Tech Support Forum - View Single Post - Infections found following panda online active scan

slinkykatt · 02-23-2007, 12:08 AM

Hiya

I've done all that you have requested except remove C:\WINDOWS\DHU.exe as I cannot find it! The only thing

I can find relating to it is:

DHU.EXE-34C45808.pf located in C:\WINDOWS\Prefetch

I have left this alone

unless I get instructions from you to do othewise.

Things sem to be running fine, here are the scan results and logs you asked for:

Complete scanning result of "bytespersecond.dat", received in VirusTotal at 02.23.2007, 07:25:33 (CET).

Antivirus Version Update Result
AntiVir 7.3.1.38 02.22.2007 no virus found
Authentium 4.93.8 02.23.2007 no virus found
Avast 4.7.936.0 02.22.2007 no virus found
AVG 386 02.23.2007 no virus found
BitDefender 7.2 02.23.2007 no virus found
CAT-QuickHeal 9.00 02.22.2007 no virus found
ClamAV devel-20060426 02.22.2007 no virus found
DrWeb 4.33 02.23.2007 no virus found
eSafe 7.0.14.0 02.23.2007 no virus found
eTrust-Vet 30.4.3424 02.23.2007 no virus found
Ewido 4.0 02.22.2007 no virus found
FileAdvisor 1 02.23.2007 no virus found
Fortinet 2.85.0.0 02.23.2007 no virus found
F-Prot 4.3.1.45 02.22.2007 no virus found
F-Secure 6.70.13030.0 02.23.2007 no virus found
Ikarus T3.1.0.31 02.23.2007 no virus found
Kaspersky 4.0.2.24 02.23.2007 no virus found
McAfee 4969 02.22.2007 no virus found
Microsoft 1.2204 02.23.2007 no virus found
NOD32v2 2076 02.22.2007 no virus found
Norman 5.80.02 02.22.2007 no virus found
Panda 9.0.0.4 02.23.2007 no virus found
Prevx1 V2 02.23.2007 no virus found
Sophos 4.14.0 02.21.2007 no virus found
Sunbelt 2.2.907.0 02.22.2007 no virus found
Symantec 10 02.23.2007 no virus found
TheHacker 6.1.6.063 02.23.2007 no virus found
UNA 1.83 02.22.2007 no virus found
VBA32 3.11.2 02.22.2007 no virus found
VirusBuster 4.3.19:9 02.22.2007 no virus found

Aditional Information
File size: 4 bytes
MD5: 135072e1583bc9716ef759b1a67e5ac3
SHA1: 0cc1d4d9dbf8cfb1dee0798b1c028f81b7c5a4b2

Complete scanning result of "elmore_music_messenger.exe", received in VirusTotal at 02.23.2007, 07:32:01 (CET).

Antivirus Version Update Result
AntiVir 7.3.1.38 02.22.2007 no virus found
Authentium 4.93.8 02.23.2007 no virus found
Avast 4.7.936.0 02.22.2007 no virus found
AVG 386 02.23.2007 no virus found
BitDefender 7.2 02.23.2007 no virus found
CAT-QuickHeal 9.00 02.22.2007 no virus found
ClamAV devel-20060426 02.22.2007 no virus found
DrWeb 4.33 02.23.2007 no virus found
eSafe 7.0.14.0 02.23.2007 no virus found
eTrust-Vet 30.4.3424 02.23.2007 no virus found
Ewido 4.0 02.22.2007 no virus found
FileAdvisor 1 02.23.2007 no virus found
Fortinet 2.85.0.0 02.23.2007 no virus found
F-Prot 4.3.1.45 02.22.2007 no virus found
F-Secure 6.70.13030.0 02.23.2007 no virus found
Ikarus T3.1.0.31 02.23.2007 no virus found
Kaspersky 4.0.2.24 02.23.2007 no virus found
McAfee 4969 02.22.2007 no virus found
Microsoft 1.2204 02.23.2007 no virus found
NOD32v2 2076 02.22.2007 no virus found
Norman 5.80.02 02.22.2007 no virus found
Panda 9.0.0.4 02.23.2007 Suspicious file
Prevx1 V2 02.23.2007 no virus found
Sophos 4.14.0 02.21.2007 no virus found
Sunbelt 2.2.907.0 02.22.2007 no virus found
Symantec 10 02.23.2007 no virus found
TheHacker 6.1.6.063 02.23.2007 no virus found
UNA 1.83 02.22.2007 no virus found
VBA32 3.11.2 02.22.2007 no virus found
VirusBuster 4.3.19:9 02.22.2007 no virus found

Aditional Information
File size: 292658 bytes
MD5: 58b1f24d6cbbf21f77f867d17938d071
SHA1: 696b1df189a107f63b3b1750ceeadb08a6dfea27

Complete scanning result of "GDIPFONTCACHEV1.DAT", received in VirusTotal at 02.23.2007, 07:53:08 (CET).

Antivirus Version Update Result
AntiVir 7.3.1.38 02.22.2007 no virus found
Authentium 4.93.8 02.23.2007 no virus found
Avast 4.7.936.0 02.22.2007 no virus found
AVG 386 02.23.2007 no virus found
BitDefender 7.2 02.23.2007 no virus found
CAT-QuickHeal 9.00 02.22.2007 no virus found
ClamAV devel-20060426 02.22.2007 no virus found
DrWeb 4.33 02.23.2007 no virus found
eSafe 7.0.14.0 02.23.2007 no virus found
eTrust-Vet 30.4.3424 02.23.2007 no virus found
Ewido 4.0 02.22.2007 no virus found
FileAdvisor 1 02.23.2007 no virus found
Fortinet 2.85.0.0 02.23.2007 no virus found
F-Prot 4.3.1.45 02.22.2007 no virus found
F-Secure 6.70.13030.0 02.23.2007 no virus found
Ikarus T3.1.0.31 02.23.2007 no virus found
Kaspersky 4.0.2.24 02.23.2007 no virus found
McAfee 4969 02.22.2007 no virus found
Microsoft 1.2204 02.23.2007 no virus found
NOD32v2 2076 02.22.2007 no virus found
Norman 5.80.02 02.22.2007 no virus found
Panda 9.0.0.4 02.23.2007 no virus found
Prevx1 V2 02.23.2007 no virus found
Sophos 4.14.0 02.21.2007 no virus found
Sunbelt 2.2.907.0 02.22.2007 no virus found
Symantec 10 02.23.2007 no virus found
TheHacker 6.1.6.063 02.23.2007 no virus found
UNA 1.83 02.22.2007 no virus found
VBA32 3.11.2 02.22.2007 no virus found
VirusBuster 4.3.19:9 02.22.2007 no virus found

Aditional Information
File size: 90032 bytes
MD5: f8e87644e9c231e3c9364486c2236980
SHA1: 18b26b4988158ca94d82fc81aee0860c00886c80

Logfile of HijackThis v1.99.1
Scan saved at 07:00:30, on 23/02/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\acer\epm\epm-dm.exe
C:\Program Files\Acer\eRecovery\Monitor.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\ali\My Documents\applications\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by109fd.bay109.hotmail.msn.co...s/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary...o.cab53083.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://www.carbonspace.com/bin/msnchat45.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D7E32E7C-41A3-46D2-A442-565FFFFE4BE1}: NameServer = 4.2.2.1,4.2.2.2
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

02-23-2007, 12:08 AM	#6 (permalink)
slinkykatt Registered User Join Date: Feb 2007 Posts: 5 OS: XP home	Hiya I've done all that you have requested except remove C:\WINDOWS\DHU.exe as I cannot find it! The only thing I can find relating to it is: DHU.EXE-34C45808.pf located in C:\WINDOWS\Prefetch I have left this alone unless I get instructions from you to do othewise. Things sem to be running fine, here are the scan results and logs you asked for: Complete scanning result of "bytespersecond.dat", received in VirusTotal at 02.23.2007, 07:25:33 (CET). Antivirus Version Update Result AntiVir 7.3.1.38 02.22.2007 no virus found Authentium 4.93.8 02.23.2007 no virus found Avast 4.7.936.0 02.22.2007 no virus found AVG 386 02.23.2007 no virus found BitDefender 7.2 02.23.2007 no virus found CAT-QuickHeal 9.00 02.22.2007 no virus found ClamAV devel-20060426 02.22.2007 no virus found DrWeb 4.33 02.23.2007 no virus found eSafe 7.0.14.0 02.23.2007 no virus found eTrust-Vet 30.4.3424 02.23.2007 no virus found Ewido 4.0 02.22.2007 no virus found FileAdvisor 1 02.23.2007 no virus found Fortinet 2.85.0.0 02.23.2007 no virus found F-Prot 4.3.1.45 02.22.2007 no virus found F-Secure 6.70.13030.0 02.23.2007 no virus found Ikarus T3.1.0.31 02.23.2007 no virus found Kaspersky 4.0.2.24 02.23.2007 no virus found McAfee 4969 02.22.2007 no virus found Microsoft 1.2204 02.23.2007 no virus found NOD32v2 2076 02.22.2007 no virus found Norman 5.80.02 02.22.2007 no virus found Panda 9.0.0.4 02.23.2007 no virus found Prevx1 V2 02.23.2007 no virus found Sophos 4.14.0 02.21.2007 no virus found Sunbelt 2.2.907.0 02.22.2007 no virus found Symantec 10 02.23.2007 no virus found TheHacker 6.1.6.063 02.23.2007 no virus found UNA 1.83 02.22.2007 no virus found VBA32 3.11.2 02.22.2007 no virus found VirusBuster 4.3.19:9 02.22.2007 no virus found Aditional Information File size: 4 bytes MD5: 135072e1583bc9716ef759b1a67e5ac3 SHA1: 0cc1d4d9dbf8cfb1dee0798b1c028f81b7c5a4b2 Complete scanning result of "elmore_music_messenger.exe", received in VirusTotal at 02.23.2007, 07:32:01 (CET). Antivirus Version Update Result AntiVir 7.3.1.38 02.22.2007 no virus found Authentium 4.93.8 02.23.2007 no virus found Avast 4.7.936.0 02.22.2007 no virus found AVG 386 02.23.2007 no virus found BitDefender 7.2 02.23.2007 no virus found CAT-QuickHeal 9.00 02.22.2007 no virus found ClamAV devel-20060426 02.22.2007 no virus found DrWeb 4.33 02.23.2007 no virus found eSafe 7.0.14.0 02.23.2007 no virus found eTrust-Vet 30.4.3424 02.23.2007 no virus found Ewido 4.0 02.22.2007 no virus found FileAdvisor 1 02.23.2007 no virus found Fortinet 2.85.0.0 02.23.2007 no virus found F-Prot 4.3.1.45 02.22.2007 no virus found F-Secure 6.70.13030.0 02.23.2007 no virus found Ikarus T3.1.0.31 02.23.2007 no virus found Kaspersky 4.0.2.24 02.23.2007 no virus found McAfee 4969 02.22.2007 no virus found Microsoft 1.2204 02.23.2007 no virus found NOD32v2 2076 02.22.2007 no virus found Norman 5.80.02 02.22.2007 no virus found Panda 9.0.0.4 02.23.2007 Suspicious file Prevx1 V2 02.23.2007 no virus found Sophos 4.14.0 02.21.2007 no virus found Sunbelt 2.2.907.0 02.22.2007 no virus found Symantec 10 02.23.2007 no virus found TheHacker 6.1.6.063 02.23.2007 no virus found UNA 1.83 02.22.2007 no virus found VBA32 3.11.2 02.22.2007 no virus found VirusBuster 4.3.19:9 02.22.2007 no virus found Aditional Information File size: 292658 bytes MD5: 58b1f24d6cbbf21f77f867d17938d071 SHA1: 696b1df189a107f63b3b1750ceeadb08a6dfea27 Complete scanning result of "GDIPFONTCACHEV1.DAT", received in VirusTotal at 02.23.2007, 07:53:08 (CET). Antivirus Version Update Result AntiVir 7.3.1.38 02.22.2007 no virus found Authentium 4.93.8 02.23.2007 no virus found Avast 4.7.936.0 02.22.2007 no virus found AVG 386 02.23.2007 no virus found BitDefender 7.2 02.23.2007 no virus found CAT-QuickHeal 9.00 02.22.2007 no virus found ClamAV devel-20060426 02.22.2007 no virus found DrWeb 4.33 02.23.2007 no virus found eSafe 7.0.14.0 02.23.2007 no virus found eTrust-Vet 30.4.3424 02.23.2007 no virus found Ewido 4.0 02.22.2007 no virus found FileAdvisor 1 02.23.2007 no virus found Fortinet 2.85.0.0 02.23.2007 no virus found F-Prot 4.3.1.45 02.22.2007 no virus found F-Secure 6.70.13030.0 02.23.2007 no virus found Ikarus T3.1.0.31 02.23.2007 no virus found Kaspersky 4.0.2.24 02.23.2007 no virus found McAfee 4969 02.22.2007 no virus found Microsoft 1.2204 02.23.2007 no virus found NOD32v2 2076 02.22.2007 no virus found Norman 5.80.02 02.22.2007 no virus found Panda 9.0.0.4 02.23.2007 no virus found Prevx1 V2 02.23.2007 no virus found Sophos 4.14.0 02.21.2007 no virus found Sunbelt 2.2.907.0 02.22.2007 no virus found Symantec 10 02.23.2007 no virus found TheHacker 6.1.6.063 02.23.2007 no virus found UNA 1.83 02.22.2007 no virus found VBA32 3.11.2 02.22.2007 no virus found VirusBuster 4.3.19:9 02.22.2007 no virus found Aditional Information File size: 90032 bytes MD5: f8e87644e9c231e3c9364486c2236980 SHA1: 18b26b4988158ca94d82fc81aee0860c00886c80 Logfile of HijackThis v1.99.1 Scan saved at 07:00:30, on 23/02/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16414) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Acer\eManager\anbmServ.exe C:\WINDOWS\Explorer.EXE C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\acer\epm\epm-dm.exe C:\Program Files\Acer\eRecovery\Monitor.exe C:\Program Files\BroadJump\Client Foundation\CFD.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\notepad.exe C:\Documents and Settings\ali\My Documents\applications\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\eRecovery\Monitor.exe O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O15 - Trusted Zone: http://download.windowsupdate.com O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by109fd.bay109.hotmail.msn.co...s/MsnPUpld.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary...o.cab53083.cab O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://www.carbonspace.com/bin/msnchat45.cab O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab31267.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{D7E32E7C-41A3-46D2-A442-565FFFFE4BE1}: NameServer = 4.2.2.1,4.2.2.2 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe