We’d like to remind Forumites to please avoid political debate on the Forum.

This is to keep it a safe and useful space for MoneySaving discussions. Threads that are – or become – political in nature may be removed in line with the Forum’s rules. Thank you for your understanding.

📨 Have you signed up to the Forum's new Email Digest yet? Get a selection of trending threads sent straight to your inbox daily, weekly or monthly!

HiJack this log

24

Comments

  • tranmererovers
    tranmererovers Posts: 2,313 Forumite
    Part of the Furniture 1,000 Posts Combo Breaker
    edited 30 April 2010 at 9:40PM
    Avira AntiVir Personal
    Report file date: 30 April 2010 20:58

    Scanning for 2062283 virus strains and unwanted programs.

    The program is running as an unrestricted full version.
    Online services are available:

    Licensee : Avira AntiVir Personal - FREE Antivirus
    Serial number : 0000149996-ADJIE-0000001
    Platform : Windows XP
    Windows version : (Service Pack 3) [5.1.2600]
    Boot mode : Normally booted
    Username : SYSTEM
    Computer name : FSC391216061805

    Version information:
    BUILD.DAT : 10.0.0.567 32097 Bytes 4/19/2010 15:07:00
    AVSCAN.EXE : 10.0.3.0 433832 Bytes 4/1/2010 12:37:38
    AVSCAN.DLL : 10.0.3.0 46440 Bytes 4/1/2010 12:57:04
    LUKE.DLL : 10.0.2.3 104296 Bytes 3/7/2010 18:33:04
    LUKERES.DLL : 10.0.0.1 12648 Bytes 2/10/2010 23:40:49
    VBASE000.VDF : 7.10.0.0 19875328 Bytes 11/6/2009 09:05:36
    VBASE001.VDF : 7.10.1.0 1372672 Bytes 11/19/2009 19:27:49
    VBASE002.VDF : 7.10.3.1 3143680 Bytes 1/20/2010 17:37:42
    VBASE003.VDF : 7.10.3.75 996864 Bytes 1/26/2010 16:37:42
    VBASE004.VDF : 7.10.4.203 1579008 Bytes 3/5/2010 11:29:03
    VBASE005.VDF : 7.10.6.82 2494464 Bytes 4/15/2010 16:35:47
    VBASE006.VDF : 7.10.6.83 2048 Bytes 4/15/2010 16:35:47
    VBASE007.VDF : 7.10.6.84 2048 Bytes 4/15/2010 16:35:47
    VBASE008.VDF : 7.10.6.85 2048 Bytes 4/15/2010 16:35:47
    VBASE009.VDF : 7.10.6.86 2048 Bytes 4/15/2010 16:35:47
    VBASE010.VDF : 7.10.6.87 2048 Bytes 4/15/2010 16:35:48
    VBASE011.VDF : 7.10.6.88 2048 Bytes 4/15/2010 16:35:48
    VBASE012.VDF : 7.10.6.89 2048 Bytes 4/15/2010 16:35:48
    VBASE013.VDF : 7.10.6.90 2048 Bytes 4/15/2010 16:35:48
    VBASE014.VDF : 7.10.6.123 126464 Bytes 4/19/2010 16:35:49
    VBASE015.VDF : 7.10.6.152 123392 Bytes 4/21/2010 16:35:50
    VBASE016.VDF : 7.10.6.178 122880 Bytes 4/22/2010 16:35:50
    VBASE017.VDF : 7.10.6.206 120320 Bytes 4/26/2010 16:35:51
    VBASE018.VDF : 7.10.6.232 99328 Bytes 4/28/2010 16:35:51
    VBASE019.VDF : 7.10.7.2 155648 Bytes 4/30/2010 16:35:52
    VBASE020.VDF : 7.10.7.3 2048 Bytes 4/30/2010 16:35:52
    VBASE021.VDF : 7.10.7.4 2048 Bytes 4/30/2010 16:35:52
    VBASE022.VDF : 7.10.7.5 2048 Bytes 4/30/2010 16:35:53
    VBASE023.VDF : 7.10.7.6 2048 Bytes 4/30/2010 16:35:53
    VBASE024.VDF : 7.10.7.7 2048 Bytes 4/30/2010 16:35:53
    VBASE025.VDF : 7.10.7.8 2048 Bytes 4/30/2010 16:35:53
    VBASE026.VDF : 7.10.7.9 2048 Bytes 4/30/2010 16:35:53
    VBASE027.VDF : 7.10.7.10 2048 Bytes 4/30/2010 16:35:53
    VBASE028.VDF : 7.10.7.11 2048 Bytes 4/30/2010 16:35:53
    VBASE029.VDF : 7.10.7.12 2048 Bytes 4/30/2010 16:35:53
    VBASE030.VDF : 7.10.7.13 2048 Bytes 4/30/2010 16:35:54
    VBASE031.VDF : 7.10.7.16 43520 Bytes 4/30/2010 16:35:54
    Engineversion : 8.2.1.224
    AEVDF.DLL : 8.1.2.0 106868 Bytes 4/30/2010 16:36:07
    AESCRIPT.DLL : 8.1.3.27 1294714 Bytes 4/30/2010 16:36:07
    AESCN.DLL : 8.1.5.0 127347 Bytes 2/25/2010 18:38:41
    AESBX.DLL : 8.1.3.1 254324 Bytes 4/30/2010 16:36:07
    AERDL.DLL : 8.1.4.6 541043 Bytes 4/30/2010 16:36:05
    AEPACK.DLL : 8.2.1.1 426358 Bytes 3/19/2010 12:34:51
    AEOFFICE.DLL : 8.1.0.41 201083 Bytes 3/17/2010 11:09:46
    AEHEUR.DLL : 8.1.1.24 2613623 Bytes 4/30/2010 16:36:03
    AEHELP.DLL : 8.1.11.3 242039 Bytes 4/1/2010 16:05:25
    AEGEN.DLL : 8.1.3.7 373106 Bytes 4/30/2010 16:35:57
    AEEMU.DLL : 8.1.2.0 393588 Bytes 4/30/2010 16:35:56
    AECORE.DLL : 8.1.13.1 188790 Bytes 4/1/2010 16:05:25
    AEBB.DLL : 8.1.1.0 53618 Bytes 4/30/2010 16:35:55
    AVWINLL.DLL : 10.0.0.0 19304 Bytes 1/14/2010 12:03:38
    AVPREF.DLL : 10.0.0.0 44904 Bytes 1/14/2010 12:03:35
    AVREP.DLL : 10.0.0.8 62209 Bytes 2/18/2010 16:47:40
    AVREG.DLL : 10.0.3.0 53096 Bytes 4/1/2010 12:35:46
    AVSCPLR.DLL : 10.0.3.0 83816 Bytes 4/1/2010 12:39:51
    AVARKT.DLL : 10.0.0.14 227176 Bytes 4/1/2010 12:22:13
    AVEVTLOG.DLL : 10.0.0.8 203112 Bytes 1/26/2010 09:53:30
    SQLITE3.DLL : 3.6.19.0 355688 Bytes 1/28/2010 12:57:58
    AVSMTP.DLL : 10.0.0.17 63848 Bytes 3/16/2010 15:38:56
    NETNT.DLL : 10.0.0.0 11624 Bytes 2/19/2010 14:41:00
    RCIMAGE.DLL : 10.0.0.26 2550120 Bytes 1/28/2010 13:10:20
    RCTEXT.DLL : 10.0.53.0 97128 Bytes 4/9/2010 14:14:29

