|
|
|||||||
|
Hi Bricat. Firstly, many thanks for all your help so far. You certainly know your stuff. Here is the deljob log: -------------------------------------------------------- Backups created in C:\deljob AF7DAF7991862135.job -------------------------------------------------------- Files in Windows Tasks folder AppleSoftwareUpdate.job Check Updates for Windows Live Toolbar.job McAfee.com Scan for Viruses - My Computer (HARPER-Nick Harper).job MP Scheduled Scan.job -------------------------------------------------------- Export App Data folders -------------------------------------------------------- Volume in drive C has no label. Volume Serial Number is 185B-13F4 Directory of C:\Documents and Settings\Mary Harper\Application Data 15/01/2008 16:27 <DIR> . 15/01/2008 16:27 <DIR> .. 15/08/2007 12:05 <DIR> ACDSYS~1 ACD Systems 30/07/2007 15:54 <DIR> Adobe 25/11/2007 12:24 <DIR> AdobeUM 05/12/2006 20:36 <DIR> AOL 20/12/2006 14:53 <DIR> APPLEC~1 Apple Computer 10/06/2007 16:00 <DIR> AVG7 04/03/2007 13:00 <DIR> bang 28/01/2008 18:36 <DIR> CASTPL~1 castplusnoun 12/08/2007 12:46 <DIR> Comodo 30/09/2006 16:31 <DIR> CORELP~1 Corel Photo Album 02/09/2007 14:28 <DIR> Google 13/07/2006 00:48 <DIR> Gtek 10/08/2004 12:08 <DIR> IDENTI~1 Identities 23/07/2006 15:59 <DIR> LEADER~1 Leadertech 12/08/2006 20:21 <DIR> MACROM~1 Macromedia 24/07/2006 15:39 <DIR> MCAFEE~1.COM McAfee.com Personal Firewall 04/11/2007 16:58 <DIR> MICROS~1 Microsoft 13/08/2006 19:29 <DIR> RAPTIS~1 Raptisoft 04/08/2007 15:46 <DIR> Samsung 23/06/2007 15:38 <DIR> SecuROM 23/07/2006 15:59 <DIR> Sonic 13/07/2006 00:42 <DIR> Sun 13/07/2006 00:49 <DIR> Symantec 24/10/2006 20:30 <DIR> Teleca 29/10/2007 16:09 <DIR> VideoEgg 13/07/2006 00:53 <DIR> YOU'VE~1 You've Got Pictures Screensaver 0 File(s) 0 bytes 28 Dir(s) 89,561,034,752 bytes free Volume in drive C has no label. Volume Serial Number is 185B-13F4 Directory of C:\Documents and Settings\All Users\Application Data 02/03/2008 18:08 <DIR> . 02/03/2008 18:08 <DIR> .. 11/08/2006 19:43 <DIR> ACDSYS~1 ACD Systems 25/11/2007 12:20 <DIR> Adobe 05/12/2006 20:37 <DIR> AOL 14/12/2006 19:14 <DIR> APPLEC~1 Apple Computer 12/03/2008 18:35 <DIR> avg7 12/08/2007 12:46 <DIR> Comodo 15/01/2008 16:27 <DIR> DOGSTA~1 Dog Start New Blue 20/02/2007 10:38 <DIR> FIRSTC~1 FirstClass 11/08/2007 20:46 <DIR> Google 11/03/2008 17:48 <DIR> GOOGLE~1 Google Updater 24/07/2006 17:29 <DIR> Grisoft 13/07/2006 00:48 <DIR> GTek 13/07/2006 00:50 <DIR> INSTAL~1 InstallShield 17/02/2008 15:28 <DIR> Lavasoft 18/10/2007 16:44 <DIR> Logishrd 13/07/2006 00:55 <DIR> McAfee 01/11/2006 18:59 <DIR> McAfee.com 14/10/2006 20:05 <DIR> MCAFEE~1.COM McAfee.com Personal Firewall 28/08/2007 19:09 <DIR> MESSEN~1 Messenger Plus! 07/03/2008 19:15 <DIR> MICROS~1 Microsoft 01/10/2006 16:13 <DIR> OBERON~1 Oberon Media 11/08/2006 21:00 <DIR> QUICKT~1 QuickTime 10/08/2004 12:13 <DIR> SBSI 03/03/2007 15:53 <DIR> SINGLE~1 SingleClick Systems 13/07/2006 00:46 <DIR> Sonic 04/03/2008 19:57 <DIR> SPYBOT~1 Spybot - Search & Destroy 17/08/2006 17:13 <DIR> Symantec 12/03/2008 19:00 <DIR> TEMP 01/10/2006 16:13 <DIR> Trymedia 13/07/2006 00:53 <DIR> VIEWPO~1 Viewpoint 05/09/2006 17:21 <DIR> WINDOW~1 Windows Genuine Advantage 13/09/2006 17:27 <DIR> WINDOW~2 Windows Live Toolbar 07/03/2008 19:10 <DIR> WLINST~1 WLInstaller 0 File(s) 0 bytes 35 Dir(s) 89,561,030,656 bytes free -------------------------------------------------------- All User Accounts -------------------------------------------------------- All Users Mary Harper Owner -------------------------------------------------------- Here is the Combofix log: ComboFix 07-08-13.3 - "Mary Harper" 2008-03-12 18:54:47.5 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.436 [GMT 0:00] Command switches used :: C:\Documents and Settings\Mary Harper\Desktop\CFScript.txt * Created a new restore point ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Program Files\castplusnoun C:\Program Files\PlayMP3z C:\Program Files\PlayMP3z\PlayMP3.exe C:\Program Files\PlayMP3z\uninstall.exe ((((((((((((((((((((((((( Files Created from 2008-02-12 to 2008-03-12 ))))))))))))))))))))))))))))))) 2008-03-10 22:31 <DIR> d-------- C:\Program Files\New Folder 2008-03-07 19:11 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller 2008-03-02 18:08 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller 2008-02-23 12:06 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2008-02-23 12:06 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll 2008-02-23 12:06 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2008-02-23 12:06 15,104 --a------ C:\WINDOWS\system32\dllcache\usbscan.sys 2008-02-17 16:04 