We’d like to remind Forumites to please avoid political debate on the Forum.

This is to keep it a safe and useful space for MoneySaving discussions. Threads that are – or become – political in nature may be removed in line with the Forum’s rules. Thank you for your understanding.

📨 Have you signed up to the Forum's new Email Digest yet? Get a selection of trending threads sent straight to your inbox daily, weekly or monthly!
The Forum now has a brand new text editor, adding a bunch of handy features to use when creating posts. Read more in our how-to guide

Malware Logs

13

Comments

  • tranmererovers
    tranmererovers Posts: 2,313 Forumite
    Part of the Furniture 1,000 Posts Combo Breaker
    All windows update are now done and there are about 70 processes that seem to run on startup. Have removed what I can with startuplite but there are loads of icons on the taskbar - how do I disable these??
    It's easier to get forgiveness than to ask permission ;)
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    Id definitely remove all VIRGIN software

    Especially anything that relates to 'radialpoint' which seems to have loads of different drivers running (Not sure how it relates to virgin, but theyre connected somehow)
    :idea:
  • tranmererovers
    tranmererovers Posts: 2,313 Forumite
    Part of the Furniture 1,000 Posts Combo Breaker
    aliEnRIK wrote: »
    Id definitely remove all VIRGIN software

    Especially anything that relates to 'radialpoint' which seems to have loads of different drivers running (Not sure how it relates to virgin, but theyre connected somehow)

    Virgin is their ISP and some of the software is related to the router (eg they have Virgin broadband wireless manager software on there) which I think I need to leave?????
    It's easier to get forgiveness than to ask permission ;)
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    I have virgin and I dont require any virgin software for it to run
    :idea:
  • tranmererovers
    tranmererovers Posts: 2,313 Forumite
    Part of the Furniture 1,000 Posts Combo Breaker
    aliEnRIK wrote: »
    I have virgin and I dont require any virgin software for it to run

    OK thanks. In that case I will do.

    How is the Combofix looking please?
    It's easier to get forgiveness than to ask permission ;)
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    I cant see anything nasty left running
    :idea:
  • tranmererovers
    tranmererovers Posts: 2,313 Forumite
    Part of the Furniture 1,000 Posts Combo Breaker
    aliEnRIK wrote: »
    I cant see anything nasty left running

    Thanks, I've just run a full scan with the newly installed avira and that found a couple of things. Here is the log..



    Avira AntiVir Personal
    Report file date: 12 September 2010 13:17

    Scanning for 2801829 virus strains and unwanted programs.

    The program is running as an unrestricted full version.
    Online services are available:

    Licensee : Avira AntiVir Personal - FREE Antivirus
    Serial number : 0000149996-ADJIE-0000001
    Platform : Windows XP
    Windows version : (Service Pack 3) [5.1.2600]
    Boot mode : Normally booted
    Username : SYSTEM
    Computer name : TWINS

