Hijackthis

[Justin]

My problem can be found here
http://www.computerforum.com/127696-eeeeh-help.html

Here's the log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:18:01 PM, on 8/10/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\SiteAdvisor\6261\SiteAdv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\acrotray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Windows\system32\igfxsrvc.exe
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynToshiba.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe
C:\Users\Home\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshibadirect.com/dpdstart
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: UserInit=Userinit.exe
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - MRI_DISABLED - (no file)
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Catcher Class - {ADECBED6-0366-4377-A739-E69DFBA04663} - C:\Program Files\Moyea\FLV Downloader\MoyeaCth.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [SiteAdvisor] "C:\Program Files\SiteAdvisor\6261\SiteAdv.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKCU\..\Run: [TOSCDSPD] TOSCDSPD.EXE
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [iLike] C:\Program Files\iLike\1.1.41\ilikesidebar.exe /checkforupdate (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [iLike] C:\Program Files\iLike\1.1.41\ilikesidebar.exe /checkforupdate (User 'Default user')
O4 - Startup: Microsoft .NET Framework 1.1.exe.lnk = C:\Program Files\Common Files\Microsoft .NET Framework 1.1.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPAHelper.exe - Unknown owner - C:\Program Files\iPod Access for Windows\iPAHelper.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: Messager - Unknown owner - c:\temp\svchost.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6261\SAService.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 12379 bytes

 

[cohen]

Hello,

Download and Run ComboFix
If you already have Combofix, please delete this copy and download it again as it's being updated regularly.

• Download this file from one of the three below listed places :
  
  http://download.bleepingcomputer.com/sUBs/ComboFix.exe
  http://www.forospyware.com/sUBs/ComboFix.exe
  http://subs.geekstogo.com/ComboFix.exe
  
• Then double click combofix.exe & follow the prompts.
• When finished, it shall produce a log for you. Post that log in your next reply

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

In your reply:

• Post the combo fix log
• Post a Fresh Hijackthis log

Thankyou

 

[Justin]

uhhh. my taskbar disappeared and my desktop icons disappeared and that's where my HJT is. should i reboot? i can't access "computer" also.

anyway

Combo Fix log first



ComboFix 08-08-10.02 - Home 2008-08-11 11:24:42.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.337 [GMT 8:00]
Running from: C:\Users\Home\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\temp\svchost.exe

.
((((((((((((((((((((((((( Files Created from 2008-07-11 to 2008-08-11 )))))))))))))))))))))))))))))))
.