691,545 --a------ C:\WINDOWS\unins000.exe 2008-02-17 16:04 3,449 --a------ C:\WINDOWS\unins000.dat (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2008-03-12 18:47 --------- d-------- C:\Program Files\BrowsingSoftware 2008-03-07 22:28 --------- d-------- C:\Program Files\LimeWire Music 2008-03-07 19:35 --------- d-------- C:\Program Files\Incomplete 2008-03-07 19:11 --------- d-------- C:\Program Files\Windows Live 2008-03-07 19:09 --------- d-------- C:\Program Files\MSN Messenger 2008-02-17 15:54 --------- d-------- C:\Program Files\SpywareBlaster 2008-02-17 15:26 9344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys 2008-02-17 15:26 8320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys 2008-02-17 15:26 12632 --a------ C:\WINDOWS\system32\lsdelete.exe 2008-01-28 18:36 --------- d-------- C:\Program Files\Circle Developement 2008-01-28 18:36 --------- d-------- C:\DOCUME~1\MARYHA~1\APPLIC~1\castplusnoun 2008-01-15 16:26 --------- d-------- C:\Program Files\Messenger Plus! Live 2008-01-11 05:53 44544 --a------ C:\WINDOWS\system32\dllcache\pngfilt.dll 2007-12-23 10:11 21840 --a----t- C:\WINDOWS\system32\SIntfNT.dll 2007-12-23 10:11 17212 --a----t- C:\WINDOWS\system32\SIntf32.dll 2007-12-23 10:11 12067 --a----t- C:\WINDOWS\system32\SIntf16.dll 2007-12-19 23:01 347136 --a------ C:\WINDOWS\system32\dllcache\dxtmsft.dll 2007-12-18 09:51 179584 --------- C:\WINDOWS\system32\dllcache\mrxdav.sys 2007-12-08 11:32 22328 --a------ C:\DOCUME~1\MARYHA~1\APPLIC~1\PnkBstrK.sys 2007-08-28 08:57 3949904 --a------ C:\Program Files\MsgPlusLive-423.exe 2007-08-18 15:10 2566736 --a------ C:\Program Files\spywareblastersetup351.exe 2007-08-18 15:01 5154304 --a------ C:\Program Files\WindowsDefender.msi 2007-08-12 13:15 212849 --a------ C:\Program Files\hijackthis.zip 2007-08-12 12:58 7649240 --a------ C:\Program Files\Windows-KB890830-V1.31.exe 2007-08-12 12:20 7943248 --a------ C:\Program Files\CFP_Setup_English_2.4.18.184.exe 2007-08-11 20:45 878216 --a------ C:\Program Files\Google_Updater.exe 2007-08-11 20:22 5037072 --a------ C:\Program Files\spybotsd14.exe 2007-08-11 19:52 18176512 --a------ C:\Program Files\aaw2007.exe 2007-08-11 19:33 15505200 --a------ C:\Program Files\IE7-WindowsXP-x86-enu.exe 2007-08-11 19:19 2720456 --a------ C:\Program Files\ccsetup141.exe 2006-09-30 16:30:40 88 --sh--r C:\WINDOWS\system32\44CA78DA86.sys 2006-07-21 17:56:58 56 --sh--r C:\WINDOWS\system32\7430AB4CD4.sys 2006-09-30 16:31:24 5,382 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B886C1F4-D1D3-45F5-F45E-75EB024320AC}] 2007-12-30 20:48 1019904 --a------ C:\Program Files\BrowsingSoftware\BrowsingSoftware-2.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [2005-04-13 02:48] "SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 15:20 C:\WINDOWS\stsystra.exe] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 20:05] "DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 02:12] "ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 09:44] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 09:44] "RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2006-07-13 00:52] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 18:58] "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 04:20] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-07-13 00:56] "DSLSTATEXE"="C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe" [2003-06-28 14:10] "DSLAGENTEXE"="C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe" [2003-08-19 11:47] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-29 10:50] "Camera Detector"="C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.exe" [2003-06-17 14:43] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 04:00 C:\WINDOWS\system32\bthprops.cpl] "MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 15:16] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 12:49] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 12:46] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-10-14 12:50] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 09:36] "COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2007-08-12 12:23] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20] "New blue plus face"="C:\Documents and Settings\All Users\Application Data\Dog Start New Blue\Copy gram.exe" [2008-03-12 18:51] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:00] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-11 20:46] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce] "SWHelper"="C:\WINDOWS\system32\Macromed\Shockwave 10\PostUpdate.exe" 1013018 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-07-21 18:17:48] Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26] BTTray.lnk - C:\Program Files\Belkin\Bluetooth Software\BTTray.exe [2004-10-01 14:12:18] Dell Network Assistant.lnk - C:\WINDOWS\Installer\{0240BDFB-2995-4A3F-8C96-18D41282B716}\Icon0240BDFB3.exe [2006-07-13 01:00:00] Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-08-11 20:46:19] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL R2 Packet;Auto Internet Protocol;C:\WINDOWS\system32\DRIVERS\packet.sys R3 akshasp;Aladdin HASP Key;C:\WINDOWS\system32\DRIVERS\akshasp.sys R3 wanusb;BT Voyager 105 ADSL Modem;C:\WINDOWS\system32\DRIVERS\gwausb.sys S2 AIMMSN;AIM;"C:\WINDOWS\aimmsn.exe" S3 PID_PEPI;Logitech QuickCam IM(PID_PEPI);C:\WINDOWS\system32\DRIVERS\LV302V32.SYS [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs BthServ Contents of the 'Scheduled Tasks' folder 2008-03-12 18:00:01 C:\WINDOWS\Tasks\AF7DAF7991862135.job - c:\docume~1\maryha~1\applic~1\castpl~1\ROAMTYPEMPEG.exe 2008-03-12 16:54:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe 2008-03-12 18:51:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE 2008-03-07 18:30:00 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (HARPER-Nick Harper).job - c:\program files\mcafee.com\vso\mcmnhdlr.exe 2008-03-12 18:53:09 C:\WINDOWS\Tasks\MP Scheduled Scan.job - C:\Program Files\Windows Defender\MpCmdRun.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-12 18:57:21 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2008-03-12 18:57:49 C:\ComboFix-quarantined-files.txt ... 2008-03-12 18:57 C:\ComboFix2.txt ... 2008-03-11 18:56 C:\ComboFix3.txt ... 2008-03-10 22:23 --- E O F --- And here is the new Hijack this log: Logfile of HijackThis v1.99.1 Scan saved at 19:06:37, on 12/03/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe C:\WINDOWS\stsystra.exe C:\Program Files\Dell\Media Experience\DMXLauncher.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\System32\DLA\DLACTRLW.EXE C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe C:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe C:\Program Files\Comodo\Firewall\cmdagent.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE C:\WINDOWS\system32\rundll32.exe C:\Program Files\Dell Network Assistant\hnm_svc.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Comodo\Firewall\CPF.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\PnkBstrB.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\svchost.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\Program Files\Belkin\Bluetooth Software\BTTray.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Dell Network Assistant\ezi_hnm2.exe C:\Program Files\Google\Google Updater\GoogleUpdater.exe C:\WINDOWS\system32\Macromed\Shockwave 10\PostUpdate.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.com/sports R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.msn.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.co.uk/ig/dell?hl=en&client=dell-usuk&channel=uk R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.btbroadbandstart.com/ R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll O2 - BHO: BrowsingSoftware - {B886C1F4-D1D3-45F5-F45E-75EB024320AC} - C:\Program Files\BrowsingSoftware\BrowsingSoftware-2.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [Camera Detector] C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE -autorun O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [New blue plus face] C:\Documents and Settings\All Users\Application Data\Dog Start New Blue\Copy gram.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9 O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\RunOnce: [SWHelper] "C:\WINDOWS\system32\Macromed\Shockwave 10\PostUpdate.exe" 1013018 O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: Dell Network Assistant.lnk = ? O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe O8 - Extra context menu item: &Search - ?p=ZNxmk121YYGB O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/games/hamsterball/en/raptisoftgameloader.cab O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8300.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/Windows/Initial/VideoEggPublisher.exe O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{8F24B7CB-66E9-488B-AAB9-8B2E1F3871B1}: NameServer = 62.24.218.220 62.24.218.221 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O21 - SSODL: rdihost - {4289C461-F41A-46B0-BD28-DAE4A2772206} - (no file) O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: AIM (AIMMSN) - Unknown owner - C:\WINDOWS\aimmsn.exe (file missing) O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe I hope i have followed your instructions properly Many thanks, Trueblue40 |