We recommend! Click here to scan your PC for common system errors

Is Your System Infected with a Virus / Spyware / Adware / Trojan? – Part II

592 Replies:

Pages: [1] 2 3 4 5 … 60 » Show All

1. Palla Sredhar said:

   Hey Vishal!
   Nice of you to help so many guys with their PC problems.
   As insisted by you i'm copying the "hijackthis.log" FILE for your perusal.
   Though my system is clean. I'm just sending to re-check for any of the viruses, adware etc.

   --------------------------------------hijackthis.log(sredhar Palla)-------------
   Logfile of Trend Micro HijackThis v2.0.2
   Scan saved at 6:01:44 PM, on 10/6/2008
   Platform: Windows XP SP3 (WinNT 5.01.2600)
   MSIE: Internet Explorer v8.00 (8.00.6001.18241)
   Boot mode: Normal

   Running processes:
   E:\WINDOWS\System32\smss.exe
   E:\WINDOWS\system32\winlogon.exe
   E:\WINDOWS\system32\services.exe
   E:\WINDOWS\system32\lsass.exe
   E:\WINDOWS\system32\Ati2evxx.exe
   E:\WINDOWS\system32\svchost.exe
   E:\Program Files\Windows Defender\MsMpEng.exe
   E:\WINDOWS\System32\svchost.exe
   J:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
   J:\Program Files\Alwil Software\Avast4\ashServ.exe
   E:\WINDOWS\system32\Ati2evxx.exe
   E:\WINDOWS\Explorer.EXE
   E:\WINDOWS\system32\spoolsv.exe
   E:\WINDOWS\system32\svchost.exe
   E:\Program Files\Viewpoint\Common\ViewpointService.exe
   J:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
   J:\Program Files\Alwil Software\Avast4\ashWebSv.exe
   J:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
   E:\WINDOWS\RTHDCPL.EXE
   E:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
   E:\Program Files\Windows Defender\MSASCui.exe
   E:\Program Files\Common Files\Real\Update_OB\realsched.exe
   E:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
   J:\Program Files\Nitro PDF\Professional\NitroPDFPrinterMonitor.exe
   E:\WINDOWS\system32\ctfmon.exe
   J:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe
   J:\Program Files\WordWeb\wweb32.exe
   E:\Program Files\Opera\opera.exe
   J:\Program Files\Internet Download Manager\IDMan.exe
   j:\Program Files\Trend Micro\HijackThis\HijackThis.exe

   R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
   R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
   R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
   R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
   R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
   R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - E:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
   O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - J:\Program Files\Internet Download Manager\IDMIECC.dll
   O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - E:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
   O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
   O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
   O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - j:\PROGRA~1\SPYBOT~1\SDHelper.dll
   O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
   O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
   O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - E:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
   O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - E:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
   O4 - HKLM\..\Run: [avast!] J:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
   O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
   O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
   O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "J:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
   O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
   O4 - HKLM\..\Run: [Windows Defender] "E:\Program Files\Windows Defender\MSASCui.exe" -hide
   O4 - HKLM\..\Run: [TkBellExe] "E:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
   O4 - HKLM\..\Run: [Google Desktop Search] "E:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
   O4 - HKLM\..\Run: [Nitro PDF Printer Monitor] "J:\Program Files\Nitro PDF\Professional\NitroPDFPrinterMonitor.exe"
   O4 - HKCU\..\Run: [ctfmon.exe] E:\WINDOWS\system32\ctfmon.exe
   O4 - HKCU\..\Run: [SRS Audio Sandbox] "J:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe" /hideme
   O4 - HKCU\..\Run: [DW6] "E:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"
   O4 - HKCU\..\Run: [AROReminder] E:\Program Files\Advanced Registry Optimizer\aro.exe -rem
   O4 - Global Startup: WordWeb.lnk = J:\Program Files\WordWeb\wweb32.exe
   O8 - Extra context menu item: &WordWeb... - res://E:\WINDOWS\system32\wweb32.dll/lookup.html
   O8 - Extra context menu item: Download all links with IDM - J:\Program Files\Internet Download Manager\IEGetAll.htm
   O8 - Extra context menu item: Download FLV video content with IDM - J:\Program Files\Internet Download Manager\IEGetVL.htm
   O8 - Extra context menu item: Download with IDM - J:\Program Files\Internet Download Manager\IEExt.htm
   O8 - Extra context menu item: E&xport to Microsoft Excel - res://J:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
   O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
   O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
   O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - J:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
   O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - j:\PROGRA~1\SPYBOT~1\SDHelper.dll
   O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - j:\PROGRA~1\SPYBOT~1\SDHelper.dll
   O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
   O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
   O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
   O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
   O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1222390224328
   O17 - HKLM\System\CCS\Services\Tcpip\..\{E45ED456-2DD9-43F5-AD97-895DCEE3D6C7}: NameServer = 203.109.88.226 203.187.192.15
   O20 - AppInit_DLLs: E:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
   O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - J:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
   O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - E:\WINDOWS\system32\Ati2evxx.exe
   O23 - Service: avast! Antivirus - ALWIL Software - J:\Program Files\Alwil Software\Avast4\ashServ.exe
   O23 - Service: avast! Mail Scanner - ALWIL Software - J:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
   O23 - Service: avast! Web Scanner - ALWIL Software - J:\Program Files\Alwil Software\Avast4\ashWebSv.exe
   O23 - Service: Google Desktop Manager 5.8.809.23506 (GoogleDesktopManager-092308-165331) - Google - E:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
   O23 - Service: Google Updater Service (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
   O23 - Service: iPod Service - Apple Inc. - E:\Program Files\iPod\bin\iPodService.exe
   O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - E:\Program Files\Viewpoint\Common\ViewpointService.exe

