Combo fix log:
ComboFix 08-06-20.4 - Panthro 2008-06-24 6:42:46.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2506 [GMT -5:00]
Running from: Z:\New Folder\ComboFix.exe
Command switches used :: Z:\New Folder\CFScript.txt
* Created a new restore point
FILE ::
C:\4dzjaeh0.sys
C:\WINDOWS\system32\1d928a64.dll
C:\WINDOWS\system32\34cd0980.dll
C:\WINDOWS\system32\9b70280.dll
C:\WINDOWS\system32\9d94cca.dll
C:\WINDOWS\system32\jkkIBUkk.dll
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\4dzjaeh0.sys
C:\Program Files\temp01\
C:\WINDOWS\system32\1d928a64.dll
C:\WINDOWS\system32\34cd0980.dll
C:\WINDOWS\system32\9b70280.dll
C:\WINDOWS\system32\9d94cca.dll
C:\WINDOWS\system32\jkkIBUkk.dll
.
((((((((((((((((((((((((( Files Created from 2008-05-24 to 2008-06-24 )))))))))))))))))))))))))))))))
.
2008-06-23 14:56 . 2008-06-23 16:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SITEguard
2008-06-23 14:55 . 2008-06-23 14:55 <DIR> d-------- C:\Program Files\Common Files\iS3
2008-06-23 14:55 . 2008-06-23 16:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla!
2008-06-23 11:33 . 2003-03-31 07:00 271,067 --a------ C:\WINDOWS\system32\WINLOGON.EX_
2008-06-23 09:42 . 2008-06-23 09:42 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-21 16:38 . 2008-06-21 16:38 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-06-21 16:34 . 2008-06-21 16:34 <DIR> d-------- C:\WINDOWS\NV7641172.TMP
2008-06-21 10:08 . 2008-06-21 10:08 <DIR> d-------- C:\WINDOWS\nvidia icons
2008-06-20 07:56 . 2008-06-20 07:56 <DIR> d-------- C:\Program Files\Codelobster Software
2008-06-19 13:30 . 2008-06-13 08:10 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-02 14:10 . 2008-06-02 14:10 <DIR> d-------- C:\Program Files\PC Drivers HeadQuarters
2008-06-02 14:10 . 2008-06-02 14:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
2008-06-02 12:03 . 1995-11-02 00:00 331,776 --a------ C:\Documents and Settings\Panthro\ACMSETUP.EXE
2008-06-02 12:03 . 1995-11-02 00:00 249,344 --a------ C:\Documents and Settings\Panthro\MSSETUP.DLL
2008-06-02 12:03 . 1995-11-02 00:00 189,952 --a------ C:\Documents and Settings\Panthro\MSADTUSA.DLL
2008-06-02 12:03 . 1995-11-02 00:00 72,992 --a------ C:\Documents and Settings\Panthro\SETUP.EXE
2008-06-02 12:03 . 1995-11-02 00:00 67,584 --a------ C:\Documents and Settings\Panthro\MSACCCAH.DLL
2008-06-02 12:03 . 1995-11-02 00:00 38,352 --a------ C:\Documents and Settings\Panthro\EXPAND.EXE
2008-06-02 10:05 . 2008-06-02 11:48 8,628 --ah----- C:\WINDOWS\system32\myodbc3.GID
2008-06-02 08:33 . 2007-11-08 23:23 4,796,472 --a------ C:\WINDOWS\system32\php5ts.dll
2008-06-01 19:11 . 2008-06-02 12:50 502 --a------ C:\WINDOWS\my.ini
2008-06-01 18:48 . 2008-06-01 16:52 482 --a------ C:\WINDOWS\my.ini.old
2008-06-01 16:47 . 2008-06-01 16:50 <DIR> d-------- C:\xampp
2008-06-01 16:35 . 2008-06-01 18:55 5,367 --a------ C:\WINDOWS\my.ini.older.ini
2008-05-31 07:19 . 2007-11-08 23:23 2,035,712 --a------ C:\WINDOWS\system32\libmySQL.dll
2008-05-31 07:01 . 2008-05-31 07:01 <DIR> d-------- C:\Program Files\MySQL
2008-05-30 13:00 . 2008-06-01 07:59 <DIR> d-------- C:\Documents and Settings\Panthro\Application Data\phpDesigner 2008
2008-05-30 12:59 . 2008-06-23 08:14 <DIR> d-------- C:\Program Files\phpDesigner 2008
2008-05-28 10:45 . 2008-05-28 10:45 <DIR> d-------- C:\Documents and Settings\Panthro\Application Data\SmartFTP
2008-05-28 10:44 . 2008-05-28 10:44 <DIR> d-------- C:\Program Files\SmartFTP Client 3.0 Setup Files
2008-05-28 10:44 . 2008-05-28 10:44 <DIR> d-------- C:\Program Files\SmartFTP Client
2008-05-24 14:02 . 2008-05-22 18:25 0 --a------ C:\WINDOWS\php.ini.clbak
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-24 11:35 --------- d-----w C:\Program Files\Java
2008-06-23 21:38 --------- d-----w C:\Program Files\Poser 7
2008-06-22 23:00 --------- d-----w C:\Program Files\Norton Security Scan
2008-06-20 21:18 --------- d-----w C:\Documents and Settings\Panthro\Application Data\FileZilla
2008-06-20 13:20 --------- d-----w C:\Program Files\FileZilla FTP Client
2008-06-13 13:10 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-30 16:59 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-05-23 18:17 --------- d-----w C:\Documents and Settings\Panthro\Application Data\ClPhpEd
2008-05-09 21:43 --------- d-----w C:\Program Files\Hard Disk Sentinel
2008-05-08 20:39 --------- d-----w C:\Program Files\SD
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-03 12:38 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-03 12:38 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-05-03 12:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\InstallShield
2008-05-03 03:46 6,554,496 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys
2008-05-02 21:38 --------- d-----w C:\Program Files\Build A Lot
2008-05-02 21:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\HipSoft
2008-05-02 21:32 --------- d-----w C:\Program Files\The Wonderful Wizard of Oz
2008-05-02 21:26 --------- d-----w C:\Program Files\Mystery Case Files - Ravenhearst
2008-05-02 15:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Trymedia
2008-05-02 15:11 --------- d-----w C:\Program Files\BFG
2008-05-01 16:54 --------- d-----w C:\Program Files\Banner Maker Pro 6
2008-04-29 23:41 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-29 23:11 --------- d-----w C:\Program Files\Pets Fun House
2008-04-29 19:22 --------- d-----w C:\Program Files\Wheel of Fortune 2
2008-04-29 19:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\BigFishGamesCache
2008-04-29 19:15 0 ----a-w C:\Program Files\temp01
2008-04-29 19:15 --------- d-----w C:\Program Files\bfgclient
2008-04-27 18:26 --------- d-----w C:\Program Files\Sun
2008-04-26 17:29 --------- d-----w C:\Program Files\Free-Soft
2008-04-25 23:44 --------- d-----w C:\Program Files\Arcade!
2008-04-25 19:19 --------- d-----w C:\Documents and Settings\Panthro\Application Data\Yahoo!
2008-04-25 19:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-04-24 12:41 --------- d-----w C:\Documents and Settings\Panthro\Application Data\CodeLobster Php Edition
2008-04-12 22:27 1,049,519 ----a-w C:\WINDOWS\Prison Tycoon 3 Uninstaller.exe
.
((((((((((((((((((((((((((((( snapshot@2008-06-23_15.38.42.68 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-23 20:20:56 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-24 11:49:50 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-02 22:46 13529088]
"nwiz"="nwiz.exe" [2008-05-02 22:46 1630208 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-02 22:46 86016]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
C:\Documents and Settings\Panthro\Start Menu\Programs\Startup\
WinMySQLadmin.lnk - C:\xampp\mysql\bin\winmysqladmin.exe [2007-12-20 21:00:28 936448]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll 2008-01-09 12:30 72208 c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk
backup=C:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Panthro^Start Menu^Programs^Startup^MagicDisc.lnk]
path=C:\Documents and Settings\Panthro\Start Menu\Programs\Startup\MagicDisc.lnk
backup=C:\WINDOWS\pss\MagicDisc.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
--a------ 2008-04-16 08:57 262401 C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Pro Agent]
--a------ 2007-09-06 08:08 136136 C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Hard Disk Sentinel]
--a------ 2007-04-21 10:47 2787328 C:\Program Files\Hard Disk Sentinel\HDSentinel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2008-05-02 22:46 13529088 C:\WINDOWS\system32\NvCpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2008-05-02 22:46 86016 C:\WINDOWS\system32\NvMcTray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2008-05-02 22:46 1630208 C:\WINDOWS\system32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2004-07-27 04:01 68096 C:\WINDOWS\SOUNDMAN.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-03-25 04:28 144784 C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2007-08-30 17:43 4670704 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Opera\\Opera.exe"=
"C:\\Program Files\\IceChat7\\IceChat7.exe"=
"C:\\Program Files\\Autodesk\\3dsMax8\\3dsmax.exe"=
"C:\\Program Files\\Autodesk\\backburner\\monitor.exe"=
"C:\\Program Files\\Autodesk\\backburner\\manager.exe"=
"C:\\Program Files\\Autodesk\\backburner\\server.exe"=
"C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"=
"C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Warlords\\Civ4Warlords.exe"=
"C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Warlords\\Civ4Warlords_PitBoss.exe"=
"C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword.exe"=
"C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword_PitBoss.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
"C:\\Program Files\\phpDesigner 2008\\phpDesigner2008.exe"=
"C:\\xampp\\apache\\bin\\apache.exe"=
R2 Apache2.2;Apache2.2;"C:\xampp\apache\bin\apache.exe" -k runservice []
S0 OemBiosDevice;Royalty OEM BIOS Extension;C:\WINDOWS\system32\DRIVERS\royal.sys [2007-03-02 09:19]
S2 XAMPP;XAMPP Service;c:\xampp\service.exe [2007-12-20 21:01]
.
Contents of the 'Scheduled Tasks' folder
"2008-06-22 23:00:08 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-06-24 06:50:59
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\xampp\mysql\bin\mysqld-nt.exe
.
**************************************************************************
.
Completion time: 2008-06-24 7:02:06 - machine was rebooted [Panthro]
ComboFix-quarantined-files.txt 2008-06-24 12:02:03
ComboFix2.txt 2008-06-23 21:53:13
ComboFix3.txt 2008-06-23 20:41:04
Pre-Run: 96,127,000,576 bytes free
Post-Run: 96,111,112,192 bytes free
207 --- E O F --- 2008-06-20 21:18:47
mbam log:
mbamMalwarebytes' Anti-Malware 1.18
Database version: 884
8:51:30 AM 6/24/2008
mbam-log-6-24-2008 (08-51-30).txt
Scan type: Full Scan (C:\|H:\|Z:\|)
Objects scanned: 246723
Time elapsed: 1 hour(s), 29 minute(s), 30 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\WINDOWS\system32\WINLOGON.EX_ (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
New Hijackthis log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:54:11 AM, on 6/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\xampp\apache\bin\apache.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\xampp\apache\bin\apache.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\xampp\mysql\bin\mysqld-nt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - Startup: WinMySQLadmin.lnk = C:\xampp\mysql\bin\winmysqladmin.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apache2.2 - Apache Software Foundation - C:\xampp\apache\bin\apache.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - c:\xampp\FileZillaFTP\FileZillaServer.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
O23 - Service: mysql - Unknown owner - C:\xampp\mysql\bin\mysqld-nt.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: XAMPP Service (XAMPP) - Unknown owner - c:\xampp\service.exe
--
End of file - 5030 bytes