note: while running combofix, i got an error message. (i wouldve posted it, but i pressed ok b4 i thought about it, but the 1st numbers of the error were something like "0000013"
ComboFix 07-10-14.4 - Oz 2007-10-14 19:04:58.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1579 [GMT 1:00]
Running from: C:\Documents and Settings\Oz\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2007-09-14 to 2007-10-14 )))))))))))))))))))))))))))))))
.
2007-10-14 19:04 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-14 18:07 <DIR> d-------- C:\Deckard
2007-10-14 00:20 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2007-10-14 00:20 <DIR> d-------- C:\Documents and Settings\Oz\Application Data\SystemRequirementsLab
2007-10-14 00:13 <DIR> d-------- C:\WINDOWS\Sun
2007-10-14 00:12 <DIR> d-------- C:\Program Files\Java
2007-10-14 00:12 <DIR> d-------- C:\Program Files\Common Files\Java
2007-10-12 10:25 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll
2007-10-12 10:25 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll
2007-10-12 10:25 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll
2007-10-12 10:25 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll
2007-10-12 10:25 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll
2007-10-12 10:25 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll
2007-10-12 10:25 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll
2007-10-12 10:22 <DIR> d-------- C:\Program Files\Activision
2007-10-11 22:54 <DIR> d-------- C:\VundoFix Backups
2007-10-11 22:35 <DIR> d-------- C:\Program Files\Trend Micro
2007-10-08 09:05 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-10-07 14:34 <DIR> d-------- C:\Program Files\RivaTuner v2.05
2007-10-07 00:42 <DIR> d-------- C:\WINDOWS\nview
2007-10-07 00:42 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe
2007-10-07 00:41 <DIR> d-------- C:\NVIDIA
2007-10-07 00:41 356,352 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2007-10-07 00:05 53,248 --a------ C:\WINDOWS\system32\CSVer.dll
2007-10-02 14:40 <DIR> d-------- C:\Program Files\Asus
2007-10-02 11:04 <DIR> d-------- C:\Program Files\Bonjour
2007-10-02 10:57 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2007-10-02 10:14 <DIR> d-------- C:\Program Files\VirtualDJ
2007-10-02 09:55 <DIR> d-------- C:\Program Files\MagicISO
2007-09-30 19:46 <DIR> d-------- C:\Documents and Settings\Oz\.assistant
2007-09-30 19:38 <DIR> d-------- C:\Program Files\Marvell
2007-09-27 22:24 <DIR> d-------- C:\Program Files\Sierra Entertainment
2007-09-27 22:24 <DIR> d-------- C:\Documents and Settings\Oz\Application Data\InstallShield
2007-09-27 22:23 <DIR> d-------- C:\Program Files\DAEMON Tools
2007-09-25 14:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2007-09-24 10:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet
2007-09-24 10:26 47,357 --a------ C:\WINDOWS\system32\Keygen.exe
2007-09-21 19:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Screaming Bee
2007-09-21 19:32 <DIR> d-------- C:\Documents and Settings\Oz\Application Data\Screaming Bee
2007-09-21 19:24 <DIR> d-------- C:\Program Files\Common Files\Screaming Bee
2007-09-21 19:10 <DIR> d-------- C:\Program Files\AV Vcs 6.0 GOLD
2007-09-18 16:38 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Xfire
2007-09-17 19:50 <DIR> d-------- C:\Program Files\Xfire
2007-09-17 19:50 <DIR> d-------- C:\Documents and Settings\Oz\Application Data\Xfire
2007-09-15 16:50 6,853,088 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-09-15 16:50 6,853,088 --a--c--- C:\WINDOWS\system32\dllcache\nv4_mini.sys
2007-09-15 16:50 5,783,040 --a------ C:\WINDOWS\system32\nv4_disp.dll
2007-09-15 16:50 5,783,040 --a--c--- C:\WINDOWS\system32\dllcache\nv4_disp.dll
2007-09-14 23:54 <DIR> d-------- C:\Program Files\RegSupreme Pro
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-14 18:04 --------- d-----w C:\Documents and Settings\Oz\Application Data\uTorrent
2007-10-14 11:36 --------- d-----w C:\Program Files\Steam
2007-10-12 09:24 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-08 11:52 --------- d-----w C:\Program Files\Microsoft Works
2007-10-06 23:55 --------- d-----w C:\Program Files\NVIDIA Corporation
2007-10-05 09:17 --------- d-----w C:\Program Files\a-squared Anti-Malware
2007-10-02 10:03 --------- d-----w C:\Program Files\Common Files\Adobe
2007-09-25 13:37 --------- d-----w C:\Program Files\QuickTime
2007-09-25 13:37 --------- d-----w C:\Program Files\Apple Software Update
2007-09-17 00:07 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll
2007-09-17 00:07 81,920 ----a-w C:\WINDOWS\system32\nvmctray.dll
2007-09-17 00:07 8,491,008 ----a-w C:\WINDOWS\system32\nvcpl.dll
2007-09-17 00:07 753,664 ----a-w C:\WINDOWS\system32\nvcplui.exe
2007-09-17 00:07 6,746,112 ----a-w C:\WINDOWS\system32\nvoglnt.dll
2007-09-17 00:07 6,344,704 ----a-w C:\WINDOWS\system32\nvdisps.dll
2007-09-17 00:07 5,509,120 ----a-w C:\WINDOWS\system32\nvdispsr.dll
2007-09-17 00:07 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll
2007-09-17 00:07 458,752 ----a-w C:\WINDOWS\system32\nvmccssr.dll
2007-09-17 00:07 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll
2007-09-17 00:07 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe
2007-09-17 00:07 425,984 ----a-w C:\WINDOWS\system32\keystone.exe
2007-09-17 00:07 364,544 ----a-w C:\WINDOWS\system32\nvapi.dll
2007-09-17 00:07 36,864 ----a-w C:\WINDOWS\system32\nvcodins.dll
2007-09-17 00:07 36,864 ----a-w C:\WINDOWS\system32\nvcod.dll
2007-09-17 00:07 335,872 ----a-w C:\WINDOWS\system32\nvwrses.dll
2007-09-17 00:07 335,872 ----a-w C:\WINDOWS\system32\nvwrsel.dll
2007-09-17 00:07 327,680 ----a-w C:\WINDOWS\system32\nvwrsfr.dll
2007-09-17 00:07 327,680 ----a-w C:\WINDOWS\system32\nvwrsesm.dll
2007-09-17 00:07 327,680 ----a-w C:\WINDOWS\system32\nvrshe.dll
2007-09-17 00:07 327,680 ----a-w C:\WINDOWS\system32\nvrsar.dll
2007-09-17 00:07 323,584 ----a-w C:\WINDOWS\system32\nvwrspt.dll
2007-09-17 00:07 323,584 ----a-w C:\WINDOWS\system32\nvwrsit.dll
2007-09-17 00:07 319,488 ----a-w C:\WINDOWS\system32\nvwrsptb.dll
2007-09-17 00:07 319,488 ----a-w C:\WINDOWS\system32\nvwrsnl.dll
2007-09-17 00:07 315,392 ----a-w C:\WINDOWS\system32\nvwrsru.dll
2007-09-17 00:07 315,392 ----a-w C:\WINDOWS\system32\nvwrshu.dll
2007-09-17 00:07 311,296 ----a-w C:\WINDOWS\system32\nvwrsde.dll
2007-09-17 00:07 307,200 ----a-w C:\WINDOWS\system32\nvexpbar.dll
2007-09-17 00:07 303,104 ----a-w C:\WINDOWS\system32\nvwrstr.dll
2007-09-17 00:07 303,104 ----a-w C:\WINDOWS\system32\nvwrssl.dll
2007-09-17 00:07 303,104 ----a-w C:\WINDOWS\system32\nvwrsfi.dll
2007-09-17 00:07 3,629,056 ----a-w C:\WINDOWS\system32\nvvitvsr.dll
2007-09-17 00:07 3,551,232 ----a-w C:\WINDOWS\system32\nvvitvs.dll
2007-09-17 00:07 3,334,144 ----a-w C:\WINDOWS\system32\nvgames.dll
2007-09-17 00:07 3,166,208 ----a-w C:\WINDOWS\system32\nvgamesr.dll
2007-09-17 00:07 299,008 ----a-w C:\WINDOWS\system32\nvwrssk.dll
2007-09-17 00:07 299,008 ----a-w C:\WINDOWS\system32\nvwrsno.dll
2007-09-17 00:07 294,912 ----a-w C:\WINDOWS\system32\nvwrssv.dll
2007-09-17 00:07 294,912 ----a-w C:\WINDOWS\system32\nvwrspl.dll
2007-09-17 00:07 294,912 ----a-w C:\WINDOWS\system32\nvwrsda.dll
2007-09-17 00:07 290,816 ----a-w C:\WINDOWS\system32\nvwrsth.dll
2007-09-17 00:07 286,720 ----a-w C:\WINDOWS\system32\nvwrseng.dll
