Combofix
ComboFix 07-10-08 - all users 2007-10-07 21:55:12.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.147 [GMT 1:00]
Running from: C:\Documents and Settings\all users.silver\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2007-09-08 to 2007-10-08 )))))))))))))))))))))))))))))))
.
2007-10-07 21:53 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-05 16:21 <DIR> d-------- C:\Deckard
2007-10-03 21:25 <DIR> d-------- C:\Program Files\Lavasoft
2007-10-03 21:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-10-03 21:24 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-10-02 20:33 <DIR> d-------- C:\info
2007-10-01 23:00 212 --a------ C:\delete.bat
2007-09-30 00:27 <DIR> d-------- C:\Documents and Settings\Guest\WINDOWS
2007-09-30 00:27 <DIR> d-------- C:\Documents and Settings\Guest\Application Data\SampleView
2007-09-30 00:27 <DIR> d-------- C:\Documents and Settings\Guest\Application Data\CyberLink
2007-09-30 00:27 <DIR> d-------- C:\Documents and Settings\Guest\Application Data\Apple Computer
2007-09-22 18:45 304,160 --a------ C:\StiImg.dat
2007-09-22 18:42 53,248 --a------ C:\WINDOWS\system32\PAStiSvc.exe
2007-09-22 18:41 <DIR> d-------- C:\WINDOWS\PixArt
2007-09-22 18:41 <DIR> d-------- C:\Program Files\Trust
2007-09-22 18:41 <DIR> d-------- C:\Program Files\Common Files\PCCamera
2007-09-15 14:00 <DIR> d-------- C:\Program Files\MSN Messenger
2007-09-12 21:16 109,600 --a------ C:\WINDOWS\system32\sptll.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-07 14:30 --------- d-------- C:\Program Files\lx_cats
2007-10-04 22:33 --------- d-------- C:\Program Files\TweakGenie
2007-10-04 22:32 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-10-04 22:32 --------- d-------- C:\Program Files\Activision
2007-10-04 22:31 --------- d-------- C:\Program Files\My Pet Hotel
2007-10-04 22:31 --------- d-------- C:\Program Files\Mindscape
2007-10-04 22:26 --------- d-------- C:\Program Files\Jasc Software Inc
2007-10-04 22:23 --------- d-------- C:\Program Files\eGames
2007-10-04 21:51 --------- d-------- C:\Program Files\AlienGUIse
2007-10-03 21:24 --------- d-------- C:\Documents and Settings\all users.silver\Application Data\Lavasoft
2007-10-02 19:56 --------- d-------- C:\Documents and Settings\all users.silver\Application Data\LimeWire
2007-09-30 08:55 --------- d-------- C:\Documents and Settings\all users.silver\Application Data\AdobeUM
2007-09-06 11:05 94416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-09-06 11:05 92848 --a--c--- C:\WINDOWS\system32\drivers\aswmon.sys
2007-09-06 11:03 23152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-09-06 11:02 42912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-09-06 11:00 26624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-09-04 19:34 --------- d-------- C:\Documents and Settings\all users.silver\Application Data\Google
2007-09-04 19:33 --------- d-------- C:\Program Files\Google
2007-09-04 18:44 --------- d-------- C:\Program Files\Play89
2007-08-19 11:54 --------- d-------- C:\Documents and Settings\all users.silver\Application Data\GlueTypeView
2007-08-19 11:36 --------- d-------- C:\Program Files\Yahoo!
2007-08-15 17:52 --------- d-------- C:\Program Files\MSXML 6.0
2007-08-12 21:32 --------- d-------- C:\Documents and Settings\All Users\Application Data\Winferno
2007-01-23 23:14 360448 --a--c--- C:\Program Files\Uninstall My Web Search.dll
2006-10-15 16:23 92 --a--c--- C:\Program Files\Print Files.bat
2006-10-15 16:19 86 --a--c--- C:\Program Files\List Files.bat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 21:42]
"SoundMan"="SOUNDMAN.EXE" [2006-03-01 16:22 C:\WINDOWS\soundman.exe]
"Run StartupMonitor"="StartupMonitor.exe" [2000-05-20 17:23 C:\WINDOWS\StartupMonitor.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 11:06]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-09 01:02]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 20:00]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsMenu"=0 (0x0)
"NoSMHelp"=0 (0x0)
"NoLogoff"=0 (0x0)
"NoSetTaskBar"=0 (0x0)
"NoSetFolders"=0 (0x0)
"NoStartMenuMFUprogramsList"=0 (0x0)
"NoStartMenuMorePrograms"=0 (0x0)
"NoChangeStartMenu"=0 (0x0)
"MaxRecentDocs"=15 (0xf)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"EditLevel"=0 (0x0)
"NoFileMenu"=0 (0x0)
"NoCommonGroups"=0 (0x0)
"NoStrCmpLogical"=1 (0x1)
"NoRecentDocsMenu"=0 (0x0)
"NoSMHelp"=0 (0x0)
"NoLogoff"=0 (0x0)
"NoSetTaskBar"=0 (0x0)
"NoSetFolders"=0 (0x0)
"NoStartMenuMFUprogramsList"=0 (0x0)
"NoStartMenuMorePrograms"=0 (0x0)
"NoChangeStartMenu"=0 (0x0)
"MaxRecentDocs"=15 (0xf)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
C:\Program Files\AlienGUIse\fastload.dll 2001-12-21 00:34 24576 C:\Program Files\AlienGUIse\fastload.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=wbsys.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]
"C:\Program Files\Lexmark 2400 Series\ezprint.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
C:\WINDOWS\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
C:\WINDOWS\system32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxcrmon.exe]
"C:\Program Files\Lexmark 2400 Series\lxcrmon.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SearchIndexer]
rundll32.exe "C:\WINDOWS\system32\fbbstwju.dll",sitypnow
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPodService"=3 (0x3)
"WZCSVC"=2 (0x2)
"W32Time"=2 (0x2)
"ALG"=3 (0x3)
"WebClient"=2 (0x2)
"VSS"=3 (0x3)
"Themes"=2 (0x2)
"SwPrv"=3 (0x3)
"CiSvc"=3 (0x3)
"FastUserSwitchingCompatibility"=3 (0x3)
"ERSvc"=2 (0x2)
"TrkWks"=2 (0x2)
"Browser"=2 (0x2)
"wuauserv"=2 (0x2)
R2 ehMonitor;Media Center Monitor Service;C:\Program Files\Media Center Diagnostic Kit\Tests\Bin\ehMonitor.exe
S2 Ca533av;Icatch(IV) Video Camera Device;C:\WINDOWS\system32\Drivers\Ca533av.sys
S2 GDI23880;Genesis Video Capture;C:\WINDOWS\system32\drivers\gdi2vid.sys
S2 GDI2BTS;Genesis BDA Transport Capture;C:\WINDOWS\system32\drivers\gdi2bts.sys
S2 GDI2IR;Genesis InfraRed;C:\WINDOWS\system32\drivers\gdi2ir.sys
S2 GDI2XBAR;Genesis Crossbar;C:\WINDOWS\system32\drivers\gdi2xbr.sys
S3 GDI2BDA;Black Gold Signature BDA DVB Tuner/Demod;C:\WINDOWS\system32\drivers\gdi2bda.sys
S3 Hauppauge WinTV-HVR;Hauppauge WinTV-HVR 713X PCI Card;C:\WINDOWS\system32\DRIVERS\HCW713x.sys
S3 PAC207;Trust WB-1400T Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys
S3 SE2Bbus;Sony Ericsson Device 043 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\SE2Bbus.sys
S3 SE2Bmdfl;Sony Ericsson Device 043 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\SE2Bmdfl.sys
S3 SE2Bmdm;Sony Ericsson Device 043 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\SE2Bmdm.sys
S3 SE2Bmgmt;Sony Ericsson Device 043 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\SE2Bmgmt.sys
S3 se2Bnd5;Sony Ericsson Device 043 USB Ethernet Emulation SEMC43 (NDIS);C:\WINDOWS\system32\DRIVERS\se2Bnd5.sys
S3 SE2Bobex;Sony Ericsson Device 043 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\SE2Bobex.sys
S3 se2Bunic;Sony Ericsson Device 043 USB Ethernet Emulation SEMC43 (WDM);C:\WINDOWS\system32\DRIVERS\se2Bunic.sys
S3 SQLWriter;SQL Server VSS Writer;"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
S3 USBCamera;Icatch(IV) Still Camera Device;C:\WINDOWS\system32\Drivers\Bulk533.sys
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\Z]
AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480
.