    Configuration settings for the scan:
    Jobname.............................: Complete system scan
    Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp
    Logging.............................: low
    Primary action......................: interactive
    Secondary action....................: ignore
    Scan master boot sector.............: on
    Scan boot sector....................: on
    Boot sectors........................: C:,
    Process scan........................: on
    Extended process scan...............: on
    Scan registry.......................: on
    Search for rootkits.................: on
    Integrity checking of system files..: off
    Scan all files......................: All files
    Scan archives.......................: on
    Recursion depth.....................: 20
    Smart extensions....................: on
    Macro heuristic.....................: on
    File heuristic......................: medium

    Start of the scan: 30 April 2010 20:58

    Starting search for hidden objects.

    The scan of running processes will be started
    Scan process 'msdtc.exe' - '40' Module(s) have been scanned
    Scan process 'dllhost.exe' - '61' Module(s) have been scanned
    Scan process 'dllhost.exe' - '45' Module(s) have been scanned
    Scan process 'vssvc.exe' - '48' Module(s) have been scanned
    Scan process 'avscan.exe' - '67' Module(s) have been scanned
    Scan process 'avshadow.exe' - '26' Module(s) have been scanned
    Scan process 'avguard.exe' - '55' Module(s) have been scanned
    Scan process 'avcenter.exe' - '67' Module(s) have been scanned
    Scan process 'BTTray.exe' - '44' Module(s) have been scanned
    Scan process 'TeaTimer.exe' - '36' Module(s) have been scanned
    Scan process 'E_FATIFCE.EXE' - '32' Module(s) have been scanned
    Scan process 'GoogleToolbarNotifier.exe' - '56' Module(s) have been scanned
    Scan process 'ctfmon.exe' - '30' Module(s) have been scanned
    Scan process 'msnmsgr.exe' - '103' Module(s) have been scanned
    Scan process 'avgnt.exe' - '56' Module(s) have been scanned
    Scan process 'NokiaMServer.exe' - '34' Module(s) have been scanned
    Scan process 'OEdmn_6.exe' - '38' Module(s) have been scanned
    Scan process 'sm56hlpr.exe' - '40' Module(s) have been scanned
    Scan process 'jusched.exe' - '21' Module(s) have been scanned
    Scan process 'GrooveMonitor.exe' - '38' Module(s) have been scanned
    Scan process 'rundll32.exe' - '34' Module(s) have been scanned
    Scan process 'InCD.exe' - '27' Module(s) have been scanned
    Scan process 'VTtrayp.exe' - '26' Module(s) have been scanned
    Scan process 'VTTimer.exe' - '18' Module(s) have been scanned
    Scan process 'SOUNDMAN.EXE' - '25' Module(s) have been scanned
    Scan process 'Explorer.EXE' - '118' Module(s) have been scanned
    Scan process 'alg.exe' - '31' Module(s) have been scanned
    Scan process 'symlcsvc.exe' - '30' Module(s) have been scanned
    Scan process 'svchost.exe' - '38' Module(s) have been scanned
    Scan process 'SeaPort.exe' - '46' Module(s) have been scanned
    Scan process 'jqs.exe' - '33' Module(s) have been scanned
    Scan process 'IconixService.exe' - '31' Module(s) have been scanned
    Scan process 'btwdins.exe' - '26' Module(s) have been scanned
    Scan process 'svchost.exe' - '34' Module(s) have been scanned
    Scan process 'bgsvcgen.exe' - '11' Module(s) have been scanned
    Scan process 'svchost.exe' - '34' Module(s) have been scanned
    Scan process 'sched.exe' - '43' Module(s) have been scanned
    Scan process 'spoolsv.exe' - '65' Module(s) have been scanned
    Scan process 'svchost.exe' - '37' Module(s) have been scanned
    Scan process 'svchost.exe' - '32' Module(s) have been scanned
    Scan process 'svchost.exe' - '30' Module(s) have been scanned
    Scan process 'InCDsrv.exe' - '20' Module(s) have been scanned
    Scan process 'svchost.exe' - '169' Module(s) have been scanned
    Scan process 'svchost.exe' - '40' Module(s) have been scanned
    Scan process 'svchost.exe' - '53' Module(s) have been scanned
    Scan process 'lsass.exe' - '58' Module(s) have been scanned
    Scan process 'services.exe' - '36' Module(s) have been scanned
    Scan process 'winlogon.exe' - '67' Module(s) have been scanned
    Scan process 'csrss.exe' - '12' Module(s) have been scanned
    Scan process 'smss.exe' - '2' Module(s) have been scanned

    Starting master boot sector scan:
    Master boot sector HD0
    [INFO] No virus was found!

    Start scanning boot sectors:
    Boot sector 'C:\'
    [INFO] No virus was found!

    Starting to scan executable files (registry).
    The registry was scanned ( '1823' files ).


    Starting the file scan:

    Begin scan in 'C:\' <System>
    C:\Documents and Settings\RB\Application Data\DealAssistant\DAUninstall.exe
    [DETECTION] Is the TR/Spy.269312.7 Trojan
    C:\System Volume Information\_restore{E2EBC557-D74B-4114-9489-BBBB8C50BDA0}\RP74\A0016352.dll
    [DETECTION] Is the TR/Drop.Softomat.AN Trojan
    C:\System Volume Information\_restore{E2EBC557-D74B-4114-9489-BBBB8C50BDA0}\RP74\A0016353.exe
    [DETECTION] Is the TR/Trash.Gen Trojan
    C:\System Volume Information\_restore{E2EBC557-D74B-4114-9489-BBBB8C50BDA0}\RP74\A0016354.exe
    [DETECTION] Is the TR/Trash.Gen Trojan
    C:\System Volume Information\_restore{E2EBC557-D74B-4114-9489-BBBB8C50BDA0}\RP74\A0016355.exe
    [DETECTION] Is the TR/Trash.Gen Trojan
    C:\WINDOWS\Temp\FIN10.tmp\upgrade.exe
    [DETECTION] Is the TR/BHO.Zwangi.226 Trojan
    C:\WINDOWS\Temp\FINB.tmp\upgrade.exe
    [0] Archive type: NSIS
    [DETECTION] Is the TR/BHO.Zwangi.194 Trojan
    --> [UnknownDir]/findbasic.dll
    [DETECTION] Is the TR/Dropper.Gen Trojan
    --> [UnknownDir]/findbasic.exe
    [DETECTION] Contains recognition pattern of the ADSPY/Agent.58872 adware or spyware
    C:\WINDOWS\Temp\FINC.tmp\upgrade.exe
    [0] Archive type: NSIS
    [DETECTION] Is the TR/BHO.Zwangi.174 Trojan
    --> [UnknownDir]/findbasic.dll
    [DETECTION] Is the TR/Dropper.Gen Trojan
    C:\WINDOWS\Temp\FIND.tmp\upgrade.exe
    [0] Archive type: NSIS
    [DETECTION] Is the TR/BHO.Zwangi.41 Trojan
    --> [UnknownDir]/findbasic.dll
    [DETECTION] Is the TR/Dropper.Gen Trojan
    --> [UnknownDir]/findbasic.exe
    [DETECTION] Contains recognition pattern of the ADSPY/Zwangi.AE.4 adware or spyware
    C:\WINDOWS\Temp\FINF.tmp\upgrade.exe
    [DETECTION] Is the TR/BHO.Zwangi.312 Trojan

    Beginning disinfection:
    C:\WINDOWS\Temp\FINF.tmp\upgrade.exe
    [DETECTION] Is the TR/BHO.Zwangi.312 Trojan
    [NOTE] The file was moved to the quarantine directory under the name '44ceef0b.qua'.
    C:\WINDOWS\Temp\FIND.tmp\upgrade.exe
    [DETECTION] Is the TR/BHO.Zwangi.41 Trojan
    [NOTE] The file was moved to the quarantine directory under the name '5c59c0ac.qua'.
    C:\WINDOWS\Temp\FINC.tmp\upgrade.exe
    [DETECTION] Is the TR/BHO.Zwangi.174 Trojan
    [NOTE] The file was moved to the quarantine directory under the name '0e069a44.qua'.
    C:\WINDOWS\Temp\FINB.tmp\upgrade.exe
    [DETECTION] Is the TR/BHO.Zwangi.194 Trojan
    [NOTE] The file was moved to the quarantine directory under the name '6831d586.qua'.
    C:\WINDOWS\Temp\FIN10.tmp\upgrade.exe
    [DETECTION] Is the TR/BHO.Zwangi.226 Trojan
    [NOTE] The file was moved to the quarantine directory under the name '2db5f8b9.qua'.
    C:\System Volume Information\_restore{E2EBC557-D74B-4114-9489-BBBB8C50BDA0}\RP74\A0016355.exe
    [DETECTION] Is the TR/Trash.Gen Trojan
    [NOTE] The file was moved to the quarantine directory under the name '52e7ca18.qua'.
    C:\System Volume Information\_restore{E2EBC557-D74B-4114-9489-BBBB8C50BDA0}\RP74\A0016354.exe
    [DETECTION] Is the TR/Trash.Gen Trojan
    [NOTE] The file was moved to the quarantine directory under the name '1e5fe652.qua'.
    C:\System Volume Information\_restore{E2EBC557-D74B-4114-9489-BBBB8C50BDA0}\RP74\A0016353.exe
    [DETECTION] Is the TR/Trash.Gen Trojan
    [NOTE] The file was moved to the quarantine directory under the name '6247a602.qua'.
    C:\System Volume Information\_restore{E2EBC557-D74B-4114-9489-BBBB8C50BDA0}\RP74\A0016352.dll
    [DETECTION] Is the TR/Drop.Softomat.AN Trojan
    [NOTE] The file was moved to the quarantine directory under the name '4f1d894f.qua'.
    C:\Documents and Settings\RB\Application Data\DealAssistant\DAUninstall.exe
    [DETECTION] Is the TR/Spy.269312.7 Trojan
    [NOTE] The file was moved to the quarantine directory under the name '564eb2e6.qua'.


    End of the scan: 30 April 2010 22:27
    Used time: 1:14:50 Hour(s)

    The scan has been done completely.

    7475 Scanned directories
    318659 Files were scanned
    15 Viruses and/or unwanted programs were found
    0 Files were classified as suspicious
    0 files were deleted
    0 Viruses and unwanted programs were repaired
    10 Files were moved to quarantine
    0 Files were renamed
    0 Files cannot be scanned
    318644 Files not concerned
    8018 Archives were scanned
    0 Warnings
    10 Notes
    414459 Objects were scanned with rootkit scan
    0 Hidden objects were found
    It's easier to get forgiveness than to ask permission ;)
  • tranmererovers
    tranmererovers Posts: 2,313 Forumite
    Part of the Furniture 1,000 Posts Combo Breaker
    Logfile of Trend Micro HijackThis v2.0.3 (BETA)
    Scan saved at 22:36:39, on 30/04/2010
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Ahead\InCD\InCDsrv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir Desktop\sched.exe
    C:\WINDOWS\system32\bgsvcgen.exe
    C:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe
    C:\Program Files\Common Files\Iconix\IconixService.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\system32\VTTimer.exe
    C:\WINDOWS\system32\VTtrayp.exe
    C:\Program Files\Ahead\InCD\InCD.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\WINDOWS\sm56hlpr.exe
    C:\Program Files\Iconix\OEAddOn\OEdmn_6.exe
    C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIFCE.EXE
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Belkin\Bluetooth Software\BTTray.exe
    C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
    O2 - BHO: IconixBHOClass Class - {761233B6-F228-49E4-8F6B-668499D4E55A} - C:\Program Files\Iconix\IEAddOn\IconixBHO_42.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (file missing)
    O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (file missing)
    O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
    O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
    O4 - HKLM\..\Run: [EPSON Stylus DX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE /P26 "EPSON Stylus DX3800 Series" /O6 "USB001" /M "Stylus DX3800"
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [EPSON Stylus DX3800 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE /P35 "EPSON Stylus DX3800 Series (Copy 1)" /O5 "LPT1:" /M "Stylus DX3800"
    O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
    O4 - HKLM\..\Run: [IconixOEAddOn] "C:\Program Files\Iconix\OEAddOn\OEdmn_6.exe"
    O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
    O4 - HKLM\..\Run: [NokiaMusic FastStart] "C:\Program Files\Nokia\Ovi Player\OviPlayer.exe" /command:faststart
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
    O4 - HKCU\..\Run: [EPSON SX410 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIFCE.EXE /FU "C:\WINDOWS\TEMP\E_SC4.tmp" /EF "HKCU"
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
    O4 - Global Startup: BTTray.lnk = ?
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
    O9 - Extra button: Sky - {08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.sky.com (file missing)
    O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: (no name) - {400A6CFA-E326-4d61-A90C-9AD75358DC5F} - C:\Program Files\Iconix\IEAddOn\IconixBHO_42.dll
    O9 - Extra 'Tools' menuitem: Email ID Preferences - {400A6CFA-E326-4d61-A90C-9AD75358DC5F} - C:\Program Files\Iconix\IEAddOn\IconixBHO_42.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {BC3F6B6D-2E49-4603-B028-7411655713F3} - C:\Program Files\Iconix\IEAddOn\IconixBHO_42.dll
    O9 - Extra 'Tools' menuitem: About Email ID - {BC3F6B6D-2E49-4603-B028-7411655713F3} - C:\Program Files\Iconix\IEAddOn\IconixBHO_42.dll
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
    O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
    O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe
    O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Iconix Update Service (IconixService) - Unknown owner - C:\Program Files\Common Files\Iconix\IconixService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

    --
    End of file - 13041 bytes
    It's easier to get forgiveness than to ask permission ;)
  • The_Grandmaster
    The_Grandmaster Posts: 1,424 Forumite
    Part of the Furniture Combo Breaker
    Still me with the lack of technical skills but on the avira scan it says 15 virus found, 10 quarantined - what happened to the remaining 5? Hope someone can answer that and also look at the log for tranmereovers (I think there's 3 things which can be removed but I'm no expert!)
  • tranmererovers
    tranmererovers Posts: 2,313 Forumite
    Part of the Furniture 1,000 Posts Combo Breaker
    The_Grandmaster wrote: »
    Still me with the lack of technical skills but on the avira scan it says 15 virus found, 10 quarantined - what happened to the remaining 5? Hope someone can answer that and also look at the log for tranmereovers (I think there's 3 things which can be removed but I'm no expert!)

    Thanks Grandmaster, that's what I wondered too, where are the missing 5??
    It's easier to get forgiveness than to ask permission ;)
  • The_Grandmaster
    The_Grandmaster Posts: 1,424 Forumite
    Part of the Furniture Combo Breaker
    Maybe worth rescanning while you wait? Have no answer really.

    I hope someone looks at your log!
  • closed
    closed Posts: 10,886 Forumite
    edited 30 April 2010 at 11:23PM
    How much ram, what is the commit charge in task manager.

    Run this http://www.malwarebytes.org/startuplite.php

    uninstall spybot, remove all the file missing entries, and post a fresh log
    !!
    > . !!!! ----> .
  • tranmererovers
    tranmererovers Posts: 2,313 Forumite
    Part of the Furniture 1,000 Posts Combo Breaker
    Thanks for your reply closed. I've got an action packed weekend now so I'll get right onto it on Monday.

    Appreciate the reply :)
    It's easier to get forgiveness than to ask permission ;)
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    edited 1 May 2010 at 11:04AM
    TICK and FIX these ~
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (file missing)
    O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (file missing)
    O9 - Extra button: Sky - {08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.sky.com (file missing)
    O9 - Extra button: (no name) - {BC3F6B6D-2E49-4603-B028-7411655713F3} - C:\Program Files\Iconix\IEAddOn\IconixBHO_42.dll
    O9 - Extra 'Tools' menuitem: About Email ID - {BC3F6B6D-2E49-4603-B028-7411655713F3} - C:\Program Files\Iconix\IEAddOn\IconixBHO_42.dll




    Turn off Spybots 'TEA TIMER' mode ~
    Open Spybot
    Change Mode (Top) to ADVANCED
    Select TOOLS then RESIDENT
    UNTICK 'Resident TEA TIMER' (Leave 'SD Helper' TICKED)


    Please run COMBOFIX
    http://download.bleepingcomputer.com/sUBs/ComboFix.exe
    Shut down your anti virus
    Follow the simple instructions it gives
    Post the COMPLETE log it creates here (Split into sections if need be) ~ if there are loads of 'SNAPSHOT' pages then leave them out

    If it comes up with a RENAMING error then RIGHT click the exe file and RENAME and call it QWERTY (Making the complete file name 'QWERTY.exe') Or SAVE as 'QWERTY' on download
    :idea:
  • tranmererovers
    tranmererovers Posts: 2,313 Forumite
    Part of the Furniture 1,000 Posts Combo Breaker
    edited 3 May 2010 at 5:16PM
    Thanks Closed and aliEnRIK

    I have uninstalled Spybot for the time being as it had problems loading and I was getting virtual memory messages :(

    I have fixed those 6 entries in Hijack this.

    And here follows the combofix log

    ComboFix 10-05-02.03 - ANOTHER 03/05/2010 17:31:19.1.1 - x86
    Running from: c:\documents and settings\ANOTHER\Desktop\ComboFix.exe
    AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\program files\WindowsUpdate
    c:\recycler\S-1-5-21-1128375744-1742829904-41918106-1003

    .
    ((((((((((((((((((((((((( Files Created from 2010-04-03 to 2010-05-03 )))))))))))))))))))))))))))))))
    .

    2010-04-30 20:00 . 2010-04-30 21:10
    d
    w- c:\windows\system32\NtmsData
    2010-04-30 18:03 . 2010-04-30 18:03
    d-sh--w- c:\documents and settings\NetworkService\IETldCache
    2010-04-30 17:42 . 2010-02-24 09:16 181632
    w- c:\windows\system32\MpSigStub.exe
    2010-04-30 16:46 . 2010-04-30 16:46
    d
    w- c:\documents and settings\another\Application Data\Avira
    2010-04-30 16:11 . 2010-03-01 09:05 124784 ----a-w- c:\windows\system32\drivers\avipbb.sys
    2010-04-30 16:10 . 2009-05-11 11:49 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
    2010-04-30 16:10 . 2010-02-16 13:24 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys
    2010-04-30 16:10 . 2009-05-11 11:49 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
    2010-04-30 16:09 . 2010-04-30 16:09
    d
    w- c:\documents and settings\All Users\Application Data\Avira
    2010-04-30 16:09 . 2010-04-30 16:09
    d
    w- c:\program files\Avira
    2010-04-30 15:57 . 2010-05-03 15:43
    d
    w- c:\program files\Spybot - Search & Destroy
    2010-04-30 15:57 . 2010-05-03 15:40
    d
    w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2010-04-30 15:17 . 2010-04-30 15:17
    d
    w- c:\documents and settings\All Users\Application Data\avg8
    2010-04-30 13:38 . 2010-04-30 13:38
    d
    w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
    2010-04-30 13:37 . 2010-04-30 15:08
    d
    w- c:\program files\SUPERAntiSpyware
    2010-04-29 20:51 . 2010-04-29 20:51
    d
    w- c:\program files\CCleaner
    2010-04-29 20:32 . 2010-04-29 20:32 388096 ----a-r- c:\documents and settings\another\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
    2010-04-29 20:32 . 2010-04-29 20:32
    d
    w- c:\program files\TrendMicro
    2010-04-29 20:02 . 2010-04-29 20:02
    d
    w- c:\documents and settings\another\Application Data\Malwarebytes
    2010-04-29 20:02 . 2010-04-29 11:19 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-04-29 20:02 . 2010-04-29 20:02
    d
    w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2010-04-29 20:02 . 2010-04-29 20:53
    d
    w- c:\program files\Malwarebytes' Anti-Malware
    2010-04-29 20:02 . 2010-04-29 11:19 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-04-24 08:38 . 2008-06-12 10:09 33088 ----a-w- c:\documents and settings\another\Application Data\Macromedia\Flash Player\https://www.macromedia.com\bin\airappinstaller\airappinstaller.exe
    2010-04-23 15:56 . 2010-04-23 15:56
    d
    w- c:\documents and settings\another\Application Data\Nokia
    2010-04-23 15:53 . 2010-04-23 15:53
    d
    w- c:\documents and settings\another\Local Settings\Application Data\IsolatedStorage
    2010-04-23 15:49 . 2010-04-23 15:49
    d
    w- c:\documents and settings\another\Application Data\PC Suite
    2010-04-22 15:49 . 2010-04-22 15:49
    d
    w- c:\documents and settings\another\Application Data\EPSON
    2010-04-22 15:48 . 2010-04-22 15:48 74408 ----a-w- c:\documents and settings\another\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2010-04-21 16:11 . 2010-04-21 16:11
    d-sh--w- c:\documents and settings\another\IECompatCache
    2010-04-21 16:03 . 2010-04-21 16:03
    d-sh--w- c:\documents and settings\another\PrivacIE
    2010-04-21 16:03 . 2010-04-21 16:04
    d
    w- c:\documents and settings\another\Local Settings\Application Data\Google
    2010-04-21 16:03 . 2010-04-21 16:03
    d
    w- c:\documents and settings\another\Application Data\Iconix
    2010-04-21 16:02 . 2010-04-23 15:50
    d
    w- c:\documents and settings\another\Local Settings\Application Data\Nokia

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-04-30 15:22 . 2009-11-11 22:43
    d
    w- c:\documents and settings\All Users\Application Data\avg9
    2010-04-26 22:06 . 2008-09-24 16:11
    d
    w- c:\documents and settings\All Users\Application Data\Microsoft Help
    2010-04-23 16:40 . 2010-03-10 22:09 166208 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
    2010-04-21 16:03 . 2009-12-27 21:31
    d
    w- c:\documents and settings\All Users\Application Data\Iconix
    2010-04-07 20:00 . 2009-02-04 18:44 74408 ----a-w- c:\documents and settings\another\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2010-03-24 20:06 . 2006-06-23 17:02
    d--h--w- c:\program files\InstallShield Installation Information
    2010-03-22 22:58 . 2010-03-18 21:25
    d
    w- c:\program files\RegWork
    2010-03-10 21:46 . 2010-03-10 21:46
    d
    w- c:\documents and settings\All Users\Application Data\Sony
    2010-03-10 06:15 . 2005-02-02 20:37 420352 ----a-w- c:\windows\system32\vbscript.dll
    2010-03-09 21:53 . 2010-03-09 21:53
    d
    w- c:\documents and settings\another\Application Data\PC Suite
    2010-03-09 20:53 . 2010-03-09 20:53 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
    2010-03-09 20:53 . 2010-03-09 20:53 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
    2010-03-09 20:37 . 2010-03-09 20:37
    d
    w- c:\program files\MSXML 6.0
    2010-03-09 20:34 . 2010-03-09 20:04
    d
    w- c:\program files\Nokia
    2010-03-09 20:34 . 2010-03-09 20:34
    d
    w- c:\documents and settings\All Users\Application Data\NokiaMusic
    2010-03-09 20:31 . 2010-03-09 20:31
    d
    w- c:\program files\Common Files\muvee Technologies
    2010-03-09 20:29 . 2010-03-09 20:28
    d
    w- c:\program files\Common Files\Nokia
    2010-03-09 20:18 . 2010-03-09 20:18
    d
    w- c:\documents and settings\All Users\Application Data\PC Suite
    2010-03-09 20:05 . 2010-03-09 20:05
    d
    w- c:\program files\DIFX
    2010-03-07 09:30 . 2009-12-27 21:31
    d
    w- c:\program files\Common Files\Iconix
    2010-02-25 06:24 . 2005-02-02 20:37 916480 ----a-w- c:\windows\system32\wininet.dll
    2010-02-24 13:11 . 2005-02-02 20:38 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
    2010-02-17 08:10 . 2005-02-02 20:36 2189952 ----a-w- c:\windows\system32\ntoskrnl.exe
    2010-02-16 13:25 . 2005-02-02 20:36 2066816 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2010-02-12 10:03 . 2010-03-07 09:35 293376
    w- c:\windows\system32\browserchoice.exe
    2010-02-12 04:33 . 2005-02-02 20:36 100864 ----a-w- c:\windows\system32\6to4svc.dll
    2010-02-11 12:02 . 2005-02-02 20:38 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-02 68856]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
    "SoundMan"="SOUNDMAN.EXE" [2005-05-17 77824]
    "VTTimer"="VTTimer.exe" [2005-03-08 53248]
    "VTTrayp"="VTtrayp.exe" [2005-11-01 163840]
    "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
    "InCD"="c:\program files\Ahead\InCD\InCD.exe" [2005-07-25 1397760]
    "EPSON Stylus DX3800 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE" [2005-02-08 98304]
    "BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
    "EPSON Stylus DX3800 Series (Copy 1)"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE" [2005-02-08 98304]
    "REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248]
    "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
    "SMSERIAL"="sm56hlpr.exe" [2005-04-07 544768]
    "IconixOEAddOn"="c:\program files\Iconix\OEAddOn\OEdmn_6.exe" [2010-03-06 342872]
    "NokiaMusic FastStart"="c:\program files\Nokia\Ovi Player\OviPlayer.exe" [2009-08-19 2372896]
    "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "RunNarrator"="Narrator.exe" [2008-04-14 53760]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    BTTray.lnk - c:\program files\Belkin\Bluetooth Software\BTTray.exe [2004-10-1 565309]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @="Driver"

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\LimeWire\\LimeWire.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=

    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [30/04/2010 17:11 135336]
    R2 IconixService;Iconix Update Service;c:\program files\Common Files\Iconix\IconixService.exe [27/12/2009 22:31 283992]
    R3 EKBfltr;ENE Keyboard Controller;c:\windows\system32\drivers\EKBfltr.sys [25/11/2005 12:54 5504]
    R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [10/03/2010 22:35 27632]
    S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [09/02/2010 21:14 135664]
    S3 s3017bus;Sony Ericsson Device 3017 driver (WDM);c:\windows\system32\drivers\s3017bus.sys [10/03/2010 22:27 83880]
    S3 s3017mdfl;Sony Ericsson Device 3017 USB WMC Modem Filter;c:\windows\system32\drivers\s3017mdfl.sys [10/03/2010 22:27 15016]
    S3 s3017mdm;Sony Ericsson Device 3017 USB WMC Modem Driver;c:\windows\system32\drivers\s3017mdm.sys [10/03/2010 22:27 110632]
    S3 s3017mgmt;Sony Ericsson Device 3017 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s3017mgmt.sys [10/03/2010 22:27 104616]
    S3 s3017obex;Sony Ericsson Device 3017 USB WMC OBEX Interface;c:\windows\system32\drivers\s3017obex.sys [10/03/2010 22:27 100648]
    S3 s3017unic;Sony Ericsson Device 3017 USB Ethernet Emulation SEMC3017 (WDM);c:\windows\system32\drivers\s3017unic.sys [10/03/2010 22:27 110120]
    .
    Contents of the 'Scheduled Tasks' folder

    2010-05-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-09 20:14]

    2010-05-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-09 20:14]

    2009-03-18 c:\windows\Tasks\Symantec NetDetect.job
    - c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2009-03-18 12:24]

    2010-05-03 c:\windows\Tasks\User_Feed_Synchronization-{47A9E285-6036-41F8-B099-2E2DD6D425D2}.job
    - c:\windows\system32\msfeedssync.exe [2007-08-13 03:31]
    .
    .
    Supplementary Scan
    .
    uStart Page = hxxp://www.google.co.uk/
    uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
    mSearch Bar = hxxp://www.google.com
    uSearchURL,(Default) = hxxp://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
    IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
    IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
    DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
    .
    - - - - ORPHANS REMOVED - - - -

    WebBrowser-{135503F4-6D8B-4CDF-81D5-86571B20A25F} - c:\windows\system32\f078.dll



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-05-03 17:40
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    DLLs Loaded Under Running Processes

    - - - - - - - > 'explorer.exe'(1760)
    c:\windows\system32\WININET.dll
    c:\program files\Iconix\OEAddOn\OEldr_7.dll
    c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    Completion time: 2010-05-03 17:46:29
    ComboFix-quarantined-files.txt 2010-05-03 16:46

    Pre-Run: 22,879,043,584 bytes free
    Post-Run: 23,270,797,312 bytes free

    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

    - - End Of File - - 997D5749726AE5C05EBDD170035F3D39
    It's easier to get forgiveness than to ask permission ;)
  • tranmererovers
    tranmererovers Posts: 2,313 Forumite
    Part of the Furniture 1,000 Posts Combo Breaker
    Here is a new HiJackThis file

    Logfile of Trend Micro HijackThis v2.0.3 (BETA)
    Scan saved at 18:10:40, on 03/05/2010
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Ahead\InCD\InCDsrv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir Desktop\sched.exe
    C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    C:\WINDOWS\system32\bgsvcgen.exe
    C:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe
    C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    C:\Program Files\Common Files\Iconix\IconixService.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\system32\VTTimer.exe
    C:\WINDOWS\system32\VTtrayp.exe
    C:\Program Files\Ahead\InCD\InCD.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\WINDOWS\sm56hlpr.exe
    C:\Program Files\Iconix\OEAddOn\OEdmn_6.exe
    C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Belkin\Bluetooth Software\BTTray.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe
    c:\program files\avira\antivir desktop\avcenter.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
    O2 - BHO: IconixBHOClass Class - {761233B6-F228-49E4-8F6B-668499D4E55A} - C:\Program Files\Iconix\IEAddOn\IconixBHO_42.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
    O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
    O4 - HKLM\..\Run: [EPSON Stylus DX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE /P26 "EPSON Stylus DX3800 Series" /O6 "USB001" /M "Stylus DX3800"
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [EPSON Stylus DX3800 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE /P35 "EPSON Stylus DX3800 Series (Copy 1)" /O5 "LPT1:" /M "Stylus DX3800"
    O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
    O4 - HKLM\..\Run: [IconixOEAddOn] "C:\Program Files\Iconix\OEAddOn\OEdmn_6.exe"
    O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
    O4 - HKLM\..\Run: [NokiaMusic FastStart] "C:\Program Files\Nokia\Ovi Player\OviPlayer.exe" /command:faststart
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
    O4 - Global Startup: BTTray.lnk = ?
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
    O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: (no name) - {400A6CFA-E326-4d61-A90C-9AD75358DC5F} - C:\Program Files\Iconix\IEAddOn\IconixBHO_42.dll
    O9 - Extra 'Tools' menuitem: Email ID Preferences - {400A6CFA-E326-4d61-A90C-9AD75358DC5F} - C:\Program Files\Iconix\IEAddOn\IconixBHO_42.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
    O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
    O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe
    O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Iconix Update Service (IconixService) - Unknown owner - C:\Program Files\Common Files\Iconix\IconixService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

    --
    End of file - 11339 bytes
    It's easier to get forgiveness than to ask permission ;)
This discussion has been closed.
★ ★ ★ Meet your Ambassadors

🚀 Getting Started

Hi new member!

Our Getting Started Guide will help you get the most out of the Forum

Categories

  • All Categories
  • 352.3K Banking & Borrowing
  • 253.6K Reduce Debt & Boost Income
  • 454.3K Spending & Discounts
  • 245.3K Work, Benefits & Business
  • 601.1K Mortgages, Homes & Bills
  • 177.6K Life & Family
  • 259.2K Travel & Transport
  • 1.5M Hobbies & Leisure
  • 16K Discuss & Feedback
  • 37.7K Read-Only Boards

Is this how you want to be seen?

We see you are using a default avatar. It takes only a few seconds to pick a picture.
Update Your Picture