Spyware / Malware / Virus Removal

[Closed] Erratic internet connection... slow computer

5 min read

Looking for the outcome? Ask AI

centaurcoach Topic Starter

Post #1October 19, 2008, 3:17 PM UTC

At times my cable connection is down for no known reason. Usually this occurs after a period of inactivity eg I fall asleep and in the morning no connectivity. Restart computer and unplug modem… did not work today. Comcast's desktop doctor failed to ferret out the problem… including disabling firewall. But then restoring firewall McAfee suddenly restored connectivity. It just seems strange to me.

PS… I lost connectivity again just as I tried to post this log.
Got it back in the middle of a Malwarebytes scan… but no objects detected.
Could it be my modem?

Would someone have a look at my Hijackthis log?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:42:24 AM, on 10/19/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\McAfee\MBK\MBackMonitor.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\WINDOWS\system32\atiptaxx.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\LVCOMSX.EXE
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\LAUNCH~1\launchit.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
C:\Program Files\Eraser\eraser.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\eFax Messenger 4.1\J2GTray.exe
C:\Program Files\Network Associates\PGPNT\PGPTray.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\system32\BRMFRSMG.EXE
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
c:\PROGRA~1\mcafee\msc\mcshell.exe
C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
C:\WINDOWS\hh.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.wikipedia.org/wiki/Main_page
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.wikipedia.org/wiki/Main_Page
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [McAfee Backup] C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe
O4 - HKLM\..\Run: [MBkLogOnHook] C:\Program Files\McAfee\MBK\LogOnHook.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LaunchIt NOW!] C:\PROGRA~1\LAUNCH~1\launchit.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: eFax 4.1.lnk = C:\Program Files\eFax Messenger 4.1\J2GTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: PGPtray.lnk = C:\Program Files\Network Associates\PGPNT\PGPTray.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\WINDOWS\system32\shdocvw.dll (HKCU)
O9 - Extra 'Tools' menuitem: Show Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\WINDOWS\system32\shdocvw.dll (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O16 - DPF: {BEB82CC6-09F3-43EA-BEB1-97188E21035D} (FootPedalCtl Class) - http://precyse2.mttest.com/Shared/footpedal.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - http://www.adobe.com/products/acrobat/nos/gp.cab
O18 - Protocol: bw+0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: intu-help-qb1 - {9B0F96C7-2E4B-433E-ABF3-043BA1B54AE3} - C:\Program Files\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll
O18 - Protocol: offline-8876480 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Advanced WindowsCare Boost Service (AwcService) - IObit - C:\Program Files\IObit\Advanced WindowsCare 3 Beta\awcservice.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Sony SPTI Service for DVE (ICDSPTSV) - Sony Corporation - C:\WINDOWS\system32\IcdSptSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

–
End of file - 24990 bytes

centaurcoach

Post #2October 20, 2008, 3:37 AM UTC

Update: I called Comcast and got a message apologizing for a temporary loss of service in my area. But let me know if you recognize anything unusual in the HiJackThis log. Thanks. Jeff

Tomk

Post #3October 24, 2008, 4:59 AM UTC

centaurcoach,

All I'm seeing is you need to update your Java.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Updating Java:

Download the latest version of Java Runtime Environment (JRE) 6 Update 7.
Scroll down to where it says "The Java SE Runtime Environment (JRE) allows end-users to run Java applications".
Click the "Download" button to the right.
In the pull down menu next to Platform select Windows
Check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement"
Click Continue
Click on the link to download Windows Offline Installation and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u7-windows-i586-p.exe to install the newest version.

Now to Clean out the Java cache:

Go into the Control Panel and double-click the Java Icon. [external image: Posted Image]

Under Temporary Internet Files, click the Settings… button
click the Delete Files button.
There are three options in the window to clear the cache - Leave all 3 Checked
- Downloaded Applets
  Downloaded Applications
  Other Files
Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Temporary Files Settings
Click OK to leave the Java Control Panel.

Then

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply along with a new HijackThis log.

centaurcoach

Post #4October 27, 2008, 12:08 AM UTC

I can't seem to save the Kaspersky scan report as a txt or as html. It simply doesn't create the specified file. I have to repeat it.

