skullshock
Topic Starter
I downloaded a program and ran it (I forgot the program name), and immediately my Spysweeper popped up to warn me that a program is trying to connect to some IP address that is listed as a spyware site (i.e., [removed]). I let Spysweeper do its thing but it was not successful (I think) in removing whatever was dropped into my PC. The malware kept trying to connect but Spyware kept blocking it every half second or so, until I let Spysweeper automatically block it without notifying me. Now the hard drive keeps blinking 2 or 3 times a second, perhaps due to the battle going on between Spysweeper and the malware. From time to time, my browser opens www.travian.com by itself. Please help!! Below is the hijackthis log:
Logfile of HijackThis v1.99.1
Scan saved at 8:44:36 PM, on 6/19/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\PaperSecu\SecuGate.exe
C:\WINDOWS\system32\paperSecu\PaperSrv.exe
C:\Program Files\Geot\Unicure\AVKService.exe
C:\Program Files\Geot\Unicure\AVKWCtl.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Samsung\Samsung EDS\EDSAgent.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\QNA.exe
C:\WINDOWS\QNAScheduler.exe
C:\Program Files\Common Files\PWC3800\PWCam.exe
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\Samsung\PanelMgr\ssmmgr.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\SAMSUNG\MagicKBD\MagicKBD.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Chikka\Chikka.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
C:\Program Files\Swift To-Do List\Swift To-Do List Lite.exe
C:\WINDOWS\INCOPS3\ictray.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Hometime.exe
C:\PROGRA~1\Chikka\BnrRepo2.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.samsung.net/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - (no file)
O3 - Toolbar: &Google; - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [MagicKeyboard] "C:\Program Files\SAMSUNG\MagicKBD\PreMKBD.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [EDS] "C:\Program Files\Samsung\Samsung EDS\EDSAgent.exe"
O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
O4 - HKLM\..\Run: [DMHotKey] "C:\Program Files\Samsung\Easy Display Manager\DMLoader.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] "rundll32.exe" bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [qna] C:\WINDOWS\QNA.exe
O4 - HKLM\..\Run: [qnasch] C:\WINDOWS\QNAScheduler.exe
O4 - HKLM\..\Run: [PWCam] "C:\Program Files\Common Files\PWC3800\PWCam.exe"
O4 - HKLM\..\Run: [BigDogPath] "C:\WINDOWS\VM_STI.EXE" PLEOMAX PWC-3800
O4 - HKLM\..\Run: [Samsung PanelMgr] "C:\WINDOWS\Samsung\PanelMgr\ssmmgr.exe" /autorun
O4 - HKLM\..\Run: [PWRISOVM.EXE] "C:\Program Files\PowerISO\PWRISOVM.EXE"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ChikkaIM] "C:\Program Files\Chikka\Chikka.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [SwiftToDoListLite] "C:\Program Files\Swift To-Do List\Swift To-Do List Lite.exe" minimized
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Hometime.exe
O8 - Extra context menu item: &D;&ownload; &with; BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D;&ownload; all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D;&ownload; all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\anywall3.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\anywall3.dll
O15 - Trusted Zone: *.samsung.net
O15 - Trusted Zone: http://*.samsung.net
O15 - Trusted IP range: http://66.10.54.21
O15 - Trusted IP range: http://66.10.54.15
O15 - Trusted IP range: http://203.254.238.25
O15 - Trusted IP range: http://203.254.216.132
O15 - Trusted IP range: http://203.254.216.135
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {08BCD971-A13B-4D6E-A2A5-E9B2324FC00D} (ClientEXE Class) - http://66.10.54.15:10080/EP/web/common/cab…M_ClientEXE.cab
O16 - DPF: {0A2233AD-E771-11D2-973D-00104B15E56F} (ToinbWTR Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbtr.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1B954045-CB17-46CF-A596-BC59E7861D79} (mySingle.ClsLocal) - https://www.samsung.net/cabs/localmailfolde…ingle_XPSP2.CAB
O16 - DPF: {1EFB6596-857C-11D1-B16A-00C0F0283628} (Microsoft TabStrip Control 6.0 (SP6)) - http://www.samsung.net/cabs/LocalFolder2004/Cab/MSComCtl.cab
O16 - DPF: {1F57AEAD-DB12-11D2-A4F9-00608CEBEE49} (ToinbWGrid Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbgrid.cab
O16 - DPF: {2022EE84-1E1F-45B0-8D35-FF9DA75366BC} (ExpressViewer Class) - http://download.softforum.co.kr/Published/…ei_install2.cab
O16 - DPF: {2FF8F8B7-1B3F-4E5F-93B1-FEF1D703C0F4} (LocalTree.LocalXMLTree) - http://www.samsung.net/cabs/LocalFolder200…ngleLocal_U.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {3267EA0D-B5D8-11D2-A4F9-00608CEBEE49} (ToinbWData Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbdata.cab
O16 - DPF: {34B5A473-9696-4F9A-9BA1-41B8185A9798} (EpFTP3 Control) - http://www.samsung.net/cabs/EpFTP3/EpFTP3_U.cab
O16 - DPF: {37D13B2F-E5EB-11D2-973D-00104B15E56F} (ToinbWReport Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbrep.cab
O16 - DPF: {37DEC207-782F-40F5-803C-18ACEDA1ABA6} (PersonalCache Control) - http://www.samsung.net/portalWeb/cabs/mySi…rsonalCache.cab
O16 - DPF: {4401B994-DD33-11D2-B539-006097ADB678} (ToinbWTree Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbtree.cab
O16 - DPF: {4646547A-22E8-485F-95BC-B4C76835BF80} (RSAutoUp Control) - http://samsunghelp.co.kr/cab/rsautoup.cab
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/vers…vex-2.2.3.5.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {5FBAE1CD-A276-11D3-AF84-00C026DC3D95} (ToinbwMEdit Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbmedit.cab
O16 - DPF: {60109D65-70C0-425C-B3A4-4CB001513C69} (LuxeWCombo Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\LuxeCombo.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1205776733531
O16 - DPF: {69F1348F-3EBE-11D3-973D-0060979E2A03} (ToinbWInputFile Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbifile.cab
O16 - DPF: {6CE20149-ABE3-462E-A1B4-5B549971AA38} (XecureCKKB Class) - http://ck.softforum.co.kr/CKKeyPro/keb/CKKeyPro.cab
O16 - DPF: {754F3DC4-0C79-4C92-AD64-A806D8FF2AB0} (ToinbWRadio Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbradio.cab
O16 - DPF: {75B5421D-15E1-43FA-990D-C7847D1077F0} (XChart Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\xchart.cab
O16 - DPF: {7A54CBF0-2CB4-11D4-973E-0060979E2A03} (ToinbWMenu Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbmenu.cab
O16 - DPF: {7D73D9AC-9E28-47E7-B496-867A2341DD6F} (PdssRun Class) - http://203.254.238.25:8002/activex/pdss40.cab
O16 - DPF: {7E9FDB80-5316-11D4-B02C-00C04F0CD404} (XecureWeb 4.0 Client Control) - http://xecure.kbstar.com/xecure/xw_install_v7202.cab
O16 - DPF: {838CAAAF-C7EA-486A-9FEF-DDD5DAD079CF} (TrustSession Class) - https://www.samsung.net/cabs/auth/SecuiEPIE.cab
O16 - DPF: {88DDFD7D-14F7-4E89-8F85-737B90B1A0D0} (mySingleTrust.ClsMain) - http://www.samsung.net/cabs/LocalFolder200…ingle_Trust.CAB
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=21871
O16 - DPF: {91B0A4F0-3206-4564-9BB4-AF9055DEF8A1} (ToinbWTextArea Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbtextarea.cab
O16 - DPF: {9C9AB433-EA85-11D2-A4F9-00608CEBEE49} (ToinbWBind Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbbind.cab
O16 - DPF: {B5F6727A-DD38-11D2-973D-00104B15E56F} (ToinbWChart Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbchart.cab
O16 - DPF: {BCB3A52D-F8E7-11D3-973E-0060979E2A03} (ToinbWImgData Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbimgdata.cab
O16 - DPF: {C63E3330-049F-4C31-B47E-425C84A5A725} (EpAdm2 Control) - http://www.samsung.net/cabs/Tray/EpAdm2.cab
O16 - DPF: {C945E31A-102E-4A0D-8854-D599D7AED5FA} (ComponentOne FlexGrid 8.0 (OLEDB)) - http://66.10.54.21:11000/web/sei_c9/common/cab/vsflex8.cab
O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} (NPX Control) - http://n-protect.kbstar.com/nprotect/module/npx.cab
O16 - DPF: {DC4207CE-C03E-4449-ACB1-032CA4137053} (Npz Control) - http://update.nprotect.net/nprotect2006/keb/npz.cab
O16 - DPF: {DE6ABA6A-095B-43E3-BEBB-879868DC5C8A} (SSLinks Control) - http://www.samsung.net/portalWeb/cabs/messenger/SSLinks.cab
O16 - DPF: {DF88B6BB-3A73-4443-95A4-23A1568CAC80} (Coxgrd Control) - http://www.ks.or.kr/iisweb/app/coxgrd.7.0.3.7.cab
O16 - DPF: {E1D1DACA-5BA2-4376-89AD-3A213B916779} (IBLeaders IBSheet For Unicode Control) - http://203.254.238.25:8002/activex/IBSheet4Unicode.CAB
O16 - DPF: {E6876E99-7C28-43AD-9088-315DC302C05F} (ToinbWEMEdit Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbemedit.cab
O16 - DPF: {E831AA9C-C980-4F16-B252-09AAF40D0E9B} (Kdfense9 Control) - http://k-defence.kbstar.com/kdfx218/kbstar/kdfense9.cab
O16 - DPF: {ED382953-E907-11D3-B694-006097AD7252} (ToinbWTab Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbtab.cab
O16 - DPF: {FD4C6571-DD20-11D2-973D-00104B15E56F} (ToInbWCCombo Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbccombo.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2CD8216-F618-4F40-B44A-5FF576417010}: Domain = secl.samsung.co.kr
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVK Service (AVKService) - Unknown owner - C:\Program Files\Geot\Unicure\AVKService.exe
O23 - Service: AVK Monitor (AVKWCtl) - Unknown owner - C:\Program Files\Geot\Unicure\AVKWCtl.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: gateman - SDS - C:\WINDOWS\incops3\gateman.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: SQL Server FullText Search (SQLEXPRESS) (msftesql$SQLEXPRESS) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe" -s:MSSQL.1 -f:SQLEXPRESS (file missing)
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OracleClientCache80 - Unknown owner - C:\orant\BIN\ONRSD80.EXE
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Windows Spooler (W32Print) - Unknown owner - C:\WINDOWS\system32\PaperSecu\svcpaper.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: winfil32 - SDS - C:\WINDOWS\system32\winfil32.exe
Thanks in advance!!
Logfile of HijackThis v1.99.1
Scan saved at 8:44:36 PM, on 6/19/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\PaperSecu\SecuGate.exe
C:\WINDOWS\system32\paperSecu\PaperSrv.exe
C:\Program Files\Geot\Unicure\AVKService.exe
C:\Program Files\Geot\Unicure\AVKWCtl.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Samsung\Samsung EDS\EDSAgent.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\QNA.exe
C:\WINDOWS\QNAScheduler.exe
C:\Program Files\Common Files\PWC3800\PWCam.exe
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\Samsung\PanelMgr\ssmmgr.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\SAMSUNG\MagicKBD\MagicKBD.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Chikka\Chikka.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
C:\Program Files\Swift To-Do List\Swift To-Do List Lite.exe
C:\WINDOWS\INCOPS3\ictray.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Hometime.exe
C:\PROGRA~1\Chikka\BnrRepo2.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.samsung.net/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - (no file)
O3 - Toolbar: &Google; - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [MagicKeyboard] "C:\Program Files\SAMSUNG\MagicKBD\PreMKBD.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [EDS] "C:\Program Files\Samsung\Samsung EDS\EDSAgent.exe"
O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
O4 - HKLM\..\Run: [DMHotKey] "C:\Program Files\Samsung\Easy Display Manager\DMLoader.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] "rundll32.exe" bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [qna] C:\WINDOWS\QNA.exe
O4 - HKLM\..\Run: [qnasch] C:\WINDOWS\QNAScheduler.exe
O4 - HKLM\..\Run: [PWCam] "C:\Program Files\Common Files\PWC3800\PWCam.exe"
O4 - HKLM\..\Run: [BigDogPath] "C:\WINDOWS\VM_STI.EXE" PLEOMAX PWC-3800
O4 - HKLM\..\Run: [Samsung PanelMgr] "C:\WINDOWS\Samsung\PanelMgr\ssmmgr.exe" /autorun
O4 - HKLM\..\Run: [PWRISOVM.EXE] "C:\Program Files\PowerISO\PWRISOVM.EXE"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ChikkaIM] "C:\Program Files\Chikka\Chikka.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [SwiftToDoListLite] "C:\Program Files\Swift To-Do List\Swift To-Do List Lite.exe" minimized
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Hometime.exe
O8 - Extra context menu item: &D;&ownload; &with; BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D;&ownload; all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D;&ownload; all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\anywall3.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\anywall3.dll
O15 - Trusted Zone: *.samsung.net
O15 - Trusted Zone: http://*.samsung.net
O15 - Trusted IP range: http://66.10.54.21
O15 - Trusted IP range: http://66.10.54.15
O15 - Trusted IP range: http://203.254.238.25
O15 - Trusted IP range: http://203.254.216.132
O15 - Trusted IP range: http://203.254.216.135
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {08BCD971-A13B-4D6E-A2A5-E9B2324FC00D} (ClientEXE Class) - http://66.10.54.15:10080/EP/web/common/cab…M_ClientEXE.cab
O16 - DPF: {0A2233AD-E771-11D2-973D-00104B15E56F} (ToinbWTR Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbtr.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1B954045-CB17-46CF-A596-BC59E7861D79} (mySingle.ClsLocal) - https://www.samsung.net/cabs/localmailfolde…ingle_XPSP2.CAB
O16 - DPF: {1EFB6596-857C-11D1-B16A-00C0F0283628} (Microsoft TabStrip Control 6.0 (SP6)) - http://www.samsung.net/cabs/LocalFolder2004/Cab/MSComCtl.cab
O16 - DPF: {1F57AEAD-DB12-11D2-A4F9-00608CEBEE49} (ToinbWGrid Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbgrid.cab
O16 - DPF: {2022EE84-1E1F-45B0-8D35-FF9DA75366BC} (ExpressViewer Class) - http://download.softforum.co.kr/Published/…ei_install2.cab
O16 - DPF: {2FF8F8B7-1B3F-4E5F-93B1-FEF1D703C0F4} (LocalTree.LocalXMLTree) - http://www.samsung.net/cabs/LocalFolder200…ngleLocal_U.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {3267EA0D-B5D8-11D2-A4F9-00608CEBEE49} (ToinbWData Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbdata.cab
O16 - DPF: {34B5A473-9696-4F9A-9BA1-41B8185A9798} (EpFTP3 Control) - http://www.samsung.net/cabs/EpFTP3/EpFTP3_U.cab
O16 - DPF: {37D13B2F-E5EB-11D2-973D-00104B15E56F} (ToinbWReport Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbrep.cab
O16 - DPF: {37DEC207-782F-40F5-803C-18ACEDA1ABA6} (PersonalCache Control) - http://www.samsung.net/portalWeb/cabs/mySi…rsonalCache.cab
O16 - DPF: {4401B994-DD33-11D2-B539-006097ADB678} (ToinbWTree Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbtree.cab
O16 - DPF: {4646547A-22E8-485F-95BC-B4C76835BF80} (RSAutoUp Control) - http://samsunghelp.co.kr/cab/rsautoup.cab
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/vers…vex-2.2.3.5.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {5FBAE1CD-A276-11D3-AF84-00C026DC3D95} (ToinbwMEdit Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbmedit.cab
O16 - DPF: {60109D65-70C0-425C-B3A4-4CB001513C69} (LuxeWCombo Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\LuxeCombo.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1205776733531
O16 - DPF: {69F1348F-3EBE-11D3-973D-0060979E2A03} (ToinbWInputFile Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbifile.cab
O16 - DPF: {6CE20149-ABE3-462E-A1B4-5B549971AA38} (XecureCKKB Class) - http://ck.softforum.co.kr/CKKeyPro/keb/CKKeyPro.cab
