Hello John
Hope you had a good weekend.
I have run the scans as you asked (took me a while to read and understand the combofix tutorial but i carefully went through it very carefully and it went as the tutorial said...Phew)
Scans are below.
BTW 2 things
I deleted the 06 policy restrictions in Hijack this log (2) as you asked but noticed there were another 2 the same. I have left these just in case you wanted them left, please advise if you want me to delete these also.
It maybe a clue for you or might be another problem. Sometimes when i click restart the p.c shuts down and i have to boot it up again, as i say this may be an XP issue and not maleware but i thought i should tell you anyway.
combofix logComboFix 09-03-06.02 - The Prout Family 2009-03-09 11:33:13.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.447.196 [GMT 0:00]
Running from: c:\documents and settings\The Prout Family.ELONEX\Desktop\ComboFix.exe
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated)
FW: ESET Personal firewall *disabled*
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\Microsoft Common
c:\windows.0\system32\a.exe
c:\windows.0\system32\twain32
c:\windows.0\system32\twain32\local.ds
c:\windows.0\system32\twain32\user(10)(2).ds
c:\windows.0\system32\twain32\user(11)(2).ds
c:\windows.0\system32\twain32\user(12)(2).ds
c:\windows.0\system32\twain32\user(13)(2).ds
c:\windows.0\system32\twain32\user(14)(2).ds
c:\windows.0\system32\twain32\user(15)(2).ds
c:\windows.0\system32\twain32\user(16)(2).ds
c:\windows.0\system32\twain32\user(17)(2).ds
c:\windows.0\system32\twain32\user(2)(2).ds
c:\windows.0\system32\twain32\user(2)(5).ds
c:\windows.0\system32\twain32\user(2)(6).ds
c:\windows.0\system32\twain32\user(3)(3).ds
c:\windows.0\system32\twain32\user(3)(4).ds
c:\windows.0\system32\twain32\user(4)(3).ds
c:\windows.0\system32\twain32\user(4)(4).ds
c:\windows.0\system32\twain32\user(5)(3).ds
c:\windows.0\system32\twain32\user(5)(4).ds
c:\windows.0\system32\twain32\user(6)(3).ds
c:\windows.0\system32\twain32\user(6)(4).ds
c:\windows.0\system32\twain32\user(7)(3).ds
c:\windows.0\system32\twain32\user(7)(4).ds
c:\windows.0\system32\twain32\user(8)(3).ds
c:\windows.0\system32\twain32\user(8)(4).ds
c:\windows.0\system32\twain32\user(9)(3).ds
c:\windows.0\system32\twain32\user(9)(4).ds
c:\windows.0\system32\twain32\user.ds
c:\windows.0\system32\twain32\user.ds.lll
.
((((((((((((((((((((((((( Files Created from 2009-02-09 to 2009-03-09 )))))))))))))))))))))))))))))))
.
2009-03-05 15:09 . 2009-03-05 15:09 <DIR> d-------- c:\windows.0\Sun
2009-03-05 15:09 . 2009-03-05 15:08 410,984 --a------ c:\windows.0\system32\deploytk.dll
2009-03-05 15:09 . 2009-03-05 15:08 73,728 --a------ c:\windows.0\system32\javacpl.cpl
2009-03-05 15:08 . 2009-03-05 15:08 <DIR> d-------- c:\program files\Java
2009-03-02 23:56 . 2009-03-07 15:20 <DIR> d-------- c:\documents and settings\The Prout Family.ELONEX\Application Data\Abra Academy2
2009-03-02 11:23 . 2009-03-02 11:23 <DIR> d-------- c:\documents and settings\The Prout Family.ELONEX\Application Data\ESET
2009-03-02 11:22 . 2009-03-02 11:22 <DIR> d-------- c:\program files\ESET
2009-03-02 11:22 . 2009-03-02 11:22 <DIR> d-------- c:\documents and settings\All Users.WINDOWS.0\Application Data\ESET
2009-02-27 00:21 . 2009-02-27 00:21 <DIR> d-------- c:\documents and settings\All Users.WINDOWS.0\Application Data\ThumbnailCache4R
2009-02-25 20:10 . 2009-02-25 20:10 <DIR> d-------- c:\program files\SUPERAntiSpyware
2009-02-25 20:10 . 2009-02-25 20:10 <DIR> d-------- c:\documents and settings\The Prout Family.ELONEX\Application Data\SUPERAntiSpyware.com
2009-02-25 20:10 . 2009-02-25 20:10 <DIR> d-------- c:\documents and settings\All Users.WINDOWS.0\Application Data\SUPERAntiSpyware.com
2009-02-25 19:57 . 2009-02-25 19:58 <DIR> d-------- c:\windows.0\LastGood(2).Tmp
2009-02-24 21:26 . 2009-01-09 19:19 1,089,593 -----c--- c:\windows.0\system32\dllcache\ntprint.cat
2009-02-20 10:56 . 2009-02-20 10:56 <DIR> d-------- c:\documents and settings\The Prout Family.ELONEX\Application Data\Skunk Studios
2009-02-17 10:56 . 2008-06-19 16:24 28,544 --a------ c:\windows.0\system32\drivers\pavboot.sys
2009-02-12 20:38 . 2009-02-12 20:42 <DIR> d-------- c:\documents and settings\The Prout Family.ELONEX\Application Data\ArcSoft
2009-02-12 20:37 . 2009-02-12 20:37 <DIR> d-------- c:\program files\Common Files\ArcSoft
2009-02-12 20:37 . 2003-03-18 22:14 499,712 -ra------ c:\windows.0\system32\msvcp71.dll
2009-02-12 20:37 . 2005-04-27 16:36 245,408 --a------ c:\windows.0\system32\unicows.dll
2009-02-12 20:36 . 2006-11-10 15:05 18,688 --a------ c:\windows.0\system32\drivers\afc.sys
2009-02-12 20:35 . 2009-02-12 20:37 <DIR> d-------- c:\program files\ArcSoft
2009-02-12 20:35 . 1995-08-01 04:44 212,480 --a------ c:\windows.0\PCDLIB32.DLL
2009-02-12 20:34 . 2009-02-12 20:34 <DIR> d-------- c:\windows.0\STK02N
2009-02-12 20:34 . 2007-03-12 14:25 101,520 --a------ c:\windows.0\system32\drivers\STK02NW2.sys
2009-02-12 20:34 . 2007-03-12 14:28 40,960 --a------ c:\windows.0\system32\STK02NP.ax
2009-02-12 20:34 . 2007-03-12 14:25 33,728 --a------ c:\windows.0\system32\drivers\STK02NW1.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-09 11:17 --------- d---a-w c:\documents and settings\All Users.WINDOWS.0\Application Data\TEMP
2009-03-09 11:17 --------- d-----w c:\program files\SpywareBlaster
2009-03-07 16:15 --------- d---a-w c:\program files\Between The Worlds
2009-03-04 17:48 --------- d-----w c:\program files\Sky Games
2009-03-04 17:48 --------- d-----w c:\program files\GameHouse
2009-03-02 23:50 --------- d-----w c:\program files\LeeGTs Games
2009-02-25 20:09 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-02-25 19:58 --------- d-----w c:\documents and settings\The Prout Family.ELONEX\Application Data\Network Associates
2009-02-25 19:58 --------- d-----w c:\documents and settings\All Users.WINDOWS.0\Application Data\Network Associates
2009-02-25 19:51 --------- d-----w c:\program files\Mystery Legends - Sleepy Hollow
2009-02-20 10:58 --------- d-----w c:\documents and settings\All Users.WINDOWS.0\Application Data\Enkord
2009-02-20 10:52 --------- d-----w c:\documents and settings\All Users.WINDOWS.0\Application Data\MumboJumbo
2009-02-12 20:37 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-09 18:03 --------- d-----w c:\program files\Mahjong Quest 2
2009-01-29 21:33 --------- d-----w c:\program files\MahJong Quest 3 - Balance of Life
2009-01-29 12:00 --------- d---a-w c:\program files\Haunted Hotel 2 - Believe the Lies
2009-01-29 10:19 --------- d-----w c:\program files\Reference Assemblies
2009-01-29 10:19 --------- d-----w c:\program files\MSBuild
2009-01-24 19:53 --------- d-----w c:\program files\The Wizard's Pen
2009-01-24 19:48 --------- d-----w c:\program files\Steveredrum
2009-01-24 19:48 --------- d-----w c:\documents and settings\The Prout Family.ELONEX\Application Data\Meridian93
2009-01-24 19:46 --------- d-----w c:\documents and settings\The Prout Family.ELONEX\Application Data\Shape games
2009-01-24 19:37 --------- d-----w c:\program files\Games
2009-01-24 19:35 --------- d-----w c:\program files\Mahjong The Endless Journey
2009-01-24 19:28 --------- d-----w c:\documents and settings\The Prout Family.ELONEX\Application Data\Jetsetter
2009-01-24 19:24 --------- d-----w c:\program files\Gourmania
2009-01-24 19:21 --------- d-----w c:\documents and settings\All Users.WINDOWS.0\Application Data\PlayPond
2009-01-24 19:16 --------- d-----w c:\documents and settings\The Prout Family.ELONEX\Application Data\PlayFirst
2009-01-24 19:16 --------- d-----w c:\documents and settings\All Users.WINDOWS.0\Application Data\PlayFirst
2009-01-22 19:55 --------- d-----w c:\program files\BFG
2009-01-22 19:04 --------- d-----w c:\program files\Panda Security
2009-01-22 17:45 --------- d-----w c:\program files\EPSON
2009-01-11 20:05 --------- d-----w c:\program files\Abbyy FineReader 6.0 Sprint
2009-01-11 20:04 --------- d-----w c:\documents and settings\The Prout Family.ELONEX\Application Data\Dell Imaging Toolbox
2009-01-11 19:59 --------- d-----w c:\program files\Dell V105
2009-01-11 19:55 --------- d-----w c:\program files\Dell
2007-10-26 13:14 774,144 ----a-w c:\program files\RngInterstitial.dll
2008-06-16 18:53 32,768 --sha-w c:\windows.0\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008061620080617\index.dat
2008-08-30 18:44 32,768 --sha-w c:\windows.0\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008083020080831\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Window Washer"="c:\program files\Webroot\Washer\wwDisp.exe" [2007-11-26 1206600]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-02-17 1830128]
"ctfmon.exe"="c:\windows.0\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows.0\system32\NvMcTray.dll" [2008-09-17 86016]
"dldnmon.exe"="c:\program files\Dell V105\dldnmon.exe" [2008-06-24 668912]
"dldnamon"="c:\program files\Dell V105\dldnamon.exe" [2008-06-24 16624]
"NvCplDaemon"="c:\windows.0\system32\NvCpl.dll" [2008-09-17 13574144]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-10-24 1451264]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-05 148888]
"RTHDCPL"="RTHDCPL.EXE" [2006-08-14 c:\windows.0\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows.0\SkyTel.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows.0\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users.WINDOWS.0\Start Menu\Programs\Startup\
Exif Launcher S.lnk - c:\program files\FinePixViewerS\QuickDCF2.exe [2008-02-09 303104]
STK02N 2.3 PNP Monitor.lnk - c:\windows.0\STK02N\STK02NM.exe [2009-02-12 163840]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-04-14 00:12 1695232 c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2008-09-17 22:55 1657376 c:\windows.0\system32\nwiz.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=c:\windows.0\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS.0\\system32\\dldncoms.exe"=
"c:\\Program Files\\Dell V105\\dldnmon.exe"=
"c:\\WINDOWS.0\\system32\\spool\\drivers\\w32x86\\3\\dldnpswx.exe"=
"c:\\WINDOWS.0\\system32\\spool\\drivers\\w32x86\\3\\dldnjswx.exe"=
"c:\\Program Files\\Dell V105\\dldnlscn.exe"=
R0 pavboot;pavboot;c:\windows.0\system32\drivers\pavboot.sys [2009-02-17 28544]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-02-17 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-02-17 55024]
R2 dldn_device;dldn_device;c:\windows.0\system32\dldncoms.exe -service --> c:\windows.0\system32\dldncoms.exe -service [?]
R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2008-10-24 468224]
R2 wwEngineSvc;Window Washer Engine;c:\program files\Webroot\Washer\WasherSvc.exe [2008-04-16 598856]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-02-17 7408]
R3 WebSTARXP;Scientific Atlanta WebSTAR 100 & 200 series Cable Modem;c:\windows.0\system32\drivers\SACMXP1.sys [2003-11-20 14848]
S2 dldnCATSCustConnectService;dldnCATSCustConnectService;c:\windows.0\system32\spool\drivers\w32x86\3\dldnserv.exe [2009-01-11 99568]
S3 WebSTARNdis;WebSTAR DPX USB Cable Modem Adapter;c:\windows.0\system32\drivers\WebSTAR.sys [2008-04-16 15417]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder
2009-02-20 c:\windows.0\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClick.exe [2007-12-21 14:17]
.
- - - - ORPHANS REMOVED - - - -
MSConfigStartUp-CTFMON - (no file)
.
------- Supplementary Scan -------
.
uStart Page =
hxxp://uk.yahoo.com/FF - ProfilePath -
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-03-09 11:37:10
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\ESET\ESET Security\CurrentVersion\Info]
@Denied: (3) (LocalSystem)
"AppDataDir"="c:\\Documents and Settings\\All Users.WINDOWS.0\\Application Data\\ESET\\ESET Smart Security\\"
"DataDir"="ESET\\ESET Smart Security\\"
"EditionName"="Student Edition"
"InstallDir"="c:\\Program Files\\ESET\\ESET Smart Security\\"
"LanguageId"=dword:00000409
"ProductBase"=dword:00000001
"ProductCode"="{4CEBE5E6-D1FD-4BDF-8C9C-29A9A3CC2B7C}"
"ProductName"="ESET Smart Security"
"ProductType"="ess"
"ProductVersion"="3.0.684.0"
"UniqueId"="0006AC9E49ABC1A1"
"ScannerBuild"=dword:00000ed0
"ScannerVersionId"=dword:00000de1
"ScannerVersion"=""
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1224)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows.0\system32\dldncoms.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows.0\system32\nvsvc32.exe
c:\windows.0\system32\searchindexer.exe
c:\windows.0\system32\rundll32.exe
c:\program files\Dell V105\dldnmsdmon.exe
c:\windows.0\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-03-09 11:38:57 - machine was rebooted
ComboFix-quarantined-files.txt 2009-03-09 11:38:54
Pre-Run: 231,497,908,224 bytes free
Post-Run: 231,436,660,736 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS.0
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS.0="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
243 --- E O F --- 2009-02-25 20:01:34
Hijack this logLogfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:49:59, on 09/03/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\system32\spoolsv.exe
C:\WINDOWS.0\system32\dldncoms.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS.0\system32\nvsvc32.exe
C:\WINDOWS.0\system32\svchost.exe
C:\Program Files\Webroot\Washer\WasherSvc.exe
C:\WINDOWS.0\system32\SearchIndexer.exe
C:\WINDOWS.0\RTHDCPL.EXE
C:\WINDOWS.0\system32\RUNDLL32.EXE
C:\Program Files\Dell V105\dldnmon.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Dell V105\dldnMsdMon.exe
C:\Program Files\Webroot\Washer\wwDisp.exe
C:\WINDOWS.0\system32\ctfmon.exe
C:\Program Files\FinePixViewerS\QuickDCF2.exe
C:\WINDOWS.0\STK02N\STK02NM.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS.0\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://uk.yahoo.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS.0\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [dldnmon.exe] "C:\Program Files\Dell V105\dldnmon.exe"
O4 - HKLM\..\Run: [dldnamon] "C:\Program Files\Dell V105\dldnamon.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS.0\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS.0\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Exif Launcher S.lnk = C:\Program Files\FinePixViewerS\QuickDCF2.exe
O4 - Global Startup: STK02N 2.3 PNP Monitor.lnk = ?
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) -
http://www.pcpitstop.com/betapit/PCPitStop.CABO16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) -
http://acs.pandasoftware.com/activescan ... stubie.cabO16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cabO16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) -
http://sdlc-esd.sun.com/ESD7/JSCDL/jdk/ ... dl.sun.comO16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) -
http://www.crucial.com/controls/cpcScanner.cabO16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.12) -
http://gameadvisor.futuremark.com/global/msc3121.cabO20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: dldnCATSCustConnectService - Unknown owner - C:\WINDOWS.0\System32\spool\DRIVERS\W32X86\3\\dldnserv.exe
O23 - Service: dldn_device - - C:\WINDOWS.0\system32\dldncoms.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS.0\system32\nvsvc32.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS.0\System32\TuneUpDefragService.exe
O23 - Service: Window Washer Engine (wwEngineSvc) - Webroot Software, Inc. - C:\Program Files\Webroot\Washer\WasherSvc.exe
--
End of file - 6783 bytes