Thread: Firefox/IE isn't working & has malware pop-ups
View Single Post
Old 08-05-2008, 11:53 PM   #8 (permalink)
ElessarDunadan
Registered User
 
Join Date: Jul 2008
Posts: 10
OS: Windows XP SP2


Re: Firefox/IE isn't working & has malware pop-ups
I ran ComboFix with the CFScript and successfully submitted the file.







Here is the ComboFix log:

ComboFix 08-08-04.09 - Family 2008-08-05 23:26:28.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.379 [GMT -6:00]
Running from: C:\Documents and Settings\Family\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Family\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\WINDOWS\BMabd9e110.xml
C:\WINDOWS\system32\wmyulvhb.tmp
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\BMabd9e110.txt
C:\WINDOWS\BMabd9e110.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\ahjpppua.dll
C:\WINDOWS\system32\bhvluymw.dll
C:\WINDOWS\system32\bjemuv.dll
C:\WINDOWS\system32\bsxuheci.dll
C:\WINDOWS\system32\DghQqBeg.ini
C:\WINDOWS\system32\DghQqBeg.ini2
C:\WINDOWS\system32\ffqrkh.dll
C:\WINDOWS\system32\flsblx.dll
C:\WINDOWS\system32\geBqQhgD.dll
C:\WINDOWS\system32\hbwlmnbo.ini
C:\WINDOWS\system32\idapesxy.dll
C:\WINDOWS\system32\jdonphjv.dll
C:\WINDOWS\system32\jiskiiip.dll
C:\WINDOWS\system32\mkmgxisw.dll
C:\WINDOWS\system32\mnrbcb.dll
C:\WINDOWS\system32\nqkbjeai.dll
C:\WINDOWS\system32\onfrbhxd.dll
C:\WINDOWS\system32\pjxvastr.dll
C:\WINDOWS\system32\pngvbl.dll
C:\WINDOWS\system32\qcxpovag.dll
C:\WINDOWS\system32\relsgwvl.exe
C:\WINDOWS\system32\roeiyidj.dll
C:\WINDOWS\system32\rukcelyy.dll
C:\WINDOWS\system32\snltmrcd.exe
C:\WINDOWS\system32\tcsfvb.dll
C:\WINDOWS\system32\tjartvos.dll
C:\WINDOWS\system32\ugqtwg.dll
C:\WINDOWS\system32\unnffk.dll
C:\WINDOWS\system32\uxsdxvsl.dll
C:\WINDOWS\system32\vcdblbih.dll
C:\WINDOWS\system32\vdlcvhpu.dll
C:\WINDOWS\system32\wmyulvhb.ini
C:\WINDOWS\system32\wuyvtjdu.dll

.
((((((((((((((((((((((((( Files Created from 2008-07-06 to 2008-08-06 )))))))))))))))))))))))))))))))
.

2008-08-05 23:33 . 2008-08-05 23:33 294 ---hs---- C:\WINDOWS\system32\hbwlmnbo.ini
2008-08-05 22:36 . 2008-08-05 22:36 2,048 --a------ C:\WINDOWS\system32\huayofpj.exe
2008-08-05 22:33 . 2008-08-05 22:33 105,472 --a------ C:\WINDOWS\system32\ntrjxuql.dll
2008-08-05 22:33 . 2008-08-05 22:33 105,472 --a------ C:\WINDOWS\system32\hooktu.dll
2008-08-05 22:31 . 2008-08-05 22:31 91,648 --a------ C:\WINDOWS\system32\ntkgclwh.dll
2008-08-05 22:31 . 2008-08-05 22:31 83,456 --a------ C:\WINDOWS\system32\obnmlwbh.dll
2008-08-05 22:21 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-08-05 22:21 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-08-04 10:44 . 2008-08-04 10:44 <DIR> d-------- C:\LORD-CD
2008-07-30 20:08 . 2008-07-30 20:08 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-30 19:30 . 2008-07-30 19:30 <DIR> d-------- C:\Deckard
2008-07-30 19:09 . 2008-07-30 19:10 <DIR> d-------- C:\ie-spyad_zo
2008-07-30 15:41 . 2008-07-30 15:41 <DIR> d-------- C:\Program Files\Panda Security
2008-07-30 15:41 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys
2008-07-29 21:09 . 2008-07-29 21:09 1,096 --a------ C:\WINDOWS\system32\tmp.reg
2008-07-29 12:33 . 2008-07-29 12:35 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-29 12:02 . 2008-07-29 12:02 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-07-29 10:48 . 2008-07-29 10:48 <DIR> d-------- C:\Documents and Settings\Family\Application Data\Bitdefender
2008-07-29 10:31 . 2008-07-29 10:31 <DIR> d-------- C:\Program Files\Softwin
2008-07-28 21:50 . 2008-07-28 21:50 113,180 --ah----- C:\WINDOWS\system32\mlfcache.dat
2008-07-28 19:42 . 2008-07-28 20:14 <DIR> d-------- C:\WINDOWS\RmFtaWx5
2008-07-27 09:07 . 2008-07-27 09:07 132 --a------ C:\WINDOWS\liveup.ini
2008-07-24 19:15 . 2008-07-24 19:17 <DIR> d-------- C:\Program Files\Strawberry Prolog
2008-07-20 21:12 . 2008-07-20 21:30 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-07-19 21:10 . 2008-07-31 12:43 <DIR> d-------- C:\Program Files\Safari

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-06 03:30 --------- d-----w C:\Program Files\MSECache
2008-08-06 02:21 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-07-29 17:57 --------- d-----w C:\Program Files\Windows Live
2008-07-29 16:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\BitDefender
2008-07-29 16:31 --------- d-----w C:\Program Files\Common Files\Softwin
2008-07-23 02:24 --------- d-----w C:\Program Files\HiDownload
2008-07-20 04:25 --------- d-----w C:\Documents and Settings\Family\Application Data\Apple Computer
2008-07-20 03:17 --------- d-----w C:\Program Files\QuickTime
2008-07-20 03:04 --------- d-----w C:\Program Files\Apple Software Update
2008-07-11 01:02 --------- d-----w C:\Program Files\Winamp
2008-07-05 20:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\AGS Demo Game
2008-07-01 17:21 --------- d-----w C:\Program Files\NoteWorthy Composer
2008-06-27 01:41 --------- d-----w C:\Documents and Settings\Family\Application Data\ICAClient
2008-05-22 04:29 906 ----a-w C:\Documents and Settings\Family\Application Data\wklnhst.dat
2006-09-22 15:42 421,888 ----a-w C:\Program Files\putty.exe
2005-02-04 02:35 5,808 ----a-w C:\Program Files\dad.rvn
2005-02-02 22:21 7,387 ----a-w C:\Program Files\ryan.rvn
2005-02-02 22:00 7,190 ----a-w C:\Program Files\keri.rvn
2000-01-15 23:03 4,770 ----a-w C:\Program Files\SOUND.DRV
2000-01-15 23:03 14,743 ----a-w C:\Program Files\MUSIC.DRV
2005-09-09 16:04 56 --sh--r C:\WINDOWS\system32\02836ADAB6.sys
2008-02-20 02:51 56 --sh--r C:\WINDOWS\system32\401AA90494.sys
2008-02-20 02:51 9,188 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

---- Directory of C:\WINDOWS\RmFtaWx5 ----



((((((((((((((((((((((((((((( snapshot@2008-08-05_22.27.52.81 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-08-06 04:19:03 81,984 ----a-w C:\WINDOWS\system32\bdod.bin
+ 2008-08-06 05:31:16 81,984 ----a-w C:\WINDOWS\system32\bdod.bin
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{26b56d21-d367-4337-9eb1-298c0872fce5}]
2008-08-05 22:33 105472 --a------ C:\WINDOWS\system32\hooktu.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseSVN]
@="{30351346-7B7D-4FCC-81B4-1E394CA267EB}"
[HKEY_CLASSES_ROOT\CLSID\{30351346-7B7D-4FCC-81B4-1E394CA267EB}]
2008-02-16 12:35 536576 --a------ C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseSVN]
@="{30351347-7B7D-4FCC-81B4-1E394CA267EB}"
[HKEY_CLASSES_ROOT\CLSID\{30351347-7B7D-4FCC-81B4-1E394CA267EB}]
2008-02-16 12:35 536576 --a------ C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseSVN]
@="{30351348-7B7D-4FCC-81B4-1E394CA267EB}"
[HKEY_CLASSES_ROOT\CLSID\{30351348-7B7D-4FCC-81B4-1E394CA267EB}]
2008-02-16 12:35 536576 --a------ C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseSVN]
@="{3035134B-7B7D-4FCC-81B4-1E394CA267EB}"
[HKEY_CLASSES_ROOT\CLSID\{3035134B-7B7D-4FCC-81B4-1E394CA267EB}]
2008-02-16 12:35 536576 --a------ C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseSVN]
@="{3035134C-7B7D-4FCC-81B4-1E394CA267EB}"
[HKEY_CLASSES_ROOT\CLSID\{3035134C-7B7D-4FCC-81B4-1E394CA267EB}]
2008-02-16 12:35 536576 --a------ C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseSVN]
@="{3035134D-7B7D-4FCC-81B4-1E394CA267EB}"
[HKEY_CLASSES_ROOT\CLSID\{3035134D-7B7D-4FCC-81B4-1E394CA267EB}]
2008-02-16 12:35 536576 --a------ C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseSVN]
@="{3035134E-7B7D-4FCC-81B4-1E394CA267EB}"
[HKEY_CLASSES_ROOT\CLSID\{3035134E-7B7D-4FCC-81B4-1E394CA267EB}]
2008-02-16 12:35 536576 --a------ C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IECheck"="C:\WINDOWS\IECheck.exe" [2005-11-17 20:40 108544]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 06:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"FLMK08KB"="C:\Program Files\Muiltmedia keyboard utility\1.3\MMKEYBD.EXE" [2008-03-16 11:38 207360]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"BDAgent"="C:\Program Files\Softwin\BitDefender10\bdagent.exe" [2007-03-26 14:49 69632]
"a8ead28c"="C:\WINDOWS\system32\obnmlwbh.dll" [2008-08-05 22:31 83456]
"BMabd9e110"="C:\WINDOWS\system32\ntkgclwh.dll" [2008-08-05 22:31 91648]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"AllowLegacyWebView"= 1 (0x1)
"AllowUnhashedWebView"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.avis"= ff_acm.acm

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Uakos"="C:\Documents and Settings\Family\Application Data\F?nts\j?vaw.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NvMediaCenter"=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
"nwiz"=nwiz.exe /install
"Cmaudio"=RunDll32 cmicnfg.cpl,CMICtrlWnd

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\Mozilla Thunderbird\\thunderbird.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"3724:TCP"= 3724:TCP:Blizzard Downloader
"6112:TCP"= 6112:TCP:Blizzard Downloader

R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 17:24]
S3 CardReaderFilter;Card Reader Filter;C:\WINDOWS\system32\Drivers\USBCRFT.SYS [2008-03-13 14:10]
S3 UKBFLT;UKBFLT;C:\WINDOWS\system32\DRIVERS\UKBFLT.sys [2003-12-19 16:13]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2006-12-02 06:17]

*Newly Created Service* - GTNDIS5
.
Contents of the 'Scheduled Tasks' folder
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-05 23:32:56
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


C:\WINDOWS\system32\hbwlmnbo.ini 1487794 bytes

scan completed successfully
hidden files: 1

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\obnmlwbh.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\ehome\ehrecvr.exe
C:\WINDOWS\ehome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Program Files\Muiltmedia keyboard utility\1.3\KBDAP32A.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2008-08-05 23:40:16 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-06 05:40:08
ComboFix2.txt 2008-08-06 04:28:41
ComboFix3.txt 2008-07-29 17:22:24

Pre-Run: 247,513,014,272 bytes free
Post-Run: 247,493,632,000 bytes free

238









And here is the HiJackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:50:10 PM, on 08/05/08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\Muiltmedia keyboard utility\1.3\KbdAp32A.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Safari\Safari.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: {5ecf2780-c892-1be9-7334-763d12d65b62} - {26b56d21-d367-4337-9eb1-298c0872fce5} - C:\WINDOWS\system32\hooktu.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [FLMK08KB] C:\Program Files\Muiltmedia keyboard utility\1.3\MMKEYBD.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [a8ead28c] rundll32.exe "C:\WINDOWS\system32\obnmlwbh.dll",b
O4 - HKLM\..\Run: [BMabd9e110] Rundll32.exe "C:\WINDOWS\system32\ntkgclwh.dll",s
O4 - HKCU\..\Run: [IECheck] C:\WINDOWS\IECheck.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: Download All Files by HiDownload - C:\Program Files\HiDownload\HDGetAll.htm
O8 - Extra context menu item: Download by HiDownload - C:\Program Files\HiDownload\HDGet.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Flash Decompiler SWF Capture tool - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\Program Files\Eltima Software\Flash Decompiler Trillix\saveflash\iebt.dll (file missing)
O9 - Extra 'Tools' menuitem: Flash Decompiler SWF Capture tool menu - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\Program Files\Eltima Software\Flash Decompiler Trillix\saveflash\iebt.dll (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: HiDownload - {F4FBA929-A891-492C-A0F6-5C79CC4F1742} - C:\Program Files\HiDownload\hidownload.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.cicero.ca/
O16 - DPF: {2042B57E-6336-459E-B7CE-2A0F6C9E6AF8} (IEPlayInterface Class) - http://www.lotrdvd.com/dvdkey/extend...s/iaieplay.dll
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/micr...?1193323682406
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1193323659546
O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft Terminal Services Client Control (redist)) - http://engrwww.usask.ca/department/s...y/ts/msrdp.cab
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SQL Server Browser (SQLBrowser) - Unknown owner - c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe (file missing)
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

--
End of file - 6844 bytes
ElessarDunadan is offline