Here's the HiJackThis file.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:49:12 PM, on 10/26/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\McAfee\MBK\MBackMonitor.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\LAUNCH~1\launchit.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
C:\Program Files\Eraser\eraser.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\eFax Messenger 4.1\J2GTray.exe
C:\Program Files\Network Associates\PGPNT\PGPTray.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\BRMFRSMG.EXE
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Program Files\uTorrent\uTorrent.exe
c:\PROGRA~1\mcafee\msc\mcshell.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\SONY\Digital Voice Editor 2\DVEdit.exe
C:\WINDOWS\System32\NOTEPAD.EXE
C:\PROGRA~1\FOXITS~1\FOXITR~1\FOXITR~1.EXE
C:\Program Files\Deneba\Canvas 8\canvas8.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.wikipedia.org/wiki/Main_page
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.wikipedia.org/wiki/Main_Page
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [McAfee Backup] C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe
O4 - HKLM\..\Run: [MBkLogOnHook] C:\Program Files\McAfee\MBK\LogOnHook.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LaunchIt NOW!] C:\PROGRA~1\LAUNCH~1\launchit.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: eFax 4.1.lnk = C:\Program Files\eFax Messenger 4.1\J2GTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: PGPtray.lnk = C:\Program Files\Network Associates\PGPNT\PGPTray.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\WINDOWS\system32\shdocvw.dll (HKCU)
O9 - Extra 'Tools' menuitem: Show Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\WINDOWS\system32\shdocvw.dll (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-03.sun.com/s/ESD5/JSCDL/jdk…ows-i586-jc.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O16 - DPF: {BEB82CC6-09F3-43EA-BEB1-97188E21035D} (FootPedalCtl Class) - http://precyse2.mttest.com/Shared/footpedal.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - http://www.adobe.com/products/acrobat/nos/gp.cab
O18 - Protocol: bw+0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: intu-help-qb1 - {9B0F96C7-2E4B-433E-ABF3-043BA1B54AE3} - C:\Program Files\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll
O18 - Protocol: offline-8876480 - {CE8E021F-1D22-42DE-A1DE-F238E5F7B8CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Advanced WindowsCare Boost Service (AwcService) - IObit - C:\Program Files\IObit\Advanced WindowsCare 3 Beta\awcservice.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Sony SPTI Service for DVE (ICDSPTSV) - Sony Corporation - C:\WINDOWS\system32\IcdSptSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

–
End of file - 25645 bytes

Tomk

Post #5October 27, 2008, 12:16 AM UTC

centaurcoach,

Did it show anything?

If you can't get it to work, run this one instead:

I need you to run the following scan: Eset Online Scanner

Place a check mark in the box YES, I accept the Terms Of Use
Click the Start button.
Now click the Install button.
Click Start. The scanner engine will initialize and update.
Do Not place a check mark in the box beside Remove found threats.
Click the Scan button. The scan will now run, please be patient.
When the scan finishes click the Details tab.
Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.

centaurcoach

Post #6October 28, 2008, 1:14 AM UTC

# version=4 # OnlineScanner.ocx=1.0.0.635 # OnlineScannerDLLA.dll=1, 0, 0, 79 # OnlineScannerDLLW.dll=1, 0, 0, 78 # OnlineScannerUninstaller.exe=1, 0, 0, 49 # vers_standard_module=3557 (20081026) # vers_arch_module=1.064 (20080214) # vers_adv_heur_module=1.064 (20070717) # EOSSerial=19ed4f187f2e6e468fa8e5e7807d9e22 # end=finished # remove_checked=false # unwanted_checked=false # utc_time=2008-10-27 06:22:05 # local_time=2008-10-27 02:22:05 (-0500, Eastern Daylight Time) # country="United States" # osver=5.1.2600 NT Service Pack 3 # scanned=692097 # found=3 # scan_time=58704 D:\downloads\Commune-ications\Install_AIM.exe Win32/Adware.WBug.A application 954B1F29D2963F04FEF9E652967EBC17 D:\downloads\Commune-ications\Install_AIM.exe »WISE »WxBug.EXE Win32/Adware.WBug.A application 00000000000000000000000000000000 D:\downloads\Commune-ications\Install_AIM.exe »WISE »WxBug.EXE »WISE »MiniBugTransporter.dll Win32/Adware.WBug.A application 00000000000000000000000000000000

Tomk

Post #7October 28, 2008, 1:26 AM UTC

centaurcoach,

OK. I'm not sure if those are legitimate infections or a false positive. I'd like to run another tool.

Disable resident protections (Antivirus…); you'll re-enable them after the scan

Download Lop S&D < here

Double-click Lop S&D.exe
Choose the language, then choose Option 1 (Search)
Wait till the end of the scan
Post the log which is created: (%SystemDrive%\lopR.txt)

centaurcoach

Post #8October 28, 2008, 4:06 AM UTC

——————–\\ Lop S&D 4.2.4-8 XP/Vista

Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Intel® Celeron® CPU 2.00GHz )
BIOS : Version 1.00
USER : Jeff Heilman ( Administrator )
BOOT : Normal boot
Antivirus : McAfee VirusScan (Not Activated)
Firewall : McAfee Personal Firewall (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:149 Go (Free:32 Go)
D:\ (Local Disk) - NTFS - Total:149 Go (Free:4 Go)
E:\ (CD or DVD)
F:\ (CD or DVD)
G:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 27-10-2008|09:15 )
Option : [1] ( Mon 10/27/2008|22:15 )

——————–\\ Listing folders in APPLIC~1

[12/08/2007|03:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ {9E97B640-FCFE-4900-B18A-72FAE662D6B7}
[07/01/2008|08:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Adobe
[12/08/2007|10:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Anonymizer
[12/08/2007|10:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ AOL
[12/08/2007|11:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ AOL Downloads
[12/08/2007|11:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ AOL OCP
[12/10/2007|12:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple
[12/08/2007|11:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple Computer
[07/03/2008|10:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Comcast
[03/29/2008|12:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ COMMON FILES
[12/08/2007|11:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ CyberLink
[12/08/2007|11:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ DVD Shrink
[12/08/2007|11:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ eFax Messenger 4.1 Setup
[12/10/2007|10:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Geek Squad
[12/10/2007|11:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Google
[10/26/2008|02:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Google Updater
[12/08/2007|11:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ HP
[12/08/2007|11:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ InstallShield
[03/31/2008|08:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Intuit
[09/22/2008|10:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Lavasoft
[09/22/2008|06:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Malwarebytes
[09/22/2008|12:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ McAfee
[12/08/2007|02:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ McAfee.com
[09/22/2008|12:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Microsoft
[12/08/2007|02:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Microsoft Help
[12/08/2007|02:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ NCH Swift Sound
[12/08/2007|02:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Nero
[12/08/2007|02:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Paragon CD-ROM Emulator
[02/18/2008|03:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ PAS
[12/08/2007|02:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Pure Networks
[12/08/2007|02:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Raxco
[04/13/2008|11:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ RiyazStudio
[12/08/2007|03:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ ScanSoft
[12/08/2007|03:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SecTaskMan
[09/22/2008|07:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Simply Super Software
[12/08/2007|03:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Skype
[10/12/2008|11:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Spybot - Search & Destroy
[12/08/2007|03:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Support.com
[06/13/2008|07:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SupportSoft
[10/18/2008|06:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ TEMP
[12/08/2007|03:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Ulead Systems
[12/08/2007|03:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Viewpoint
[12/08/2007|03:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Winamp Toolbar
[12/08/2007|03:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Windows Genuine Advantage
[12/08/2007|03:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ yahoo!

[12/08/2007|03:43] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Microsoft

[06/22/2008|09:05] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Adobe
[07/01/2008|07:56] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ AdobeUM
[12/09/2007|06:29] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Ahead
[12/09/2007|06:30] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Aim
[12/09/2007|06:30] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ AOL
[12/09/2007|06:30] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Apple Computer
[12/09/2007|06:30] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Azureus
[12/09/2007|06:30] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Cakewalk
[12/09/2007|06:30] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ CopyToDvd
[12/09/2007|06:30] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ CyberLink
[12/09/2007|06:30] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Deneba
[09/30/2008|09:00] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ dvdcss
[12/09/2007|06:30] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ EndNote
[12/09/2007|06:30] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ FarStone
[12/09/2007|06:30] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ FotoWire
[12/09/2007|06:30] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ GemiScorp
[12/09/2007|06:30] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Google
[12/09/2007|06:30] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Help
[12/09/2007|06:31] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ HP
[12/09/2007|06:31] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Identities
[12/09/2007|06:31] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Image Zone Express
[03/29/2008|10:33] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ InstallShield
[04/13/2008|03:03] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Intuit
[04/05/2008|02:07] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ IObit
[12/09/2007|06:31] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ iPodder
[04/06/2008|12:10] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Lavasoft
[12/09/2007|06:31] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Leadertech
[12/09/2007|06:31] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Logitech
[12/09/2007|06:31] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Macromedia
[09/22/2008|06:58] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Malwarebytes
[12/09/2007|06:32] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ ManyOne
[09/22/2008|12:10] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ McAfee
[12/09/2007|06:32] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Media Player Classic
[10/17/2008|10:30] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Microsoft
[12/09/2007|06:33] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Miranda
[08/29/2008|08:56] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Mozilla
[12/09/2007|09:56] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ NCH Swift Sound
[12/09/2007|09:56] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Nero
[12/09/2007|09:56] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Nvu
[12/09/2007|09:57] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Offline Explorer
[04/28/2008|01:48] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ OpenOffice.org2
[12/09/2007|09:57] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Opera
[02/18/2008|03:22] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Palo Alto Software
[12/09/2007|09:57] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Pamela
[12/09/2007|09:57] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ PGP
[12/09/2007|09:57] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Qualcomm
[12/09/2007|10:47] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Real
[12/09/2007|10:51] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ RecordPad
[12/09/2007|10:56] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Roxio
[12/09/2007|10:56] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ ScanSoft
[12/09/2007|10:56] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Screaming Bee
[09/20/2008|06:45] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Simply Super Software
[12/09/2007|10:57] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Skype
[12/09/2007|10:57] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Skype(2)
[12/09/2007|10:57] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Spell Catcher Plus
[12/09/2007|10:57] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ stickies
[12/09/2007|10:57] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Sun
[12/09/2007|10:58] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Talkback
[12/09/2007|10:58] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ The Labyrinth Plus! Edition
[12/10/2007|01:29] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Thunderbird
[12/10/2007|01:29] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ U3
[12/10/2007|01:29] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Ulead Systems
[10/27/2008|10:15] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ uTorrent
[12/10/2007|01:31] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ vlc
[02/20/2008|08:49] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ WinRAR
[12/10/2007|01:32] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Yahoo!
[12/10/2007|01:32] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ Yahoo! Messenger
[12/10/2007|01:32] C:\DOCUME~1\JEFFHE~1\APPLIC~1\ You've Got Pictures Screensaver

[12/08/2007|03:43] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Adobe
[12/08/2007|03:43] C:\DOCUME~1\LOCALS~1\APPLIC~1\ AdobeUM
[12/08/2007|03:43] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Macromedia
[12/08/2007|03:43] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Microsoft
[12/08/2007|03:43] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Yahoo!

[05/08/2008|03:43] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Adobe
[04/13/2008|02:51] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Intuit
[09/19/2008|07:49] C:\DOCUME~1\NETWOR~1\APPLIC~1\ McAfee
[12/08/2007|03:44] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Microsoft
[12/08/2007|03:44] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Symantec

——————–\\ Scheduled Tasks located in C:\WINDOWS\Tasks

[10/27/2008 08:41 PM][–ah—–] C:\WINDOWS\tasks\MP Scheduled Scan.job
[08/03/2008 09:56 AM][–a——] C:\WINDOWS\tasks\McQcTask.job
[04/05/2008 12:03 PM][–ah—–] C:\WINDOWS\tasks\SA.DAT
[12/10/2007 10:36 AM][–a——] C:\WINDOWS\tasks\SCHEDLGU.TXT
[03/15/2008 01:00 AM][–a——] C:\WINDOWS\tasks\McDefragTask.job
[10/30/2004 10:03 AM][–a——] C:\WINDOWS\tasks\dfrg.job
[03/22/2008 12:53 PM][–a——] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[03/31/2003 08:00 AM][-r-h—–] C:\WINDOWS\tasks\desktop.ini

——————–\\ Listing Folders in C:\Program Files

[12/07/2007|10:05] C:\Program Files\ 321Studios
[12/07/2007|10:05] C:\Program Files\ 3D MP3 Sound Recorder
[12/07/2007|10:05] C:\Program Files\ AC3Filter
[04/28/2008|11:31] C:\Program Files\ Acoustica Mixcraft
[12/07/2007|10:06] C:\Program Files\ activePDF
[12/07/2007|10:08] C:\Program Files\ Admiresoft
[12/07/2007|10:17] C:\Program Files\ Adobe
[12/07/2007|10:17] C:\Program Files\ Advanced StartUp Manager
[12/07/2007|10:17] C:\Program Files\ Agnitum
[12/07/2007|10:17] C:\Program Files\ Ahead
[12/07/2007|10:18] C:\Program Files\ AIM
[12/07/2007|10:18] C:\Program Files\ AliveMedia
[06/15/2008|08:50] C:\Program Files\ Amazon
[12/07/2007|10:18] C:\Program Files\ Anonymizer
[12/07/2007|10:18] C:\Program Files\ AOD
[12/10/2007|12:49] C:\Program Files\ Apple Software Update
[12/07/2007|10:18] C:\Program Files\ Arturia
[12/07/2007|10:18] C:\Program Files\ ATI Technologies
[12/07/2007|10:19] C:\Program Files\ Audacity
[12/07/2007|10:20] C:\Program Files\ AVI DivX MPEG to DVD Converter & Burner Pro
[09/03/2008|05:57] C:\Program Files\ AVI MPEG RM WMV Joiner
[12/07/2007|10:20] C:\Program Files\ AVIcodec
[12/07/2007|10:20] C:\Program Files\ AvRack
[12/07/2007|10:20] C:\Program Files\ AWS
[12/07/2007|10:20] C:\Program Files\ Azureus
[12/07/2007|10:20] C:\Program Files\ BigFix
[12/07/2007|10:20] C:\Program Files\ BitComet
[12/07/2007|10:20] C:\Program Files\ Cakewalk
[12/18/2007|01:07] C:\Program Files\ CCleaner
[05/16/2008|07:32] C:\Program Files\ Citrix
[12/07/2007|10:20] C:\Program Files\ CodeStuff
[12/07/2007|10:20] C:\Program Files\ Color Wheel Pro
[06/13/2008|07:02] C:\Program Files\ Comcast
[10/25/2008|08:03] C:\Program Files\ Common Files
[12/08/2007|10:44] C:\Program Files\ ComPlus Applications
[12/08/2007|10:44] C:\Program Files\ Creativity Software
[12/08/2007|10:44] C:\Program Files\ Cucusoft
[12/08/2007|10:44] C:\Program Files\ CyberLink
[03/25/2008|09:23] C:\Program Files\ Data Converter
[12/08/2007|10:44] C:\Program Files\ Deneba
[12/08/2007|10:48] C:\Program Files\ Deskshare
[12/08/2007|10:48] C:\Program Files\ DivX
[12/08/2007|10:48] C:\Program Files\ DivX_311alpha
[12/08/2007|10:49] C:\Program Files\ eFax Messenger 4.1
[10/27/2008|08:20] C:\Program Files\ eMule
[12/08/2007|05:42] C:\Program Files\ EndNote 9
[10/25/2008|08:06] C:\Program Files\ Eraser
[09/22/2008|04:11] C:\Program Files\ ERUNT
[10/27/2008|02:22] C:\Program Files\ EsetOnlineScanner
[12/08/2007|05:42] C:\Program Files\ Evolve Developmental Coaching
[12/08/2007|05:42] C:\Program Files\ Evrsoft
[12/08/2007|05:43] C:\Program Files\ EZClaim
[12/08/2007|05:43] C:\Program Files\ FadeToBlack
[12/08/2007|05:43] C:\Program Files\ FarStone
[12/08/2007|05:43] C:\Program Files\ Finale NotePad 2006
[12/08/2007|05:43] C:\Program Files\ FlashTray Pro
[04/17/2008|10:53] C:\Program Files\ Foxit Software
[09/26/2008|11:53] C:\Program Files\ Freecorder
[12/08/2007|05:53] C:\Program Files\ GiPo@Utilities
[09/14/2008|12:41] C:\Program Files\ Google
[12/08/2007|05:55] C:\Program Files\ GustoSoft
[12/08/2007|05:55] C:\Program Files\ HiDownload
[12/08/2007|05:55] C:\Program Files\ HotRecorder
[12/08/2007|06:03] C:\Program Files\ HP
[12/08/2007|06:04] C:\Program Files\ Infogrames
[06/13/2008|06:57] C:\Program Files\ InstallShield Installation Information
[09/29/2008|08:49] C:\Program Files\ InterActual
[10/15/2008|10:05] C:\Program Files\ Internet Explorer
[03/29/2008|12:31] C:\Program Files\ Intuit
[03/20/2008|11:02] C:\Program Files\ IObit
[03/01/2008|03:41] C:\Program Files\ iPod
[12/08/2007|07:11] C:\Program Files\ iPodder
[12/08/2007|07:11] C:\Program Files\ IrfanView
[12/08/2007|07:17] C:\Program Files\ ItsDeductible2005
[03/29/2008|10:39] C:\Program Files\ ItsDeductible2006
[12/08/2007|07:20] C:\Program Files\ ItsDeductibleEX
[03/01/2008|03:41] C:\Program Files\ iTunes
[12/08/2007|07:26] C:\Program Files\ iTunes(2)
[10/25/2008|08:38] C:\Program Files\ Java
[12/08/2007|08:26] C:\Program Files\ Jufsoft
[12/08/2007|08:27] C:\Program Files\ Juice
[12/08/2007|08:27] C:\Program Files\ LaunchIt NOW!
[09/22/2008|10:43] C:\Program Files\ Lavasoft
[12/08/2007|08:27] C:\Program Files\ LG Software Innovations
[12/08/2007|08:29] C:\Program Files\ Logitech
[12/08/2007|08:31] C:\Program Files\ MagicDVDRipper
[07/05/2008|12:59] C:\Program Files\ MagicISO
[12/08/2007|08:31] C:\Program Files\ Magnus Brading
[10/18/2008|06:55] C:\Program Files\ Malwarebytes' Anti-Malware
[12/08/2007|08:31] C:\Program Files\ Mandala 4
[12/08/2007|08:31] C:\Program Files\ Max DVD to AVI Converter 4.0 trial
[09/13/2008|08:00] C:\Program Files\ McAfee
[12/08/2007|08:34] C:\Program Files\ McAfee.com
[12/08/2007|08:35] C:\Program Files\ Media Player Classic
[10/10/2008|11:29] C:\Program Files\ Messenger
[12/08/2007|08:35] C:\Program Files\ Microsoft Bootvis
[12/08/2007|08:35] C:\Program Files\ microsoft frontpage
[10/17/2008|10:25] C:\Program Files\ Microsoft Office
[12/08/2007|08:42] C:\Program Files\ Microsoft Plus!
[12/08/2007|08:42] C:\Program Files\ Microsoft Windows Script
[10/06/2008|11:09] C:\Program Files\ MindHabits
[12/08/2007|08:42] C:\Program Files\ Miranda IM
[10/10/2008|11:15] C:\Program Files\ Movie Maker
[10/27/2008|09:19] C:\Program Files\ Mozilla Firefox
[10/27/2008|09:12] C:\Program Files\ Mozilla Thunderbird
[12/08/2007|08:44] C:\Program Files\ mozilla.org
[12/10/2007|01:42] C:\Program Files\ MSBuild
[12/08/2007|08:45] C:\Program Files\ MSI
[10/10/2008|11:15] C:\Program Files\ msn
[12/08/2007|08:45] C:\Program Files\ MSN Gaming Zone
[12/08/2007|08:45] C:\Program Files\ MSXML 4.0
[12/10/2007|01:35] C:\Program Files\ MSXML 6.0
[12/08/2007|08:45] C:\Program Files\ MtStudio
[12/08/2007|08:46] C:\Program Files\ NCH Swift Sound
[12/17/2007|11:21] C:\Program Files\ Nero
[10/10/2008|11:09] C:\Program Files\ NetMeeting
[12/08/2007|09:04] C:\Program Files\ Network Associates
[12/08/2007|09:04] C:\Program Files\ NLP Coach 2005
[12/08/2007|09:05] C:\Program Files\ Nvu
[12/08/2007|09:05] C:\Program Files\ Offline Explorer Pro
[12/08/2007|09:05] C:\Program Files\ Online Services
[12/08/2007|09:05] C:\Program Files\ Ontrack
[04/01/2008|10:55] C:\Program Files\ OpenOffice.org 2.2
[04/28/2008|02:04] C:\Program Files\ OpenOffice.org 2.4
[10/10/2008|11:09] C:\Program Files\ Outlook Express
[12/08/2007|09:14] C:\Program Files\ Palm
[02/18/2008|03:11] C:\Program Files\ Palo Alto Software
[12/08/2007|09:14] C:\Program Files\ Pamela
[12/08/2007|09:14] C:\Program Files\ Paragon Software
[12/08/2007|09:14] C:\Program Files\ PCPitstop
[07/05/2008|01:23] C:\Program Files\ PowerISO
[12/08/2007|09:14] C:\Program Files\ Pure Networks
[12/08/2007|09:14] C:\Program Files\ Qualcomm
[12/08/2007|09:15] C:\Program Files\ QuickTime
[03/01/2008|03:37] C:\Program Files\ QuickTime Alternative
[12/08/2007|09:17] C:\Program Files\ Rallentando Software
[12/08/2007|09:17] C:\Program Files\ RAXCO
[12/08/2007|09:19] C:\Program Files\ Real
[12/10/2007|01:41] C:\Program Files\ Reference Assemblies
[09/22/2008|07:26] C:\Program Files\ RegistryFix
[04/13/2008|12:37] C:\Program Files\ RiyazStudio
[05/10/2008|07:44] C:\Program Files\ Safer Networking
[12/08/2007|09:31] C:\Program Files\ ScanSoft
[05/16/2008|07:31] C:\Program Files\ Screaming Bee
[12/08/2007|09:37] C:\Program Files\ Seagate Software
[12/08/2007|09:37] C:\Program Files\ Security Task Manager
[12/08/2007|09:37] C:\Program Files\ Serials3k
[12/08/2007|09:38] C:\Program Files\ Setup Files
[12/08/2007|09:39] C:\Program Files\ Sibelius Software
[12/08/2007|09:39] C:\Program Files\ Sierra Imaging
[12/08/2007|09:40] C:\Program Files\ SiSoftware
[12/08/2007|09:40] C:\Program Files\ Skype
[12/08/2007|09:41] C:\Program Files\ SONY
[12/08/2007|09:41] C:\Program Files\ SpaceSynthesizer
[12/08/2007|09:41] C:\Program Files\ Spell Catcher Plus
[10/12/2008|09:33] C:\Program Files\ Spybot - Search & Destroy
[10/18/2008|06:50] C:\Program Files\ SpywareBlaster
[10/25/2008|08:43] C:\Program Files\ SpywareGuard
[12/08/2007|09:42] C:\Program Files\ Starcraft
[12/08/2007|09:48] C:\Program Files\ Steinberg
[12/08/2007|09:48] C:\Program Files\ Super DVD Ripper
[06/13/2008|06:59] C:\Program Files\ support.com
[09/08/2008|07:12] C:\Program Files\ Symantec
[12/08/2007|09:48] C:\Program Files\ TablEdit
[07/06/2008|12:51] C:\Program Files\ TagRename
[06/13/2008|06:57] C:\Program Files\ Terayon
[12/08/2007|09:48] C:\Program Files\ The Anthony Robbins Companies
[05/16/2008|07:34] C:\Program Files\ The Weather Channel FW
[12/08/2007|09:49] C:\Program Files\ TLI
[09/22/2008|02:39] C:\Program Files\ Trend Micro
[12/08/2007|09:49] C:\Program Files\ TryMedia
[04/13/2008|02:58] C:\Program Files\ TurboTax
[12/08/2007|09:58] C:\Program Files\ TypingMaster
[12/08/2007|09:58] C:\Program Files\ Ubi Soft
[12/08/2007|09:59] C:\Program Files\ Ulead Systems
[12/08/2007|10:00] C:\Program Files\ Uninstall Information
[09/25/2008|09:44] C:\Program Files\ uTorrent
[12/08/2007|10:00] C:\Program Files\ Videodesk
[12/08/2007|10:00] C:\Program Files\ VideoLAN
[12/08/2007|10:04] C:\Program Files\ vso
[12/08/2007|10:06] C:\Program Files\ Winamp
[12/08/2007|10:06] C:\Program Files\ Winamp Toolbar
[12/08/2007|10:06] C:\Program Files\ WinAVI DVD Copy
[09/22/2008|12:10] C:\Program Files\ Windows Defender
[12/10/2007|01:33] C:\Program Files\ Windows Media Connect 2
[10/10/2008|11:09] C:\Program Files\ Windows Media Player
[10/10/2008|11:09] C:\Program Files\ Windows NT
[12/10/2007|10:38] C:\Program Files\ WindowsUpdate
[12/08/2007|10:07] C:\Program Files\ WinLemm
[02/24/2008|12:32] C:\Program Files\ WinRAR
[12/08/2007|10:07] C:\Program Files\ xerox
[09/22/2008|07:26] C:\Program Files\ XoftSpySE
[12/10/2007|10:33] C:\Program Files\ Yahoo!
[12/08/2007|10:11] C:\Program Files\ Zero G Registry
[12/08/2007|10:11] C:\Program Files\ Zone Labs

——————–\\ Listing Folders in C:\Program Files\Common Files

[07/01/2008|08:02] C:\Program Files\Common Files\ Adobe
[12/07/2007|10:21] C:\Program Files\Common Files\ Agnitum Shared
[04/13/2008|03:00] C:\Program Files\Common Files\ AnswerWorks 4.0
[03/30/2008|01:32] C:\Program Files\Common Files\ AnswerWorks 5.0
[12/07/2007|10:21] C:\Program Files\Common Files\ AOL
[12/10/2007|01:06] C:\Program Files\Common Files\ Apple
[10/17/2008|10:26] C:\Program Files\Common Files\ Designer
[12/07/2007|10:21] C:\Program Files\Common Files\ DeskShare Shared
[12/07/2007|10:21] C:\Program Files\Common Files\ FotoWire
[12/07/2007|10:21] C:\Program Files\Common Files\ Gibinsoft Shared
[12/07/2007|10:21] C:\Program Files\Common Files\ HP
[12/07/2007|10:22] C:\Program Files\Common Files\ InstallShield
[03/29/2008|12:33] C:\Program Files\Common Files\ Intuit
[12/08/2007|10:24] C:\Program Files\Common Files\ Logitech
[08/03/2008|09:28] C:\Program Files\Common Files\ McAfee
[10/17/2008|10:26] C:\Program Files\Common Files\ Microsoft Shared
[12/08/2007|10:27] C:\Program Files\Common Files\ mozilla.org
[12/08/2007|10:28] C:\Program Files\Common Files\ MSSoap
[12/17/2007|11:23] C:\Program Files\Common Files\ Nero
[12/08/2007|10:34] C:\Program Files\Common Files\ NSV
[12/08/2007|10:34] C:\Program Files\Common Files\ Nullsoft
[12/08/2007|10:34] C:\Program Files\Common Files\ ODBC
[05/16/2008|07:24] C:\Program Files\Common Files\ Palo Alto Software
[12/08/2007|10:34] C:\Program Files\Common Files\ Raxco
[12/08/2007|10:35] C:\Program Files\Common Files\ Real
[12/08/2007|10:35] C:\Program Files\Common Files\ Risxtd
[12/10/2007|11:18] C:\Program Files\Common Files\ Roxio Shared
[12/08/2007|10:40] C:\Program Files\Common Files\ Scansoft Shared
[12/08/2007|10:40] C:\Program Files\Common Files\ Screaming Bee
[12/08/2007|10:40] C:\Program Files\Common Files\ Services
[12/08/2007|10:40] C:\Program Files\Common Files\ Skype
[12/08/2007|10:40] C:\Program Files\Common Files\ SpeechEngines
[06/29/2008|04:47] C:\Program Files\Common Files\ SupportSoft
[12/08/2007|10:43] C:\Program Files\Common Files\ SWF Studio
[09/08/2008|07:12] C:\Program Files\Common Files\ Symantec Shared
[10/10/2008|11:09] C:\Program Files\Common Files\ System
[12/08/2007|10:43] C:\Program Files\Common Files\ Ulead Systems
[09/22/2008|10:42] C:\Program Files\Common Files\ Wise Installation Wizard
[12/08/2007|10:44] C:\Program Files\Common Files\ xing shared

——————–\\ Process

( 59 Processes )

… OK !

——————–\\ Searching with S_Lop

No Lop folder found !

——————–\\ Searching for Lop Files - Folders

No Lop folder found !

——————–\\ Searching within the Registry

….. OK !

——————–\\ Checking the Hosts file

Hosts file CLEAN

——————–\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-27 22:18:50
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden files …
scan completed successfully
hidden processes: 0
hidden files: 0

——————–\\ Searching for other infections

——————–\\ Cracks & Keygens ..

C:\DOCUME~1\JEFFHE~1\Desktop\downloads\(Crack) quicken 2008 by CORE [Techno]
C:\DOCUME~1\JEFFHE~1\Desktop\downloads\(Crack) quicken 2008 by CORE [Techno].zip
C:\DOCUME~1\JEFFHE~1\Desktop\downloads\Quicken Deluxe 2007 crack0.exe
C:\DOCUME~1\JEFFHE~1\Desktop\downloads\Quicken_Premier_2008(crack)
C:\DOCUME~1\JEFFHE~1\Desktop\downloads\Quicken_Premier_2008(crack).zip
C:\DOCUME~1\JEFFHE~1\Desktop\downloads\(Crack) quicken 2008 by CORE [Techno]\Setup.exe
C:\DOCUME~1\JEFFHE~1\Desktop\downloads\Quicken_Premier_2008(crack)\Quicken_Premier_2008(crack)
C:\DOCUME~1\JEFFHE~1\Desktop\downloads\Quicken_Premier_2008(crack)\Quicken_Premier_2008(crack)\Quicken_Premier_2008(crack).data
C:\DOCUME~1\JEFFHE~1\My Documents\Downloads\PowerISO.v4.1.Incl.Keymaker-AGAiN\Keygen.exe

[F:1294][D:17]-> C:\DOCUME~1\JEFFHE~1\LOCALS~1\Temp
[F:1][D:0]-> C:\DOCUME~1\JEFFHE~1\Cookies
[F:2][D:0]-> C:\DOCUME~1\JEFFHE~1\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - Mon 10/27/2008|22:21 - Option : [1]

——————–\\ Scan completed at 22:21:14

Tomk

Post #9October 28, 2008, 4:33 AM UTC

centaurcoach,

It appears you got infected because you have several cracks on your machine

Please download the OTMoveIt3 by OldTimer.

Save it to your desktop.
Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).

Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe

:Services

:Reg

:Files
C:\DOCUME~1\JEFFHE~1\Desktop\downloads\(Crack) quicken 2008 by CORE [Techno]
C:\DOCUME~1\JEFFHE~1\Desktop\downloads\(Crack) quicken 2008 by CORE [Techno].zip
C:\DOCUME~1\JEFFHE~1\Desktop\downloads\Quicken Deluxe 2007 crack0.exe
C:\DOCUME~1\JEFFHE~1\Desktop\downloads\Quicken_Premier_2008(crack)
C:\DOCUME~1\JEFFHE~1\Desktop\downloads\Quicken_Premier_2008(crack).zip
C:\DOCUME~1\JEFFHE~1\Desktop\downloads\(Crack) quicken 2008 by CORE [Techno]\Setup.exe
C:\DOCUME~1\JEFFHE~1\Desktop\downloads\Quicken_Premier_2008(crack)\Quicken_Premier_2008(crack)
C:\DOCUME~1\JEFFHE~1\Desktop\downloads\Quicken_Premier_2008(crack)\Quicken_Premier_2008(crack)\Quicken_Premier_2008(crack).data
C:\DOCUME~1\JEFFHE~1\My Documents\Downloads\PowerISO.v4.1.Incl.Keymaker-AGAiN\Keygen.exe
D:\downloads\Commune-ications\Install_AIM.exe

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Tomk

Post #10November 1, 2008, 11:20 PM UTC

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Closed] Erratic internet connection... slow computer

✨ Ask AI

Ask AI