2008-08-10 19:57 . 2008-08-10 19:57 244 --ah----- C:\sqmnoopt14.sqm
2008-08-10 19:57 . 2008-08-10 19:57 232 --ah----- C:\sqmdata14.sqm
2008-08-10 18:24 . 2008-08-10 18:24 244 --ah----- C:\sqmnoopt13.sqm
2008-08-10 18:24 . 2008-08-10 18:24 232 --ah----- C:\sqmdata13.sqm
2008-08-09 13:30 . 2008-08-09 13:30 244 --ah----- C:\sqmnoopt12.sqm
2008-08-09 13:30 . 2008-08-09 13:30 232 --ah----- C:\sqmdata12.sqm
2008-08-08 17:02 . 2008-08-08 17:02 244 --ah----- C:\sqmnoopt11.sqm
2008-08-08 17:02 . 2008-08-08 17:02 232 --ah----- C:\sqmdata11.sqm
2008-08-08 15:43 . 2008-08-08 15:43 244 --ah----- C:\sqmnoopt10.sqm
2008-08-08 15:43 . 2008-08-08 15:43 232 --ah----- C:\sqmdata10.sqm
2008-08-08 15:42 . 2008-08-08 15:42 244 --ah----- C:\sqmnoopt09.sqm
2008-08-08 15:42 . 2008-08-08 15:42 232 --ah----- C:\sqmdata09.sqm
2008-08-08 12:09 . 2008-08-11 11:11 <DIR> d-------- C:\Program Files\Steam
2008-08-08 12:09 . 2008-08-08 16:47 <DIR> d-------- C:\Program Files\Common Files\Steam
2008-08-07 17:11 . 2008-08-07 17:11 244 --ah----- C:\sqmnoopt08.sqm
2008-08-07 17:11 . 2008-08-07 17:11 232 --ah----- C:\sqmdata08.sqm
2008-08-07 13:30 . 2008-08-07 13:30 244 --ah----- C:\sqmnoopt07.sqm
2008-08-07 13:30 . 2008-08-07 13:30 232 --ah----- C:\sqmdata07.sqm
2008-08-07 09:34 . 2008-08-07 09:34 244 --ah----- C:\sqmnoopt06.sqm
2008-08-07 09:34 . 2008-08-07 09:34 232 --ah----- C:\sqmdata06.sqm
2008-08-06 19:54 . 2008-08-06 19:54 244 --ah----- C:\sqmnoopt05.sqm
2008-08-06 19:54 . 2008-08-06 19:54 232 --ah----- C:\sqmdata05.sqm
2008-08-06 09:39 . 2008-08-07 13:06 <DIR> d-------- C:\Fraps
2008-08-05 14:38 . 2008-08-05 14:38 244 --ah----- C:\sqmnoopt04.sqm
2008-08-05 14:38 . 2008-08-05 14:38 232 --ah----- C:\sqmdata04.sqm
2008-08-05 10:33 . 2008-08-05 10:37 <DIR> d-------- C:\Westwood
2008-08-03 21:22 . 2008-08-03 21:23 <DIR> d-------- C:\Program Files\Condition Zero
2008-08-03 18:26 . 2008-08-03 18:26 244 --ah----- C:\sqmnoopt03.sqm
2008-08-03 18:26 . 2008-08-03 18:26 232 --ah----- C:\sqmdata03.sqm
2008-08-03 15:48 . 2008-08-03 15:48 244 --ah----- C:\sqmnoopt02.sqm
2008-08-03 15:48 . 2008-08-03 15:48 232 --ah----- C:\sqmdata02.sqm
2008-08-02 12:31 . 2008-08-02 12:31 1,957,672 --a------ C:\Windows\System32\pbsvc.exe
2008-08-02 12:31 . 2008-08-02 12:31 103,736 --a------ C:\Windows\System32\PnkBstrB.exe
2008-08-02 12:31 . 2008-08-02 12:31 66,872 --a------ C:\Windows\System32\PnkBstrA.exe
2008-08-02 12:31 . 2008-08-02 12:31 22,328 --a------ C:\Windows\System32\drivers\PnkBstrK.sys
2008-08-02 12:31 . 2008-08-02 12:31 22,328 --a------ C:\Users\Home\AppData\Roaming\PnkBstrK.sys
2008-08-02 11:51 . 2006-11-29 13:06 440,080 --a------ C:\Windows\System32\d3dx10.dll
2008-08-02 11:51 . 2006-12-08 12:02 251,672 --a------ C:\Windows\System32\xactengine2_5.dll
