boston813 Posted March 30, 2009 ID:68558 Share Posted March 30, 2009 I have been working for a few days to get this cleaned up and I have tried a number of things including...ATF-CleanerCCleanerMalwarebytesFixwareoutAd-AwareSpybot-------------------------------------------Sample Reidrect link - http://64.5.219.20/yz/Monitor?enc=spNhqmYZ...ecid=1644981394-------------------------------------------Included is my Hijack this log in hopes that some one can help me kill the redirects.Logfile of Trend Micro HijackThis v2.0.2Scan saved at 2:46:02 AM, on 3/30/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v8.00 (8.00.6001.18702)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Nero\Nero 7\InCD\InCDsrv.exeC:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exeC:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\Program Files\Lavasoft\Ad-Aware\aawservice.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Google\Update\GoogleUpdate.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\Symantec AntiVirus\DefWatch.exeC:\WINDOWS\system32\GEARSEC.EXEC:\Program Files\Java\jre6\bin\jqs.exeC:\Program Files\Logitech\Easy Synchronization\servicestub.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exeC:\WINDOWS\system32\nvsvc32.exeC:\Program Files\Raxco\PerfectDisk\PDAgent.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Symantec AntiVirus\Rtvscan.exeC:\Program Files\Raxco\PerfectDisk\PDEngine.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\PROGRA~1\SYMANT~1\VPTray.exeC:\WINDOWS\SOUNDMAN.EXEC:\Program Files\Nero\Nero 7\InCD\InCD.exeC:\Program Files\DAEMON Tools\daemon.exeC:\WINDOWS\system32\taskswitch.exeC:\Program Files\PowerISO\PWRISOVM.EXEC:\WINDOWS\system32\RUNDLL32.EXEC:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exeC:\Program Files\Logitech\SetPoint\LBTWiz.exeC:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Java\jre6\bin\jusched.exeC:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exeC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\Program Files\PeerGuardian2\pg2.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exeC:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exeC:\Program Files\Logitech\SetPoint\SetPoint.exeC:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exeC:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXEC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXEC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS\system32\NOTEPAD.EXEC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.localO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exeO4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [inCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exeO4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exeO4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXEO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exeO4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXEO4 - HKLM\..\Run: [bluetooth Connection Assistant] LBTWIZ.EXE -silentO4 - HKLM\..\Run: [Easy Synchronization] C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exeO4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"O4 - HKLM\..\RunOnce: [Easy Synchronization] C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe --portsO4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeO4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exeO4 - HKCU\..\Run: [steam] "d:\hl game install\steam.exe" -silentO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytrayO4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exeO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exeO4 - Global Startup: Bluetooth.lnk = ?O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exeO4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exeO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htmO9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (file missing)O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htmO9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htmO9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dllO9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dllO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dllO18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLLO20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dllO20 - Winlogon Notify: jkkLFxvW - jkkLFxvW.dll (file missing)O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exeO23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeO23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exeO23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\system32\GEARSEC.EXEO23 - Service: Google Update Service (gupdate1c960b8a4041630) (gupdate1c960b8a4041630) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exeO23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exeO23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exeO23 - Service: Logitech Easy Synchronization - Unknown owner - C:\Program Files\Logitech\Easy Synchronization\servicestub.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exeO23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exeO23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exeO23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exeO23 - Service: ServiceLayer - Unknown owner - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (file missing)O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeO23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeO23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe--End of file - 11167 bytes Link to post Share on other sites More sharing options...
boston813 Posted March 30, 2009 Author ID:68559 Share Posted March 30, 2009 Also adding the startuplistStartupList report, 3/30/2009, 1:00:47 AMStartupList version: 1.52.2Started from : C:\Program Files\Trend Micro\HijackThis\HijackThis.EXEDetected: Windows XP SP3 (WinNT 5.01.2600)Detected: Internet Explorer v7.00 (7.00.6000.16791)* Using default options* Including empty and uninteresting sections* Showing rarely important sections==================================================Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Nero\Nero 7\InCD\InCDsrv.exeC:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\Program Files\Symantec AntiVirus\DefWatch.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\Program Files\Logitech\Easy Synchronization\servicestub.exeC:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\WINDOWS\system32\nvsvc32.exeC:\Program Files\Raxco\PerfectDisk\PDAgent.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Symantec AntiVirus\Rtvscan.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\PROGRA~1\SYMANT~1\VPTray.exeC:\WINDOWS\SOUNDMAN.EXEC:\WINDOWS\system32\taskswitch.exeC:\WINDOWS\system32\RUNDLL32.EXEC:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\Java\jre6\bin\jusched.exeC:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exeC:\Program Files\Logitech\SetPoint\SetPoint.exeC:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXEC:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\explorer.exeC:\WINDOWS\system32\taskmgr.exeC:\WINDOWS\system32\wscntfy.exeC:\Program Files\Lavasoft\Ad-Aware\aawservice.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\Trend Micro\HijackThis\HijackThis.exe--------------------------------------------------Listing of startup folders:Shell folders Startup:[C:\Documents and Settings\Boston813\Start Menu\Programs\Startup]*No files*Shell folders AltStartup:*Folder not found*User shell folders Startup:*Folder not found*User shell folders AltStartup:*Folder not found*Shell folders Common Startup:[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exeAdobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exeBluetooth.lnk = ?Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exeLogitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exeShell folders Common AltStartup:*Folder not found*User shell folders Common Startup:*Folder not found*User shell folders Alternate Common Startup:*Folder not found*--------------------------------------------------Checking Windows NT UserInit:[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]UserInit = C:\WINDOWS\system32\userinit.exe,[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]*Registry key not found*[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]*Registry value not found*[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]*Registry key not found*--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows\CurrentVersion\RunccApp = "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"vptray = C:\PROGRA~1\SYMANT~1\VPTray.exeSoundMan = SOUNDMAN.EXENeroFilterCheck = C:\WINDOWS\system32\NeroCheck.exeInCD = C:\Program Files\Nero\Nero 7\InCD\InCD.exeDAEMON Tools = "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033CoolSwitch = C:\WINDOWS\system32\taskswitch.exePWRISOVM.EXE = C:\Program Files\PowerISO\PWRISOVM.EXENvCplDaemon = RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupnwiz = nwiz.exe /installNvMediaCenter = RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInitHPDJ Taskbar Utility = C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exeKernel and Hardware Abstraction Layer = KHALMNPR.EXEBluetooth Connection Assistant = LBTWIZ.EXE -silentEasy Synchronization = C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exeQuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottimeiTunesHelper = "C:\Program Files\iTunes\iTunesHelper.exe"SunJavaUpdateSched = "C:\Program Files\Java\jre6\bin\jusched.exe"--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEasy Synchronization = C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe --ports--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx*No values found*--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices*Registry key not found*--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce*Registry key not found*--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows\CurrentVersion\RunBgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} = "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"swg = C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exePeerGuardian = C:\Program Files\PeerGuardian2\pg2.exeSteam = "d:\hl game install\steam.exe" -silentctfmon.exe = C:\WINDOWS\system32\ctfmon.exePC Suite Tray = "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytraySUPERAntiSpyware = C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce*No values found*--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx*Registry key not found*--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices*Registry key not found*--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce*Registry key not found*--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run*Registry key not found*--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run*Registry key not found*--------------------------------------------------Autorun entries in Registry subkeys of:HKLM\Software\Microsoft\Windows\CurrentVersion\Run[OptionalComponents]*No values found*--------------------------------------------------Autorun entries in Registry subkeys of:HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce*No subkeys found*--------------------------------------------------Autorun entries in Registry subkeys of:HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx*No subkeys found*--------------------------------------------------Autorun entries in Registry subkeys of:HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices*Registry key not found*--------------------------------------------------Autorun entries in Registry subkeys of:HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce*Registry key not found*--------------------------------------------------Autorun entries in Registry subkeys of:HKCU\Software\Microsoft\Windows\CurrentVersion\Run*No subkeys found*--------------------------------------------------Autorun entries in Registry subkeys of:HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce*No subkeys found*--------------------------------------------------Autorun entries in Registry subkeys of:HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx*Registry key not found*--------------------------------------------------Autorun entries in Registry subkeys of:HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices*Registry key not found*--------------------------------------------------Autorun entries in Registry subkeys of:HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce*Registry key not found*--------------------------------------------------Autorun entries in Registry subkeys of:HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run*Registry key not found*--------------------------------------------------Autorun entries in Registry subkeys of:HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run*Registry key not found*--------------------------------------------------File association entry for .EXE:HKEY_CLASSES_ROOT\exefile\shell\open\command(Default) = "%1" %*--------------------------------------------------File association entry for .COM:HKEY_CLASSES_ROOT\comfile\shell\open\command(Default) = "%1" %*--------------------------------------------------File association entry for .BAT:HKEY_CLASSES_ROOT\batfile\shell\open\command(Default) = "%1" %*--------------------------------------------------File association entry for .PIF:HKEY_CLASSES_ROOT\piffile\shell\open\command(Default) = "%1" %*--------------------------------------------------File association entry for .SCR:HKEY_CLASSES_ROOT\scrfile\shell\open\command(Default) = "%1" /S--------------------------------------------------File association entry for .HTA:HKEY_CLASSES_ROOT\htafile\shell\open\command(Default) = C:\WINDOWS\system32\mshta.exe "%1" %*--------------------------------------------------File association entry for .TXT:HKEY_CLASSES_ROOT\txtfile\shell\open\command(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1--------------------------------------------------Enumerating Active Setup stub paths:HKLM\Software\Microsoft\Active Setup\Installed Components(* = disabled by HKCU twin)[<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] *StubPath = C:\WINDOWS\system32\ieudinit.exe[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP[>{26923b43-4d38-484f-9b9e-de460746276c}] *StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] *StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT[{5945c046-1e7d-11d1-bc44-00c04fd912be}] *StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub[{7790769C-0471-11d2-AF11-00C04FA35D02}] *StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install[{89820200-ECBD-11cf-8B85-00AA005B4340}] *StubPath = regsvr32.exe /s /n /i:U shell32.dll[{89820200-ECBD-11cf-8B85-00AA005B4383}] *StubPath = C:\WINDOWS\system32\ie4uinit.exe -BaseSettings[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *StubPath = C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install--------------------------------------------------Enumerating ICQ Agent Autostart apps:HKCU\Software\Mirabilis\ICQ\Agent\Apps*Registry key not found*--------------------------------------------------Load/Run keys from C:\WINDOWS\WIN.INI:load=*INI section not found*run=*INI section not found*Load/Run keys from Registry:HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*HKCU\..\Windows NT\CurrentVersion\Windows: load=HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=--------------------------------------------------Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:Shell=*INI section not found*SCRNSAVE.EXE=*INI section not found*drivers=*INI section not found*Shell & screensaver key from Registry:Shell=Explorer.exeSCRNSAVE.EXE=C:\WINDOWS\System32\ssstars.scrdrivers=*Registry value not found*Policies Shell key:HKCU\..\Policies: Shell=*Registry key not found*HKLM\..\Policies: Shell=*Registry value not found*--------------------------------------------------Checking for EXPLORER.EXE instances:C:\WINDOWS\Explorer.exe: PRESENT!C:\Explorer.exe: not presentC:\WINDOWS\Explorer\Explorer.exe: not presentC:\WINDOWS\System\Explorer.exe: not presentC:\WINDOWS\System32\Explorer.exe: not presentC:\WINDOWS\Command\Explorer.exe: not presentC:\WINDOWS\Fonts\Explorer.exe: not present--------------------------------------------------Checking for superhidden extensions:.lnk: HIDDEN! (arrow overlay: yes).pif: HIDDEN! (arrow overlay: yes).exe: not hidden.com: not hidden.bat: not hidden.hta: not hidden.scr: not hidden.shs: HIDDEN!.shb: HIDDEN!.vbs: not hidden.vbe: not hidden.wsh: not hidden.scf: HIDDEN! (arrow overlay: NO!).url: HIDDEN! (arrow overlay: yes).js: not hidden.jse: not hidden--------------------------------------------------Verifying REGEDIT.EXE integrity:- Regedit.exe found in C:\WINDOWS- .reg open command is normal (regedit.exe %1)- Company name OK: 'Microsoft Corporation'- Original filename OK: 'REGEDIT.EXE'- File description: 'Registry Editor'Registry check passed--------------------------------------------------Enumerating Browser Helper Objects:Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll - {22BF413B-C6D2-4d91-82A9-A0F997BA588C}(no name) - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll - {AA58ED58-01DD-4d91-8333-CF10577473F7}(no name) - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}Google Dictionary Compression sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E}(no name) - C:\Program Files\Java\jre6\bin\jp2ssv.dll - {DBC80044-A445-435b-BC74-9C25C1C588A9}JQSIEStartDetectorImpl - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll - {E7E6F031-17CE-4C07-BC86-EABFE594F69C}--------------------------------------------------Enumerating Task Scheduler jobs:AppleSoftwareUpdate.jobGoogle Software Updater.jobGoogleUpdateTaskMachine.job--------------------------------------------------Enumerating Download Program Files:[shockwave ActiveX Control]InProcServer32 = C:\WINDOWS\system32\Adobe\Director\swdir.dllCODEBASE = http://fpdownload.macromedia.com/get/shock...director/sw.cab[Java Plug-in 1.6.0_13]InProcServer32 = C:\Program Files\Java\jre6\bin\jp2iexp.dllCODEBASE = http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab[{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}]CODEBASE = http://fpdownload.macromedia.com/get/flash...r/ultrashim.cab[Java Plug-in 1.5.0_06]InProcServer32 = C:\Program Files\Java\jre6\bin\jp2iexp.dllCODEBASE = http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab[Java Plug-in 1.6.0_03]InProcServer32 = C:\Program Files\Java\jre6\bin\jp2iexp.dllCODEBASE = http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab[Java Plug-in 1.6.0_05]InProcServer32 = C:\Program Files\Java\jre6\bin\jp2iexp.dllCODEBASE = http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab[Java Plug-in 1.6.0_07]InProcServer32 = C:\Program Files\Java\jre6\bin\jp2iexp.dllCODEBASE = http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab[Java Plug-in 1.6.0_13]InProcServer32 = C:\Program Files\Java\jre6\bin\jp2iexp.dllCODEBASE = http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab[Java Plug-in 1.6.0_13]InProcServer32 = C:\Program Files\Java\jre6\bin\npjpi160_13.dllCODEBASE = http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab--------------------------------------------------Enumerating Winsock LSP files:NameSpace #1: C:\WINDOWS\System32\mswsock.dllNameSpace #2: C:\WINDOWS\System32\winrnr.dllNameSpace #3: C:\WINDOWS\System32\mswsock.dllNameSpace #4: C:\Program Files\Bonjour\mdnsNSP.dllProtocol #1: C:\WINDOWS\system32\mswsock.dllProtocol #2: C:\WINDOWS\system32\mswsock.dllProtocol #3: C:\WINDOWS\system32\mswsock.dllProtocol #4: C:\WINDOWS\system32\rsvpsp.dllProtocol #5: C:\WINDOWS\system32\rsvpsp.dllProtocol #6: C:\WINDOWS\system32\mswsock.dllProtocol #7: C:\WINDOWS\system32\mswsock.dllProtocol #8: C:\WINDOWS\system32\mswsock.dllProtocol #9: C:\WINDOWS\system32\mswsock.dllProtocol #10: C:\WINDOWS\system32\mswsock.dllProtocol #11: C:\WINDOWS\system32\mswsock.dllProtocol #12: C:\WINDOWS\system32\mswsock.dllProtocol #13: C:\WINDOWS\system32\mswsock.dllProtocol #14: C:\WINDOWS\system32\mswsock.dllProtocol #15: C:\WINDOWS\system32\mswsock.dll--------------------------------------------------Enumerating Windows NT/2000/XP servicesLavasoft Ad-Aware Service: "C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe" (autostart)Microsoft ACPI Driver: System32\DRIVERS\ACPI.sys (system)Microsoft Kernel Acoustic Echo Canceller: system32\drivers\aec.sys (manual start)AFD Networking Support Environment: \SystemRoot\System32\drivers\afd.sys (system)Service for Realtek AC97 Audio (WDM): system32\drivers\ALCXWDM.SYS (manual start)Alerter: %SystemRoot%\System32\svchost.exe -k LocalService (disabled)Application Layer Gateway Service: %SystemRoot%\System32\alg.exe (manual start)AMD Processor Driver: system32\DRIVERS\AmdK8.sys (system)Apple Mobile Device: "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe" (autostart)Application Management: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)ASP.NET State Service: %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (manual start)RAS Asynchronous Media Driver: System32\DRIVERS\asyncmac.sys (manual start)Standard IDE/ESDI Hard Disk Controller: System32\DRIVERS\atapi.sys (system)ATM ARP Client Protocol: System32\DRIVERS\atmarpc.sys (manual start)Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Audio Stub Driver: System32\DRIVERS\audstub.sys (manual start)Background Intelligent Transfer Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)Bonjour Service: "C:\Program Files\Bonjour\mDNSResponder.exe" (autostart)MAC Bridge: system32\DRIVERS\bridge.sys (manual start)MAC Bridge Miniport: System32\DRIVERS\bridge.sys (manual start)Computer Browser: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Bluetooth Audio Device: system32\drivers\btaudio.sys (manual start)Bluetooth Virtual Communications Driver: system32\DRIVERS\btport.sys (manual start)Bluetooth Bus Enumerator: system32\DRIVERS\btkrnl.sys (manual start)Bluetooth Service: C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe (autostart)btwhid: system32\DRIVERS\btwhid.sys (manual start)WIDCOMM USB Bluetooth Driver: System32\Drivers\btwusb.sys (manual start)Closed Caption Decoder: system32\DRIVERS\CCDECODE.sys (manual start)Symantec Event Manager: "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe" (autostart)Symantec Password Validation: "C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe" (manual start)Symantec Settings Manager: "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe" (autostart)CD-ROM Driver: System32\DRIVERS\cdrom.sys (system)Indexing Service: C:\WINDOWS\System32\cisvc.exe (manual start)ClipBook: %SystemRoot%\system32\clipsrv.exe (disabled).NET Runtime Optimization Service v2.0.50727_X86: C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (manual start)COM+ System Application: C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start)Cryptographic Services: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)iP2937 USB Camera: System32\Drivers\iP293x.sys (manual start)DCOM Server Process Launcher: %SystemRoot%\system32\svchost -k DcomLaunch (autostart)Symantec AntiVirus Definition Watcher: "C:\Program Files\Symantec AntiVirus\DefWatch.exe" (autostart)DHCP Client: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Disk Driver: System32\DRIVERS\disk.sys (system)Logical Disk Manager Administrative Service: %SystemRoot%\System32\dmadmin.exe /com (manual start)dmboot: System32\drivers\dmboot.sys (disabled)Logical Disk Manager Driver: System32\drivers\dmio.sys (system)dmload: System32\drivers\dmload.sys (system)Logical Disk Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Microsoft Kernel DLS Syntheiszer: system32\drivers\DMusic.sys (manual start)DNS Client: %SystemRoot%\System32\svchost.exe -k NetworkService (autostart)Wired AutoConfig: %SystemRoot%\System32\svchost.exe -k dot3svc (manual start)Microsoft Kernel DRM Audio Descrambler: system32\drivers\drmkaud.sys (manual start)Extensible Authentication Protocol Service: %SystemRoot%\System32\svchost.exe -k eapsvcs (manual start)Symantec Eraser Control driver: \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (system)EraserUtilRebootDrv: \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (manual start)Error Reporting Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Event Log: %SystemRoot%\system32\services.exe (autostart)COM+ Event System: C:\WINDOWS\System32\svchost.exe -k netsvcs (manual start)Fast User Switching Compatibility: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)Floppy Disk Controller Driver: System32\DRIVERS\fdc.sys (manual start)Floppy Disk Driver: System32\DRIVERS\flpydisk.sys (manual start)FltMgr: system32\drivers\fltmgr.sys (system)Windows Presentation Foundation Font Cache 3.0.0.0: C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe (manual start)Volume Manager Driver: System32\DRIVERS\ftdisk.sys (system)Game Port Enumerator: System32\DRIVERS\gameenum.sys (manual start)GEAR ASPI Filter Driver: System32\Drivers\GEARAspiWDM.sys (manual start)GEARSecurity: C:\WINDOWS\system32\GEARSEC.EXE (autostart)Generic Packet Classifier: System32\DRIVERS\msgpc.sys (manual start)Google Update Service (gupdate1c960b8a4041630): "C:\Program Files\Google\Update\GoogleUpdate.exe" /svc (autostart)Google Software Updater: "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe" (autostart)Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)HID Input Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Microsoft HID Class Driver: System32\DRIVERS\hidusb.sys (manual start)Health Key and Certificate Management Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)HTTP: System32\Drivers\HTTP.sys (manual start)HTTP SSL: %SystemRoot%\System32\svchost.exe -k HTTPFilter (manual start)i8042 Keyboard and PS/2 Mouse Port Driver: System32\DRIVERS\i8042prt.sys (system)Windows CardSpace: "C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe" (manual start)imagedrv: System32\Drivers\imagedrv.sys (system)imagesrv: system32\DRIVERS\imagesrv.sys (system)CD-Burning Filter Driver: system32\DRIVERS\imapi.sys (system)IMAPI CD-Burning COM Service: C:\WINDOWS\System32\imapi.exe (manual start)InCD File System: system32\drivers\InCDFs.sys (disabled)InCDPass: system32\drivers\InCDPass.sys (system)InCD Reader: system32\drivers\InCDRm.sys (system)InCD Helper: C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe (autostart)IPv6 Windows Firewall Driver: system32\drivers\ip6fw.sys (manual start)IP Traffic Filter Driver: System32\DRIVERS\ipfltdrv.sys (manual start)IP in IP Tunnel Driver: System32\DRIVERS\ipinip.sys (manual start)IP Network Address Translator: System32\DRIVERS\ipnat.sys (manual start)iPod Service: "C:\Program Files\iPod\bin\iPodService.exe" (manual start)IPSEC driver: System32\DRIVERS\ipsec.sys (system)IR Enumerator Service: System32\DRIVERS\irenum.sys (manual start)PnP ISA/EISA Bus Driver: System32\DRIVERS\isapnp.sys (system)Java Quick Starter: "C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf" (autostart)Keyboard Class Driver: System32\DRIVERS\kbdclass.sys (system)Keyboard HID Driver: system32\DRIVERS\kbdhid.sys (system)Microsoft Kernel Wave Audio Mixer: system32\drivers\kmixer.sys (manual start)Logitech SetPoint Keyboard Driver: system32\DRIVERS\L8042Kbd.sys (manual start)Server: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Workstation: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Logitech Bluetooth Service: C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (autostart)Logitech SetPoint KMDF HID Filter Driver: system32\DRIVERS\LHidFilt.Sys (manual start)TCP/IP NetBIOS Helper: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)Logitech SetPoint KMDF Mouse Filter Driver: system32\DRIVERS\LMouFilt.Sys (manual start)Logitech Easy Synchronization: C:\Program Files\Logitech\Easy Synchronization\servicestub.exe (autostart)Machine Debug Manager: "C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" (autostart)Messenger: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)NetMeeting Remote Desktop Sharing: C:\WINDOWS\System32\mnmsrvc.exe (manual start)Mouse Class Driver: System32\DRIVERS\mouclass.sys (system)Mouse HID Driver: System32\DRIVERS\mouhid.sys (manual start)WebDav Client Redirector: System32\DRIVERS\mrxdav.sys (manual start)MRXSMB: System32\DRIVERS\mrxsmb.sys (system)Distributed Transaction Coordinator: C:\WINDOWS\System32\msdtc.exe (manual start)Windows Installer: C:\WINDOWS\system32\msiexec.exe /V (manual start)Microsoft Streaming Service Proxy: system32\drivers\MSKSSRV.sys (manual start)Microsoft Streaming Clock Proxy: system32\drivers\MSPCLOCK.sys (manual start)Microsoft Streaming Quality Manager Proxy: system32\drivers\MSPQM.sys (manual start)Microsoft System Management BIOS Driver: System32\DRIVERS\mssmbios.sys (manual start)Microsoft Streaming Tee/Sink-to-Sink Converter: system32\drivers\MSTEE.sys (manual start)Microsoft MPU-401 MIDI UART Driver: system32\drivers\msmpu401.sys (manual start)ATK0110 ACPI UTILITY: system32\DRIVERS\ASACPI.sys (manual start)NABTS/FEC VBI Codec: system32\DRIVERS\NABTSFEC.sys (manual start)Network Access Protection Agent: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)NAVENG: \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20090327.005\naveng.sys (manual start)NAVEX15: \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20090327.005\navex15.sys (manual start)Microsoft TV/Video Connection: system32\DRIVERS\NdisIP.sys (manual start)Remote Access NDIS TAPI Driver: System32\DRIVERS\ndistapi.sys (manual start)NDIS Usermode I/O Protocol: System32\DRIVERS\ndisuio.sys (manual start)Remote Access NDIS WAN Driver: System32\DRIVERS\ndiswan.sys (manual start)NetBIOS Interface: System32\DRIVERS\netbios.sys (system)NetBios over Tcpip: System32\DRIVERS\netbt.sys (system)Network DDE: %SystemRoot%\system32\netdde.exe (disabled)Network DDE DSDM: %SystemRoot%\system32\netdde.exe (disabled)Net Logon: %SystemRoot%\System32\lsass.exe (manual start)Network Connections: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)Net.Tcp Port Sharing Service: "C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe" (disabled)Network Location Awareness (NLA): %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)NT LM Security Support Provider: %SystemRoot%\System32\lsass.exe (manual start)Removable Storage: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)nv: system32\DRIVERS\nv4_mini.sys (manual start)NVIDIA nForce Networking Controller Driver: system32\DRIVERS\NVENETFD.sys (manual start)NVIDIA Network Bus Enumerator: system32\DRIVERS\nvnetbus.sys (manual start)NVIDIA Display Driver Service: %SystemRoot%\system32\nvsvc32.exe (autostart)IPX Traffic Filter Driver: System32\DRIVERS\nwlnkflt.sys (manual start)IPX Traffic Forwarder Driver: System32\DRIVERS\nwlnkfwd.sys (manual start)Office Source Engine: "C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE" (manual start)Parallel port driver: System32\DRIVERS\parport.sys (manual start)PCCS Mode Change Filter Driver: system32\DRIVERS\pccsmcfd.sys (manual start)PCI Bus Driver: System32\DRIVERS\pci.sys (system)PCIIde: System32\DRIVERS\pciide.sys (system)PDAgent: "C:\Program Files\Raxco\PerfectDisk\PDAgent.exe" (autostart)PDEngine: "C:\Program Files\Raxco\PerfectDisk\PDEngine.exe" (manual start)pgfilter: \??\C:\Program Files\PeerGuardian2\pgfilter.sys (manual start)Plug and Play: %SystemRoot%\system32\services.exe (autostart)IPSEC Services: %SystemRoot%\System32\lsass.exe (autostart)WAN Miniport (PPTP): System32\DRIVERS\raspptp.sys (manual start)D-Link Air DWL-122 Wireless USB Adapter Driver: System32\DRIVERS\PRISMUSB.sys (manual start)Processor Driver: System32\DRIVERS\processr.sys (system)Protected Storage: %SystemRoot%\system32\lsass.exe (autostart)QoS Packet Scheduler: System32\DRIVERS\psched.sys (manual start)Direct Parallel Link Driver: System32\DRIVERS\ptilink.sys (manual start)PxHelp20: System32\Drivers\PxHelp20.sys (system)Remote Access Auto Connection Driver: System32\DRIVERS\rasacd.sys (system)Remote Access Auto Connection Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)WAN Miniport (L2TP): System32\DRIVERS\rasl2tp.sys (manual start)Remote Access Connection Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)Remote Access PPPOE Driver: System32\DRIVERS\raspppoe.sys (manual start)Direct Parallel: System32\DRIVERS\raspti.sys (manual start)Rdbss: System32\DRIVERS\rdbss.sys (system)RDPCDD: System32\DRIVERS\RDPCDD.sys (system)Terminal Server Device Redirector Driver: System32\DRIVERS\rdpdr.sys (manual start)Remote Desktop Help Session Manager: C:\WINDOWS\system32\sessmgr.exe (manual start)Digital CD Audio Playback Filter Driver: System32\DRIVERS\redbook.sys (system)Routing and Remote Access: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)Remote Registry: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)Microsoft Legacy Modem Driver: System32\Drivers\RootMdm.sys (manual start)Remote Procedure Call (RPC) Locator: %SystemRoot%\System32\locator.exe (manual start)Remote Procedure Call (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)QoS RSVP: %SystemRoot%\System32\rsvp.exe (manual start)SABProcEnum: \??\C:\Program Files\Internet Explorer\SABProcEnum.sys (manual start)Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)SASDIFSV: \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS (system)SASENUM: \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS (manual start)SASKUTIL: \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys (system)SAVRoam: "C:\Program Files\Symantec AntiVirus\SavRoam.exe" (manual start)SAVRT: \??\C:\Program Files\Symantec AntiVirus\savrt.sys (system)SAVRTPEL: \??\C:\Program Files\Symantec AntiVirus\Savrtpel.sys (system)Smart Card: %SystemRoot%\System32\SCardSvr.exe (manual start)Task Scheduler: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Secdrv: System32\DRIVERS\secdrv.sys (manual start)Secondary Logon: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)Serenum Filter Driver: System32\DRIVERS\serenum.sys (manual start)Serial port driver: System32\DRIVERS\serial.sys (system)ServiceLayer: "C:\Program Files\PC Connectivity Solution\ServiceLayer.exe" (manual start)Windows Firewall/Internet Connection Sharing (ICS): %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Shell Hardware Detection: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)BDA Slip De-Framer: system32\DRIVERS\SLIP.sys (manual start)Symantec Network Drivers Service: "C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe" (manual start)Sony USB Filter Driver (SONYPVU1): system32\DRIVERS\SONYPVU1.SYS (manual start)SPBBCDrv: \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (manual start)Symantec SPBBCSvc: "C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe" (manual start)Microsoft Kernel Audio Splitter: system32\drivers\splitter.sys (manual start)Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)sptd: System32\Drivers\sptd.sys (system)System Restore Filter Driver: \SystemRoot\System32\DRIVERS\sr.sys (disabled)System Restore Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Srv: System32\DRIVERS\srv.sys (manual start)SSDP Discovery Service: %SystemRoot%\System32\svchost.exe -k LocalService (manual start)Windows Image Acquisition (WIA): %SystemRoot%\System32\svchost.exe -k imgsvc (autostart)BDA IPSink: system32\DRIVERS\StreamIP.sys (manual start)Software Bus Driver: System32\DRIVERS\swenum.sys (manual start)Microsoft Kernel GS Wavetable Synthesizer: system32\drivers\swmidi.sys (manual start)MS Software Shadow Copy Provider: C:\WINDOWS\System32\dllhost.exe /Processid:{B54A7310-A96B-47C8-9105-3818E909C902} (manual start)Symantec AntiVirus: "C:\Program Files\Symantec AntiVirus\Rtvscan.exe" (autostart)SymEvent: \??\C:\Program Files\Symantec\SYMEVENT.SYS (manual start)SYMREDRV: \SystemRoot\System32\Drivers\SYMREDRV.SYS (manual start)SYMTDI: \SystemRoot\System32\Drivers\SYMTDI.SYS (system)Microsoft Kernel System Audio Device: system32\drivers\sysaudio.sys (manual start)Performance Logs and Alerts: %SystemRoot%\system32\smlogsvc.exe (manual start)Telephony: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)TCP/IP Protocol Driver: System32\DRIVERS\tcpip.sys (system)Terminal Device Driver: System32\DRIVERS\termdd.sys (system)Terminal Services: %SystemRoot%\System32\svchost -k DComLaunch (manual start)Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Telnet: C:\WINDOWS\System32\tlntsvr.exe (manual start)Distributed Link Tracking Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)Microcode Update Driver: System32\DRIVERS\update.sys (manual start)Universal Plug and Play Device Host: %SystemRoot%\System32\svchost.exe -k LocalService (manual start)Uninterruptible Power Supply: %SystemRoot%\System32\ups.exe (manual start)Apple Mobile USB Driver: System32\Drivers\usbaapl.sys (manual start)USB Audio Driver (WDM): system32\drivers\usbaudio.sys (manual start)Microsoft USB Generic Parent Driver: system32\DRIVERS\usbccgp.sys (manual start)Microsoft USB 2.0 Enhanced Host Controller Miniport Driver: system32\DRIVERS\usbehci.sys (manual start)Microsoft USB Standard Hub Driver: System32\DRIVERS\usbhub.sys (manual start)Microsoft USB Open Host Controller Miniport Driver: System32\DRIVERS\usbohci.sys (manual start)Microsoft USB PRINTER Class: system32\DRIVERS\usbprint.sys (manual start)USB Mass Storage Driver: system32\DRIVERS\USBSTOR.SYS (manual start)USBVSP: system32\drivers\Usbvsp.sys (manual start)VGA Display Controller.: \SystemRoot\System32\drivers\vga.sys (system)Virtual Serial Bus Enumerator: system32\DRIVERS\vsb.sys (manual start)ELTIMA Virtual Serial Ports Driver: System32\DRIVERS\vserial.sys (manual start)Volume Shadow Copy: %SystemRoot%\System32\vssvc.exe (manual start)Windows Time: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Remote Access IP ARP Driver: System32\DRIVERS\wanarp.sys (manual start)Wdf01000: system32\DRIVERS\Wdf01000.sys (manual start)Microsoft WINMM WDM Audio Compatibility Driver: system32\drivers\wdmaud.sys (manual start)WebClient: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)Windows Management Instrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart)Portable Media Serial Number Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)Windows Management Instrumentation Driver Extensions: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)WMI Performance Adapter: C:\WINDOWS\System32\wbem\wmiapsrv.exe (manual start)Windows Media Player Network Sharing Service: "C:\Program Files\Windows Media Player\WMPNetwk.exe" (manual start)Security Center: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)World Standard Teletext Codec: system32\DRIVERS\WSTCODEC.SYS (manual start)Automatic Updates: %systemRoot%\System32\svchost.exe -k netsvcs (autostart)Windows Driver Foundation - User-mode Driver Framework Platform Driver: system32\DRIVERS\WudfPf.sys (system)Windows Driver Foundation - User-mode Driver Framework Reflector: system32\DRIVERS\wudfrd.sys (manual start)Windows Driver Foundation - User-mode Driver Framework: %SystemRoot%\system32\svchost.exe -k WudfServiceGroup (autostart)Wireless Zero Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Network Provisioning Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)--------------------------------------------------Enumerating Windows NT logon/logoff scripts:*No scripts set to run*Windows NT checkdisk command:BootExecute = PDBoot.exeWindows NT 'Wininit.ini':PendingFileRenameOperations: *Registry value not found*--------------------------------------------------Enumerating ShellServiceObjectDelayLoad items:PostBootReminder: C:\WINDOWS\system32\SHELL32.dllCDBurn: C:\WINDOWS\system32\SHELL32.dllWebCheck: C:\WINDOWS\system32\webcheck.dllSysTray: C:\WINDOWS\System32\stobject.dllWPDShServiceObj: C:\WINDOWS\system32\WPDShServiceObj.dll--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run*Registry key not found*--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run*Registry key not found*--------------------------------------------------End of report, 42,130 bytesReport generated in 0.140 secondsCommand line options: /verbose - to add additional info on each section /complete - to include empty sections and unsuspicious data /full - to include several rarely-important sections /force9x - to include Win9x-only startups even if running on WinNT /forcent - to include WinNT-only startups even if running on Win9x /forceall - to include all Win9x and WinNT startups, regardless of platform /history - to list version history only Link to post Share on other sites More sharing options...
Recommended Posts