2007-09-17 00:07 286,720 ----a-w C:\WINDOWS\system32\nvwrscs.dll
2007-09-17 00:07 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll
2007-09-17 00:07 282,624 ----a-w C:\WINDOWS\system32\nvwrsar.dll
2007-09-17 00:07 282,624 ----a-w C:\WINDOWS\system32\nvrsfr.dll
2007-09-17 00:07 282,624 ----a-w C:\WINDOWS\system32\nvrses.dll
2007-09-17 00:07 282,624 ----a-w C:\WINDOWS\system32\nvrsel.dll
2007-09-17 00:07 278,528 ----a-w C:\WINDOWS\system32\nvwrshe.dll
2007-09-17 00:07 278,528 ----a-w C:\WINDOWS\system32\nvrsit.dll
2007-09-17 00:07 278,528 ----a-w C:\WINDOWS\system32\nvrsde.dll
2007-09-17 00:07 274,432 ----a-w C:\WINDOWS\system32\nvrspt.dll
2007-09-17 00:07 274,432 ----a-w C:\WINDOWS\system32\nvrsnl.dll
2007-09-17 00:07 274,432 ----a-w C:\WINDOWS\system32\nvrsesm.dll
2007-09-17 00:07 270,336 ----a-w C:\WINDOWS\system32\nvrsru.dll
2007-09-17 00:07 266,240 ----a-w C:\WINDOWS\system32\nvrsptb.dll
2007-09-17 00:07 266,240 ----a-w C:\WINDOWS\system32\nvrsja.dll
2007-09-17 00:07 258,048 ----a-w C:\WINDOWS\system32\nvrstr.dll
2007-09-17 00:07 258,048 ----a-w C:\WINDOWS\system32\nvrssl.dll
2007-09-17 00:07 258,048 ----a-w C:\WINDOWS\system32\nvrssk.dll
2007-09-17 00:07 258,048 ----a-w C:\WINDOWS\system32\nvrsko.dll
2007-09-17 00:07 258,048 ----a-w C:\WINDOWS\system32\nvrshu.dll
2007-09-17 00:07 253,952 ----a-w C:\WINDOWS\system32\nvrsth.dll
2007-09-17 00:07 253,952 ----a-w C:\WINDOWS\system32\nvrssv.dll
2007-09-17 00:07 253,952 ----a-w C:\WINDOWS\system32\nvrspl.dll
2007-09-17 00:07 253,952 ----a-w C:\WINDOWS\system32\nvrsno.dll
2007-09-17 00:07 253,952 ----a-w C:\WINDOWS\system32\nvrsda.dll
2007-09-17 00:07 249,856 ----a-w C:\WINDOWS\system32\nvrsfi.dll
2007-09-17 00:07 249,856 ----a-w C:\WINDOWS\system32\nvrscs.dll
2007-09-17 00:07 245,760 ----a-w C:\WINDOWS\system32\nvrseng.dll
2007-09-17 00:07 229,376 ----a-w C:\WINDOWS\system32\nvmccs.dll
2007-09-17 00:07 225,280 ----a-w C:\WINDOWS\system32\nvrszhc.dll
2007-09-17 00:07 212,992 ----a-w C:\WINDOWS\system32\nvwrsja.dll
2007-09-17 00:07 2,854,912 ----a-w C:\WINDOWS\system32\nvmoblsr.dll
2007-09-17 00:07 2,441,216 ----a-w C:\WINDOWS\system32\nvwssr.dll
2007-09-17 00:07 2,371,584 ----a-w C:\WINDOWS\system32\nvwss.dll
2007-09-17 00:07 196,608 ----a-w C:\WINDOWS\system32\nvwrsko.dll
2007-09-17 00:07 188,416 ----a-w C:\WINDOWS\system32\nvmccss.dll
2007-09-17 00:07 167,936 ----a-w C:\WINDOWS\system32\nvwrszht.dll
2007-09-17 00:07 163,840 ----a-w C:\WINDOWS\system32\nvwrszhc.dll
2007-09-17 00:07 155,716 ----a-w C:\WINDOWS\system32\nvsvc32.exe
2007-09-17 00:07 147,456 ----a-w C:\WINDOWS\system32\nvcolor.exe
2007-09-17 00:07 126,976 ----a-w C:\WINDOWS\system32\nvrszht.dll
2007-09-17 00:07 1,703,936 ----a-w C:\WINDOWS\system32\nvwdmcpl.dll
2007-09-17 00:07 1,626,112 ----a-w C:\WINDOWS\system32\nwiz.exe
2007-09-17 00:07 1,478,656 ----a-w C:\WINDOWS\system32\nview.dll
2007-09-17 00:07 1,339,392 ----a-w C:\WINDOWS\system32\nvdspsch.exe
2007-09-17 00:07 1,150,976 ----a-w C:\WINDOWS\system32\nvmobls.dll
2007-09-17 00:07 1,073,152 ----a-w C:\WINDOWS\system32\nvcpluir.dll
2007-09-17 00:07 1,019,904 ----a-w C:\WINDOWS\system32\nvwimg.dll
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
----a-w 331,776 2006-03-20 19:43:16 C:\Program Files\AGEIA Technologies\bak\TrayIcon.exe
----a-w 102,400 2004-12-02 17:23:34 C:\Program Files\Creative\MediaSource\Detector\bak\CTDetect.exe
------w 102,400 2004-12-02 17:23:34 C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
----a-w 35,328 2005-12-08 19:18:40 C:\Program Files\Winamp\bak\winampa.exe
----a-w 39,424 2007-08-22 02:50:34 C:\Program Files\Winamp\winampa.exe
----a-w 15,360 2004-08-04 12:00:00 C:\WINDOWS\system32\bak\ctfmon.exe
----a-w 15,360 2004-08-04 12:00:00 C:\WINDOWS\system32\ctfmon.exe
----a-w 155,648 2001-07-09 18:50:42 C:\WINDOWS\system32\bak\NeroCheck.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00]
"RTHDCPL"="RTHDCPL.EXE" [2006-04-17 08:34 C:\WINDOWS\RTHDCPL.exe]
"P17Helper"="P17.dll" [2005-05-03 12:38 C:\WINDOWS\system32\P17.dll]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-03-02 20:13]
"CTHelper"="CTHELPER.EXE" [2005-06-18 07:01 C:\WINDOWS\CTHELPER.EXE]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"a-squared"="C:\Program Files\a-squared Anti-Malware\a2guard.exe" [2007-09-02 16:02]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 01:07]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-07-03 12:32]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=?I?
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Creative Detector"=C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" /background
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Lexmark 1200 Series"="C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
"Alcmtr"=ALCMTR.EXE
"NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" -atboottime
R3 P17;Sound Blaster Audigy;C:\WINDOWS\system32\drivers\P17.sys
S3 BTNetFilter;Bluetooth Network Filter;\??\C:\WINDOWS\system32\drivers\BTNetFilter.sys
S3 RivaTuner32;RivaTuner32;\??\C:\Program Files\RivaTuner v2.05\RivaTuner32.sys
S3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;C:\WINDOWS\system32\DRIVERS\RTL8187.sys
S3 scrcap;scrcap;C:\WINDOWS\system32\DRIVERS\scrcap.sys
S3 SCREAMINGBDRIVER;Screaming Bee Audio;C:\WINDOWS\system32\drivers\ScreamingBAudio.sys
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ac91ba86-d572-11db-9bdb-009096cd6312}]
AutoRun\command - J:\autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ac91ba9e-d572-11db-9bdb-009096cd6312}]
AutoRun\command - J:\autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aca780e2-4300-11db-841e-806d6172696f}]
AutoRun\command - D:\bootcd\autorun.com
*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2007-10-09 20:13:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
"2007-10-14 10:04:24 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-10-05 12:17:00 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2007-09-05 12:17:31 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
.
**************************************************************************
catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-10-14 19:07:29
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-10-14 19:09:45
.
--- E O F ---
-HI_JACK_THIS:-
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:11:02, on 14/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\CTHELPER.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe" /d=60
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.google.co.uk
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://www.update.microsoft.com/micr...?1191752884906
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) -
http://messenger.zone.msn.com/binary...t.cab55762.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) -
http://messenger.zone.msn.com/binary...o.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) -
http://messenger.zone.msn.com/binary...t.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -
http://messenger.zone.msn.com/binary...t.cab56907.cab
O20 - AppInit_DLLs: ?I?
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing)
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business XII\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business XII\RpcSandraSrv.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
--
End of file - 7927 bytes