2008-08-02 11:51 . 2006-11-15 11:38 15,128 --a------ C:\Windows\System32\x3daudio1_1.dll
2008-08-01 16:19 . 2008-08-01 16:19 <DIR> d-------- C:\Users\Home\AppData\Roaming\Nokia
2008-08-01 15:59 . 2008-08-01 15:59 <DIR> dr------- C:\Windows\System32\config\systemprofile\Videos
2008-08-01 15:59 . 2008-08-01 15:59 <DIR> dr------- C:\Windows\System32\config\systemprofile\Searches
2008-08-01 15:59 . 2008-08-01 15:59 <DIR> dr------- C:\Windows\System32\config\systemprofile\Saved Games
2008-08-01 15:59 . 2008-08-01 15:59 <DIR> dr------- C:\Windows\System32\config\systemprofile\Pictures
2008-08-01 15:59 . 2008-08-01 15:59 <DIR> dr------- C:\Windows\System32\config\systemprofile\Links
2008-08-01 15:59 . 2008-08-01 15:59 <DIR> dr------- C:\Windows\System32\config\systemprofile\Downloads
2008-08-01 15:59 . 2008-08-03 15:48 <DIR> dr------- C:\Windows\System32\config\systemprofile\Documents
2008-08-01 14:07 . 2008-08-01 14:07 <DIR> d-------- C:\Users\Home\AppData\Roaming\Miranda
2008-08-01 13:50 . 2008-08-01 13:50 <DIR> d-------- C:\Windows\Sun
2008-08-01 11:42 . 2008-08-01 11:42 244 --ah----- C:\sqmnoopt01.sqm
2008-08-01 11:42 . 2008-08-01 11:42 232 --ah----- C:\sqmdata01.sqm
2008-08-01 11:25 . 2008-08-01 11:25 244 --ah----- C:\sqmnoopt00.sqm
2008-08-01 11:25 . 2008-08-01 11:25 232 --ah----- C:\sqmdata00.sqm
2008-07-31 15:58 . 2008-07-31 15:58 <DIR> d-------- C:\Users\All Users\Office Genuine Advantage
2008-07-31 15:58 . 2008-07-31 15:58 <DIR> d-------- C:\ProgramData\Office Genuine Advantage
2008-07-29 14:49 . 2008-07-29 14:49 <DIR> d-------- C:\Windows\System32\Adobe
2008-07-29 14:49 . 2004-08-17 08:40 16,384 --a------ C:\Windows\System32\FileOps.exe
2008-07-29 14:47 . 2008-07-29 14:47 <DIR> d-------- C:\Users\All Users\Adobe Systems
2008-07-29 14:47 . 2008-07-29 14:47 <DIR> d-------- C:\ProgramData\Adobe Systems
2008-07-29 14:39 . 2008-07-29 14:39 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2008-07-24 18:49 . 2008-07-24 18:49 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2008-07-24 18:48 . 2008-07-24 18:49 <DIR> d-------- C:\Users\Home\AppData\Roaming\SystemRequirementsLab
2008-07-22 08:42 . 2008-07-22 08:42 42,320 --a------ C:\Windows\System32\xfcodec.dll
2008-07-19 23:37 . 2008-07-19 23:37 <DIR> d-------- C:\Program Files\MSN Messenger
2008-07-19 02:34 . 2008-07-19 02:34 586,240 --a------ C:\Windows\WLXPGSS.SCR
2008-07-18 21:34 . 2008-07-18 21:34 <DIR> d-------- C:\Program Files\iPod
2008-07-18 18:10 . 2008-06-26 09:45 12,240,896 --a------ C:\Windows\System32\NlsLexicons0007.dll
2008-07-18 18:10 . 2008-06-26 09:45 2,644,480 --a------ C:\Windows\System32\NlsLexicons0009.dll
2008-07-18 18:10 . 2008-06-26 11:29 801,280 --a------ C:\Windows\System32\NaturalLanguage6.dll
2008-07-18 16:11 . 2008-07-18 16:13 <DIR> d-------- C:\Program Files\QuickTime