    Version information:
    BUILD.DAT : 10.0.0.567 32097 Bytes 4/19/2010 15:07:00
    AVSCAN.EXE : 10.0.3.0 433832 Bytes 4/1/2010 12:37:38
    AVSCAN.DLL : 10.0.3.0 46440 Bytes 4/1/2010 12:57:04
    LUKE.DLL : 10.0.2.3 104296 Bytes 3/7/2010 18:33:04
    LUKERES.DLL : 10.0.0.1 12648 Bytes 2/10/2010 23:40:49
    VBASE000.VDF : 7.10.0.0 19875328 Bytes 11/6/2009 09:05:36
    VBASE001.VDF : 7.10.1.0 1372672 Bytes 11/19/2009 19:27:49
    VBASE002.VDF : 7.10.3.1 3143680 Bytes 1/20/2010 17:37:42
    VBASE003.VDF : 7.10.3.75 996864 Bytes 1/26/2010 16:37:42
    VBASE004.VDF : 7.10.4.203 1579008 Bytes 3/5/2010 11:29:03
    VBASE005.VDF : 7.10.6.82 2494464 Bytes 4/15/2010 19:27:09
    VBASE006.VDF : 7.10.7.218 2294784 Bytes 6/2/2010 19:27:13
    VBASE007.VDF : 7.10.9.165 4840960 Bytes 7/23/2010 19:27:25
    VBASE008.VDF : 7.10.9.166 2048 Bytes 7/23/2010 19:27:25
    VBASE009.VDF : 7.10.9.167 2048 Bytes 7/23/2010 19:27:26
    VBASE010.VDF : 7.10.9.168 2048 Bytes 7/23/2010 19:27:27
    VBASE011.VDF : 7.10.9.169 2048 Bytes 7/23/2010 19:27:28
    VBASE012.VDF : 7.10.9.170 2048 Bytes 7/23/2010 19:27:28
    VBASE013.VDF : 7.10.9.198 157696 Bytes 7/26/2010 19:27:29
    VBASE014.VDF : 7.10.9.255 997888 Bytes 7/29/2010 19:27:32
    VBASE015.VDF : 7.10.10.28 139264 Bytes 8/2/2010 19:27:33
    VBASE016.VDF : 7.10.10.52 127488 Bytes 8/3/2010 19:27:33
    VBASE017.VDF : 7.10.10.84 137728 Bytes 8/6/2010 19:27:34
    VBASE018.VDF : 7.10.10.107 176640 Bytes 8/9/2010 19:27:35
    VBASE019.VDF : 7.10.10.130 132608 Bytes 8/10/2010 19:27:36
    VBASE020.VDF : 7.10.10.158 131072 Bytes 8/12/2010 19:27:37
    VBASE021.VDF : 7.10.10.190 136704 Bytes 8/16/2010 19:27:38
    VBASE022.VDF : 7.10.10.217 118272 Bytes 8/19/2010 19:27:38
    VBASE023.VDF : 7.10.10.246 130048 Bytes 8/23/2010 19:27:39
    VBASE024.VDF : 7.10.11.11 144896 Bytes 8/25/2010 19:27:40
    VBASE025.VDF : 7.10.11.33 135168 Bytes 8/27/2010 19:27:41
    VBASE026.VDF : 7.10.11.52 148992 Bytes 8/31/2010 19:27:42
    VBASE027.VDF : 7.10.11.75 124928 Bytes 9/3/2010 19:27:43
    VBASE028.VDF : 7.10.11.92 137728 Bytes 9/6/2010 19:27:46
    VBASE029.VDF : 7.10.11.107 166400 Bytes 9/8/2010 19:27:47
    VBASE030.VDF : 7.10.11.127 136704 Bytes 9/10/2010 19:27:47
    VBASE031.VDF : 7.10.11.128 2048 Bytes 9/10/2010 19:27:47
    Engineversion : 8.2.4.50
    AEVDF.DLL : 8.1.2.1 106868 Bytes 9/10/2010 19:28:11
    AESCRIPT.DLL : 8.1.3.44 1364346 Bytes 9/10/2010 19:28:10
    AESCN.DLL : 8.1.6.1 127347 Bytes 9/10/2010 19:28:08
    AESBX.DLL : 8.1.3.1 254324 Bytes 9/10/2010 19:28:11
    AERDL.DLL : 8.1.8.2 614772 Bytes 9/10/2010 19:28:08
    AEPACK.DLL : 8.2.3.5 471412 Bytes 9/10/2010 19:28:07
    AEOFFICE.DLL : 8.1.1.8 201081 Bytes 9/10/2010 19:28:07
    AEHEUR.DLL : 8.1.2.21 2883958 Bytes 9/10/2010 19:28:05
    AEHELP.DLL : 8.1.13.3 242038 Bytes 9/10/2010 19:27:59
    AEGEN.DLL : 8.1.3.20 397684 Bytes 9/10/2010 19:27:59
    AEEMU.DLL : 8.1.2.0 393588 Bytes 9/10/2010 19:27:58
    AECORE.DLL : 8.1.16.2 192887 Bytes 9/10/2010 19:27:58
    AEBB.DLL : 8.1.1.0 53618 Bytes 9/10/2010 19:27:57
    AVWINLL.DLL : 10.0.0.0 19304 Bytes 1/14/2010 12:03:38
    AVPREF.DLL : 10.0.0.0 44904 Bytes 1/14/2010 12:03:35
    AVREP.DLL : 10.0.0.8 62209 Bytes 2/18/2010 16:47:40
    AVREG.DLL : 10.0.3.0 53096 Bytes 4/1/2010 12:35:46
    AVSCPLR.DLL : 10.0.3.0 83816 Bytes 4/1/2010 12:39:51
    AVARKT.DLL : 10.0.0.14 227176 Bytes 4/1/2010 12:22:13
    AVEVTLOG.DLL : 10.0.0.8 203112 Bytes 1/26/2010 09:53:30
    SQLITE3.DLL : 3.6.19.0 355688 Bytes 1/28/2010 12:57:58
    AVSMTP.DLL : 10.0.0.17 63848 Bytes 3/16/2010 15:38:56
    NETNT.DLL : 10.0.0.0 11624 Bytes 2/19/2010 14:41:00
    RCIMAGE.DLL : 10.0.0.26 2550120 Bytes 1/28/2010 13:10:20
    RCTEXT.DLL : 10.0.53.0 97128 Bytes 4/9/2010 14:14:29

    Configuration settings for the scan:
    Jobname.............................: Complete system scan
    Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp
    Logging.............................: low
    Primary action......................: interactive
    Secondary action....................: ignore
    Scan master boot sector.............: on
    Scan boot sector....................: on
    Boot sectors........................: C:, D:,
    Process scan........................: on
    Extended process scan...............: on
    Scan registry.......................: on
    Search for rootkits.................: on
    Integrity checking of system files..: off
    Scan all files......................: All files
    Scan archives.......................: on
    Recursion depth.....................: 20
    Smart extensions....................: on
    Macro heuristic.....................: on
    File heuristic......................: medium

    Start of the scan: 12 September 2010 13:17

    Starting search for hidden objects.
    HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\VAIO_VEDB\MSSQLServer\uptime_time_utc
    [NOTE] The registry entry is invisible.

    The scan of running processes will be started
    Scan process 'ISUSPM.exe' - '27' Module(s) have been scanned
    Scan process 'agent.exe' - '58' Module(s) have been scanned
    Scan process 'avscan.exe' - '71' Module(s) have been scanned
    Scan process 'avcenter.exe' - '83' Module(s) have been scanned
    Scan process 'wmiprvse.exe' - '44' Module(s) have been scanned
    Scan process 'ndis_events.exe' - '30' Module(s) have been scanned
    Scan process 'ymsgr_tray.exe' - '32' Module(s) have been scanned
    Scan process 'ServiceLayer.exe' - '49' Module(s) have been scanned
    Scan process 'WindowsSearch.exe' - '70' Module(s) have been scanned
    Scan process 'QuickDCF.exe' - '24' Module(s) have been scanned
    Scan process 'ctfmon.exe' - '28' Module(s) have been scanned
    Scan process 'ISUSPM.exe' - '44' Module(s) have been scanned
    Scan process 'avgnt.exe' - '54' Module(s) have been scanned
    Scan process 'BrMfcmon.exe' - '30' Module(s) have been scanned
    Scan process 'VirginMediaHUB.exe' - '87' Module(s) have been scanned
    Scan process 'Wireless Manager.exe' - '72' Module(s) have been scanned
    Scan process 'brccMCtl.exe' - '66' Module(s) have been scanned
    Scan process 'Apntex.exe' - '24' Module(s) have been scanned
    Scan process 'ycommon.exe' - '50' Module(s) have been scanned
    Scan process 'VAIOUpdt.exe' - '59' Module(s) have been scanned
    Scan process 'NSLauncher.exe' - '35' Module(s) have been scanned
    Scan process 'GrooveMonitor.exe' - '42' Module(s) have been scanned
    Scan process 'BrMfcWnd.exe' - '37' Module(s) have been scanned
    Scan process 'pptd40nt.exe' - '30' Module(s) have been scanned
    Scan process 'apdproxy.exe' - '51' Module(s) have been scanned
    Scan process 'ybrwicon.exe' - '33' Module(s) have been scanned
    Scan process 'pdservice.exe' - '28' Module(s) have been scanned
    Scan process 'ISBMgr.exe' - '37' Module(s) have been scanned
    Scan process 'SPMgr.exe' - '44' Module(s) have been scanned
    Scan process 'ICO.EXE' - '22' Module(s) have been scanned
    Scan process 'RTHDCPL.EXE' - '42' Module(s) have been scanned
    Scan process 'Apoint.exe' - '39' Module(s) have been scanned
    Scan process 'Explorer.EXE' - '119' Module(s) have been scanned
    Scan process 'wmiprvse.exe' - '42' Module(s) have been scanned
    Scan process 'alg.exe' - '33' Module(s) have been scanned
    Scan process 'VzFw.exe' - '35' Module(s) have been scanned
    Scan process 'VzCdbSvc.exe' - '70' Module(s) have been scanned
    Scan process 'igfxsrvc.exe' - '23' Module(s) have been scanned
    Scan process 'igfxext.exe' - '21' Module(s) have been scanned
    Scan process 'SearchIndexer.exe' - '57' Module(s) have been scanned
    Scan process 'VCSW.exe' - '36' Module(s) have been scanned
    Scan process 'VESMgr.exe' - '64' Module(s) have been scanned
    Scan process 'wdfmgr.exe' - '15' Module(s) have been scanned
    Scan process 'svchost.exe' - '39' Module(s) have been scanned
    Scan process 'ServicepointService.exe' - '36' Module(s) have been scanned
    Scan process 'SeaPort.exe' - '44' Module(s) have been scanned
    Scan process 'RegSrvc.exe' - '21' Module(s) have been scanned
    Scan process 'sqlservr.exe' - '30' Module(s) have been scanned
    Scan process 'avshadow.exe' - '25' Module(s) have been scanned
    Scan process 'avguard.exe' - '54' Module(s) have been scanned
    Scan process 'AffinegyService.exe' - '22' Module(s) have been scanned
    Scan process 'PhotoshopElementsFileAgent.exe' - '25' Module(s) have been scanned
    Scan process 'svchost.exe' - '34' Module(s) have been scanned
    Scan process 'sched.exe' - '46' Module(s) have been scanned
    Scan process 'LEXPPS.EXE' - '25' Module(s) have been scanned
    Scan process 'spoolsv.exe' - '63' Module(s) have been scanned
    Scan process 'LEXBCES.EXE' - '23' Module(s) have been scanned
    Scan process 'svchost.exe' - '37' Module(s) have been scanned
    Scan process 'svchost.exe' - '32' Module(s) have been scanned
    Scan process 'smc.exe' - '88' Module(s) have been scanned
    Scan process 'svchost.exe' - '160' Module(s) have been scanned
    Scan process 'svchost.exe' - '39' Module(s) have been scanned
    Scan process 'svchost.exe' - '52' Module(s) have been scanned
    Scan process 'lsass.exe' - '58' Module(s) have been scanned
    Scan process 'services.exe' - '27' Module(s) have been scanned
    Scan process 'winlogon.exe' - '72' Module(s) have been scanned
    Scan process 'csrss.exe' - '12' Module(s) have been scanned
    Scan process 'smss.exe' - '2' Module(s) have been scanned

    Starting master boot sector scan:
    Master boot sector HD0
    [INFO] No virus was found!
    Master boot sector HD1
    [INFO] No virus was found!

    Start scanning boot sectors:
    Boot sector 'C:\'
    [INFO] No virus was found!
    Boot sector 'D:\'
    [INFO] No virus was found!

    Starting to scan executable files (registry).
    The registry was scanned ( '509' files ).


    Starting the file scan:

    Begin scan in 'C:\' <VAIO>
    C:\Documents and Settings\Daddy\Local Settings\Temp\Temporary Internet Files\Content.IE5\1MJEJAFT\asian[1].htm
    [DETECTION] Contains HEUR/HTML.Malware suspicious code
    C:\Documents and Settings\Daddy\Local Settings\Temporary Internet Files\Content.IE5\MYSLQHBN\ADSAdClient31[7].txt
    [DETECTION] Contains recognition pattern of the HTML/Infected.WebPage.Gen HTML script virus
    C:\Program Files\ISP\BTPreload\DialBBSignUp.exe
    [DETECTION] Contains recognition pattern of the DIAL/270336 dialer
    Begin scan in 'D:\' <VAIO>

    Beginning disinfection:
    C:\Program Files\ISP\BTPreload\DialBBSignUp.exe
    [DETECTION] Contains recognition pattern of the DIAL/270336 dialer
    [NOTE] The file was moved to the quarantine directory under the name '47ef41e3.qua'.
    C:\Documents and Settings\Daddy\Local Settings\Temporary Internet Files\Content.IE5\MYSLQHBN\ADSAdClient31[7].txt
    [DETECTION] Contains recognition pattern of the HTML/Infected.WebPage.Gen HTML script virus
    [NOTE] The file was moved to the quarantine directory under the name '5f4a6e61.qua'.
    C:\Documents and Settings\Daddy\Local Settings\Temp\Temporary Internet Files\Content.IE5\1MJEJAFT\asian[1].htm
    [DETECTION] Contains HEUR/HTML.Malware suspicious code
    [NOTE] The detection was classified as suspicious.
    [NOTE] The file was moved to the quarantine directory under the name '0d3f3458.qua'.


    End of the scan: 12 September 2010 15:34
    Used time: 2:03:08 Hour(s)

    The scan has been done completely.

    11396 Scanned directories
    397630 Files were scanned
    2 Viruses and/or unwanted programs were found
    1 Files were classified as suspicious
    0 files were deleted
    0 Viruses and unwanted programs were repaired
    3 Files were moved to quarantine
    0 Files were renamed
    0 Files cannot be scanned
    397627 Files not concerned
    8014 Archives were scanned
    0 Warnings
    3 Notes
    522421 Objects were scanned with rootkit scan
    1 Hidden objects were found

    Just re running a full scan with malwarebytes, that's showing 1 infected object so far :(
    It's easier to get forgiveness than to ask permission ;)
  • tranmererovers
    tranmererovers Posts: 2,313 Forumite
    Part of the Furniture 1,000 Posts Combo Breaker
    Here is the latest malwarebytes scan that has just finished running

    Malwarebytes' Anti-Malware 1.46
    https://www.malwarebytes.org

    Database version: 4600

    Windows 5.1.2600 Service Pack 3
    Internet Explorer 8.0.6001.18702

    12/09/2010 17:56:08
    mbam-log-2010-09-12 (17-56-08).txt

    Scan type: Full scan (C:\|D:\|)
    Objects scanned: 311058
    Time elapsed: 2 hour(s), 8 minute(s), 59 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 1
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
    It's easier to get forgiveness than to ask permission ;)
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    Run a fresh hijack log
    :idea:
  • tranmererovers
    tranmererovers Posts: 2,313 Forumite
    Part of the Furniture 1,000 Posts Combo Breaker
    Here is the latest HJT


    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 19:23:03, on 12/09/2010
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\Program Files\Avira\AntiVir Desktop\sched.exe
    C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
    C:\Program Files\Virgin Broadband Wireless\AffinegyService.exe
    C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
    C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\Program Files\Virgin Media\HUB\ServicepointService.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
    C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
    C:\WINDOWS\system32\SearchIndexer.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
    C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
    C:\Program Files\Apoint\Apoint.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\system32\ICO.EXE
    C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
    C:\Program Files\Sony\ISB Utility\ISBMgr.exe
    C:\Program Files\Utimaco\SafeGuard PrivateDisk\pdservice.exe
    C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
    C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
    C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
    C:\PROGRA~1\Yahoo!\browser\ycommon.exe
    C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
    C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe
    C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
    C:\Program Files\Apoint\Apntex.exe
    C:\Program Files\Virgin Broadband Wireless\Wireless Manager.exe
    C:\Program Files\Virgin Media\HUB\VirginMediaHUB.exe
    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    C:\Program Files\Trusteer\Rapport\bin\RapportService.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\FinePixViewer\QuickDCF.exe
    C:\Program Files\Windows Desktop Search\WindowsSearch.exe
    C:\Program Files\Virgin Broadband Wireless\ndis_events.exe
    C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
    C:\Program Files\Virgin Media\HUB\VirginMediaHUBComHandler.exe
    C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
    C:\WINDOWS\system32\SearchProtocolHost.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virginmedia.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sb/*http://uk.docs.yahoo.com/info/bt_side.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.live.com/sphome.aspx
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
    O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
    O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\YTSingleInstance.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
    O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
    O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
    O4 - HKLM\..\Run: [SonyPowerCfg] C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
    O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe
    O4 - HKLM\..\Run: [PDService.exe] C:\Program Files\Utimaco\SafeGuard PrivateDisk\pdservice.exe
    O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
    O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
    O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
    O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
    O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini
    O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
    O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKLM\..\Run: [NSLauncher] C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe /startup
    O4 - HKLM\..\Run: [VAIO Update 5] "C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe" /Stationary
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    O4 - HKLM\..\Run: [Wireless Manager] "C:\Program Files\Virgin Broadband Wireless\Wireless Manager.exe" startup
    O4 - HKLM\..\Run: [VirginMediaHUB.exe] "C:\Program Files\Virgin Media\HUB\VirginMediaHUB.exe" /AUTORUN
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
    O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Broadband Desktop Help.lnk = C:\Program Files\BT Broadband 210\Help\bin\matcli.exe
    O4 - Global Startup: Exif Launcher.lnk = ?
    O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
    O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
    O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.com/en/
    O15 - Trusted Zone: *.sony-europe.com
    O15 - Trusted Zone: *.sonystyle-europe.com
    O15 - Trusted Zone: *.vaio-link.com
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
    O20 - AppInit_DLLs:
    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
    O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
    O23 - Service: AffinegyService - Affinegy, Inc. - C:\Program Files\Virgin Broadband Wireless\AffinegyService.exe
    O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
    O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
    O23 - Service: Rapport Management Service (RapportMgmtService) - Trusteer Ltd. - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
    O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe (file missing)
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
    O23 - Service: ServicepointService - Radialpoint Inc. - C:\Program Files\Virgin Media\HUB\ServicepointService.exe
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
    O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
    O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
    O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
    O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
    O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
    O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
    O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
    O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
    O23 - Service: VAIO Cooporated Initialisation (VCI) - Sony Corporation - C:\Program Files\Sony\VAIO Cooperated Initialisation\VCI_SVC.exe
    O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
    O23 - Service: Volume Shadow Copy (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe (file missing)
    O23 - Service: VUAgent - Sony Corporation - C:\Program Files\Sony\VAIO Update 5\VUAgent.exe
    O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
    O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
    O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

    --
    End of file - 16139 bytes


    Thanks
    It's easier to get forgiveness than to ask permission ;)
This discussion has been closed.
★ ★ ★ Meet your Ambassadors

🚀 Getting Started

Hi new member!

Our Getting Started Guide will help you get the most out of the Forum

Categories

  • All Categories
  • 353.5K Banking & Borrowing
  • 254.1K Reduce Debt & Boost Income
  • 455K Spending & Discounts
  • 246.6K Work, Benefits & Business
  • 602.9K Mortgages, Homes & Bills
  • 178K Life & Family
  • 260.5K Travel & Transport
  • 1.5M Hobbies & Leisure
  • 16K Discuss & Feedback
  • 37.7K Read-Only Boards

Is this how you want to be seen?

We see you are using a default avatar. It takes only a few seconds to pick a picture.
Update Your Picture