|
|
|||||||
|
All seems ok upto now, but will let you know after a while if that's ok. Here are your logs for the day, Thanks, Rich. ComboFix 08-03-14.4 - Rich 2008-03-17 20:09:33.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.573 [GMT 0:00] Running from: C:\Documents and Settings\Rich\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Rich\Desktop\CFScript.txt * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! FILE :: C:\Program Files\tmp0.exe C:\WINDOWS\fmsxwqs.exe C:\WINDOWS\PSEXESVC.EXE . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\tmp0.exe C:\WINDOWS\fmsxwqs.exe C:\WINDOWS\PSEXESVC.EXE . ((((((((((((((((((((((((( Files Created from 2008-02-17 to 2008-03-17 ))))))))))))))))))))))))))))))) . 2008-03-17 10:00 . 2008-03-17 10:00 <DIR> d-------- C:\Documents and Settings\Anne\Application Data\Grisoft 2008-03-16 09:23 . 2008-03-16 09:23 <DIR> d-------- C:\VundoFix Backups 2008-03-16 09:00 . 2008-03-16 09:09 30,590 --a------ C:\WINDOWS\system32\pavas.ico 2008-03-16 09:00 . 2008-03-16 09:09 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico 2008-03-16 09:00 . 2008-03-16 09:09 1,406 --a------ C:\WINDOWS\system32\Help.ico 2008-03-15 18:53 . 2008-03-15 18:53 <DIR> d-------- C:\Documents and Settings\Rich\Application Data\Grisoft 2008-03-15 18:53 . 2008-03-15 18:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-03-15 18:53 . 2007-05-30 12:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2008-03-15 18:34 . 2008-03-15 18:34 <DIR> d-------- C:\Program Files\Trend Micro 2008-03-15 13:16 . 2008-03-15 13:16 <DIR> d-------- C:\Documents and Settings\Rich\Application Data\DivX 2008-03-12 21:44 . 2008-03-17 19:13 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-03-12 21:44 . 2008-03-12 21:44 1,409 --a------ C:\WINDOWS\QTFont.for 2008-02-21 02:05 . 2008-02-21 02:05 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2008-02-21 02:05 . 2008-02-21 02:05 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll 2008-02-21 02:05 . 2008-02-21 02:05 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe 2008-02-21 02:05 . 2008-02-21 02:05 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll 2008-02-21 02:05 . 2008-02-21 02:05 4,816 --a------ C:\WINDOWS\system32\divxsm.tlb 2008-02-21 02:03 . 2008-02-21 02:03 630,784 --a------ C:\WINDOWS\system32\divxdec.ax 2008-02-21 02:03 . 2008-02-21 02:03 352,401 --a------ C:\WINDOWS\system32\DivXMedia.ax 2008-02-21 02:03 . 2008-02-21 02:03 156,992 --a------ C:\WINDOWS\system32\DivXCodecVersionChecker.exe 2008-02-21 02:03 . 2008-02-21 02:03 12,288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-17 20:16 3,204 ----a-w C:\WINDOWS\system32\drivers\APPFLTR.CFG.bck 2008-03-17 20:16 3,204 ----a-w C:\WINDOWS\system32\drivers\APPFLTR.CFG 2008-03-17 20:08 282,072 ----a-w C:\WINDOWS\system32\drivers\APPFCONT.DAT.bck 2008-03-17 20:08 282,072 ----a-w C:\WINDOWS\system32\drivers\APPFCONT.DAT 2008-03-17 20:06 13,880 ----a-w C:\WINDOWS\system32\drivers\COMFiltr.sys 2008-03-16 17:33 --------- d-----w C:\Program Files\xnews 2008-03-15 17:42 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-03-15 17:35 --------- d-----w C:\Program Files\Microsoft IntelliType Pro 2008-03-15 17:32 --------- d-----w C:\Program Files\iTunes 2008-03-15 17:25 --------- d-----w C:\Program Files\Common Files\DataViz 2008-03-15 14:56 --------- d-----w C:\Program Files\Norton SystemWorks 2008-03-15 13:03 --------- d-----w C:\Program Files\DivX 2008-03-12 21:44 --------- d-----w C:\Program Files\iPod 2008-03-12 21:43 --------- d-----w C:\Program Files\QuickTime 2008-02-18 17:37 --------- d-----w C:\Documents and Settings\Anne\Application Data\AdobeUM 2008-02-16 11:14 --------- d---a-w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-02-16 11:07 691,545 ----a-w C:\WINDOWS\unins000.exe 2008-02-03 16:19 --------- d-----w C:\Program Files\Lavasoft 2008-02-03 16:18 --------- d---a-w C:\Documents and Settings\Rich\Application Data\Lavasoft 2008-02-03 16:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-02-03 16:10 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-02-03 13:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage 2008-01-29 22:38 --------- d-----w C:\Program Files\PopCap Games 2007-09-05 18:45 1,476 ----a-w C:\Documents and Settings\Rich\pback1.dat 2007-09-02 17:43 3,815 ---ha-w C:\Documents and Settings\Rich\hpothb07.dat 2007-09-02 17:43 164 ---ha-w C:\Documents and Settings\All Users\hpothb07.dat 2007-09-02 09:49 309 ---ha-w C:\Documents and Settings\Anne\hpothb07.dat 2007-05-13 09:53 32,768 ----a-w C:\Documents and Settings\UserData\index.dat 2006-06-10 13:02 25,600 ----a-w C:\Documents and Settings\Rich\usbsermptxp.sys 2006-06-10 13:02 22,768 ----a-w C:\Documents and Settings\Rich\usbsermpt.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56 15360] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 20:05 204288] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Cmaudio"="cmicnfg.cpl" [] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 17:14 8491008] "nwiz"="nwiz.exe" [2007-10-04 17:14 1626112 C:\WINDOWS\system32\nwiz.exe] "Logitech Utility"="Logi_MwX.Exe" [2003-06-30 08:50 19968 C:\WINDOWS\LOGI_MWX.EXE] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 10:38 866816] "AcctMgr"="C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe" [2004-08-18 11:41 586896] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-01-31 23:13 385024] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 14:57 153136] "itype"="c:\Program Files\Microsoft IntelliType Pro\itype.exe" [2006-11-21 16:08 813912] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496] "vcdplayx"="C:\WINDOWS\vcdplayx.exe" [2002-03-18 15:31 57344] "D-Link AirPlus G"="C:\Program Files\D-Link\AirPlus G\AirGCFG.exe" [2005-11-23 15:04 1544192] "ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2005-10-19 18:19 49152] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 03:10 55824 C:\WINDOWS\KHALMNPR.Exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-04 17:14 81920] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 09:25 6731312] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:56 15360] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696] DataViz Inc Messenger.lnk - C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe [2007-08-15 08:29:03 28672] HotSync Manager.lnk - C:\Program Files\palmOne\Hotsync.exe [2004-06-09 13:16:08 471040] Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-12-02 15:52:30 784912] [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] FriendlyName= Newcastle Airport: the world on your doorstep [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "ServiceSetup"= {9ac0b372-7cd7-4436-830c-506a04a6d60c} - C:\WINDOWS\Installer\{9ac0b372-7cd7-4436-830c-506a04a6d60c}\ServiceSetup.dll [2008-03-15 08:43 18714] "SysBoot"= {d7bc87be-be15-49c2-9f6d-cdea38ea7c98} - C:\WINDOWS\Installer\{d7bc87be-be15-49c2-9f6d-cdea38ea7c98}\SysBoot.dll [2008-03-15 08:43 18526] "zip"= {30ea0f8f-2f92-440d-8eec-63f7f5ca936d} - C:\WINDOWS\Installer\{30ea0f8f-2f92-440d-8eec-63f7f5ca936d}\zip.dll [2008-03-15 08:43 23130] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr] avldr.dll 2007-02-15 19:02 50736 C:\WINDOWS\system32\avldr.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] c:\program files\common files\logitech\bluetooth\LBTWlgn.dll 2007-11-15 10:10 72208 c:\Program Files\Common Files\Logitech\Bluetooth\LBTWLgn.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 2000 Series.lnk] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hpoddt01.exe.lnk] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-01-31 23:13 385024 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RaidTool] --a------ 2007-05-22 18:57 589824 C:\Program Files\VIA\RAID\raid_tool.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Windows Media Player\\wmplayer.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= R0 viasraid;viasraid;C:\WINDOWS\system32\DRIVERS\viasraid.sys [2003-06-12 10:31] R1 APPFLT;App Filter Plugin;C:\WINDOWS\system32\Drivers\APPFLT.SYS [2007-05-11 08:33] R1 cdawdm;CDAWDM;C:\WINDOWS\system32\DRIVERS\CDAWDM.sys [2002-01-24 14:25] R1 DSAFLT;DSA Filter Plugin;C:\WINDOWS\system32\Drivers\DSAFLT.SYS [2007-05-11 08:33] R1 FNETMON;NetMon Filter Plugin;C:\WINDOWS\system32\Drivers\fnetmon.SYS [2007-05-11 08:33] R1 IDSFLT;Ids Filter Plugin;C:\WINDOWS\system32\Drivers\IDSFLT.SYS [2007-07-11 10:39] R1 NETFLTDI;Panda Net Driver [TDI Layer];C:\WINDOWS\system32\Drivers\NETFLTDI.SYS [2007-05-11 08:33] R1 ShldDrv;Panda File Shield Driver;C:\WINDOWS\system32\Drivers\ShlDrv51.sys [2007-05-23 14:40] R1 SMSFLT;SMS Filter Plugin;C:\WINDOWS\system32\Drivers\SMSFLT.SYS [2007-05-11 08:33] R1 WNMFLT;Wifi Monitor Filter Plugin;C:\WINDOWS\system32\Drivers\WNMFLT.SYS [2007-05-11 08:33] R2 cpoint;Panda CPoint Driver;C:\WINDOWS\system32\drivers\cpoint.sys [2007-06-08 07:44] R2 PavProc;Panda Process Protection Driver;C:\WINDOWS\system32\DRIVERS\PavProc.sys [2007-07-12 12:49] R3 AvFlt;Antivirus Filter Driver;C:\WINDOWS\system32\drivers\av5flt.sys [] R3 ComFiltr;Panda Anti-Dialer;C:\WINDOWS\system32\DRIVERS\COMFiltr.sys [2008-03-17 20:17] R3 NETIMFLT01050093;PANDA NDIS IM Filter Miniport v1.5.0.93;C:\WINDOWS\system32\DRIVERS\netimflt.sys [2007-10-17 10:42] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4af57cfc-ed7d-11d9-a206-806d6172696f}] \Shell\AutoRun\command - E:\SETUP.EXE /AUTORUN \Shell\configure\command - E:\SETUP.EXE \Shell\install\command - E:\SETUP.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{692df7c6-504a-11d9-b162-000e5014090d}] \Shell\AutoRun\command - H:\GizmoSecure\Windows\GizmoSecure30.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{692df7c7-504a-11d9-b162-000e5014090d}] \Shell\AutoRun\command - G:\GizmoSecure\Windows\GizmoSecure30.exe *Newly Created Service* - COMFILTR . Contents of the 'Scheduled Tasks' folder "2008-03-08 22:17:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2007-08-16 09:55:12 C:\WINDOWS\Tasks\Basic clean-up.job" - C:\Program Files\Panda Software\Panda Internet Security 2007\PlaTasks.exe "2008-03-17 19:32:00 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2200 series#1179858713.job" - C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I "2008-03-12 20:57:00 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2200 series#1188503802.job" - C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I "2008-03-14 23:16:00 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2200 series#1188598520.job" - C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I "2008-02-15 17:30:00 C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job" - C:\Program Files\Norton SystemWorks\OBC.exe "2008-03-09 00:00:00 C:\WINDOWS\Tasks\Symantec Drmc.job" - C:\Program Files\Common Files\Symantec Shared\SymDrmc.exe "2008-03-17 20:17:41 C:\WINDOWS\Tasks\Symantec NetDetect.job" - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-17 20:16:11 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156] -> C:\WINDOWS\Installer\{9ac0b372-7cd7-4436-830c-506a04a6d60c}\ServiceSetup.dll -> C:\WINDOWS\Installer\{d7bc87be-be15-49c2-9f6d-cdea38ea7c98}\SysBoot.dll -> C:\WINDOWS\Installer\{30ea0f8f-2f92-440d-8eec-63f7f5ca936d}\zip.dll . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Panda Software\Panda Internet Security 2007\pavsrv51.exe C:\Program Files\Panda Software\Panda Internet Security 2007\AVENGINE.EXE C:\Program Files\Panda Software\Panda Internet Security 2007\TPSrv.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Panda Software\Panda Internet Security 2007\PsCtrls.exe C:\Program Files\Panda Software\Panda Internet Security 2007\PavFnSvr.exe C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe C:\Program Files\Panda Software\Panda Internet Security 2007\AntiSpam\pskmssvc.exe c:\program files\panda software\panda internet security 2007\firewall\PSHOST.EXE C:\Program Files\Panda Software\Panda Internet Security 2007\psimsvc.exe C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Panda Software\Panda Internet Security 2007\ApvxdWin.exe C:\Program Files\Panda Software\Panda Internet Security 2007\SRVLOAD.EXE C:\Program Files\Panda Software\Panda Internet Security 2007\WebProxy.exe C:\Program Files\Panda Software\Panda Internet Security 2007\PavBckPT.exe C:\Program Files\Panda Software\Panda Internet Security 2007\Upgrader.exe . ************************************************************************** . Completion time: 2008-03-17 20:22:26 - machine was rebooted ComboFix-quarantined-files.txt 2008-03-17 20:22:21 ComboFix2.txt 2008-03-16 16:41:08 . 2008-03-12 19:57:39 --- E O F --- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:23:54, on 17/03/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Panda Software\Panda Internet Security 2007\pavsrv51.exe C:\Program Files\Panda Software\Panda Internet Security 2007\AVENGINE.EXE C:\WINDOWS\system32\svchost.exe C:\Program Files\Panda Software\Panda Internet Security 2007\TPSrv.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Panda Software\Panda Internet Security 2007\PsCtrls.exe C:\Program Files\Panda Software\Panda Internet Security 2007\PavFnSvr.exe C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe C:\Program Files\Panda Software\Panda Internet Security 2007\AntiSpam\pskmssvc.exe c:\program files\panda software\panda internet security 2007\firewall\PSHOST.EXE C:\Program Files\Panda Software\Panda Internet Security 2007\psimsvc.exe C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Panda Software\Panda Internet Security 2007\ApvxdWin.exe C:\WINDOWS\explorer.exe C:\Program Files\Panda Software\Panda Internet Security 2007\SRVLOAD.EXE C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Panda Software\Panda Internet Security 2007\WebProxy.exe C:\Program Files\Panda Software\Panda Internet Security 2007\PavBckPT.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.altavista.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local. O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O3 - Toolbar: (no name) - {65F4F8C1-B31F-40B7-9D34-98CA11EAC387} - (no file) O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [vcdplayx] "C:\WINDOWS\vcdplayx.exe" O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://www.msi.com.tw O15 - Trusted Zone: http://moneycentral.msn.com O15 - Trusted Zone: http://www.nescafe-pickmeups.co.uk O15 - Trusted Zone: cdn.streamcdn.com O15 - Trusted Zone: gocontent.streamuk.com O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813 O16 - DPF: {4CCA4E80-9259-11D9-AC6E-444553544200} (FixController Control) - http://h30155.www3.hp.com/ediags/dd/install/HPInstallMgr_v01_6.cab O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - http://www.nanoscan.com/as/v1/cabs/ascstubie.cab O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1179861502878 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O21 - SSODL: ServiceSetup - {9ac0b372-7cd7-4436-830c-506a04a6d60c} - C:\WINDOWS\Installer\{9ac0b372-7cd7-4436-830c-506a04a6d60c}\ServiceSetup.dll O21 - SSODL: SysBoot - {d7bc87be-be15-49c2-9f6d-cdea38ea7c98} - C:\WINDOWS\Installer\{d7bc87be-be15-49c2-9f6d-cdea38ea7c98}\SysBoot.dll O21 - SSODL: zip - {30ea0f8f-2f92-440d-8eec-63f7f5ca936d} - C:\WINDOWS\Installer\{30ea0f8f-2f92-440d-8eec-63f7f5ca936d}\zip.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\PsCtrls.exe O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\PavFnSvr.exe O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\pavsrv51.exe O23 - Service: Pml Driver HPZ12 - Unknown owner - C:\DOCUME~1\Rich\LOCALS~1\Temp\500064-PMLPatch\HPZipm12.exe (file missing) O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\AntiSpam\pskmssvc.exe O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda software\panda internet security 2007\firewall\PSHOST.EXE O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\psimsvc.exe O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SsBeSvc.exe O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\TPSrv.exe O24 - Desktop Component 0: Newcastle Airport: the world on your doorstep - http://www.newcastleairport.com/flights-arrivals.asp O24 - Desktop Component 1: (no name) - http://newsrss.bbc.co.uk/rss/newsonline_uk_edition/front_page/rss.xml -- End of file - 12227 bytes |