ComboFix 09-11-05.05 - Dom Avery 2009-11-06 23:27.6.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2014.1464 [GMT 0:00]
Running from: c:\documents and settings\Dom Avery\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Dom Avery\Desktop\CFScript.txt
AV: AVG Anti-Virus *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Firewall *disabled* {8decf618-9569-4340-b34a-d78d28969b66}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Dom Avery\Application Data\LimeWire
c:\documents and settings\Dom Avery\Application Data\LimeWire\413splashfree.png
c:\documents and settings\Dom Avery\Application Data\LimeWire\createtimes.cache
c:\documents and settings\Dom Avery\Application Data\LimeWire\data.ser
c:\documents and settings\Dom Avery\Application Data\LimeWire\fileurns.bak
c:\documents and settings\Dom Avery\Application Data\LimeWire\fileurns.cache
c:\documents and settings\Dom Avery\Application Data\LimeWire\filters.props
c:\documents and settings\Dom Avery\Application Data\LimeWire\gnutella.net
c:\documents and settings\Dom Avery\Application Data\LimeWire\installation.props
c:\documents and settings\Dom Avery\Application Data\LimeWire\library.dat
c:\documents and settings\Dom Avery\Application Data\LimeWire\limewire.props
c:\documents and settings\Dom Avery\Application Data\LimeWire\pub1.key
c:\documents and settings\Dom Avery\Application Data\LimeWire\public.key
c:\documents and settings\Dom Avery\Application Data\LimeWire\questions.props
c:\documents and settings\Dom Avery\Application Data\LimeWire\responses.cache
c:\documents and settings\Dom Avery\Application Data\LimeWire\secureMessage.key
c:\documents and settings\Dom Avery\Application Data\LimeWire\simpp.xml
c:\documents and settings\Dom Avery\Application Data\LimeWire\spam.dat
c:\documents and settings\Dom Avery\Application Data\LimeWire\tables.props
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme.lwtp
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\01_star.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\02_star.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\03_star.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\04_star.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\05_star.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\360share_banner.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\button1.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\button1_press.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\button2.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\button2_press.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\button3.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\button3_press.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\button4.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\button4_press.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\button5.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\button5_press.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\chat.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\dir_closed.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\dir_open.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\forward_dn.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\forward_up.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\kill.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\kill_on.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\lime.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\limeicon.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\logo.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\notsearching.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\pause_dn.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\pause_up.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\play_dn.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\play_up.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\question.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\rewind_dn.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\rewind_up.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\search.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\searching.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\splash.png
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\splashpro.png
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\stop_dn.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\stop_up.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\theme.txt
c:\documents and settings\Dom Avery\Application Data\LimeWire\themes\360SharePro_theme\warning.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\version.key
c:\documents and settings\Dom Avery\Application Data\LimeWire\version.xml
c:\documents and settings\Dom Avery\Application Data\LimeWire\xml\data\delete_me
c:\documents and settings\Dom Avery\Application Data\LimeWire\xml\misc\application.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\xml\misc\audio.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\xml\misc\document.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\xml\misc\image.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\xml\misc\video.gif
c:\documents and settings\Dom Avery\Application Data\LimeWire\xml\schemas\application.xsd
c:\documents and settings\Dom Avery\Application Data\LimeWire\xml\schemas\audio.xsd
c:\documents and settings\Dom Avery\Application Data\LimeWire\xml\schemas\document.xsd
c:\documents and settings\Dom Avery\Application Data\LimeWire\xml\schemas\image.xsd
c:\documents and settings\Dom Avery\Application Data\LimeWire\xml\schemas\video.xsd
c:\windows\CePMTray .INI
c:\windows\system32\ctfmon .exe
c:\windows\system32\hkcmd .exe
c:\windows\system32\igfxpers .exe
c:\windows\system32\igfxtray .exe
.
--------------- FCopy ---------------
c:\windows\ServicePackFiles\i386\eventlog.dll --> c:\windows\system32\eventlog.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_MYWEBSEARCHSERVICE
((((((((((((((((((((((((( Files Created from 2009-10-06 to 2009-11-06 )))))))))))))))))))))))))))))))
.
2009-11-06 23:27 . 2008-04-14 00:11 56320 -c--a-w- c:\windows\system32\dllcache\eventlog.dll
2009-11-06 23:27 . 2008-04-14 00:11 56320 ----a-w- c:\windows\system32\eventlog.dll
2009-11-06 11:05 . 2009-11-06 11:05 -------- d-----w- C:\_OTMoveIt
2009-11-06 09:26 . 2009-10-21 15:11 2064152 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll
2009-11-05 21:20 . 2005-09-28 22:00 65536 ------w- c:\windows\system32\WLTRYSVC.EXE
2009-11-05 21:20 . 2005-09-28 22:00 86016 ------w- c:\windows\system32\wltrynt.dll
2009-11-05 21:20 . 2005-09-28 22:00 819303 ------w- c:\windows\system32\wltray.EXE
2009-11-05 21:20 . 2005-09-28 22:00 294912 ------w- c:\windows\system32\BCMLogon.dll
2009-11-05 21:20 . 2005-09-28 22:00 192512 ------w- c:\windows\system32\AegisI5.exe
2009-11-05 21:20 . 2005-09-28 22:00 122981 ------w- c:\windows\system32\preflib.dll
2009-11-05 21:20 . 2005-09-28 22:00 954474 ------w- c:\windows\system32\BCMWLTRY.EXE
2009-11-05 21:20 . 2005-09-28 22:00 1396831 ------w- c:\windows\system32\AegisE5.dll
2009-11-05 21:16 . 2005-09-28 22:00 69632 ------w- c:\windows\system32\bcmwlD2K.EXE
2009-11-05 20:47 . 2009-11-05 20:47 81920 ----a-w- c:\documents and settings\Dom Avery\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\acaddin\connecthook.dll
2009-11-05 20:47 . 2009-11-05 20:47 190976 ----a-w- c:\documents and settings\Dom Avery\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\acaddin\connectsprd.dll
2009-11-05 20:47 . 2009-11-05 20:47 4183224 ----a-w- c:\documents and settings\Dom Avery\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\acaddin\acaddin.exe
2009-11-05 16:11 . 2009-11-05 16:11 21035 ----a-w- c:\windows\system32\drivers\AegisP.sys
2009-11-05 16:11 . 2006-10-19 09:42 303616 ------w- c:\windows\system32\drivers\BLKWGNv7.SYS
2009-11-05 16:11 . 2002-10-02 09:57 13532 ----a-w- c:\windows\system32\drivers\SjyPkt.sys
2009-11-05 16:11 . 2009-11-05 16:11 -------- d-----w- c:\program files\Belkin
2009-11-05 10:11 . 2001-08-17 12:11 26568 -c--a-w- c:\windows\system32\dllcache\bcm4e5.sys
2009-11-05 10:11 . 2001-08-17 12:11 26568 ----a-w- c:\windows\system32\drivers\BCM4E5.SYS
2009-11-05 08:56 . 2009-11-05 08:56 -------- d-----w- c:\program files\BUFFALO
2009-11-05 08:52 . 2004-01-08 11:32 9600 ----a-r- c:\windows\system32\BUFADPT.SYS
2009-11-04 19:11 . 2001-08-17 12:11 96640 -c--a-w- c:\windows\system32\dllcache\b57xp32.sys
2009-11-04 19:11 . 2001-08-17 12:11 96640 ----a-w- c:\windows\system32\drivers\b57xp32.sys
2009-11-04 19:00 . 2005-09-28 22:00 176128 ------w- c:\windows\system32\bcmwlu00.exe
2009-11-04 17:02 . 2009-11-04 17:02 -------- d-----w- c:\documents and settings\Dom Avery\Application Data\Malwarebytes
2009-11-04 17:02 . 2009-09-10 14:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-04 17:02 . 2009-11-04 18:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-04 17:02 . 2009-11-04 17:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-04 17:02 . 2009-09-10 14:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-03 14:14 . 2009-11-03 14:14 -------- d-----w- C:\dell
2009-11-03 12:55 . 2009-11-03 12:55 -------- d-----w- C:\IBMTOOLS
2009-11-02 14:57 . 2009-11-01 22:10 30208 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgtray.exe
2009-11-01 17:36 . 2003-05-29 15:27 155648 ----a-w- c:\windows\system32\igfxres.dll
2009-11-01 17:32 . 2009-11-01 17:32 -------- d-----w- c:\program files\Unibrain
2009-11-01 17:12 . 2009-08-26 15:04 53248 ----a-w- c:\windows\system32\CSVer.dll
2009-11-01 17:12 . 2009-11-01 17:12 -------- d-----w- C:\Intel
2009-11-01 16:58 . 2009-11-01 16:58 -------- d-----w- c:\windows\Downloaded Installations
2009-11-01 16:57 . 2009-11-01 16:57 -------- d-----w- c:\program files\Intel Desktop Board
2009-10-31 23:14 . 2009-11-05 17:56 -------- d-----w- c:\documents and settings\All Users\Application Data\UAB
2009-10-31 23:14 . 2009-10-31 23:14 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2009-10-31 23:14 . 2009-10-31 23:14 -------- d-----w- c:\documents and settings\Dom Avery\Local Settings\Application Data\PC_Drivers_Headquarters
2009-10-31 23:13 . 2009-10-31 23:13 -------- d-----w- c:\program files\PC Drivers HeadQuarters
2009-10-31 23:05 . 2009-10-31 23:05 -------- d-----w- c:\documents and settings\Dom Avery\Application Data\Uniblue
2009-10-31 19:08 . 2009-10-31 19:08 -------- d-----w- c:\program files\Trend Micro
2009-10-30 20:43 . 2009-10-30 20:43 1025 ----a-w- c:\windows\system32\sysprs7.dll
2009-10-30 20:43 . 2009-10-30 20:43 1025 ----a-w- c:\windows\system32\clauth2.dll
2009-10-30 20:43 . 2009-10-30 20:43 1025 ----a-w- c:\windows\system32\clauth1.dll
2009-10-30 20:43 . 2009-10-30 20:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Minnetonka Audio Software
2009-10-30 16:38 . 2009-10-30 16:47 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-10-30 16:36 . 2009-10-30 16:38 38208 ----a-w- c:\documents and settings\Dom Avery\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-10-27 19:26 . 2009-10-27 19:26 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet
2009-10-27 19:08 . 2009-10-27 19:08 -------- d-----w- c:\program files\Adobe Media Player
2009-10-27 18:55 . 2009-10-27 18:55 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2009-10-20 19:04 . 2009-10-20 19:04 54960 ---ha-w- c:\windows\system32\mlfcache.dat
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-06 23:38 . 2006-02-07 07:40 30208 ----a-w- c:\windows\system32\igfxpers.exe
2009-11-06 23:38 . 2006-02-07 07:36 30208 ----a-w- c:\windows\system32\hkcmd.exe
2009-11-06 23:38 . 2006-02-07 07:39 30208 ----a-w- c:\windows\system32\igfxtray.exe
2009-11-06 23:38 . 2008-07-05 12:02 -------- d-----w- c:\program files\lg_fwupdate
2009-11-06 23:38 . 2003-08-27 10:27 -------- d-----w- c:\program files\EzButton
2009-11-06 23:38 . 2009-08-11 14:55 -------- d-----w- c:\program files\Common Files\LightScribe
2009-11-06 12:22 . 2006-02-07 07:40 30208 ----a-w- c:\windows\system32\igfxpers .exe
2009-11-06 12:22 . 2006-02-07 07:36 30208 ----a-w- c:\windows\system32\hkcmd .exe
2009-11-06 12:22 . 2006-02-07 07:39 30208 ----a-w- c:\windows\system32\igfxtray .exe
2009-11-06 12:21 . 2003-08-27 10:15 -------- d-----w- c:\program files\Apoint2K
2009-11-05 16:11 . 2003-08-27 09:12 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-10-30 16:47 . 2009-09-30 10:34 -------- d-----w- c:\program files\Yahoo!
2009-10-30 11:14 . 2008-07-07 14:18 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-10-28 19:26 . 2008-08-14 07:57 73312 ----a-w- c:\windows\system32\drivers\adfs.sys
2009-10-27 19:50 . 2008-06-26 07:52 64456 ----a-w- c:\documents and settings\Dom Avery\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-27 19:16 . 2008-06-30 14:18 -------- d-----w- c:\program files\Common Files\Adobe
2009-10-24 10:19 . 2009-09-04 11:04 548176 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-10-05 22:05 . 2009-10-05 22:06 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-05 22:05 . 2003-08-28 08:06 -------- d-----w- c:\program files\Java
2009-10-05 22:03 . 2009-10-05 22:03 152576 ----a-w- c:\documents and settings\Dom Avery\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-10-01 07:30 . 2009-09-28 15:05 -------- d-----w- c:\program files\360Share Pro
2009-09-30 10:35 . 2009-09-30 10:35 -------- d-----w- c:\documents and settings\Dom Avery\Application Data\Yahoo!
2009-09-30 10:35 . 2009-09-30 10:34 -------- d-----w- c:\program files\7-Zip
2009-09-28 17:35 . 2009-09-28 17:35 -------- d-----w- c:\program files\Common Files\Java
2009-09-26 08:07 . 2009-09-26 08:07 5806 ----a-r- c:\documents and settings\Dom Avery\Application Data\Microsoft\Installer\{8E41D2A5-C0DD-4139-8C7A-2F0E1F20ED24}\_4ae13d6c.exe
2009-09-26 08:07 . 2009-09-26 08:07 5806 ----a-r- c:\documents and settings\Dom Avery\Application Data\Microsoft\Installer\{8E41D2A5-C0DD-4139-8C7A-2F0E1F20ED24}\_18be6784.exe
2009-09-26 08:07 . 2009-09-26 08:07 1078 ----a-r- c:\documents and settings\Dom Avery\Application Data\Microsoft\Installer\{8E41D2A5-C0DD-4139-8C7A-2F0E1F20ED24}\_69525f90.exe
2009-09-26 08:07 . 2009-09-26 08:07 1078 ----a-r- c:\documents and settings\Dom Avery\Application Data\Microsoft\Installer\{8E41D2A5-C0DD-4139-8C7A-2F0E1F20ED24}\_2cd672ae.exe
2009-09-26 08:07 . 2009-09-26 08:07 1078 ----a-r- c:\documents and settings\Dom Avery\Application Data\Microsoft\Installer\{8E41D2A5-C0DD-4139-8C7A-2F0E1F20ED24}\_294823.exe
2009-09-26 08:06 . 2009-09-26 08:06 -------- d-----w- c:\program files\Alan Hadley
2009-09-20 13:30 . 2009-09-20 13:30 -------- d-----w- c:\documents and settings\Dom Avery\Application Data\Unity
2009-09-20 12:39 . 2009-09-20 12:39 -------- d-----w- c:\program files\Unity
2009-09-18 10:51 . 2008-08-08 10:44 -------- d-----w- c:\program files\Canon
2009-09-15 16:35 . 2008-10-16 09:06 -------- d-----w- c:\documents and settings\Dom Avery\Application Data\Apple Computer
2009-09-15 16:33 . 2008-10-16 09:06 -------- d-----w- c:\program files\iTunes
2009-09-15 15:33 . 2009-09-15 15:33 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-09-15 15:33 . 2009-09-15 15:33 -------- d-----w- c:\program files\iPod
2009-09-15 15:31 . 2009-09-15 15:31 -------- d-----w- c:\program files\Bonjour
2009-09-15 15:31 . 2008-07-12 20:26 -------- d-----w- c:\program files\QuickTime
2009-09-15 15:29 . 2008-10-16 09:02 -------- d-----w- c:\program files\Common Files\Apple
2009-09-11 20:24 . 2008-08-28 14:01 -------- d-----w- c:\documents and settings\Dom Avery\Application Data\U3
2009-09-11 20:10 . 2009-09-11 20:10 -------- d-----w- c:\program files\Flash Movie Player
2009-09-11 19:14 . 2009-09-11 19:14 -------- d-----w- c:\program files\GNS3
2009-09-11 19:14 . 2009-09-11 19:14 -------- d-----w- c:\program files\WinPcap
2009-09-10 21:50 . 2009-06-10 20:26 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2009-09-08 20:43 . 2009-09-08 20:43 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.0.70\SetupAdmin.exe
2009-09-03 10:45 . 2009-10-28 16:23 43872 ------w- c:\windows\system32\drivers\PxHelp20.sys
2009-09-03 10:45 . 2009-10-28 16:23 129520 ------w- c:\windows\system32\pxafs.dll
2009-09-03 10:45 . 2009-10-28 16:23 9200 ------w- c:\windows\system32\drivers\cdralw2k.sys
2009-09-03 10:45 . 2009-10-28 16:23 9072 ------w- c:\windows\system32\drivers\cdr4_xp.sys
2009-09-03 10:45 . 2009-10-28 16:23 120568 ------w- c:\windows\system32\pxcpyi64.exe
2009-09-03 10:45 . 2009-10-28 16:23 118256 ------w- c:\windows\system32\pxinsi64.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0bc6e3fa-78ef-4886-842c-5a1258c4455a}]
2008-07-25 10:16 282112 ----a-w- c:\windows\system32\mscoree.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-06-17 2363392]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-09 68856]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 1289000]
"Google Update"="c:\documents and settings\Dom Avery\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-04-21 133104]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="c:\windows\system32\wltray" [X]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2009-11-06 30208]
"CeEPOWER"="c:\program files\TOSHIBA\Power Management\CePMTray.exe" [2009-11-06 30208]
"CPLDBL10"="c:\program files\EzButton\CPLDBL10.EXE" [2009-11-06 30208]
"CeEKEY"="c:\program files\TOSHIBA\E-KEY\CeEKey.exe" [2009-11-06 30208]
"TPNF"="c:\program files\TOSHIBA\TouchPad\TPTray.exe" [2009-11-06 30208]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 56928]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 54832]
"LGODDFU"="c:\program files\lg_fwupdate\fwupdate.exe" [2008-07-05 249856]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2009-11-06 30208]
"SecurDisc"="c:\program files\Nero\Nero 7\InCD\NBHGui.exe" [2009-11-06 30208]
"InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2009-11-06 30208]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-11-02 2028312]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 75304]
"IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT .exe" [2009-11-06 30208]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-08 305440]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-05 149280]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2009-10-28 611712]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2009-11-06 30208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2009-11-06 30208]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2009-11-06 30208]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"combofix"="c:\combofix\CF28258.exe" [2009-11-06 389120]
c:\documents and settings\Dom Avery\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Belkin Wireless G Notebook Card Client Utility.lnk - c:\program files\Belkin\Cardbus F5D701F\Wireless Utility\Belkinwcui.exe [2009-11-5 1556480]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-07-31 10:04 11952 ----a-w- c:\windows\system32\avgrsstx.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"5353:TCP"= 5353:TCP:Adobe CSI CS4
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2008-07-07 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-07-07 335240]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-07-07 108552]
R2 AGCoreService;AG Core Services;c:\program files\AGI\core\3.0\AGCoreService.exe [2009-08-27 40960]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-07-07 908056]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-07-07 297752]
R2 avgfws8;AVG8 Firewall;c:\progra~1\AVG\AVG8\avgfws8.exe [2009-07-07 1370488]
R2 bwcdrv;BUFFALO Wireless Configuration;c:\windows\system32\drivers\BWCDRV.SYS [2008-06-24 19840]
R2 DPortIO;Dritek Port I/O Driver;c:\windows\system32\drivers\DPORTIO.SYS [2001-04-12 3674]
R2 ubsbm;Unibrain 1394 SBM Driver;c:\windows\system32\drivers\UBSBM.sys [2005-07-27 14080]
R2 ubumapi;Unibrain 1394 FireAPI Driver;c:\windows\system32\drivers\UBUMAPI.sys [2005-07-27 36352]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [2008-07-07 29208]
R3 ubohci;Unibrain 1394 OHCI Driver;c:\windows\system32\drivers\ubohci.sys [2005-07-27 77056]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [2008-07-07 29208]
S3 BCM44X2;BCM 10/100 Ethernet Network Adapter Driver;c:\windows\system32\drivers\BCM4E5.SYS [2009-11-05 26568]
S3 Belkin701F;Belkin Wireless G Notebook Card Service v7;c:\windows\system32\drivers\BLKWGNv7.SYS [2009-11-05 303616]
S3 CBBCM43;BUFFALO WLI-CB-XXX Series Wireless LAN Adapter;c:\windows\system32\drivers\BCMWL5.SYS [2008-06-24 376320]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-06 34064]
S3 SjyPkt;SjyPkt;c:\windows\system32\drivers\SjyPkt.sys [2009-11-05 13532]
--- Other Services/Drivers In Memory ---
*Deregistered* - mbr
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder
2009-06-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
2009-11-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1869830678-2676309887-4175131795-1005Core1ca5b96a3c627d8.job
- c:\documents and settings\Dom Avery\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-21 18:48]
2009-10-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1869830678-2676309887-4175131795-1005UA.job
- c:\documents and settings\Dom Avery\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-21 18:48]
.
.
------- Supplementary Scan -------
.
uStart Page =
hxxp://www.google.com/uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) =
hxxp://www.google.com/search?q=%s
IE: &Search
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
DPF: DirectAnimation Java Classes -
file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java -
file://c:\windows\Java\classes\xmldso.cab
.
- - - - ORPHANS REMOVED - - - -
URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
BHO-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-11-06 23:37
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
c:\windows\system32\igfxpers .exe 30208 bytes executable
c:\windows\system32\igfxtray .exe 30208 bytes executable
scan completed successfully
hidden files: 2
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1869830678-2676309887-4175131795-1005\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*%*}*]
@Class="Shell"
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_USERS\S-1-5-21-1869830678-2676309887-4175131795-1005\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*%*}*\OpenWithList]
@Class="Shell"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]
"Version"=hex:f2,23,fa,53,f5,0b,f8,41,7b,aa,a4,5a,71,d6,30,b0,8b,b7,f3,8b,bd,
e6,b7,f5,25,8d,2f,49,f9,22,2f,e2,9e,50,d6,90,b1,4a,55,91,b0,94,f3,b6,dd,2f,\
[HKEY_LOCAL_MACHINE\software\Minnetonka Audio Software\SurCode Dolby Digital Premiere\Version*Version]
"Version"=hex:f2,23,fa,53,f5,0b,f8,41,7b,aa,a4,5a,71,d6,30,b0,8b,b7,f3,8b,bd,
e6,b7,f5,25,8d,2f,49,f9,22,2f,e2,9e,50,d6,90,b1,4a,55,91,b0,94,f3,b6,dd,2f,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1228)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
c:\windows\System32\BCMLogon.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\bcmwltry.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\TOSHIBA\Power Management\CeEPwrSvc.exe
c:\program files\Nero\Nero 7\InCD\InCDsrv.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\progra~1\AVG\AVG8\avgam.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\System32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\program files\Apoint2K\Apoint .exe
c:\program files\TOSHIBA\Power Management\CePMTray .exe
c:\program files\TOSHIBA\E-KEY\CeEKey .exe
c:\program files\TOSHIBA\TouchPad\TPTray .exe
c:\program files\Apoint2K\Apntex.exe
c:\program files\Nero\Nero 7\InCD\InCD .exe
c:\program files\Nero\Nero 7\InCD\NBHGui .exe
c:\windows\system32\wltray.exe
c:\progra~1\MICROS~2\rapimgr.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-11-06 23:44 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-06 23:44
Pre-Run: 54,109,061,120 bytes free
Post-Run: 54,078,136,320 bytes free
- - End Of File - - 7FA7D336070EA9095C05D6D1AF54D052
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Saturday, November 7, 2009
Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Friday, November 06, 2009 23:42:39
Records in database: 3164747
--------------------------------------------------------------------------------
Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes
Scan area - My Computer:
C:\
D:\
Scan statistics:
Objects scanned: 89587
Threats found: 2
Infected objects found: 144
Suspicious objects found: 2
Scan duration: 03:20:06
File name / Threat / Threats count
C:\Documents and Settings\All Users\Application Data\avg8\update\backup\avgtray.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Documents and Settings\Dom Avery\Local Settings\Application Data\Identities\{7470F4B7-395D-4A57-827A-D0B01E4847B5}\Microsoft\Outlook Express\Inbox.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 2
C:\Program Files\Adobe\acrotray .exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Apoint2K\Apoint.exe/C:\Program Files\Apoint2K\Apoint.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Canon\Canon IJ Network Scan Utility\cnmnsut .exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Canon\Canon IJ Network Scan Utility\cnmnsut .exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Canon\Canon IJ Network Scan Utility\cnmnsut .exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Canon\Canon IJ Network Scan Utility\cnmnsut .exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Canon\Canon IJ Network Scan Utility\cnmnsut .exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Canon\Canon IJ Network Scan Utility\cnmnsut .exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Canon\Canon IJ Network Scan Utility\cnmnsut .exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Canon\Canon IJ Network Scan Utility\cnmnsut .exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Canon\Canon IJ Network Scan Utility\cnmnsut .exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Canon\Canon IJ Network Scan Utility\cnmnsut .exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Canon\Canon IJ Network Scan Utility\cnmnsut .exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Canon\Canon IJ Network Scan Utility\cnmnsut .exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Canon\Canon IJ Network Scan Utility\cnmnsut .exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Canon\Canon IJ Network Scan Utility\cnmnsut .exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Canon\Canon IJ Network Scan Utility\cnmnsut .exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Canon\Canon IJ Network Scan Utility\cnmnsut .exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Canon\Canon IJ Network Scan Utility\cnmnsut .exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Canon\Canon IJ Network Scan Utility\cnmnsut .exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Canon\Canon IJ Network Scan Utility\cnmnsut .exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Canon\Canon IJ Network Scan Utility\cnmnsut .exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Canon\Canon IJ Network Scan Utility\cnmnsut .exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Canon\Canon IJ Network Scan Utility\cnmnsut .exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Canon\Canon IJ Network Scan Utility\cnmnsut .exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Canon\Canon IJ Network Scan Utility\cnmnsut .exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Canon\Canon IJ Network Scan Utility\cnmnsut.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Common Files\Ahead\Lib\nerocheck.exe161 Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Common Files\LightScribe\lightscribecontrolpanel .exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Nero\Nero 7\InCD\incd.exe104 Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Nero\Nero 7\InCD\incd.exe110 Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Nero\Nero 7\InCD\incd.exe112 Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Nero\Nero 7\InCD\incd.exe164 Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Nero\Nero 7\InCD\incd.exe171 Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\Nero\Nero 7\InCD\nbhgui.exe163 Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\TOSHIBA\E-KEY\ceekey.exe154 Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\TOSHIBA\E-KEY\ceekey.exe199 Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\TOSHIBA\Power Management\cepmtray.exe193 Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\TOSHIBA\TouchPad\tptray.exe157 Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Program Files\TOSHIBA\TouchPad\tptray.exe203 Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\hkcmd .exe.vir Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\igfxpers .exe.vir Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\igfxtray .exe.vir Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0051896.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0051897.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0051898.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0051899.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0051900.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0051901.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0051902.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0051903.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052887.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052888.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052889.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052890.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052891.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052893.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052894.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052895.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052896.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052897.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052898.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052918.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052920.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052921.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052922.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052923.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052924.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052925.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052926.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052927.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052928.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052930.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052967.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052969.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052970.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052971.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052972.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052973.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052975.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052976.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052978.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052979.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP253\A0052980.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053133.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053135.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053136.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053137.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053138.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053139.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053140.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053141.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053285.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053286.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053287.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053303.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053304.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053305.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053306.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053307.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053308.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053309.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053316.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053459.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053460.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053461.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053462.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053463.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053464.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053465.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053466.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053467.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053468.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0053470.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0054456.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0054459.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0054460.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0054461.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0054462.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0054463.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0054464.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0054465.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0054466.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0054467.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0054469.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0054489.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0054490.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0054491.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0054511.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0054514.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0054516.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0054517.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0054520.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0054521.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0054522.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0054523.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\System Volume Information\_restore{1B16EE2E-9342-4425-8B41-1D61C85150F7}\RP254\A0054660.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\WINDOWS\system32\hkcmd .exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\WINDOWS\system32\igfxpers .exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\WINDOWS\system32\igfxtray .exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\WINDOWS\system32\ReinstallBackups\0019\DriverFiles\hkcmd.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\WINDOWS\system32\ReinstallBackups\0019\DriverFiles\igfxpers.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
C:\WINDOWS\system32\ReinstallBackups\0019\DriverFiles\igfxtray.exe Infected: Trojan-Downloader.Win32.Small.anxi 1
Selected area has been scanned.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:17:33 PM, on 2009-11-07
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AGI\core\3.0\AGCoreService.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Apoint2K\Apoint .exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\TOSHIBA\Power Management\CePMTray .exe
C:\Program Files\TOSHIBA\E-KEY\CeEKey .exe
C:\Program Files\TOSHIBA\TouchPad\TPTray .exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Nero\Nero 7\InCD\InCD .exe
C:\Program Files\Nero\Nero 7\InCD\NBHGui .exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\wltray.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Belkin\Cardbus F5D701F\Wireless Utility\Belkinwcui.exe
C:\PROGRA~1\MICROS~2\rapimgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Java\jre6\bin\java.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: agcore.AGUtils - {0bc6e3fa-78ef-4886-842c-5a1258c4455a} - mscoree.dll (file missing)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [CeEPOWER] C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
O4 - HKLM\..\Run: [CPLDBL10] C:\Program Files\EzButton\CPLDBL10.EXE
O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [IJNetworkScanUtility] C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT .exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\wltray
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Dom Avery\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Belkin Wireless G Notebook Card Client Utility.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List -
res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print -
res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview -
res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print -
res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://www.update.microsoft.com/windows ... 4304515531O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsoftup ... 2058940800O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) -
http://help.broadbandassist.com/bbdeskt ... reQual.cabO16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) -
http://wwwimages.adobe.com/www.adobe.co ... nos/gp.cabO16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) -
http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cabO16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) -
https://www.mybt.bt.com/dana-cached/set ... tupSP1.cabO18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AG Core Services (AGCoreService) - AG Interactive - C:\Program Files\AGI\core\3.0\AGCoreService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: CeEPwrSvc - COMPAL ELECTRONIC INC. - C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
--
End of file - 12975 bytes