows Desktop Search\WindowsSearch.exe
  • C:\WINDOWS\system32\wuauclt.exe
  • C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
  • C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
  • C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
  • C:\WINDOWS\system32\SearchProtocolHost.exe
  • C:\Program Files\Trend Micro\TrendSecure\TSCFCommander.exe
  • C:\WINDOWS\system32\ps2.exe
  • c:\windows\system\hpsysdrv.exe
  • C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  • ————————————————–
  • Listing of startup folders:
  • Shell folders Common Startup:
  • [C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
  • Bitmeter2.lnk = C:\Program Files\Codebox\BitMeter\BitMeter2.exe
  • Bluetooth.lnk = ?
  • Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
  • Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
  • ————————————————–
  • Checking Windows NT UserInit:
  • [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  • UserInit = C:\WINDOWS\system32\userinit.exe,
  • ————————————————–
  • Autorun entries from Registry:
  • HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  • ehTray = C:\WINDOWS\ehome\ehtray.exe
  • ftutil2 = rundll32.exe ftutil2.dll,SetWriteCacheMode
  • AlwaysReady Power Message APP = ARPWRMSG.EXE
  • NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  • nwiz = nwiz.exe /installquiet /keeploaded /nodetect
  • Recguard = C:\WINDOWS\SMINST\RECGUARD.EXE
  • HPBootOp = "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
  • SunJavaUpdateSched = "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
  • RTHDCPL = RTHDCPL.EXE
  • Alcmtr = ALCMTR.EXE
  • UfSeAgnt.exe = "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
  • Kernel and Hardware Abstraction Layer = KHALMNPR.EXE
  • Easy Synchronization = C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe
  • Bluetooth Connection Assistant = LBTWIZ.EXE -silent
  • ————————————————–
  • Autorun entries from Registry:
  • HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
  • Easy Synchronization = C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe –ports
  • ————————————————–
  • Autorun entries from Registry:
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  • ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
  • OE = "C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe"
  • VoipCheapCom = "C:\Program Files\VoipCheapCom\VoipCheapCom.exe" -nosplash -minimized
  • MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background
  • ————————————————–
  • Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
  • Shell=*INI section not found*
  • SCRNSAVE.EXE=*INI section not found*
  • drivers=*INI section not found*
  • Shell & screensaver key from Registry:
  • Shell=Explorer.exe
  • SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
  • drivers=*Registry value not found*
  • Policies Shell key:
  • HKCU\..\Policies: Shell=*Registry value not found*
  • HKLM\..\Policies: Shell=*Registry value not found*
  • ————————————————–
  • Enumerating Browser Helper Objects:
  • (no name) - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
  • Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll - {22BF413B-C6D2-4d91-82A9-A0F997BA588C}
  • (no name) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
  • (no name) - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
  • TransactionProtector BHO - C:\Program Files\Trend Micro\TrendSecure\TransactionProtector\TSToolbar.dll - {C1656CCA-D2EA-4A32-94AE-AE0B180E6449}
  • ————————————————–
  • Enumerating Download Program Files:
  • [CKAVWebScan Object]
  • InProcServer32 = C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
  • CODEBASE = http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
  • [ewidoOnlineScan Control]
  • InProcServer32 = C:\WINDOWS\DOWNLO~1\EWIDOO~1.DLL
  • CODEBASE = http://downloads.ewido.net/ewidoOnlineScan.cab
  • [Symantec AntiVirus scanner]
  • InProcServer32 = C:\WINDOWS\Downloaded Program Files\CONFLICT.1\avsniff.dll
  • CODEBASE = http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
  • [OnlineScanner Control]
  • InProcServer32 = C:\WINDOWS\system32\ONLINE~1.OCX
  • CODEBASE = http://www.eset.eu/buxus/docs/OnlineScanner.cab
  • [WUWebControl Class]
  • InProcServer32 = C:\WINDOWS\system32\wuweb.dll
  • CODEBASE = http://www.update.microsoft.com/windowsupd…b?1193745264187
  • [Symantec RuFSI Utility Class]
  • InProcServer32 = C:\WINDOWS\Downloaded Program Files\CONFLICT.1\rufsi.dll
  • CODEBASE = http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
  • [MUWebControl Class]
  • InProcServer32 = C:\WINDOWS\system32\muweb.dll
  • CODEBASE = http://www.update.microsoft.com/microsoftu…b?1204291929734
  • [WScanCtl Class]
  • InProcServer32 = C:\WINDOWS\Downloaded Program Files\webscan.dll
  • CODEBASE = http://ca.com/us/securityadvisor/virusinfo/webscan.cab
  • [McFreeScan Class]
  • InProcServer32 = C:\WINDOWS\McAfee.com\FreeScan\mcfscan.dll
  • CODEBASE = http://download.mcafee.com/molbin/iss-loc/…241/mcfscan.cab
  • ————————————————–
  • Enumerating ShellServiceObjectDelayLoad items:
  • PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
  • CDBurn: C:\WINDOWS\system32\SHELL32.dll
  • WebCheck: C:\WINDOWS\system32\webcheck.dll
  • SysTray: C:\WINDOWS\system32\stobject.dll
  • WPDShServiceObj: C:\WINDOWS\system32\WPDShServiceObj.dll
  • ————————————————–
  • End of report, 8,937 bytes
  • Report generated in 0.110 seconds
  • Command line options:
  • /verbose - to add additional info on each section
  • /complete - to include empty sections and unsuspicious data
  • /full - to include several rarely-important sections
  • /force9x - to include Win9x-only startups even if running on WinNT
  • /forcent - to include WinNT-only startups even if running on Win9x
  • /forceall - to include all Win9x and WinNT startups, regardless of platform
  • /history - to list version history only


thank you for any help.

Lafar