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-09 18:39 --------- d-----w C:\Users\Home\AppData\Roaming\uTorrent
2008-08-09 05:24 --------- d-----w C:\Program Files\McAfee
2008-08-07 05:30 --------- d---a-w C:\ProgramData\TEMP
2008-08-03 12:53 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-01 08:22 --------- d-----w C:\Program Files\EPSON
2008-08-01 08:21 --------- d-----w C:\Program Files\Nokia
2008-08-01 08:09 --------- d-----w C:\Program Files\Bonjour
2008-08-01 08:05 --------- d-----w C:\Program Files\Toshiba
2008-08-01 07:55 --------- d-----w C:\ProgramData\Toshiba
2008-08-01 07:46 --------- d-----w C:\ProgramData\Xfire
2008-07-29 08:35 --------- d-----w C:\Users\Home\AppData\Roaming\Xfire
2008-07-29 08:22 --------- d-----w C:\Program Files\Xfire
2008-07-29 06:58 --------- d-----w C:\Program Files\Common Files\Adobe
2008-07-19 10:44 --------- d-----w C:\Program Files\Java
2008-07-18 13:34 --------- d-----w C:\Program Files\iTunes
2008-07-11 08:43 --------- d-----w C:\Program Files\CD Art Display
2008-07-11 08:39 --------- d-----w C:\Users\Home\AppData\Roaming\CD Art Display
2008-07-11 01:27 --------- d-----w C:\Program Files\Windows Mail
2008-07-10 01:35 32,000 ----a-w C:\Windows\system32\drivers\usbaapl.sys
2008-07-08 12:16 --------- d-----w C:\Users\Home\AppData\Roaming\Skype
2008-07-07 08:17 2,560 ----a-w C:\Windows\_MSRSTRT.EXE
2008-07-07 01:38 --------- d-----w C:\Program Files\Stardock
2008-07-07 01:38 --------- d-----w C:\Program Files\Common Files\Stardock
2008-07-07 01:37 --------- d-----w C:\Program Files\Object Desktop
2008-07-02 02:06 920,088 ----a-w C:\Windows\System32\igxpun.exe
2008-07-01 10:02 --------- d-----w C:\ProgramData\WindowsSearch
2008-06-24 06:40 --------- d-----w C:\ProgramData\Messenger Plus!
2008-06-23 02:59 --------- d-----w C:\Users\Home\AppData\Roaming\PeerNetworking
2008-06-20 09:13 --------- d-----w C:\Users\Home\AppData\Roaming\FLV Extract
2008-06-18 06:01 539,160 ----a-w C:\Windows\System32\igfxcfg.exe
2008-06-18 06:01 256,536 ----a-w C:\Windows\System32\igfxsrvc.exe
2008-06-18 06:01 170,520 ----a-w C:\Windows\System32\igfxzoom.exe
2008-06-18 06:01 170,520 ----a-w C:\Windows\System32\igfxext.exe
2008-06-18 06:01 166,424 ----a-w C:\Windows\System32\hkcmd.exe
2008-06-18 06:01 141,848 ----a-w C:\Windows\System32\igfxtray.exe
2008-06-18 06:01 133,656 ----a-w C:\Windows\System32\igfxpers.exe
2008-06-18 05:51 147,456 ----a-w C:\Windows\System32\igfxCoIn_v1504.dll
2008-06-18 05:38 3,305,472 ----a-w C:\Windows\System32\igdumd32.dll
2008-06-18 05:38 2,307,584 ----a-w C:\Windows\system32\drivers\igdkmd32.sys
2008-06-18 05:27 2,174,976 ----a-w C:\Windows\System32\ig4dev32.dll
2008-06-18 05:26 2,420,736 ----a-w C:\Windows\System32\ig4icd32.dll
2008-06-18 05:19 69,632 ----a-w C:\Windows\System32\oemdspif.dll
2008-06-18 05:19 241,664 ----a-w C:\Windows\System32\igfxTMM.dll
2008-06-18 05:19 24,576 ----a-w C:\Windows\System32\igfxexps.dll
2008-06-18 05:19 204,800 ----a-w C:\Windows\System32\igfxpph.dll
2008-06-18 05:18 48,640 ----a-w C:\Windows\System32\igfxsrvc.dll
2008-06-18 05:18 3,293,184 ----a-w C:\Windows\System32\igfxress.dll
2008-06-18 05:18 204,800 ----a-w C:\Windows\System32\igfxdev.dll
2008-06-18 05:18 135,168 ----a-w C:\Windows\System32\igfxdo.dll
2008-06-18 05:18 106,496 ----a-w C:\Windows\System32\hccutils.dll
2008-06-17 18:32 35,709 ----a-w C:\Program Files\Common Files\Stardock Keygen.exe
2008-06-13 01:13 --------- d-----w C:\Users\Home\AppData\Roaming\gtk-2.0
2008-06-12 06:28 --------- d-----w C:\Users\Home\AppData\Roaming\SiteAdvisor
2008-06-11 19:03 --------- d-----w C:\Program Files\Windows Live
2008-06-11 05:40 --------- d-----w C:\Users\Home\AppData\Roaming\iLike
2008-06-11 05:05 --------- d-----w C:\Users\Home\AppData\Roaming\LimeWire
2008-06-11 00:20 --------- d-----w C:\ProgramData\Yahoo! Companion
2008-06-05 11:40 174 --sha-w C:\Program Files\desktop.ini
2008-06-05 10:41 82,432 ----a-w C:\Windows\System32\axaltocm.dll
2008-06-05 10:41 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
2008-05-27 05:21 1,582,592 ----a-w C:\Windows\System32\tquery.dll
2008-05-27 05:21 1,418,240 ----a-w C:\Windows\System32\mssrch.dll
2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\SearchFilterHost.exe
2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\mssitlb.dll
2008-05-27 05:17 754,176 ----a-w C:\Windows\System32\propsys.dll
2008-05-27 05:17 60,416 ----a-w C:\Windows\System32\msscntrs.dll
2008-05-27 05:17 6,103,040 ----a-w C:\Windows\System32\chtbrkr.dll
2008-05-27 05:17 34,816 ----a-w C:\Windows\System32\msscb.dll
2008-05-27 05:17 32,768 ----a-w C:\Windows\System32\mssprxy.dll
2008-05-27 05:17 313,344 ----a-w C:\Windows\System32\thawbrkr.dll
2008-05-27 05:17 301,568 ----a-w C:\Windows\System32\srchadmin.dll
2008-05-27 05:17 194,560 ----a-w C:\Windows\System32\offfilt.dll
2008-05-27 05:17 143,872 ----a-w C:\Windows\System32\korwbrkr.dll
2008-05-27 05:17 11,776 ----a-w C:\Windows\System32\msshooks.dll
2008-05-27 05:17 1,671,680 ----a-w C:\Windows\System32\chsbrkr.dll
2008-05-27 04:59 18,904 ----a-w C:\Windows\System32\StructuredQuerySchemaTrivial.bin
2008-05-27 04:59 106,605 ----a-w C:\Windows\System32\StructuredQuerySchema.bin
2008-05-14 20:31 107,888 ----a-w C:\Windows\System32\CmdLineExt.dll
2008-02-05 19:24 1,874,024 ----a-w C:\Users\Public\SqirlzReflect.zip
2007-01-05 23:16 262,144 ----a-w C:\ProgramData\ntuser.dat
2008-03-19 17:25 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-03-19 17:25 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-03-19 17:25 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]
"Steam"="c:\program files\steam\steam.exe" [2008-08-08 12:11 1271032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-01-19 15:38 1008184]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-28 05:50 815104]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6261\SiteAdv.exe" [2006-10-19 00:14 35928]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-10 10:51 289064]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 02:12 483328]
"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2008-06-18 14:01 141848]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2008-06-18 14:01 166424]
"Persistence"="C:\Windows\system32\igfxpers.exe" [2008-06-18 14:01 133656]
"RtHDVCpl"="RtHDVCpl.exe" [2006-11-10 02:57 3784704 C:\Windows\RtHDVCpl.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\Windows\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2008-07-29 15:02:38 25214]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDesktopCleanupWizard"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient]
2005-01-31 15:13 49152 C:\PROGRA~1\COMMON~1\Stardock\MCPStub.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\vio\dvacm.acm
"VIDC.XFR1"= xfcodec.dll

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\Windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Find Fast.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Find Fast.lnk
backup=C:\Windows\pss\Microsoft Find Fast.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Office Startup.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Office Startup.lnk
backup=C:\Windows\pss\Office Startup.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Easy-PrintToolBox]
--a------ 2004-01-14 09:10 409600 C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FixCamera]
--a------ 2006-06-02 02:26 20480 C:\Windows\FixCamera.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2006-12-11 12:52 49152 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-07-10 10:51 289064 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mcagent_exe]
--a------ 2007-08-04 14:33 582992 C:\Program Files\McAfee.com\Agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snp2std]
--a------ 2006-05-16 06:52 675840 C:\Windows\vsnp2std.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tsnp2std]
--a------ 2006-06-20 04:37 262144 C:\Windows\tsnp2std.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{C071C503-85A9-42F0-89E4-54CCD6A59C42}"= UDP:C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
"{89222904-DD06-4C3B-9791-BBED301FC9C0}"= TCP:C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
"{19AFF3F7-C40A-4ECD-ADF5-43E29791B3AE}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{D927705F-DFDE-4287-9314-26339755ECB1}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{0F791406-8A6A-4F0C-B294-83394496FF51}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{15418C9C-D114-43E3-8553-E3C46C17D24C}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"{F06175CD-2BEC-425C-B60E-D9624B97A6A9}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{A1A20F2B-E8F8-487E-A2FF-23BC47F99C77}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{14A5B037-187A-4331-B0CA-D63F194CE314}"= UDP:C:\Program Files\Atari\Test Drive Unlimited\TestDriveUnlimited.exe:Start Test Drive Unlimited
"{33C7BF16-D203-4AED-9BC9-972591FCFBE4}"= TCP:C:\Program Files\Atari\Test Drive Unlimited\TestDriveUnlimited.exe:Start Test Drive Unlimited
"TCP Query User{82F4D425-FEA5-4CD1-B018-89F007DE54BB}C:\\program files\\xfire\\xfire.exe"= UDP:C:\program files\xfire\xfire.exe:Xfire
"UDP Query User{0A208F96-20D3-4A76-BD0B-8444EE612B23}C:\\program files\\xfire\\xfire.exe"= TCP:C:\program files\xfire\xfire.exe:Xfire
"TCP Query User{FE8C5BCC-1619-4B90-A4CF-ACE1BF3CD33F}C:\\users\\home\\appdata\\local\\yahoo!\\messenger for vista\\yahoo.messenger.ymapp.exe"= UDP:C:\users\home\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe:yahoo.messenger.ymapp.exe
"UDP Query User{09A3E2AD-A0C5-4EFE-934C-4C0AEECDDF83}C:\\users\\home\\appdata\\local\\yahoo!\\messenger for vista\\yahoo.messenger.ymapp.exe"= TCP:C:\users\home\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe:yahoo.messenger.ymapp.exe
"TCP Query User{103B178D-6129-48A0-8D2A-6EF2C65EE7E4}C:\\program files\\xfire\\xfire.exe"= UDP:C:\program files\xfire\xfire.exe:Xfire
"UDP Query User{E1A3BD8B-682E-4D9E-807C-6A236E6A7652}C:\\program files\\xfire\\xfire.exe"= TCP:C:\program files\xfire\xfire.exe:Xfire
"TCP Query User{A6475D27-2692-4BEE-A316-68D46636DD42}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{4AD9C835-A14A-425A-A6A4-317AB41A5CA2}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"TCP Query User{99DFE103-88E9-49F5-9FFF-FFA4AE28C6B4}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{38B52E24-FA87-4E6F-AABF-DB5E1D7DD0E9}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"TCP Query User{AE4BAE49-03B6-4530-9399-677D56C185AC}C:\\program files\\limewire\\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{DA0CF9C8-4425-4F36-922D-5D6634D0733F}C:\\program files\\limewire\\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire
"TCP Query User{CEC7F62E-EDFD-4D89-AB17-E179B181CAA8}C:\\program files\\limewire\\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{5100AB1B-EB04-4EB5-8052-39EA9DDF280D}C:\\program files\\limewire\\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire
"{FC4B6C56-8D64-4930-84A0-721C5C961BF0}"= UDP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{600ED1E4-F8A8-4AB6-994E-259D0F88DAD4}"= TCP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{E8C24BF4-FA05-4D5A-8CD4-48F0F746D65E}"= UDP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{7F988212-746C-488D-AD43-A1F0215F1FA7}"= TCP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"TCP Query User{2A193115-EBB4-49C1-AE73-45B4F4132319}C:\\program files\\yahoo!\\messenger\\yahoomessenger.exe"= UDP:C:\program files\yahoo!\messenger\yahoomessenger.exe:Yahoo! Messenger
"UDP Query User{025ACF56-497F-471A-961E-DF366DDF05B4}C:\\program files\\yahoo!\\messenger\\yahoomessenger.exe"= TCP:C:\program files\yahoo!\messenger\yahoomessenger.exe:Yahoo! Messenger
"{E0F6FCF1-FFCF-4664-AD1A-A73730481618}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{B65C7533-5EF5-4B99-BA4C-184F6EC2AC29}"= UDP:C:\Program Files\iLike\1.1.41\ilikesidebar.exe:ilikesidebar
"{B4F29C59-6451-4CF8-B246-922D74BBFDF5}"= TCP:C:\Program Files\iLike\1.1.41\ilikesidebar.exe:ilikesidebar
"{D2B7CA04-EAC2-486A-BC55-5E5F89A202F4}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{082ADDD8-0E37-4F95-82F2-788CC8F20861}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"TCP Query User{7371CF9A-7CA9-48F9-9B82-88E7ECAA1C65}C:\\program files\\itunes\\itunes.exe"= UDP:C:\program files\itunes\itunes.exe:iTunes
"UDP Query User{331170A6-7393-40E7-BC89-9714F3DD3BD0}C:\\program files\\itunes\\itunes.exe"= TCP:C:\program files\itunes\itunes.exe:iTunes
"{8D77C95C-8BEE-4168-908E-8208340EB305}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{47E1BA92-204B-4A53-931A-A972BBBA81F4}"= UDP:C:\Windows\System32\PnkBstrA.exenkBstrA
"{965AFAA8-E497-4775-BA1D-802CE3FCCAA7}"= TCP:C:\Windows\System32\PnkBstrA.exenkBstrA
"{823BCF4E-F3B1-4AC2-A669-ADEC88C64617}"= UDP:C:\Windows\System32\PnkBstrB.exenkBstrB
"{A5C90A4A-16F8-47C9-B29A-68D97D18BB52}"= TCP:C:\Windows\System32\PnkBstrB.exenkBstrB
"TCP Query User{2C405CCC-CDC5-48A7-9324-D2E447C397F9}C:\\westwood\\renegade\\game.exe"= UDP:C:\westwood\renegade\game.exe:Renegade
"UDP Query User{1EFF9AB5-5D8F-4FB5-89EB-CAA290F571D7}C:\\westwood\\renegade\\game.exe"= TCP:C:\westwood\renegade\game.exe:Renegade
"TCP Query User{965C849C-3FF2-4C9E-81A8-D6AFE878E338}C:\\program files\\steam\\steamapps\\jnskyliner34\\counter-strike source\\hl2.exe"= UDP:C:\program files\steam\steamapps\jnskyliner34\counter-strike source\hl2.exe:hl2
"UDP Query User{04C10E9D-4809-4BC4-9D89-CDFE55BB542B}C:\\program files\\steam\\steamapps\\jnskyliner34\\counter-strike source\\hl2.exe"= TCP:C:\program files\steam\steamapps\jnskyliner34\counter-strike source\hl2.exe:hl2

S2 Messager;Messager;c:\temp\svchost.exe []
S3 s115bus;Sony Ericsson Device 115 driver (WDM);C:\Windows\system32\DRIVERS\s115bus.sys [2007-04-23 13:54]
S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;C:\Windows\system32\DRIVERS\s115mdfl.sys [2007-04-23 13:54]
S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;C:\Windows\system32\DRIVERS\s115mdm.sys [2007-04-23 13:54]
S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);C:\Windows\system32\DRIVERS\s115mgmt.sys [2007-04-23 13:54]
S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;C:\Windows\system32\DRIVERS\s115obex.sys [2007-04-23 13:54]
S3 SaiHF51A;SaiHF51A;C:\Windows\system32\DRIVERS\SaiHF51A.sys [2007-06-05 18:09]
S3 SaiUF51A;SaiUF51A;C:\Windows\system32\DRIVERS\SaiUF51A.sys [2007-06-05 18:09]
S3 SNP2STD;USB2.0 PC Camera (SNP2STD);C:\Windows\system32\DRIVERS\snp2sxp.sys [2006-06-08 01:34]
S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-08-08 12:16]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6e785c28-fa59-11db-ab2c-0016d4923157}]
\shell\AutoRun\command - bar311.exe %1
\shell\Explore\command - bar311.exe %1
\shell\Open\command - bar311.exe %1

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7274d91a-bca1-11dc-afda-0016d4923157}]
\shell\AutoRun\command - bar311.exe %1
\shell\Explore\command - bar311.exe %1
\shell\Open\command - bar311.exe %1

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7d748dbb-4004-11dd-a65a-0016d4923157}]
\shell\AutoRun\command - $17.EXE %1
\shell\Explore\command - $17.EXE %1
\shell\Open\command - $17.EXE %1

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b57c835c-3070-11dd-85a2-0016d4923157}]
\shell\AutoRun\command - E:\ukgki.cmd
\shell\explore\Command - E:\ukgki.cmd
\shell\open\Command - E:\ukgki.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e765b5fb-93ac-11dc-bac7-0016d4923157}]
\shell\AutoRun\command - bar311.exe %1
\shell\Explore\command - bar311.exe %1
\shell\Open\command - bar311.exe %1

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ede09ae5-ac37-11db-9b78-806e6f6e6963}]
\shell\AutoRun\command - D:\autorun.exe
\shell\readit\command - notepad readme.doc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fac39b83-5c5d-11dd-8b2c-0016d4923157}]
\shell\AutoRun\command - bar311.exe %1
\shell\Explore\command - bar311.exe %1
\shell\Open\command - bar311.exe %1

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder

2008-06-08 C:\Windows\Tasks\Check Updates for Windows Live Toolbar.job
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]

2007-05-25 C:\Windows\Tasks\McDefragTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]

2007-05-25 C:\Windows\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-TOSCDSPD - TOSCDSPD.EXE
HKU-Default-Run-iLike - C:\Program Files\iLike\1.1.41\ilikesidebar.exe
MSConfigStartUp-KeNotify - C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
MSConfigStartUp-LtMoh - C:\Program Files\ltmoh\Ltmoh.exe
MSConfigStartUp-NSLauncher - C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe
MSConfigStartUp-OTB - C:\Program Files\FNet\OTB\OTB.exe
MSConfigStartUp-SiteAdvisor - C:\Program Files\SiteAdvisor\6253\SiteAdv.exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\lbjiffs8.default\
FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - C:\Program Files\Yahoo!\Shared\npYState.dll


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-11 11:30:48
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-11 11:34:13
ComboFix-quarantined-files.txt 2008-08-11 03:34:07

Pre-Run: 59,950,972,928 bytes free
Post-Run: 59,979,599,872 bytes free

364 --- E O F --- 2008-08-08 08:42:14

 

[cohen]

Hijackthis log pls.

After the combo fix, it should've rebooted and produced the log??

now you say icons disappeared??? Reboot and post a fresh hijackthis log.

 

[Justin]

here's HJT

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:48:06 AM, on 8/11/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynToshiba.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\SiteAdvisor\6261\SiteAdv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\acrotray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Users\Home\Desktop\HiJackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - MRI_DISABLED - (no file)
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Catcher Class - {ADECBED6-0366-4377-A739-E69DFBA04663} - C:\Program Files\Moyea\FLV Downloader\MoyeaCth.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [SiteAdvisor] "C:\Program Files\SiteAdvisor\6261\SiteAdv.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
O4 - Startup: Microsoft .NET Framework 1.1.exe.lnk = C:\Program Files\Common Files\Microsoft .NET Framework 1.1.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPAHelper.exe - Unknown owner - C:\Program Files\iPod Access for Windows\iPAHelper.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: Messager - Unknown owner - c:\temp\svchost.exe (file missing)
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6261\SAService.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 11664 bytes







well?

 

[cohen]

Please do a scan with Kaspersky Online Scanner

Click on the Accept button and install any components it needs.

• The program will install and then begin downloading the latest definition files.
• After the files have been downloaded on the left side of the page in the Scan section select My Computer.
• This will start the program and scan your system.
• The scan will take a while, so be patient and let it run.
• Once the scan is complete, click on View scan report
• Now, click on the Save Report as button.
• In the drop down box labeled Files of type change the type to Text file.
• Save the file to your desktop.
• Copy and paste that information in your next post.

 

[Justin]

so many steps to do. oh well, kaspersky is installing right now.

the thing that keeps annoying is gone though.