   --
   End of file - 7637 bytes
   --------------------------------------------------------------------------------------------------------

   Thanks in advance for whatever you do..

   Sridhar Palla,
   M.Tech, IITK

2. Osku Kaskisola said:

   Havent you already posted this ? or is this just somekind of remind ?

3. Lukas said:

   Logfile of Trend Micro HijackThis v2.0.2
   Scan saved at 10:26:26, on 2008-10-06
   Platform: Windows Vista SP1 (WinNT 6.00.1905)
   MSIE: Internet Explorer v7.00 (7.00.6001.18000)
   Boot mode: Normal

   Running processes:
   C:\Windows\system32\taskeng.exe
   C:\Windows\system32\Dwm.exe
   C:\Windows\Explorer.EXE
   C:\Program Files\Windows Defender\MSASCui.exe
   C:\Program Files\Alwil Software\Avast4\ashDisp.exe
   C:\Program Files\Google\Google Talk\googletalk.exe
   C:\Program Files\Windows Live\Messenger\msnmsgr.exe
   C:\Windows\ehome\ehtray.exe
   C:\Program Files\Spark\Spark.exe
   C:\Program Files\WordWeb\wweb32.exe
   C:\Windows\System32\rundll32.exe
   C:\Windows\ehome\ehmsas.exe
   C:\Program Files\Mozilla Thunderbird\thunderbird.exe
   C:\Program Files\Mozilla Firefox\firefox.exe
   C:\Program Files\Google\Picasa3\Picasa3.exe
   C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

   R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
   R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.ca/ig/dell?hl=en&client=dell-row-rel&channel=ca&ibd=0070224
   R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
   R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
   R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
   R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
   R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
   R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
   R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
   O1 - Hosts: ::1 localhost
   O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
   O2 - BHO: (no name) - {259F616C-A300-44F5-B04A-ED001A26C85C} - (no file)
   O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - (no file)
   O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
   O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
   O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
   O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
   O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
   O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
   O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
   O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
   O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
   O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
   O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
   O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
   O4 - HKCU\..\Run: [Spark] C:\Program Files\Spark\Spark.exe
   O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
   O4 - HKCU\..\Run: [Gestionnaire Antidote.exe] C:\Program Files\Druide\Antidote\Gestionnaire Antidote.exe
   O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
   O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
   O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
   O4 - Startup: WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe
   O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
   O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
   O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
   O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
   O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
   O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
   O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
   O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
   O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
   O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
   O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
   O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
   O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
   O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
   O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
   O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (no file)
   O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
   O9 - Extra button: Correcteur - {F7C8E5F6-B6D1-45db-8D91-2BCFA5DF11A9} - C:\Program Files\Druide\Antidote\Internet Explorer\7\Antidote K - IE 7.htm (HKCU)
   O9 - Extra button: Dictionnaires - {F9B969E8-58D0-4dd9-AC8A-EE2336FF8F65} - C:\Program Files\Druide\Antidote\Internet Explorer\7\Antidote D - IE 7.htm (HKCU)
   O9 - Extra button: Guides - {FA089E36-3F1B-4c51-9A1A-C4E7012483AF} - C:\Program Files\Druide\Antidote\Internet Explorer\7\Antidote G - IE 7.htm (HKCU)
   O13 - Gopher Prefix:
   O15 - Trusted IP range: http://198.164.104.6
   O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = CIDIF.local
   O17 - HKLM\Software\..\Telephony: DomainName = CIDIF.local
   O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = CIDIF.local
   O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = CIDIF.local
   O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
   O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
   O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
   O23 - Service: Ad-Aware Enterprise Client - Unknown owner - C:\Program Files\Lavasoft\Ad-Aware Enterprise Client\aaclient.exe
   O23 - Service: Apache2 - Apache Software Foundation - C:\Program Files\Apache Software Foundation\Apache2.2\bin\httpd.exe
   O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
   O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
   O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
   O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
   O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
   O23 - Service: Backup Exec DLO Agent Change Journal Reader (DLOChangeJournalSvc) - Symantec Corporation - C:\Program Files\Symantec\Backup Exec\DLO\DLOChangeLogSvcu.exe
   O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
   O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
   O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
   O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
   O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
   O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\STacSV.exe
   O23 - Service: stllssvr - Unknown owner - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)