Contents of the 'Scheduled Tasks' folder
"2007-09-30 08:00:00 C:\WINDOWS\Tasks\rpc.job"
- C:\Program Files\Winferno\RegistryPowerCleaner\RegPowerClean.exe
.
**************************************************************************
catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-10-08 22:03:04
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
C:\WINDOWS\WindowsShell.Manifest
C:\WINDOWS\WindowsUpdate.log
C:\WINDOWS\winhelp.exe
C:\WINDOWS\winhlp32.exe
C:\WINDOWS\wininit.ini
C:\WINDOWS\winnt.bmp
C:\WINDOWS\winnt256.bmp
C:\WINDOWS\WinSxS
C:\WINDOWS\WMCSetup.log
C:\WINDOWS\WMFDist11.log
C:\WINDOWS\wmp11.log
C:\WINDOWS\wmsetup.log
C:\WINDOWS\wmsetup10.log
C:\WINDOWS\WMSysPr9.prx
C:\WINDOWS\Wudf01000Inst.log
C:\WINDOWS\Zapotec.bmp
C:\WINDOWS\zllsputility.exe
C:\WINDOWS\_default.pif
C:\WINDOWS\~GLH0014.TMP
scan completed successfully
hidden files: 19
**************************************************************************
.
Completion time: 2007-10-08 22:05:35 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-10-08 22:05
.
--- E O F ---
Findlop
Volume in drive C is Partition_1
Volume Serial Number is 30EF-9CEF
Directory of C:\Documents and Settings\Administrator\Application Data
09/09/2006 12:59 <DIR> Adobe
09/09/2006 12:59 <DIR> Apple Computer
09/09/2006 12:59 <DIR> CyberLink
09/09/2006 12:59 <DIR> Identities
09/09/2006 13:00 <DIR> SampleView
0 File(s) 0 bytes
5 Dir(s) 142,384,324,608 bytes free
Volume in drive C is Partition_1
Volume Serial Number is 30EF-9CEF
Directory of C:\Documents and Settings\All Users\Application Data
30/09/2007 08:58 <DIR> Adobe
09/09/2006 13:00 <DIR> Apple Computer
09/09/2006 13:00 <DIR> CyberLink
18/07/2007 18:48 <DIR> Driving Test Success
10/10/2006 04:12 <DIR> FaxCtr
03/10/2007 21:25 <DIR> Lavasoft
10/10/2006 21:54 <DIR> Microsoft Help
11/10/2006 18:59 <DIR> SpieleEntwicklungsKombinat
17/06/2007 17:03 <DIR> Spybot - Search & Destroy
04/02/2007 21:18 <DIR> Trymedia
05/02/2007 19:19 <DIR> WildTangent
11/01/2007 13:34 <DIR> Windows Genuine Advantage
12/08/2007 21:32 <DIR> Winferno
23/02/2007 22:04 <DIR> Zylom
0 File(s) 0 bytes
14 Dir(s) 142,384,320,512 bytes free
Volume in drive C is Partition_1
Volume Serial Number is 30EF-9CEF
Directory of C:\Documents and Settings\Guest\Application Data
09/09/2006 12:59 <DIR> Adobe
09/09/2006 12:59 <DIR> Apple Computer
09/09/2006 12:59 <DIR> CyberLink
09/09/2006 12:59 <DIR> Identities
30/09/2007 11:59 <DIR> Mozilla
09/09/2006 13:00 <DIR> SampleView
0 File(s) 0 bytes
6 Dir(s) 142,384,320,512 bytes free
Volume in drive C is Partition_1
Volume Serial Number is 30EF-9CEF
Directory of C:\Documents and Settings\Default User\Application Data
20/09/2006 20:03 <DIR> .
20/09/2006 20:03 <DIR> ..
04/02/2006 08:00 62 desktop.ini
1 File(s) 62 bytes
2 Dir(s) 142,384,320,512 bytes free
Volume in drive C is Partition_1
Volume Serial Number is 30EF-9CEF
Directory of C:\Documents and Settings\LocalService\Application Data
Volume in drive C is Partition_1
Volume Serial Number is 30EF-9CEF
Directory of C:\Documents and Settings\NetworkService\Application Data
[TRACE] Enumerating jobs and queues
[TRACE] Activating job 'rpc.job'
[TRACE] Printing all job properties
ApplicationName: 'C:\Program Files\Winferno\RegistryPowerCleaner\RegPowerClean.exe'
Parameters: '/ac '
WorkingDirectory: 'C:\Program Files\Winferno\RegistryPowerCleaner'
Comment: ''
Creator: 'WSTF'
Priority: NORMAL
MaxRunTime: 259200000 (3d 0:00:00)
IdleWait: 10
IdleDeadline: 60
MostRecentRun: 00/00/0000 0:00:00
NextRun: 10/14/2007 9:00:00
StartError: 0x80070003
ExitCode: 0
Status: SCHED_S_TASK_HAS_NOT_RUN
ScheduledWorkItem Flags:
DeleteWhenDone = 0
Suspend = 0
StartOnlyIfIdle = 0
KillOnIdleEnd = 0
RestartOnIdleResume = 0
DontStartIfOnBatteries = 1
KillIfGoingOnBatteries = 0
RunOnlyIfLoggedOn = 1
SystemRequired = 0
Hidden = 0
TaskFlags: 0
1 Trigger
Trigger 0:
Type: Daily
DaysInterval: 7
StartDate: 08/12/2007
EndDate: 00/00/0000
StartTime: 09:00
MinutesDuration: 0
MinutesInterval: 0
Flags:
HasEndDate = 0
KillAtDuration = 0
Disabled = 0
Hijackthis
Logfile of HijackThis v1.99.1
Scan saved at 22:10:16, on 08/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\AlienGUIse\wbload.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Media Center Diagnostic Kit\Tests\Bin\ehMonitor.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\slmdmsr.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\StartupMonitor.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AlienGUIse\AlienwareDock\ObjectDock.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\all users.silver\Desktop\~D_KrYpTs~ #F1L35#\hijackthis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Alienware Dock.lnk = C:\Program Files\AlienGUIse\AlienwareDock\ObjectDock.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Search - ?p=ZJfox000
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.iqon.ie
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} (Macromedia Authorware Web Player Control) -
http://courses.learndirect.co.uk/pro...er/awswaxf.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{57E675E6-1867-49DB-B52E-79071F46A97D}: NameServer = 192.168.1.1,212.159.11.150
O17 - HKLM\System\CCS\Services\Tcpip\..\{DBED8F7B-7929-47CC-9E4D-A0F9673FAFE1}: NameServer = 192.168.1.1,212.159.11.150
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WB - C:\Program Files\AlienGUIse\fastload.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxcr_device - - C:\WINDOWS\system32\lxcrcoms.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slmdmsr.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe