Jedi Paul9
Topic Starter
There is this strange virus that takes control of my task manager and wallpaper. I can't do anything. It tries to get me to download a program called Antivirus XP 2008. A friend referred me here and I'd appreciate anything that can be down.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:07:04 PM, on 9/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\All Users\Application Data\crcxunev\arsbylgt.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder\OrderReminder.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\coShared\CIM\1.5\AcctMgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\rhct4dj0ee6r\rhct4dj0ee6r.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\Program Files\Common Files\Symantec Shared\coShared\CW\1.5\CWDefScn.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Ventrilo\Ventrilo.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\pphcp4dj0ee6r.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com?o=1607
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {0306AFF7-50D1-4AF0-9693-44CE4054FBA4} - (no file)
O2 - BHO: (no name) - {03B902B1-9B25-4173-9468-56775C85A8D4} - (no file)
O2 - BHO: (no name) - {040B3337-2C30-49E9-A8BF-BB51F15B1ABD} - (no file)
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0ACF9D1F-7CB6-4A70-9CCD-8158CE6BBAA8} - (no file)
O2 - BHO: (no name) - {0E3F4BF4-44F1-4A85-B07F-A9440F3D28F6} - (no file)
O2 - BHO: (no name) - {0E473C05-20AE-4C90-8A11-2F851612A6AB} - (no file)
O2 - BHO: (no name) - {0EB92F9F-21A4-4DC1-B32A-2C9251022881} - (no file)
O2 - BHO: (no name) - {0F7626B6-DD11-4372-A6D0-4D2BE56D99C8} - (no file)
O2 - BHO: (no name) - {13E8BEE2-15FC-497B-AB26-51910720C48A} - (no file)
O2 - BHO: (no name) - {15C4D96A-2962-4C0A-BC28-78FD21856D22} - (no file)
O2 - BHO: (no name) - {1625E5F6-3175-4F38-A579-C83E7A188137} - (no file)
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: (no name) - {27F5705D-F637-455A-ABC7-4680726ED348} - (no file)
O2 - BHO: e404 helper - {2C566C34-7D72-4DC1-9BBE-1121A76698F8} - C:\Program Files\Helper\1203535178.dll (file missing)
O2 - BHO: (no name) - {2F4D7F45-EF62-41AC-AAC8-41DBDD04EF8A} - (no file)
O2 - BHO: (no name) - {33622B27-FBBA-4E37-9557-C74FA186CFFA} - (no file)
O2 - BHO: (no name) - {35F12448-1E4B-46B7-B90B-0E34C3607F5A} - (no file)
O2 - BHO: (no name) - {3A37E129-0396-4600-B1CC-0FE30FBC489F} - (no file)
O2 - BHO: (no name) - {3B644363-9BC8-43F3-8608-540AC03075E4} - (no file)
O2 - BHO: (no name) - {3DB5B33B-B81A-4853-BF98-6E1CF8F00E93} - (no file)
O2 - BHO: (no name) - {3F761A39-6FF8-4F86-AFD8-D50C8ADD58E4} - (no file)
O2 - BHO: (no name) - {42CC1A75-8975-4D6D-BD76-F6E90F7FC34D} - (no file)
O2 - BHO: (no name) - {4489DC42-6019-4930-A30D-C2A7C1630890} - C:\WINDOWS\system32\awvvt.dll (file missing)
O2 - BHO: (no name) - {4C28375F-E14B-4485-9162-7E970BFE7A92} - (no file)
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: XML module - {500BCA15-57A7-4eaf-8143-8C619470B13D} - C:\WINDOWS\system32\msxml71.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5A82C81B-7674-41BA-A9ED-8269EC2897A2} - (no file)
O2 - BHO: (no name) - {5acd9a02-8253-487e-9d03-9861a9c984fa} - (no file)
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {5BB8B2CE-EF7C-4322-9682-4B7580EAEECA} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {6181DA21-A8C0-416B-BEB2-82345241E395} - (no file)
O2 - BHO: (no name) - {6189A6FF-F253-421B-A5D2-658A65C013F8} - (no file)
O2 - BHO: (no name) - {61B3751F-29CD-44AA-9361-0A8875FF284A} - (no file)
O2 - BHO: (no name) - {62B2D5BF-B4D7-4A4F-8C15-EA025DD631A1} - (no file)
O2 - BHO: (no name) - {677D13D3-0174-4EE2-BF01-DBBC494FBA30} - (no file)
O2 - BHO: (no name) - {68B314C4-5287-4223-AB27-7D2C83FEBFC3} - (no file)
O2 - BHO: (no name) - {6A11553E-7737-4DA8-8FFD-B6842B415702} - (no file)
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {772CE921-5EEC-403E-B7FB-6B1219C4C443} - (no file)
O2 - BHO: (no name) - {7830F65B-8C8F-492F-BC93-1AE10994AB04} - (no file)
O2 - BHO: (no name) - {7B54CD44-3B29-472B-81E5-C8C6E7B80200} - (no file)
O2 - BHO: (no name) - {7BA618B8-689A-4D4F-B3BE-7EBA555A9208} - (no file)
O2 - BHO: (no name) - {7CDBB414-DD09-46CD-BD12-0175893A2EC6} - (no file)
O2 - BHO: (no name) - {7D08256A-040A-48FF-A0DF-8920A78596A5} - (no file)
O2 - BHO: (no name) - {7DCFC470-D7D7-4B4F-B6BF-68703EBA54FD} - (no file)
O2 - BHO: (no name) - {81613A17-4439-40CA-8EA5-06258091FF50} - (no file)
O2 - BHO: (no name) - {894599F4-1AEE-46F4-9778-FB0AC6876949} - (no file)
O2 - BHO: (no name) - {9039A09D-5495-4EDD-93C5-402F3794FD03} - (no file)
O2 - BHO: (no name) - {92952A86-DBA3-4364-AF1D-F4F448F148F1} - (no file)
O2 - BHO: (no name) - {9821178C-4842-447C-84F9-608538075A82} - (no file)
O2 - BHO: (no name) - {9ABA823F-F2AB-45FF-AF66-93E89B555B0D} - (no file)
O2 - BHO: (no name) - {9AE0D324-3789-4A50-9514-BDF21CF34DE8} - (no file)
O2 - BHO: (no name) - {A572DACF-6701-4833-B50B-797927B19618} - (no file)
O2 - BHO: (no name) - {a657eda9-f306-440f-b574-9f1b22f2b0f2} - (no file)
O2 - BHO: (no name) - {AACA6A3B-D745-4651-80BE-90438D34EBD5} - (no file)
O2 - BHO: (no name) - {ACEB16ED-0B0B-452A-A396-633C0CC71F44} - (no file)
O2 - BHO: (no name) - {B2CDC49B-16E6-49AD-9448-5E1AF40A7D73} - (no file)
O2 - BHO: (no name) - {B2E65D44-74B7-4626-83ED-5C958336183B} - (no file)
O2 - BHO: (no name) - {B60B84A4-22CF-40D6-928C-392C5583A458} - (no file)
O2 - BHO: (no name) - {B790D21D-6EEE-4877-907D-735255A89474} - (no file)
O2 - BHO: (no name) - {B84D1E98-292B-4560-94BD-B2CF40DD2026} - (no file)
O2 - BHO: (no name) - {B86A588B-BDB9-489C-9CB9-F6262D5F4768} - (no file)
O2 - BHO: (no name) - {C2A1C5CB-C0EF-4689-9436-F62CCA1C5383} - C:\Program Files\NetProject\sbmdl.dll (file missing)
O2 - BHO: (no name) - {C55826CC-4D72-4C75-863F-F1A1066C88A0} - (no file)
O2 - BHO: (no name) - {C82C2C07-A56B-488B-8E46-C34A4C94B459} - (no file)
O2 - BHO: (no name) - {C87E2269-29F5-4D68-B99B-0B922A0ED69F} - (no file)
O2 - BHO: (no name) - {DF8B7CD5-4833-4A65-9220-91696705072C} - (no file)
O2 - BHO: (no name) - {E2724E3E-76AC-4A97-9C44-52A3C1272074} - (no file)
O2 - BHO: (no name) - {E3CF8D4D-0C3B-4C8A-8EA9-33C9FC3F0791} - (no file)
O2 - BHO: (no name) - {e93a9cd5-5b01-4167-aa68-9dcf89542d38} - (no file)
O2 - BHO: (no name) - {EB37309D-FB81-44ED-8116-3F3EFE234A2C} - (no file)
O2 - BHO: (no name) - {EC5C1B7E-BC05-4981-A641-FE9E50653044} - (no file)
O2 - BHO: (no name) - {F026338B-83D3-48A7-B13A-681A75BD4B6F} - (no file)
O2 - BHO: (no name) - {f077b3cd-62a8-4430-9091-d2388a083c4d} - (no file)
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O2 - BHO: (no name) - {F1CEF16B-D46A-44B7-94BF-F16B4B1C9A5D} - (no file)
O2 - BHO: (no name) - {F2A98D87-3F34-46FE-B1EA-B208EDD661D1} - (no file)
O2 - BHO: (no name) - {F98DC67A-3E99-4BDA-8A93-3EE7C9BE8319} - (no file)
O2 - BHO: (no name) - {FA3D40BA-094C-44E4-9E47-E85168C108A7} - (no file)
O2 - BHO: (no name) - {FB7BB763-CCC0-4B1B-9860-1053A0E85869} - (no file)
O2 - BHO: (no name) - {FE8B087F-0A9D-4B73-BBFC-2E6DA793298F} - (no file)
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [StatusClient 2.6] C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe /auto
O4 - HKLM\..\Run: [TomcatStartup 2.5] C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [EPSON Stylus Photo R220 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.EXE /P30 "EPSON Stylus Photo R220 Series" /O6 "USB001" /M "Stylus Photo R220"
O4 - HKLM\..\Run: [SM_IAN] C:\Program Files\AdvancedCleaner Free\ian_monitor.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [AcctMgr] "C:\Program Files\Common Files\Symantec Shared\coShared\CIM\1.5\AcctMgr.exe" /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [basicsmssmenu] "C:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe"
O4 - HKLM\..\Run: [SMrhct4dj0ee6r] C:\Program Files\rhct4dj0ee6r\rhct4dj0ee6r.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKLM\..\Policies\Explorer\Run: [some] C:\Program Files\NetProject\scit.exe
O4 - HKLM\..\Policies\Explorer\Run: [mfsc1D17pB] C:\Documents and Settings\All Users\Application Data\crcxunev\arsbylgt.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{3B492E2C-C32F-4281-ABAE-940BF87D6233}: NameServer = 85.255.116.70,85.255.112.168
O17 - HKLM\System\CCS\Services\Tcpip\..\{FCE39F30-8423-4C39-AB8B-509966C211D9}: NameServer = 85.255.116.70,85.255.112.168
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.70 85.255.112.168
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.116.70 85.255.112.168
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.70 85.255.112.168
O20 - Winlogon Notify: jkkkiij - C:\WINDOWS\
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Basics Service - Seagate Technology LLC - C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\hpzipm12.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
–
End of file - 19226 bytes
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:07:04 PM, on 9/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\All Users\Application Data\crcxunev\arsbylgt.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder\OrderReminder.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\coShared\CIM\1.5\AcctMgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\rhct4dj0ee6r\rhct4dj0ee6r.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\Program Files\Common Files\Symantec Shared\coShared\CW\1.5\CWDefScn.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Ventrilo\Ventrilo.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\pphcp4dj0ee6r.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com?o=1607
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {0306AFF7-50D1-4AF0-9693-44CE4054FBA4} - (no file)
O2 - BHO: (no name) - {03B902B1-9B25-4173-9468-56775C85A8D4} - (no file)
O2 - BHO: (no name) - {040B3337-2C30-49E9-A8BF-BB51F15B1ABD} - (no file)
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0ACF9D1F-7CB6-4A70-9CCD-8158CE6BBAA8} - (no file)
O2 - BHO: (no name) - {0E3F4BF4-44F1-4A85-B07F-A9440F3D28F6} - (no file)
O2 - BHO: (no name) - {0E473C05-20AE-4C90-8A11-2F851612A6AB} - (no file)
O2 - BHO: (no name) - {0EB92F9F-21A4-4DC1-B32A-2C9251022881} - (no file)
O2 - BHO: (no name) - {0F7626B6-DD11-4372-A6D0-4D2BE56D99C8} - (no file)
O2 - BHO: (no name) - {13E8BEE2-15FC-497B-AB26-51910720C48A} - (no file)
O2 - BHO: (no name) - {15C4D96A-2962-4C0A-BC28-78FD21856D22} - (no file)
O2 - BHO: (no name) - {1625E5F6-3175-4F38-A579-C83E7A188137} - (no file)
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: (no name) - {27F5705D-F637-455A-ABC7-4680726ED348} - (no file)
O2 - BHO: e404 helper - {2C566C34-7D72-4DC1-9BBE-1121A76698F8} - C:\Program Files\Helper\1203535178.dll (file missing)
O2 - BHO: (no name) - {2F4D7F45-EF62-41AC-AAC8-41DBDD04EF8A} - (no file)
O2 - BHO: (no name) - {33622B27-FBBA-4E37-9557-C74FA186CFFA} - (no file)
O2 - BHO: (no name) - {35F12448-1E4B-46B7-B90B-0E34C3607F5A} - (no file)
O2 - BHO: (no name) - {3A37E129-0396-4600-B1CC-0FE30FBC489F} - (no file)
O2 - BHO: (no name) - {3B644363-9BC8-43F3-8608-540AC03075E4} - (no file)
O2 - BHO: (no name) - {3DB5B33B-B81A-4853-BF98-6E1CF8F00E93} - (no file)
O2 - BHO: (no name) - {3F761A39-6FF8-4F86-AFD8-D50C8ADD58E4} - (no file)
O2 - BHO: (no name) - {42CC1A75-8975-4D6D-BD76-F6E90F7FC34D} - (no file)
O2 - BHO: (no name) - {4489DC42-6019-4930-A30D-C2A7C1630890} - C:\WINDOWS\system32\awvvt.dll (file missing)
O2 - BHO: (no name) - {4C28375F-E14B-4485-9162-7E970BFE7A92} - (no file)
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: XML module - {500BCA15-57A7-4eaf-8143-8C619470B13D} - C:\WINDOWS\system32\msxml71.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5A82C81B-7674-41BA-A9ED-8269EC2897A2} - (no file)
O2 - BHO: (no name) - {5acd9a02-8253-487e-9d03-9861a9c984fa} - (no file)
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {5BB8B2CE-EF7C-4322-9682-4B7580EAEECA} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {6181DA21-A8C0-416B-BEB2-82345241E395} - (no file)
O2 - BHO: (no name) - {6189A6FF-F253-421B-A5D2-658A65C013F8} - (no file)
O2 - BHO: (no name) - {61B3751F-29CD-44AA-9361-0A8875FF284A} - (no file)
O2 - BHO: (no name) - {62B2D5BF-B4D7-4A4F-8C15-EA025DD631A1} - (no file)
O2 - BHO: (no name) - {677D13D3-0174-4EE2-BF01-DBBC494FBA30} - (no file)
O2 - BHO: (no name) - {68B314C4-5287-4223-AB27-7D2C83FEBFC3} - (no file)
O2 - BHO: (no name) - {6A11553E-7737-4DA8-8FFD-B6842B415702} - (no file)
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {772CE921-5EEC-403E-B7FB-6B1219C4C443} - (no file)
O2 - BHO: (no name) - {7830F65B-8C8F-492F-BC93-1AE10994AB04} - (no file)
O2 - BHO: (no name) - {7B54CD44-3B29-472B-81E5-C8C6E7B80200} - (no file)
O2 - BHO: (no name) - {7BA618B8-689A-4D4F-B3BE-7EBA555A9208} - (no file)
O2 - BHO: (no name) - {7CDBB414-DD09-46CD-BD12-0175893A2EC6} - (no file)
O2 - BHO: (no name) - {7D08256A-040A-48FF-A0DF-8920A78596A5} - (no file)
O2 - BHO: (no name) - {7DCFC470-D7D7-4B4F-B6BF-68703EBA54FD} - (no file)
O2 - BHO: (no name) - {81613A17-4439-40CA-8EA5-06258091FF50} - (no file)
O2 - BHO: (no name) - {894599F4-1AEE-46F4-9778-FB0AC6876949} - (no file)
O2 - BHO: (no name) - {9039A09D-5495-4EDD-93C5-402F3794FD03} - (no file)
O2 - BHO: (no name) - {92952A86-DBA3-4364-AF1D-F4F448F148F1} - (no file)
O2 - BHO: (no name) - {9821178C-4842-447C-84F9-608538075A82} - (no file)
O2 - BHO: (no name) - {9ABA823F-F2AB-45FF-AF66-93E89B555B0D} - (no file)
O2 - BHO: (no name) - {9AE0D324-3789-4A50-9514-BDF21CF34DE8} - (no file)
O2 - BHO: (no name) - {A572DACF-6701-4833-B50B-797927B19618} - (no file)
O2 - BHO: (no name) - {a657eda9-f306-440f-b574-9f1b22f2b0f2} - (no file)
O2 - BHO: (no name) - {AACA6A3B-D745-4651-80BE-90438D34EBD5} - (no file)
O2 - BHO: (no name) - {ACEB16ED-0B0B-452A-A396-633C0CC71F44} - (no file)
O2 - BHO: (no name) - {B2CDC49B-16E6-49AD-9448-5E1AF40A7D73} - (no file)
O2 - BHO: (no name) - {B2E65D44-74B7-4626-83ED-5C958336183B} - (no file)
O2 - BHO: (no name) - {B60B84A4-22CF-40D6-928C-392C5583A458} - (no file)
O2 - BHO: (no name) - {B790D21D-6EEE-4877-907D-735255A89474} - (no file)
O2 - BHO: (no name) - {B84D1E98-292B-4560-94BD-B2CF40DD2026} - (no file)
O2 - BHO: (no name) - {B86A588B-BDB9-489C-9CB9-F6262D5F4768} - (no file)
O2 - BHO: (no name) - {C2A1C5CB-C0EF-4689-9436-F62CCA1C5383} - C:\Program Files\NetProject\sbmdl.dll (file missing)
O2 - BHO: (no name) - {C55826CC-4D72-4C75-863F-F1A1066C88A0} - (no file)
O2 - BHO: (no name) - {C82C2C07-A56B-488B-8E46-C34A4C94B459} - (no file)
O2 - BHO: (no name) - {C87E2269-29F5-4D68-B99B-0B922A0ED69F} - (no file)
O2 - BHO: (no name) - {DF8B7CD5-4833-4A65-9220-91696705072C} - (no file)
O2 - BHO: (no name) - {E2724E3E-76AC-4A97-9C44-52A3C1272074} - (no file)
O2 - BHO: (no name) - {E3CF8D4D-0C3B-4C8A-8EA9-33C9FC3F0791} - (no file)
O2 - BHO: (no name) - {e93a9cd5-5b01-4167-aa68-9dcf89542d38} - (no file)
O2 - BHO: (no name) - {EB37309D-FB81-44ED-8116-3F3EFE234A2C} - (no file)
O2 - BHO: (no name) - {EC5C1B7E-BC05-4981-A641-FE9E50653044} - (no file)
O2 - BHO: (no name) - {F026338B-83D3-48A7-B13A-681A75BD4B6F} - (no file)
O2 - BHO: (no name) - {f077b3cd-62a8-4430-9091-d2388a083c4d} - (no file)
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O2 - BHO: (no name) - {F1CEF16B-D46A-44B7-94BF-F16B4B1C9A5D} - (no file)
O2 - BHO: (no name) - {F2A98D87-3F34-46FE-B1EA-B208EDD661D1} - (no file)
O2 - BHO: (no name) - {F98DC67A-3E99-4BDA-8A93-3EE7C9BE8319} - (no file)
O2 - BHO: (no name) - {FA3D40BA-094C-44E4-9E47-E85168C108A7} - (no file)
O2 - BHO: (no name) - {FB7BB763-CCC0-4B1B-9860-1053A0E85869} - (no file)
O2 - BHO: (no name) - {FE8B087F-0A9D-4B73-BBFC-2E6DA793298F} - (no file)
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [StatusClient 2.6] C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe /auto
O4 - HKLM\..\Run: [TomcatStartup 2.5] C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [EPSON Stylus Photo R220 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.EXE /P30 "EPSON Stylus Photo R220 Series" /O6 "USB001" /M "Stylus Photo R220"
O4 - HKLM\..\Run: [SM_IAN] C:\Program Files\AdvancedCleaner Free\ian_monitor.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [AcctMgr] "C:\Program Files\Common Files\Symantec Shared\coShared\CIM\1.5\AcctMgr.exe" /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [basicsmssmenu] "C:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe"
O4 - HKLM\..\Run: [SMrhct4dj0ee6r] C:\Program Files\rhct4dj0ee6r\rhct4dj0ee6r.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKLM\..\Policies\Explorer\Run: [some] C:\Program Files\NetProject\scit.exe
O4 - HKLM\..\Policies\Explorer\Run: [mfsc1D17pB] C:\Documents and Settings\All Users\Application Data\crcxunev\arsbylgt.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{3B492E2C-C32F-4281-ABAE-940BF87D6233}: NameServer = 85.255.116.70,85.255.112.168
O17 - HKLM\System\CCS\Services\Tcpip\..\{FCE39F30-8423-4C39-AB8B-509966C211D9}: NameServer = 85.255.116.70,85.255.112.168
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.70 85.255.112.168
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.116.70 85.255.112.168
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.70 85.255.112.168
O20 - Winlogon Notify: jkkkiij - C:\WINDOWS\
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Basics Service - Seagate Technology LLC - C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\hpzipm12.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
–
End of file - 19226 bytes