Recurring Infection: I think a Tracur.F Trojan

November 15, 2011

Hi guys,

I've had a recurring infection now for about three weeks. The main symptom is a google search link redirect in firefox. I have been prompted several time to allow 'XUL Cache' in firefox, but I never allow it. It somehow did manage to get into my addons, but I removed it.

Ive run combofix and ESET scanner which always seem to solve the problem, but only for a few days and the infection returns again.

ESET always reports fining a 'Win32/Trojan Downloader Tracur.F.Trojan'

I think I need to go through a stepwise solution to find out how the problem keeps reoccurring and what to eliminate.

Malwarebytes never finds anything, nor does TDSS Killer, Hitman Pro, Adaware, Power eraser, Spybot, etc. AVG never finds anything nor does it alert me when it's going on. Kind of at my wits end. Dont want to really do a full OS wipe & reinstall if I can help it.

I appreciate any help in advance. Below is my DDS log and attached is my zipped attach.txt

Thanks so much, Jeff

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_23

Run by Jeff Pierce at 9:55:19 on 2011-11-15

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1160 [GMT -5:00]

.

AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Nhksrv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

svchost.exe

C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe

C:\Program Files\LogMeIn\x86\RaMaint.exe

C:\Program Files\LogMeIn\x86\LogMeIn.exe

C:\Program Files\CDBurnerXP\NMSAccessU.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\LogMeIn\x86\LogMeInSystray.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe

C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\stsystra.exe

C:\Program Files\Apoint\Apoint.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\WINDOWS\MMKeybd.exe

C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\Apoint\Apntex.exe

C:\Program Files\Apoint\HidFind.exe

C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe

C:\Program Files\Netropa\OSD.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Trojan Cease\TrojanCease.exe

C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\TechSmith\Snagit 10\Snagit32.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe

C:\Program Files\TechSmith\Snagit 10\TSCHelp.exe

C:\Program Files\TechSmith\Snagit 10\SnagPriv.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\TechSmith\Snagit 10\snagiteditor.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE

C:\WINDOWS\System32\vssvc.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\system32\HPZinw12.exe

.

============== Pseudo HJT Report ===============

.

uInternet Settings,ProxyOverride = *.local

uURLSearchHooks: H - No File

BHO: SnagIt Toolbar Loader: {00c6482d-c502-44c8-8409-fce54ad9c208} - c:\program files\techsmith\snagit 10\SnagitBHO.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~3\office12\GRA8E1~1.DLL

BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll

TB: Snagit: {8ff5e183-abde-46eb-b09e-d2aab95cabe3} - c:\program files\techsmith\snagit 10\SnagitIEAddin.dll

TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll

TB: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

mRun: [intelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe"

mRun: [intelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [sigmatelSysTrayApp] stsystra.exe

mRun: [Apoint] c:\program files\apoint\Apoint.exe

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"

mRun: [switchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exe

mRun: [AdobeCS5ServiceManager] "c:\program files\common files\adobe\cs5servicemanager\CS5ServiceManager.exe" -launchedbylogin

mRun: [DellTouch] c:\windows\MMKeybd.exe

mRun: [Carbonite Backup] c:\program files\carbonite\carbonite backup\CarboniteUI.exe

mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe

mRun: [Adobe Acrobat Speed Launcher] "c:\program files\adobe\acrobat 9.0\acrobat\Acrobat_sl.exe"

mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 9.0\acrobat\Acrotray.exe"

mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe"

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [TrojanCease.exe] c:\program files\trojan cease\TrojanCease.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\snagit~1.lnk - c:\program files\techsmith\snagit 10\Snagit32.exe

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html

IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

TCP: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{FB3BC6B4-427D-4BC5-8DEB-A9829B8F36CD} : DhcpNameServer = 192.168.1.1

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~3\office12\GR99D3~1.DLL

Notify: igfxcui - igfxdev.dll

Notify: LMIinit - LMIinit.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~3\office12\GRA8E1~1.DLL

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\jeff pierce\application data\mozilla\firefox\profiles\mbc75vgw.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3007394&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - WhiteSmoke Bar Customized Web Search

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - plugin: c:\documents and settings\jeff pierce\application data\mozilla\firefox\profiles\mbc75vgw.default\extensions\logmeinclient@logmein.com\plugins\npRACtrl.dll

FF - plugin: c:\documents and settings\jeff pierce\local settings\application data\google\update\1.3.21.79\npGoogleUpdate3.dll

FF - plugin: c:\program files\google\picasa3\npPicasa3.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\microsoft silverlight\3.0.50106.0\npctrlui.dll

FF - plugin: c:\program files\mozilla firefox\plugins\NPcol400.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npMozCouponPrinter.dll

.

---- FIREFOX POLICIES ----

FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(extentions.y2layers.installId, 7418fc95-e52c-4b47-affb-c03d34c976e9

.

============= SERVICES / DRIVERS ===============

.

R2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\logmein\x86\LMIGuardianSvc.exe [2011-9-26 374152]

R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2011-9-16 12856]

R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2011-10-23 47640]

R2 Nhksrv;Netropa NHK Server;c:\windows\Nhksrv.exe [2011-9-6 28672]

R3 Msikbd2k;DellTouch;c:\windows\system32\drivers\Msikbd2k.sys [2011-9-6 6656]

S3 SwitchBoard;Adobe SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]

S4 LMIRfsClientNP;LMIRfsClientNP; [x]

.

=============== Created Last 30 ================

.

2011-11-15 13:51:40 98816 ----a-w- c:\windows\sed.exe

2011-11-15 13:51:40 518144 ----a-w- c:\windows\SWREG.exe

2011-11-15 13:51:40 256000 ----a-w- c:\windows\PEV.exe

2011-11-15 13:51:40 208896 ----a-w- c:\windows\MBR.exe

2011-11-15 12:58:27 -------- d-----w- c:\program files\Trojan Cease

2011-11-12 19:46:49 163840 ----a-w- c:\windows\system32\CNDUK175.dll

2011-11-12 19:46:49 118867 ----a-w- c:\windows\system32\DSLLK175.dll

2011-11-12 19:46:48 94208 ----a-w- c:\windows\system32\CNDCK175.dll

2011-11-12 19:46:48 40960 ----a-w- c:\windows\system32\CNDNDlg.exe

2011-11-12 19:46:46 -------- d-----w- c:\program files\Canon

2011-11-10 03:36:24 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-11-10 03:36:24 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-11-09 14:20:00 -------- d-----w- c:\documents and settings\all users\application data\AVG2012

2011-11-09 03:12:30 -------- d-----w- c:\program files\ESET

2011-11-09 02:08:24 -------- d-----w- c:\program files\Spybot - Search & Destroy

2011-11-09 02:08:24 -------- d-----w- c:\documents and settings\all users\application data\Spybot - Search & Destroy

2011-11-09 01:47:31 -------- d-----w- c:\windows\pss

2011-11-08 23:10:26 -------- d-sha-r- C:\cmdcons

2011-11-08 22:49:00 -------- d-----w- c:\documents and settings\jeff pierce\local settings\application data\NPE

2011-11-08 22:49:00 -------- d-----w- c:\documents and settings\all users\application data\Norton

2011-11-08 22:26:09 23624 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys

2011-11-08 22:25:41 -------- d-----w- c:\documents and settings\all users\application data\Hitman Pro

2011-11-08 21:21:53 -------- d-----w- c:\documents and settings\all users\application data\PC Tools

2011-11-08 19:37:51 -------- d-----w- c:\documents and settings\jeff pierce\application data\Malwarebytes

2011-11-08 19:37:39 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes

2011-11-06 13:33:10 -------- d--h--w- c:\documents and settings\all users\application data\Common Files

2011-11-06 13:29:02 -------- d-----w- c:\documents and settings\all users\application data\MFAData

2011-11-05 22:01:16 466944 ----a-w- c:\program files\mozilla firefox\plugins\NPcol400.dll

2011-11-05 22:01:16 -------- d-----w- c:\documents and settings\jeff pierce\application data\Catalina Marketing Corp

2011-11-05 11:38:10 101720 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2011-11-04 17:10:55 -------- d-----w- c:\program files\Amazon

2011-11-03 00:55:45 -------- d-----w- c:\documents and settings\jeff pierce\local settings\application data\Akamai

2011-11-02 02:36:57 73728 ----a-w- c:\windows\system32\javacpl.cpl

2011-11-02 02:36:57 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-11-02 02:36:57 472808 ----a-w- c:\program files\mozilla firefox\plugins\npdeployJava1.dll

2011-10-26 22:04:42 -------- d-----w- c:\documents and settings\jeff pierce\application data\Canneverbe Limited

2011-10-26 22:04:42 -------- d-----w- c:\documents and settings\all users\application data\Canneverbe Limited

2011-10-26 22:04:30 5504 ----a-w- c:\windows\system32\drivers\StarOpen.sys

2011-10-23 14:03:42 21728 ----a-w- c:\windows\system32\wucltui.dll.mui

2011-10-23 14:03:42 -------- d-----w- c:\windows\system32\SoftwareDistribution

2011-10-23 14:03:40 17632 ----a-w- c:\windows\system32\wuaueng.dll.mui

2011-10-23 14:03:36 15072 ----a-w- c:\windows\system32\wuaucpl.cpl.mui

2011-10-23 14:03:34 15064 ----a-w- c:\windows\system32\wuapi.dll.mui

2011-10-23 14:03:06 52096 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\LMIproc.dll

2011-10-23 14:03:06 30592 ----a-w- c:\windows\system32\LMIport.dll

2011-10-23 14:03:05 83360 ----a-w- c:\windows\system32\LMIRfsClientNP.dll

2011-10-23 14:03:05 47640 ----a-w- c:\windows\system32\drivers\LMIRfsDriver.sys

2011-10-23 14:02:50 87424 ----a-w- c:\windows\system32\LMIinit.dll

2011-10-23 14:02:36 -------- d-----w- c:\program files\LogMeIn

2011-10-17 17:03:32 -------- d-----w- c:\program files\iPod

2011-10-17 17:03:29 -------- d-----w- c:\program files\iTunes

2011-10-17 16:59:10 -------- d-----w- c:\program files\Bonjour

.

==================== Find3M ====================

.

2011-11-04 18:18:44 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-09-27 02:11:23 398760 ----a-r- c:\windows\system32\cpnprt2.cid

2011-09-16 19:10:24 25248 ----a-w- c:\windows\system32\lmimirr.dll

2011-09-16 19:10:24 11552 ----a-w- c:\windows\system32\lmimirr2.dll

2011-09-16 19:10:24 10144 ----a-w- c:\windows\system32\drivers\lmimirr.sys

2011-09-05 22:44:26 319488 ----a-w- c:\windows\system32\AegisI5Installer.exe

2011-09-05 22:44:26 21425 ----a-w- c:\windows\system32\drivers\AegisP.sys

2011-08-31 03:05:04 83816 ----a-w- c:\windows\system32\dns-sd.exe

2011-08-31 03:05:04 73064 ----a-w- c:\windows\system32\dnssd.dll

2011-08-31 03:05:04 50536 ----a-w- c:\windows\system32\jdns_sd.dll

2011-08-31 03:05:04 178536 ----a-w- c:\windows\system32\dnssdX.dll

.

============= FINISH: 9:55:44.96 ===============

attach.zip

Maniac · November 15, 2011

Hello Jeff! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/paste in your next reply.

There are a lot of work here because you decided to act on your head. Therefore there made many serious errors. However, I will try to help you to fix them.

Step 1

Now it's time to clean the cache of Java, because of malware. Malware that could be found in this cache directory are not associated with the Java that was downloaded and installed on the system. A cache directory is aa temporary storage location. When the browser runs an applet or application, Java stores files into its cache directory for better performance.

Click Start => Control Panel.

Double-click the Java icon in the control panel. The Java Control Panel appears.

Click Settings under Temporary Internet Files. The Temporary Files Settings dialog box appears.

Click Delete Files. The Delete Temporary Files dialog box appears.

Click OK on Delete Temporary Files window. Note: This deletes all the Downloaded Applications and Applets from the cache.

Click OK on Temporary Files Settings window. Note: If you want to delete a specific application and applet from the cache, click on View Application and View Applet options respectively.

Step 2

Installed and cleaned were many applications on this system, so now there are many remnants which shuld be cleaned.

Please download AppRemover:

http://www.appremover.com/get/appremover.exe

Then follow the instructions from How to Use AppRemover to Clean Up a Failed Uninstall here:

http://www.appremover.com/faq/about/using-appremover.html

In your next reply, please post a new fresh DDS log file with Attach.txt

November 15, 2011

Thanks so much MANIAC for helping me!

Ran both instructions. Updated logs below:

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_23

Run by Jeff Pierce at 17:51:18 on 2011-11-15

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1273 [GMT -5:00]

.

AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Nhksrv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

svchost.exe

C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe

C:\Program Files\LogMeIn\x86\RaMaint.exe

C:\Program Files\LogMeIn\x86\LogMeIn.exe

C:\Program Files\CDBurnerXP\NMSAccessU.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\LogMeIn\x86\LogMeInSystray.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe

C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\stsystra.exe

C:\Program Files\Apoint\Apoint.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\WINDOWS\MMKeybd.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe

C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Apoint\HidFind.exe

C:\Program Files\Apoint\Apntex.exe

C:\Program Files\Netropa\OSD.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\TechSmith\Snagit 10\Snagit32.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe

C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe

C:\Program Files\TechSmith\Snagit 10\TSCHelp.exe

C:\Program Files\TechSmith\Snagit 10\SnagPriv.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\TechSmith\Snagit 10\snagiteditor.exe

C:\WINDOWS\system32\HPZinw12.exe

C:\WINDOWS\explorer.exe