O16 - DPF: {754F3DC4-0C79-4C92-AD64-A806D8FF2AB0} (ToinbWRadio Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbradio.cab
O16 - DPF: {75B5421D-15E1-43FA-990D-C7847D1077F0} (XChart Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\xchart.cab
O16 - DPF: {7A54CBF0-2CB4-11D4-973E-0060979E2A03} (ToinbWMenu Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbmenu.cab
O16 - DPF: {7D73D9AC-9E28-47E7-B496-867A2341DD6F} (PdssRun Class) - http://203.254.238.25:8002/activex/pdss40.cab
O16 - DPF: {7E9FDB80-5316-11D4-B02C-00C04F0CD404} (XecureWeb 4.0 Client Control) - http://xecure.kbstar.com/xecure/xw_install_v7202.cab
O16 - DPF: {838CAAAF-C7EA-486A-9FEF-DDD5DAD079CF} (TrustSession Class) - https://www.samsung.net/cabs/auth/SecuiEPIE.cab
O16 - DPF: {88DDFD7D-14F7-4E89-8F85-737B90B1A0D0} (mySingleTrust.ClsMain) - http://www.samsung.net/cabs/LocalFolder200…ingle_Trust.CAB
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=21871
O16 - DPF: {91B0A4F0-3206-4564-9BB4-AF9055DEF8A1} (ToinbWTextArea Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbtextarea.cab
O16 - DPF: {9C9AB433-EA85-11D2-A4F9-00608CEBEE49} (ToinbWBind Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbbind.cab
O16 - DPF: {B5F6727A-DD38-11D2-973D-00104B15E56F} (ToinbWChart Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbchart.cab
O16 - DPF: {BCB3A52D-F8E7-11D3-973E-0060979E2A03} (ToinbWImgData Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbimgdata.cab
O16 - DPF: {C63E3330-049F-4C31-B47E-425C84A5A725} (EpAdm2 Control) - http://www.samsung.net/cabs/Tray/EpAdm2.cab
O16 - DPF: {C945E31A-102E-4A0D-8854-D599D7AED5FA} (ComponentOne FlexGrid 8.0 (OLEDB)) - http://66.10.54.21:11000/web/sei_c9/common/cab/vsflex8.cab
O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} (NPX Control) - http://n-protect.kbstar.com/nprotect/module/npx.cab
O16 - DPF: {DC4207CE-C03E-4449-ACB1-032CA4137053} (Npz Control) - http://update.nprotect.net/nprotect2006/keb/npz.cab
O16 - DPF: {DE6ABA6A-095B-43E3-BEBB-879868DC5C8A} (SSLinks Control) - http://www.samsung.net/portalWeb/cabs/messenger/SSLinks.cab
O16 - DPF: {DF88B6BB-3A73-4443-95A4-23A1568CAC80} (Coxgrd Control) - http://www.ks.or.kr/iisweb/app/coxgrd.7.0.3.7.cab
O16 - DPF: {E1D1DACA-5BA2-4376-89AD-3A213B916779} (IBLeaders IBSheet For Unicode Control) - http://203.254.238.25:8002/activex/IBSheet4Unicode.CAB
O16 - DPF: {E6876E99-7C28-43AD-9088-315DC302C05F} (ToinbWEMEdit Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbemedit.cab
O16 - DPF: {E831AA9C-C980-4F16-B252-09AAF40D0E9B} (Kdfense9 Control) - http://k-defence.kbstar.com/kdfx218/kbstar/kdfense9.cab
O16 - DPF: {ED382953-E907-11D3-B694-006097AD7252} (ToinbWTab Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbtab.cab
O16 - DPF: {FD4C6571-DD20-11D2-973D-00104B15E56F} (ToInbWCCombo Class) - file://C:\DOCUME~1\user\LOCALS~1\Temp\cabfiles\toinbccombo.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2CD8216-F618-4F40-B44A-5FF576417010}: Domain = secl.samsung.co.kr
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVK Service (AVKService) - Unknown owner - C:\Program Files\Geot\Unicure\AVKService.exe
O23 - Service: AVK Monitor (AVKWCtl) - Unknown owner - C:\Program Files\Geot\Unicure\AVKWCtl.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: gateman - SDS - C:\WINDOWS\incops3\gateman.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: SQL Server FullText Search (SQLEXPRESS) (msftesql$SQLEXPRESS) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe" -s:MSSQL.1 -f:SQLEXPRESS (file missing)
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OracleClientCache80 - Unknown owner - C:\orant\BIN\ONRSD80.EXE
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Windows Spooler (W32Print) - Unknown owner - C:\WINDOWS\system32\PaperSecu\svcpaper.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: winfil32 - SDS - C:\WINDOWS\system32\winfil32.exe
Thanks in advance!!