Need help removing malware leftovers

Mooo1 · May 8, 2010

I think I got rid of most of the malware with the help of the instructions on the main page. However, for some reason I can't access Google.com in either Firefox or Internet Explorer. And everytime I start-up my computer I get a weird message about some .dll file. I have all the logs and attached files. Help would be greatly appreciated, thanks!

Malwarebytes' Anti-Malware 1.45

www.malwarebytes.org

Database version: 4010

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

5/8/2010 1:40:29 PM

mbam-log-2010-05-08 (13-40-29).txt

Scan type: Quick scan

Objects scanned: 110814

Time elapsed: 6 minute(s), 29 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Documents and Settings\GERY\My Documents\downloads\Defogger.exe (Trojan.Agent) -> No action taken.

DDS (Ver_10-03-17.01) - NTFSx86

Run by German at 11:22:05.21 on Sat 05/08/2010

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_13

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2430 [GMT -4:00]

AV: Norton AntiVirus *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Gigabyte\EasySaver\ESSVR.EXE

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Norton AntiVirus\Engine\17.6.0.32\ccSvcHst.exe

C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

C:\Program Files\Norton AntiVirus\Engine\17.6.0.32\ccSvcHst.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\Program Files\IVT Corporation\BlueSoleil\StartSkysolSvc.exe

C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\STOPzilla!\STOPzilla.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\Documents and Settings\GERY\My Documents\Downloads\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com

mStart Page = hxxp://www.google.com

uInternet Settings,ProxyServer = http=127.0.0.1:5555

uInternet Settings,ProxyOverride = <local>;*.local

uURLSearchHooks: DeviceVM Url Search Hook: {0063bf63-bfff-4b8f-9d26-4267df7f17dd} - c:\windows\system32\dvmurl.dll

BHO: {16a0a56d-1f42-4c11-ab12-30e717e80657} - hajokufa.dll

TB: {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - No File

TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background

uRun: [mcexecwin] rundll32.exe c:\docume~1\gery\locals~1\temp\lrigx3.dll, RestoreWindows

mRun: [GEST]

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE

IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office10\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~2\INetRepl.dll

IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~2\INetRepl.dll

Trusted Zone: ninjavideo.net\www

DPF: {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} - hxxp://download.gigabyte.com.tw/object/Dldrv.ocx

DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.systemrequirementslab.com/srl_bin/sysreqlab_srl.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1240459484072

DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll

Notify: TPSvc - TPSvc.dll

AppInit_DLLs: fakowupu.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

LSA: Notification Packages = scecli scecli scecli fakowupu.dll

Hosts: 213.175.216.204 google.com www.google.com

Hosts: 213.175.216.205 mail.google.com

Hosts: 74.125.45.100 4-open-davinci.com

Hosts: 74.125.45.100 securitysoftwarepayments.com

Hosts: 74.125.45.100 privatesecuredpayments.com

Note: multiple HOSTS entries found. Please refer to Attach.txt

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\gery\applic~1\mozilla\firefox\profiles\s1hygsxh.default\

FF - prefs.js: browser.startup.homepage - hxxp://en-US.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official

FF - prefs.js: network.proxy.type - 4

FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nav_17.0.0.136\ipsffplgn\components\IPSFFPl.dll

FF - component: c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-4-23 64288]

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\nav\1106000.020\symds.sys [2010-4-20 328752]

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nav\1106000.020\symefa.sys [2010-4-20 172592]

R0 szkg5;szkg5;c:\windows\system32\drivers\SZKG.sys [2009-12-7 61328]

R0 szkgfs;szkgfs;c:\windows\system32\drivers\SZKGFS.sys [2010-1-27 167312]

R1 BHDrvx86;BHDrvx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nav_17.0.0.136\definitions\bashdefs\20100429.001\BHDrvx86.sys [2010-4-29 537136]

R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\nav\1106000.020\cchpx86.sys [2010-4-20 501888]

R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\nav\1106000.020\ironx86.sys [2010-4-20 116784]

R2 ES lite Service;ES lite Service for program management.;c:\program files\gigabyte\easysaver\essvr.exe [2009-4-22 68136]

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-2-4 1285864]

R2 NAV;Norton AntiVirus;c:\program files\norton antivirus\engine\17.6.0.32\ccsvchst.exe [2010-4-20 126392]

R2 RtNdPt5x;Realtek NDIS Protocol Driver;c:\windows\system32\drivers\RtNdPt5x.sys [2009-4-22 35840]

R2 Start BT in service;Start BT in service;c:\program files\ivt corporation\bluesoleil\StartSkysolSvc.exe [2007-12-27 51816]

R2 StarWindServiceAE;StarWind AE Service;c:\program files\alcohol soft\alcohol 120\starwind\StarWindServiceAE.exe [2007-5-28 275968]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-4-20 102448]

R3 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nav_17.0.0.136\definitions\ipsdefs\20100505.001\IDSXpx86.sys [2010-5-7 329592]

R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nav_17.0.0.136\definitions\virusdefs\20100508.003\NAVENG.SYS [2010-5-8 84912]

R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nav_17.0.0.136\definitions\virusdefs\20100508.003\NAVEX15.SYS [2010-5-8 1324720]

S0 cdburner;cdburner;c:\windows\system32\drivers\cdburner.sys [2009-5-10 15872]

S0 is3srv;is3srv;c:\windows\system32\drivers\is3srv.sys [2009-12-7 61328]

S0 xvyptryj;xvyptryj;c:\windows\system32\drivers\iorbcnnq.sys --> c:\windows\system32\drivers\iorbcnnq.sys [?]

S2 Ias;MicroSoft Snapshot Services;c:\windows\system32\svchost.exe -k netsvcs [2009-4-23 14336]

S2 WMOptimizer;Windows Media Optimizer;c:\windows\system32\scvhost.exe service --> c:\windows\system32\scvhost.exe service [?]

S3 BTCARD;3DSP Bluetooth Card v2.0;c:\windows\system32\drivers\btcard.sys --> c:\windows\system32\drivers\btcard.sys [?]

S3 GVTDrv;GVTDrv;c:\windows\system32\drivers\GVTDrv.sys [2009-4-22 24944]

S3 MFCARD;3DSP WLAN and BlueTooth Card;c:\windows\system32\drivers\tdspbus.sys --> c:\windows\system32\drivers\tdspbus.sys [?]

S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [2009-10-30 17408]

S3 RTLTEAMING;Realtek Intermediate Driver for Ethernet Extended Features;c:\windows\system32\drivers\RTLTEAMING.SYS [2009-4-22 28416]

S3 RTLVLAN;Realtek VLAN Intermediate Driver;c:\windows\system32\drivers\RTLVLAN.SYS [2009-4-22 17408]

S3 WLAN3DSPXP;3DSP WLAN Card;c:\windows\system32\drivers\wltbus50.sys --> c:\windows\system32\drivers\wltbus50.sys [?]

S4 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]

S4 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2010-2-17 12872]

S4 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-2-17 66632]

=============== Created Last 30 ================

2010-05-08 15:17:15 20 ----a-w- c:\documents and settings\gery\defogger_reenable

2010-04-23 06:47:10 15880 ----a-w- c:\windows\system32\lsdelete.exe

2010-04-23 04:59:09 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys

2010-04-23 04:59:06 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2010-04-23 04:57:15 0 dc-h--w- c:\docume~1\alluse~1\applic~1\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}

2010-04-23 04:56:58 0 d-----w- c:\program files\Lavasoft

2010-04-20 05:24:25 0 d-----w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com

2010-04-20 05:23:17 0 d-----w- c:\program files\SUPERAntiSpyware

2010-04-20 05:23:17 0 d-----w- c:\docume~1\gery\applic~1\SUPERAntiSpyware.com

2010-04-20 04:11:24 54016 ----a-w- c:\windows\system32\drivers\kvmg.sys

2010-04-20 03:59:25 54016 ----a-w- c:\windows\system32\drivers\kkdogce.sys

2010-04-20 03:40:21 54016 ----a-w- c:\windows\system32\drivers\thlrjuob.sys

2010-04-20 03:35:42 54016 ----a-w- c:\windows\system32\drivers\akfe.sys

2010-04-20 03:28:08 54016 ----a-w- c:\windows\system32\drivers\ovcg.sys

2010-04-20 03:16:44 54016 ----a-w- c:\windows\system32\drivers\vrueh.sys

2010-04-19 21:13:14 0 d-sh--w- c:\docume~1\alluse~1\applic~1\CUPCNCYEQA

2010-04-19 20:50:55 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-19 20:50:53 20824 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-19 20:50:53 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-04-19 20:13:23 0 d-----w- c:\docume~1\alluse~1\applic~1\9d746d8

2010-04-19 20:10:47 206677 --sh--w- c:\windows\system32\dewukobe.exe

2010-04-19 20:04:33 58 --sh--w- c:\windows\system32\User.ini

2010-04-19 20:04:23 91136 --sha-r- c:\windows\system32\cftmon .exe

2010-04-19 20:03:52 0 d-----w- c:\docume~1\gery\applic~1\0057160A8450E45B4E6757EF72C932AC

2010-04-19 16:36:30 805 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF

2010-04-19 16:36:30 7443 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT

2010-04-19 16:36:30 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL

2010-04-19 16:36:30 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS

2010-04-19 16:36:30 0 d-----w- c:\program files\Symantec

2010-04-19 16:36:30 0 d-----w- c:\program files\common files\Symantec Shared

2010-04-19 16:35:50 0 d-----w- c:\windows\system32\drivers\NAV

2010-04-19 16:35:47 0 d-----w- c:\program files\Norton AntiVirus

2010-04-19 16:35:14 0 d-----w- c:\program files\NortonInstaller

2010-04-19 16:27:16 0 d-----w- c:\docume~1\alluse~1\applic~1\NortonInstaller

2010-04-17 23:20:39 0 d-----w- c:\program files\iPod

2010-04-17 23:20:36 0 d-----w- c:\docume~1\alluse~1\applic~1\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

2010-04-17 23:14:56 0 d-----w- c:\program files\Bonjour

==================== Find3M ====================

2010-05-08 15:19:36 16608 ----a-w- c:\windows\gdrv.sys

2010-04-23 13:55:18 8832 ----a-w- c:\windows\system32\drivers\rasacd.sys

2010-04-19 16:31:28 24944 ----a-w- c:\windows\system32\drivers\GVTDrv.sys

2010-03-10 06:15:52 420352 ----a-w- c:\windows\system32\vbscript.dll

2010-02-25 06:24:37 916480 ----a-w- c:\windows\system32\wininet.dll

2010-02-16 14:08:49 2146304 ----a-w- c:\windows\system32\ntoskrnl.exe

2010-02-16 13:25:04 2024448 ----a-w- c:\windows\system32\ntkrnlpa.exe

2010-02-12 15:46:14 91424 ----a-w- c:\windows\system32\dnssd.dll

2010-02-12 15:46:14 107808 ----a-w- c:\windows\system32\dns-sd.exe

2010-02-12 04:33:11 100864 ----a-w- c:\windows\system32\6to4svc.dll

2010-02-05 06:11:56 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012010020520100206\index.dat

============= FINISH: 11:22:32.79 ===============

Attach.zip

Maniac · May 8, 2010

Hello Mooo1! Welcome to MalwareBytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

The process of cleaning your system may take some time, so please be patient.
Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
Instructions that I give are for your system only!
If you don't know or can't understand something please ask.
Do not install or uninstall any software or hardware, while work on.

Step 1:

Please follow these instructions:

http://forums.malwarebytes.org/index.php?showtopic=29028

Step 2:

Go into C:\Program Files\Malwarebytes' Anti-Malware and you will see a file called mbam.exe Right click on it and drop down to Rename change the name to firefox.com From mbam.exe to firefox.com . Please, restart your computer.

Step 3:

Launch Malwarebytes' Anti-Malware
Go to "Update" tab and select "Check for Updates". If an update is found, it will download and install the latest version.
Go to "Scanner" tab and select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

In your next reply, please include these log(s) in this sequence:

MalwareBytes' Anti-Malware log
a new fresh DDS log only

Mooo1 · May 9, 2010

Thanks for the reply, here is the info you requested.

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4084

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

5/9/2010 4:41:49 PM

mbam-log-2010-05-09 (16-41-49).txt

Scan type: Quick scan

Objects scanned: 124416

Time elapsed: 6 minute(s), 21 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a2ba40a0-74f1-52bd-f411-00b15a2c8953} (Trojan.Ertfor) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mcexecwin (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Documents and Settings\GERY\Local Settings\Temporary Internet Files\Content.IE5\9TWW2A3B\update[1].exe (Trojan.Dropper) -> Quarantined and deleted successfully.

DDS (Ver_10-03-17.01) - NTFSx86

Run by German at 16:50:00.59 on Sun 05/09/2010

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_13

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2535 [GMT -4:00]

AV: Norton AntiVirus *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\WINDOWS\system32\spoolsv.exe

c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Gigabyte\EasySaver\ESSVR.EXE

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Norton AntiVirus\Engine\17.6.0.32\ccSvcHst.exe

C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

C:\Program Files\Norton AntiVirus\Engine\17.6.0.32\ccSvcHst.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\Program Files\IVT Corporation\BlueSoleil\StartSkysolSvc.exe

C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\STOPzilla!\STOPzilla.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe