IE7 has been infected by whataboutadog. IE freezes on opening and I see visits to 88.80.5.21 and whataboutadog.com
I have tried the regular malware removal BKMs, Norton, Adaware, CC, Spybot, Trojan Hunter etc but HThis still shows an entry for whataboutadog.
I am posting HT and AWF logs below. Can someone help me in removing this malware?
Thx
C-dan
AWF log
Find AWF report by noahdfear ©2006
Version 1.40
The current date is: Thu 10/11/2007
The current time is: 19:45:03.81
bak folders found
~~~~~~~~~~~
Directory of C:\PROGRA~1\AIM\BAK
08/05/2005 03:08 PM 67,160 aim.exe
1 File(s) 67,160 bytes
Directory of C:\PROGRA~1\ITUNES\BAK
06/01/2007 04:51 PM 257,088 iTunesHelper.exe
1 File(s) 257,088 bytes
Directory of C:\PROGRA~1\MSNMES~1\BAK
0 File(s) 0 bytes
Directory of C:\PROGRA~1\PICASA2\BAK
06/15/2007 04:15 PM 366,400 PicasaMediaDetector.exe
1 File(s) 366,400 bytes
Directory of C:\PROGRA~1\QUICKT~1\BAK
04/27/2007 09:41 AM 282,624 qttask.exe
1 File(s) 282,624 bytes
Directory of C:\PROGRA~1\TROJAN~1.2\BAK
02/19/2005 04:36 PM 1,089,024 THGuard.exe
1 File(s) 1,089,024 bytes
Directory of C:\WINDOWS\SYSTEM32\BAK
08/04/2004 12:56 AM 15,360 ctfmon.exe
1 File(s) 15,360 bytes
Directory of C:\PROGRA~1\ANALOG~1\SOUNDMAX\BAK
08/06/2004 05:27 AM 860,160 Smax4.exe
04/01/2004 07:52 AM 1,368,064 SMax4PNP.exe
2 File(s) 2,228,224 bytes
Directory of C:\PROGRA~1\ATITEC~1\ATICON~1\BAK
02/24/2005 06:00 PM 339,968 atiptaxx.exe
1 File(s) 339,968 bytes
Directory of C:\PROGRA~1\COMMON~1\SYMANT~1\BAK
0 File(s) 0 bytes
Directory of C:\PROGRA~1\GOOGLE\GOOGLE~2\BAK
07/12/2007 11:23 AM 68,856 GoogleToolbarNotifier.exe
1 File(s) 68,856 bytes
Directory of C:\PROGRA~1\HP\HPSOFT~1\BAK
12/15/2005 12:18 PM 49,152 HPWuSchd2.exe
1 File(s) 49,152 bytes
Directory of C:\PROGRA~1\IBM\MESSAG~1\BAK
01/07/2003 02:52 PM 495,616 ibmmessages.exe
1 File(s) 495,616 bytes
Directory of C:\PROGRA~1\SYNAPT~1\SYNTP\BAK
11/08/2004 08:17 AM 512,000 SynTPEnh.exe
11/08/2004 08:17 AM 110,592 SynTPLpr.exe
2 File(s) 622,592 bytes
Directory of C:\PROGRA~1\THINKPAD\CONNEC~1\BAK
03/18/2005 12:07 AM 745,472 QCTray.exe
03/18/2005 12:07 AM 86,016 QCWLICON.EXE
2 File(s) 831,488 bytes
Directory of C:\PROGRA~1\THINKPAD\UTILIT~1\BAK
08/24/2004 10:37 PM 20,480 BMMLREF.EXE
11/23/2004 11:10 PM 212,992 EzEjMnAp.Exe
02/04/2004 03:39 PM 897,024 TpKmapAp.exe
02/04/2004 03:39 PM 32,768 TpKmapMn.exe
4 File(s) 1,163,264 bytes
Directory of C:\PROGRA~1\VERITA~1\UPDATE~1\BAK
06/18/2002 12:01 AM 155,648 sgtray.exe
1 File(s) 155,648 bytes
Directory of C:\PROGRA~1\YAHOO!\MESSEN~1\BAK
03/27/2007 03:22 PM 4,670,968 YAHOOM~1.EXE
1 File(s) 4,670,968 bytes
Directory of C:\WINDOWS\SYSTEM32\DLA\BAK
01/10/2003 03:50 AM 106,551 tfswctrl.exe
1 File(s) 106,551 bytes
Directory of C:\PROGRA~1\ADOBE\ADOBEV~1\CONTRO~1\BAK
10/13/2003 04:24 PM 1,732,608 VersionCueTray.exe
1 File(s) 1,732,608 bytes
Directory of C:\PROGRA~1\COMMON~1\REAL\UPDATE~1\BAK
04/08/2005 03:12 PM 180,269 realsched.exe
1 File(s) 180,269 bytes
Directory of C:\PROGRA~1\SBCYAH~1\CONNEC~1\IPINSI~1\BAK
07/14/2003 12:30 PM 98,304 IPMon32.exe
1 File(s) 98,304 bytes
Directory of C:\PROGRA~1\THINKPAD\PKGMGR\HOTKEY\BAK
11/16/2004 09:48 PM 94,208 TPHKMGR.exe
1 File(s) 94,208 bytes
Directory of C:\PROGRA~1\INTEL\PROSET~1\NCS\PROSET\BAK
08/06/2003 01:08 PM 86,016 PRONoMgr.exe
1 File(s) 86,016 bytes
Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~
28172 Oct 3 2007 "C:\Program Files\AIM\aim.exe"
67160 Aug 5 2005 "C:\Program Files\AIM\bak\aim.exe"
28172 Oct 3 2007 "C:\Program Files\iTunes\iTunesHelper.exe"
257088 Jun 1 2007 "C:\Program Files\iTunes\bak\iTunesHelper.exe"
102400 Jun 16 2007 "C:\WINDOWS\Installer\{553E56C3-7AA1-45FE-A2FC-2C43DC27F765}\iTunesIco.exe"
116288 Jun 16 2007 "C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.2.0.35\iTunesSetupAdmin.exe"
116288 Jun 16 2007 "C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\0D2F4H6V\iTunesSetupAdmin[1].exe"
116288 Apr 7 2007 "C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\47YHILMZ\iTunesSetupAdmin[1].exe"
476984 Jun 15 2007 "C:\Program Files\Picasa2\PicasaUpdate.exe"
366400 Jun 15 2007 "C:\Program Files\Picasa2\bak\PicasaMediaDetector.exe"
493384 Jun 15 2007 "C:\Program Files\Picasa2\cdautorun\PicasaRestore.exe"
28172 Oct 3 2007 "C:\Program Files\QuickTime\qttask.exe"
282624 Apr 27 2007 "C:\Program Files\QuickTime\bak\qttask.exe"
28172 Oct 3 2007 "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
1089024 Feb 19 2005 "C:\Program Files\TrojanHunter 4.2\bak\THGuard.exe"
15360 Aug 4 2004 "C:\WINDOWS\system32\ctfmon.exe"
15360 Aug 4 2004 "C:\WINDOWS\system32\bak\ctfmon.exe"
28172 Oct 3 2007 "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe"
860160 Aug 6 2004 "C:\DRIVERS\1GA239WW\SM_PANEL\SYS\SMAX4.EXE"
860160 Aug 6 2004 "C:\Program Files\Analog Devices\SoundMAX\bak\Smax4.exe"
28172 Oct 3 2007 "C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe"
1368064 Apr 1 2004 "C:\DRIVERS\1GA239WW\SM_PNP\SYS\SMAX4PNP.EXE"
1368064 Apr 1 2004 "C:\Program Files\Analog Devices\SoundMAX\bak\SMax4PNP.exe"
28172 Oct 3 2007 "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
339968 Feb 24 2005 "C:\Program Files\ATI Technologies\ATI Control Panel\bak\atiptaxx.exe"
52272 Jan 26 2007 "C:\Program Files\Google\googletoolbar11user.exe"
3739648 Jan 1 2007 "C:\Program Files\Google\Google Talk\googletalk.exe"
28172 Oct 3 2007 "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
138168 Jan 26 2007 "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"
1606064 Mar 4 2007 "C:\Program Files\Google\Google Talk\googletalk-1.0.0.104\googletalk-setup-upgrade.exe"
68856 Jul 12 2007 "C:\Program Files\Google\GoogleToolbarNotifier\bak\GoogleToolbarNotifier.exe"
28172 Oct 3 2007 "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
49152 Dec 15 2005 "C:\Program Files\HP\HP Software Update\bak\HPWuSchd2.exe"
495616 Jan 7 2003 "C:\Program Files\IBM\Messages By IBM\ibmmessages.exe"
495616 Jan 7 2003 "C:\Program Files\IBM\Messages By IBM\bak\ibmmessages.exe"
512000 Nov 8 2004 "C:\DRIVERS\1RGU80WW\SYNTPENH.EXE"
573440 Jan 29 2003 "C:\DRIVERS\AUDIO\SYNTPENH.EXE"
573440 Jan 29 2003 "C:\IBMWORK\3GUWYRA\SYNTPENH.EXE"
573440 Jan 29 2003 "C:\IBMTOOLS\DRIVERS\UNAV\SYNTPENH.EXE"
28172 Oct 3 2007 "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
512000 Nov 8 2004 "C:\Program Files\Synaptics\SynTP\bak\SynTPEnh.exe"
512000 Nov 8 2004 "C:\Program Files\Synaptics\SynTP\Media\SYNTPENH.EXE"
573440 Jan 29 2003 "C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\SynTPEnh.exe"
110592 Nov 8 2004 "C:\DRIVERS\1RGU80WW\SYNTPLPR.EXE"
126976 Jan 29 2003 "C:\DRIVERS\AUDIO\SYNTPLPR.EXE"
126976 Jan 29 2003 "C:\IBMWORK\3GUWYRA\SYNTPLPR.EXE"
126976 Jan 29 2003 "C:\IBMTOOLS\DRIVERS\UNAV\SYNTPLPR.EXE"
28172 Oct 3 2007 "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
110592 Nov 8 2004 "C:\Program Files\Synaptics\SynTP\bak\SynTPLpr.exe"
110592 Nov 8 2004 "C:\Program Files\Synaptics\SynTP\Media\SYNTPLPR.EXE"
126976 Jan 29 2003 "C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\SynTPLpr.exe"
536576 Mar 27 2003 "C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE"
745472 Mar 18 2005 "C:\Program Files\ThinkPad\ConnectUtilities\bak\QCTray.exe"
53248 Mar 27 2003 "C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE"
86016 Mar 18 2005 "C:\Program Files\ThinkPad\ConnectUtilities\bak\QCWLICON.EXE"
20480 Aug 24 2004 "C:\DRIVERS\1XU104US\BMMLREF.EXE"
20480 Jan 17 2003 "C:\IBMTOOLS\DRIVERS\BMMPM\BMMLREF.EXE"
28172 Oct 3 2007 "C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE"
20480 Aug 24 2004 "C:\Program Files\ThinkPad\Utilities\bak\BMMLREF.EXE"
212992 Nov 23 2004 "C:\DRIVERS\1YU202WW\EZEJMNAP.EXE"
204800 Dec 24 2002 "C:\IBMTOOLS\DRIVERS\EZEJECT\EZEJMNAP.EXE"
204800 Dec 24 2002 "C:\Program Files\ThinkPad\Utilities\EzEjMnAp.Exe"
212992 Nov 23 2004 "C:\Program Files\ThinkPad\Utilities\bak\EzEjMnAp.Exe"
28172 Oct 3 2007 "C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe"
897024 Feb 4 2004 "C:\Program Files\ThinkPad\Utilities\bak\TpKmapAp.exe"
28172 Oct 3 2007 "C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe"
32768 Feb 4 2004 "C:\Program Files\ThinkPad\Utilities\bak\TpKmapMn.exe"
28172 Oct 3 2007 "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe"
155648 Jun 18 2002 "C:\Program Files\VERITAS Software\Update Manager\bak\sgtray.exe"
4670968 Mar 27 2007 "C:\Program Files\Yahoo!\Messenger\bak\YAHOOM~1.EXE"
106551 Jan 10 2003 "C:\Program Files\IBM DLA\install\tfswctrl.exe"
28172 Oct 3 2007 "C:\WINDOWS\system32\dla\tfswctrl.exe"
106551 Jan 10 2003 "C:\WINDOWS\system32\dla\bak\tfswctrl.exe"
28172 Oct 3 2007 "C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe"
61440 Oct 13 2003 "C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe"
1732608 Oct 13 2003 "C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\bak\VersionCueTray.exe"
28172 Oct 3 2007 "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"
180269 Apr 8 2005 "C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe"
28172 Oct 3 2007 "C:\Program Files\SBC Yahoo!\Connection Manager\IP Insight\IPMon32.exe"
98304 Jul 14 2003 "C:\Program Files\SBC Yahoo!\Connection Manager\IP Insight\bak\IPMon32.exe"
94208 Nov 16 2004 "C:\DRIVERS\1YVU13WW\OSD\COMMON\TPHKMGR.EXE"
28172 Oct 3 2007 "C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe"
94208 Jan 24 2003 "C:\IBMTOOLS\DRIVERS\HOTKEY\OSD\COMMON\TPHKMGR.EXE"
94208 Nov 16 2004 "C:\Program Files\ThinkPad\PkgMgr\HOTKEY\bak\TPHKMGR.exe"
28172 Oct 3 2007 "C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe"
86016 Aug 6 2003 "C:\Program Files\Intel\PROSetWired\NCS\PROSet\bak\PRONoMgr.exe"
end of report
HT Log
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 7:44:02 PM, on 10/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\Program Files\Analog Devices\SoundMAX\bak\Smax4.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
C:\Program Files\2Wire\2PortalMon.exe
C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
C:\PROGRA~1\ThinkPad\CONNEC~1\QCTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Wireless LAN\WLAN CardBus Utility\WLAN_UI.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Synaptics\SynTP\bak\SynTPLpr.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\QCONSVC.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
c:\program files\lenovo\system update\suservice.exe
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\chandan\Desktop\HiJackThis_v2.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Dictionary.com - {11359F4A-B191-42d7-905A-594F8CF0387B} - C:\WINDOWS\Downloaded Program Files\CONFLICT.1\lexbar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar11.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Dictionary.com - {11359F4A-B191-42D7-905A-594F8CF0387B} - C:\WINDOWS\Downloaded Program Files\CONFLICT.1\lexbar.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar11.dll
O4 - HKLM\..\Run: [S3TRAY2] S3Tray2.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [TPKMAPMN] C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [StorageGuard] "c:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\bak\Smax4.exe" /tray
O4 - HKLM\..\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE
O4 - HKLM\..\Run: [BMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [ssdiag] C:\WINDOWS\ssdiag.exe
O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
O4 - HKLM\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
O4 - HKLM\..\Run: [2wSysTray] C:\Program Files\2Wire\2PortalMon.exe
O4 - HKLM\..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
O4 - HKLM\..\Run: [QCTray] C:\PROGRA~1\ThinkPad\CONNEC~1\QCTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: WLAN CardBus Utility.lnk = C:\Program Files\Wireless LAN\WLAN CardBus Utility\WLAN_UI.EXE
O8 - Extra context menu item: Display All Images with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/228
O8 - Extra context menu item: Display Image with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/227
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Search &Dictionary - C:\Program files\Lexico\Toolbar\dictionary.htm
O8 - Extra context menu item: Search &Thesaurus - C:\Program files\Lexico\Toolbar\thesaurus.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Update ThinkPad Software - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\ThinkPad\PkgMgr\\PkgMgr.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: PDFill PDF Editor - {FB858B22-55E2-413f-87F5-30ADC5552151} - C:\Program Files\PlotSoft\PDFill\\DownloadPDF.exe
O15 - Trusted Zone: *.whataboutadog.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v ... 2843087588
O16 - DPF: {F0E2D69A-DC2F-4E9B-A993-684FB1C21DBC} - http://dictionary.reference.com/tools/t ... lexico.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe
O23 - Service: QCONSVC - Unknown owner - C:\WINDOWS\System32\QCONSVC.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: System Update (SUService) - Lenovo Group Limited - c:\program files\lenovo\system update\suservice.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symuditrnmtm - Symantec Corporation - (no file)
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: TVT Scheduler - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
--
End of file - 14254 bytes