   --
   End of file - 8856 bytes

4. Tim Russel said:

   please scan this logfile

   Logfile of Trend Micro HijackThis v2.0.2
   Scan saved at 9:49:38 PM, on 10/6/2008
   Platform: Windows XP SP2 (WinNT 5.01.2600)
   MSIE: Internet Explorer v8.00 (8.00.6001.18241)
   Boot mode: Normal

   Running processes:
   C:\WINDOWS\System32\smss.exe
   C:\WINDOWS\system32\winlogon.exe
   C:\WINDOWS\system32\services.exe
   C:\WINDOWS\system32\lsass.exe
   C:\WINDOWS\system32\svchost.exe
   C:\WINDOWS\System32\svchost.exe
   C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
   C:\Program Files\Alwil Software\Avast4\ashServ.exe
   C:\WINDOWS\Explorer.EXE
   C:\WINDOWS\system32\spoolsv.exe
   C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
   C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
   C:\WINDOWS\system32\nvsvc32.exe
   C:\WINDOWS\system32\svchost.exe
   E:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe
   E:\PROGRA~1\SPEEDB~1\VideoAcceleratorEngine.exe
   C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
   C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
   C:\WINDOWS\system32\wscntfy.exe
   C:\WINDOWS\RTHDCPL.EXE
   C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
   C:\Program Files\Winamp\winampa.exe
   C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
   C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
   C:\WINDOWS\VMSnap3.EXE
   C:\WINDOWS\Domino.EXE
   E:\quicktime\QTTask.exe
   C:\Program Files\Common Files\Real\Update_OB\realsched.exe
   C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
   C:\WINDOWS\system32\Rundll32.exe
   C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
   C:\WINDOWS\system32\ctfmon.exe
   C:\Documents and Settings\blaine\Local Settings\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe
   E:\Program Files\Microsoft ActiveSync\Wcescomm.exe
   C:\Program Files\Messenger\msmsgs.exe
   C:\Program Files\Microsoft Encarta\Encarta Premium 2006\EDICT.EXE
   C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
   E:\PROGRA~1\MICROS~1\rapimgr.exe
   C:\Program Files\Common Files\Teleca Shared\Generic.exe
   C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
   E:\Program Files\Ocean Technologies & Media\GG E-Sports Platform\Garena.exe
   C:\Program Files\Internet Explorer\iexplore.exe
   C:\Program Files\Internet Explorer\iexplore.exe
   E:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
   E:\Program Files\Mozilla Firefox\firefox.exe
   E:\Program Files\Trend Micro\HijackThis\HijackThis.exe

   R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
   R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
   R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
   R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
   R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
   R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
   R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
   R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
   R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
   R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - E:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
   R3 - URLSearchHook: (no name) - {2ba521ac-b9b9-4433-ba45-dba2f02cba5a} - (no file)
   R3 - URLSearchHook: SrchHook Class - {F4F10C1D-87C7-404A-B4B3-000000000000} - E:\PROGRA~1\DAP\SBSearch.dll
   O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
   O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - E:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
   O3 - Toolbar: (no name) - {3F5A62E2-51F2-11D3-A075-CC7364CAE42A} - (no file)
   O3 - Toolbar: (no name) - {2ba521ac-b9b9-4433-ba45-dba2f02cba5a} - (no file)
   O3 - Toolbar: (no name) - {D0943516-5076-4020-A3B5-AEFAF26AB263} - (no file)
   O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
   O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
   O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
   O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
   O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
   O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
   O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
   O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
   O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
   O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
   O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
   O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
   O4 - HKLM\..\Run: [VMSnap3] C:\WINDOWS\VMSnap3.EXE
   O4 - HKLM\..\Run: [Domino] C:\WINDOWS\Domino.EXE
   O4 - HKLM\..\Run: [QuickTime Task] "E:\quicktime\QTTask.exe" -atboottime
   O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
   O4 - HKLM\..\Run: [SpeedOptimizer] "E:\Program Files\SpeedOptimizer\SPO.exe"
   O4 - HKLM\..\Run: [Gigaget] "E:\Program Files\Giganology\Gigaget\GigagetShell.exe" /s
   O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
   O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
   O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
   O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
   O4 - HKLM\..\Run: [BMe399efc2] Rundll32.exe "C:\WINDOWS\system32\eijiquwy.dll",s
   O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
   O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
   O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Documents and Settings\blaine\Local Settings\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" -inv:bootrun
   O4 - HKCU\..\Run: [H/PC Connection Agent] "E:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
   O4 - HKCU\..\Run: [Yahoo! Pager] "E:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
   O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
   O4 - HKCU\..\Run: [E06ADXRC_303078] "C:\Program Files\Microsoft Encarta\Encarta Premium 2006\EDICT.EXE" -m
   O4 - HKCU\..\Run: [zweitgeist Assistant] "E:\blaine\weblin\weblinAssistant.exe"
   O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
   O4 - HKCU\..\Run: [E06ADXRC_13977671] "C:\Program Files\Microsoft Encarta\Encarta Premium 2006\EDICT.EXE" -m
   O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (User 'SYSTEM')
   O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (User 'Default user')
   O8 - Extra context menu item: &Clean Traces - E:\Program Files\DAP\Privacy Package\dapcleanerie.htm
   O8 - Extra context menu item: &D&ownload &with BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddLink.htm
   O8 - Extra context menu item: &D&ownload all video with BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddVideo.htm
   O8 - Extra context menu item: &D&ownload all with BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
   O8 - Extra context menu item: &Download All by Gigaget - E:\Program Files\Giganology\Gigaget\getallurl.htm
   O8 - Extra context menu item: &Download by Gigaget - E:\Program Files\Giganology\Gigaget\geturl.htm
   O8 - Extra context menu item: &Download with &DAP - E:\Program Files\DAP\dapextie.htm
   O8 - Extra context menu item: Download &all with DAP - E:\Program Files\DAP\dapextie2.htm
   O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~1\INetRepl.dll
   O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~1\INetRepl.dll
   O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~1\INetRepl.dll
   O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
   O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
   O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
   O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://E:\Program Files\BitComet\tools\BitCometBHO_1.2.6.26.dll/206 (file missing)
   O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
   O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
   O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
   O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
   O10 - Unknown file in Winsock LSP: e:\progra~1\speedb~1\sblsp.dll
   O10 - Unknown file in Winsock LSP: e:\progra~1\speedb~1\sblsp.dll
   O10 - Unknown file in Winsock LSP: e:\progra~1\speedb~1\sblsp.dll
   O10 - Unknown file in Winsock LSP: e:\progra~1\speedb~1\sblsp.dll
   O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
   O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/player/install/installer.exe
   O16 - DPF: {D71F9A27-723E-4B8B-B428-B725E47CBA3E} (Imikimi_activex_plugin Control) - http://imikimi.com/download/imikimi_plugin_0.5.1.cab
   O18 - Filter: application/xhtml xml; charset=iso-8859-1 - {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll
   O18 - Filter: application/xhtml xml; charset=utf-8 - {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll
   O18 - Filter: text/xml; charset=iso-8859-1 - {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll
   O18 - Filter: text/xml; charset=utf-8 - {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll
   O20 - AppInit_DLLs: tlzotg.dll
   O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
   O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
   O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
   O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
   O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
   O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
   O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
   O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
   O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
   O23 - Service: VideoAcceleratorService - Speedbit Ltd. - E:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe

   --
   End of file - 12389 bytes

5. VG said:

   ^^ Fix following:

   O4 - HKLM\..\Run: [BMe399efc2] Rundll32.exe “C:\WINDOWS\system32\eijiquwy.dll”,s
   O20 - AppInit_DLLs: tlzotg.dll

   @Lukas
   Your log file is clean.

   @Palla Sredhar
   Your log file is also clean.

6. david said:

   Logfile of Trend Micro HijackThis v2.0.2
   Scan saved at 5:58:59 p.m., on 6/10/2008
   Platform: Windows XP SP3 (WinNT 5.01.2600)
   MSIE: Internet Explorer v7.00 (7.00.6000.16705)
   Boot mode: Normal

   Running processes:
   C:\WINDOWS\System32\smss.exe
   C:\WINDOWS\system32\winlogon.exe
   C:\WINDOWS\system32\services.exe
   C:\WINDOWS\system32\lsass.exe
   C:\WINDOWS\system32\svchost.exe
   C:\WINDOWS\System32\svchost.exe
   C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
   C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
   C:\WINDOWS\system32\ZoneLabs\vsmon.exe
   C:\Program Files\Common Files\Microsoft Shared\Ink\KeyboardSurrogate.exe
   C:\WINDOWS\SYSTEM32\WISPTIS.EXE
   C:\WINDOWS\System32\tabbtnu.exe
   C:\WINDOWS\Explorer.EXE
   C:\WINDOWS\system32\ctfmon.exe
   C:\WINDOWS\system32\spoolsv.exe
   C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
   C:\WINDOWS\system32\DVDRAMSV.exe
   C:\Program Files\TOSHIBA\TOSHIBA RAID\Service\kraidsvc.exe
   C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
   C:\WINDOWS\system32\ThpSrv.exe
   C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe
   C:\Program Files\TOSHIBA\TOSHIBA RAID\Service\krdevctl.exe
   C:\WINDOWS\system32\SearchIndexer.exe
   C:\Program Files\Common Files\Microsoft Shared\Ink\TCServer.exe
   C:\WINDOWS\system320THotkey.exe
   C:\Program Files\Toshiba\CrossMenu\CrossMenu.exe
   C:\Program Files\Common Files\Microsoft Shared\Ink\TabTip.exe
   C:\WINDOWS\system32\igfxtray.exe
   C:\WINDOWS\system32\hkcmd.exe
   C:\WINDOWS\system32\igfxpers.exe
   C:\Program Files\Apoint2K\Apoint.exe
   C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
   C:\WINDOWS\AGRSMMSG.exe
   C:\Program Files\Apoint2K\Apntex.exe
   C:\Program Files\TOSHIBA\TOSHIBA RAID\Console\Kraidman.exe
   C:\WINDOWS\system32\thpsrv.exe
   C:\WINDOWS\system32\TFNF5.exe
   C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
   C:\Program Files\TOSHIBA\TOSHIBA Rotation Utility\TRot.exe
   C:\WINDOWS\system32\TPSMain.exe
   C:\WINDOWS\system32\TPSODDCtl.exe
   C:\Program Files\TOSHIBA\TME3\TMERzCtl.EXE
   C:\Program Files\TOSHIBA\TME3\TMETEMNU.EXE
   C:\WINDOWS\system32\TPSBattM.exe
   C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe
   C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
   C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
   C:\WINDOWS\System32\DLA\DLACTRLW.EXE
   C:\Program Files\TOSHIBA\Acceleration Utilities\TAcelMgr\TAcelMgr.exe
   C:\Program Files\TOSHIBA\Acceleration Utilities\Shaker\TSkrMain.exe
   C:\Program Files\TOSHIBA\TAudEffect\TAudEff.exe
   C:\Program Files\ltmoh\Ltmoh.exe
   C:\Program Files\Protector Suite QL\psqltray.exe
   C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
   C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
   C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
   C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
   C:\WINDOWS\system32\hpnra.exe
   C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp4.exe
   C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe
   C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
   C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
   C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
   C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
   C:\Program Files\Skype\Phone\Skype.exe
   C:\WINDOWS\system32\RAMASST.exe
   C:\Program Files\Windows Desktop Search\WindowsSearch.exe
   C:\Program Files\Skype\Plugin Manager\skypePM.exe
   C:\Program Files\Internet Explorer\iexplore.exe
   C:\WINDOWS\system32\SearchProtocolHost.exe
   C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

   R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nzherald.co.nz/
   R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
   R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
   R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
   R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
   R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
   O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
   O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
   O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
   O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
   O4 - HKLM\..\Run: [TabletWizard] C:\WINDOWS\help\SplshWrp.exe
   O4 - HKLM\..\Run: [TabletTip] "C:\Program Files\Common Files\microsoft shared\ink\tabtip.exe" /resume
   O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\system320THotkey.exe
   O4 - HKLM\..\Run: [CrossMenu] C:\Program Files\Toshiba\CrossMenu\CrossMenu.exe
   O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
   O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
   O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
   O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
   O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
   O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
   O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
   O4 - HKLM\..\Run: [Kraidman] C:\Program Files\TOSHIBA\TOSHIBA RAID\Console\Kraidman.exe
   O4 - HKLM\..\Run: [ThpSrv] thpsrv /logon
   O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
   O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
   O4 - HKLM\..\Run: [TRot.exe] c:\Program Files\TOSHIBA\TOSHIBA Rotation Utility\TRot.exe
   O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
   O4 - HKLM\..\Run: [TPSODDCtl] TPSODDCtl.exe
   O4 - HKLM\..\Run: [TMESRV.EXE] C:\Program Files\TOSHIBA\TME3\TMESRV31.EXE /Logon
   O4 - HKLM\..\Run: [TMERzCtl.EXE] C:\Program Files\TOSHIBA\TME3\TMERzCtl.EXE /Service
   O4 - HKLM\..\Run: [TOSDCR] TOSDCR.EXE
   O4 - HKLM\..\Run: [TosHKCW.exe] "C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe"
   O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
   O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
   O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
   O4 - HKLM\..\Run: [TAcelMgr] C:\Program Files\TOSHIBA\Acceleration Utilities\TAcelMgr\TAcelMgr.exe
   O4 - HKLM\..\Run: [TSkrMain] C:\Program Files\TOSHIBA\Acceleration Utilities\Shaker\TSkrMain.exe
   O4 - HKLM\..\Run: [TAudEffect] C:\Program Files\TOSHIBA\TAudEffect\TAudEff.exe /run
   O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup
   O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
   O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
   O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
   O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
   O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
   O4 - HKLM\..\Run: [ScanSoft OmniPage 16-reminder] "C:\Program Files\ScanSoft\OmniPage16\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\OmniPage 16\Ereg\Ereg.ini"
   O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
   O4 - HKLM\..\Run: [HP Network Registry Agent] C:\WINDOWS\system32\hpnra.exe
   O4 - HKLM\..\Run: [FinePrint Dispatcher v4] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp4.exe
   O4 - HKLM\..\Run: [StatusClient 2.6] C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe /auto
   O4 - HKLM\..\Run: [TomcatStartup 2.5] C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe
   O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
   O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
   O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
   O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
   O4 - HKCU\..\Run: [OpAgent] "OpAgent.exe" /agent
   O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
   O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
   O4 - HKUS\S-1-5-19\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'LOCAL SERVICE')
   O4 - HKUS\S-1-5-20\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'NETWORK SERVICE')
   O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
   O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
   O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
   O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
   O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
   O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
   O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
   O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
   O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
   O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
   O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
   O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
   O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
   O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1215274947484
   O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
   O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
   O20 - Winlogon Notify: TosBtNP - C:\WINDOWS\SYSTEM32\TosBtNP.dll
   O20 - Winlogon Notify: TSigNP - C:\WINDOWS\SYSTEM32\TSigNP.dll
   O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
   O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
   O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
   O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
   O23 - Service: TOSHIBA RAID Service (kraidsvc) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA RAID\Service\kraidsvc.exe
   O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
   O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
   O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
   O23 - Service: TOSHIBA HDD Protection (Thpsrv) - TOSHIBA Corporation - C:\WINDOWS\system32\ThpSrv.exe
   O23 - Service: Tmesrv3 (Tmesrv) - TOSHIBA - C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe
   O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

   --
   End of file - 12075 bytes

7. Gurujee said:

   Logfile of Trend Micro HijackThis v2.0.2
   Scan saved at 8:40:27 PM, on 10/6/2008
   Platform: Windows XP SP2 (WinNT 5.01.2600)
   MSIE: Internet Explorer v7.00 (7.00.5730.0013)
   Boot mode: Normal

   Running processes:
   C:\WINDOWS\System32\smss.exe
   C:\WINDOWS\system32\winlogon.exe
   C:\WINDOWS\system32\services.exe
   C:\WINDOWS\system32\lsass.exe
   C:\WINDOWS\system32\svchost.exe
   C:\WINDOWS\System32\svchost.exe
   C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
   C:\WINDOWS\system32\spoolsv.exe
   C:\WINDOWS\system32\agrsmsvc.exe
   C:\WINDOWS\Explorer.EXE
   C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
   C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
   C:\WINDOWS\system32\svchost.exe
   C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
   C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
   C:\PROGRA~1\AVG\AVG8\avgtray.exe
   C:\WINDOWS\RTHDCPL.EXE
   F:\Program Files\Winamp\winampa.exe
   C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
   C:\WINDOWS\system32\ctfmon.exe
   C:\WINDOWS\system32\igfxext.exe
   C:\WINDOWS\system32\igfxsrvc.exe
   C:\PROGRA~1\AVG\AVG8\avgrsx.exe
   C:\PROGRA~1\AVG\AVG8\avgemc.exe
   C:\DOCUME~1\Gurujee\LOCALS~1\Temp\RtkBtMnt.exe
   C:\WINDOWS\system32\wuauclt.exe
   C:\Program Files\Free Download Manager\fdm.exe
   C:\Program Files\Mozilla Firefox\firefox.exe
   C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

   R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
   R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
   R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
   R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
   R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
   R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
   R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://free.avg.com/ww.registration-appf8
   O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
   O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
   O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
   O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
   O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
   O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
   O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
   O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
   O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
   O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] F:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=101208 serial=DR12WEX-1504397-KTY lang=EN
   O4 - HKLM\..\Run: [WinampAgent] "f:\Program Files\Winamp\winampa.exe"
   O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
   O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
   O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
   O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
   O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
   O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
   O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
   O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
   O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
   O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
   O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
   O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
   O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
   O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/e/37.09/HboD-mApHAo/uploader2.cab
   O16 - DPF: {4EFA317A-8569-4788-B175-5BAF9731A549} (Microsoft Virtual Server VMRC Advanced Control) - http://windowsvistatestdrive.com/SP1/ActiveX/VMRCActiveXClient1.cab
   O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
   O20 - AppInit_DLLs: avgrsstx.dll
   O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe
   O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
   O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
   O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
   O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
   O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
   O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe (file missing)
   O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

   --
   End of file - 6188 bytes

8. VG said:

   ^^ Your log file is clean.

   @david
   Your log file is also clean but you can disable many useless Toshiba startup entries to speedup your system.

9. JC said:

   Hello Vishal,
   Could you check my File? Thank you.

   Logfile of Trend Micro HijackThis v2.0.2
   Scan saved at 16:45:12, on 06/10/2008
   Platform: Windows Vista SP1 (WinNT 6.00.1905)
   MSIE: Internet Explorer v7.00 (7.00.6001.18000)
   Boot mode: Normal

   Running processes:
   C:\Windows\System32\smss.exe
   C:\Windows\system32\csrss.exe
   C:\Windows\system32\wininit.exe
   C:\Windows\system32\csrss.exe
   C:\Windows\system32\services.exe
   C:\Windows\system32\lsass.exe
   C:\Windows\system32\lsm.exe
   C:\Windows\system32\svchost.exe
   C:\Windows\system32\nvvsvc.exe
   C:\Windows\system32\winlogon.exe
   C:\Windows\system32\svchost.exe
   C:\Windows\System32\svchost.exe
   C:\Windows\System32\svchost.exe
   C:\Windows\System32\svchost.exe
   C:\Windows\system32\svchost.exe
   C:\Windows\system32\SLsvc.exe
   C:\Windows\system32\svchost.exe
   C:\Windows\system32\rundll32.exe
   C:\Windows\system32\svchost.exe
   C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
   C:\Program Files\Alwil Software\Avast4\ashServ.exe
   C:\Windows\System32\spoolsv.exe
   C:\Windows\system32\svchost.exe
   C:\Program Files\a-squared Free\a2service.exe
   C:\Windows\system32\lxdicoms.exe
   C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
   C:\Windows\system32\svchost.exe
   C:\Windows\system32\rundll32.exe
   C:\Windows\system32\svchost.exe
   C:\Program Files\ThreatFire\TFService.exe
   C:\Program Files\VistaFirewallControl\VistaFirewallService.exe
   C:\Windows\System32\svchost.exe
   C:\Windows\system32\SearchIndexer.exe
   C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
   C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
   C:\Windows\system32\taskeng.exe
   C:\Windows\system32\Dwm.exe
   C:\Windows\system32\taskeng.exe
   C:\Windows\Explorer.EXE
   C:\Program Files\Windows Defender\MSASCui.exe
   C:\Program Files\Lexmark 3500-4500 Series\lxdimon.exe
   C:\Program Files\Lexmark 3500-4500 Series\lxdiamon.exe
   C:\Windows\System32\rundll32.exe
   C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
   C:\Program Files\GreenPrint Technologies\GreenPrint World\GPPrinterNotify.exe
   C:\Program Files\Alwil Software\Avast4\ashDisp.exe
   C:\Program Files\ThreatFire\TFTray.exe
   C:\Windows\System32\rundll32.exe
   C:\Program Files\VistaFirewallControl\VistaFirewallControl.exe
   C:\Program Files\Windows Sidebar\sidebar.exe
   C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
   C:\Windows\ehome\ehtray.exe
   C:\Windows\ehome\ehmsas.exe
   C:\Program Files\Windows Sidebar\sidebar.exe
   C:\Windows\system32\taskeng.exe
   C:\Windows\system32\taskeng.exe
   C:\Windows\system32\svchost.exe
   C:\Windows\system32\wbem\wmiprvse.exe
   C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

   R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
   R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
   R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
   R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
   R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
   R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
   R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
   R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
   R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
   O1 - Hosts: ::1 localhost
   O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
   O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
   O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
   O2 - BHO: CGreenPrintPDF Object - {DF96BA30-57F6-4700-8065-910EC3BE9E3B} - C:\Program Files\GreenPrint Technologies\GreenPrint World\GPIEPlugin.dll
   O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
   O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
   O4 - HKLM\..\Run: [lxdimon.exe] "C:\Program Files\Lexmark 3500-4500 Series\lxdimon.exe"
   O4 - HKLM\..\Run: [lxdiamon] "C:\Program Files\Lexmark 3500-4500 Series\lxdiamon.exe"
   O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\\Lexmark Fax Solutions\fm3032.exe" /s
   O4 - HKLM\..\Run: [P17RunE] RunDll32 P17RunE.dll,RunDLLEntry
   O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
   O4 - HKLM\..\Run: [GPPrinterNotify] "C:\Program Files\GreenPrint Technologies\GreenPrint World\GPPrinterNotify.exe"
   O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
   O4 - HKLM\..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe
   O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
   O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
   O4 - HKLM\..\Run: [VistaFirewallControl] C:\Program Files\VistaFirewallControl\VistaFirewallControl.exe
   O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
   O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
   O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
   O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
   O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
   O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
   O4 - Global Startup: GPLog.lnk = ?
   O4 - Global Startup: GreenPrint Printer Notify.lnk = ?
   O4 - Global Startup: GreenPrint TrayIcon.lnk = ?
   O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
   O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
   O9 - Extra button: GreenPrint - {554099FE-3856-4d93-86B5-0024AEF63BC7} - C:\Program Files\GreenPrint Technologies\GreenPrint World\GPIEPlugin.dll
   O9 - Extra button: (no name) - {DF96BA30-57F6-4700-8065-910EC3BE9E3B} - (no file)
   O13 - Gopher Prefix:
   O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/download/scanner/en-us/wlscctrl2.cab
   O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/OnlineScanner.cab
   O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
   O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15105/CTPID.cab
   O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
   O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
   O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
   O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
   O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
   O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
   O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
   O23 - Service: lxdiCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxdiserv.exe
   O23 - Service: lxdi_device - - C:\Windows\system32\lxdicoms.exe
   O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
   O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
   O23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe
   O23 - Service: VistaFirewallService - Sphinx Software - C:\Program Files\VistaFirewallControl\VistaFirewallService.exe

   --
   End of file - 8441 bytes

10. david said:

    thanks VG, but there is definitely something wrong. Whenever I launch IE or change pages, my virus checker finds Exploit.Win32.PowerPlay.a in the temporary internet files. And my internet is performing eratically etc. It must be being invoked by something. How do I find the root? I did a full scan and that didnt find it

    David

Pages: [1] 2 3 4 5 … 60 » Show All

Newsletter:

Subscribe to our daily newsletter and get all the updates directly in your Inbox: