Blade181,
Sorry for that, I was so desperate for a solution that when I saw someone with same problem I try to fix mine with same directions. Sorry.
Following are my KAS, Combofix and HJT log´s. Thank you.
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Thursday, October 30, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Wednesday, October 29, 2008 18:07:35
Records in database: 1356800
--------------------------------------------------------------------------------
Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes
Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
I:\
Scan statistics:
Files scanned: 65344
Threat name: 5
Infected objects: 10
Suspicious objects: 0
Duration of the scan: 01:56:03
File name / Threat name / Threats count
C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL/C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.az 1
C:\Documents and Settings\Administrator\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1
C:\Documents and Settings\Administrator\Desktop\SmitfraudFix.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1
C:\Program Files\AskTBar\bar\1.bin\A5POPSWT.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.az 1
C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.az 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\av.dat.vir Infected: Backdoor.Win32.UltimateDefender.gfi 1
E:\Downloads\Anti Virus\panda\Antigos\titan5shuk.exe Infected: Rootkit.Win32.Agent.ejs 1
E:\Downloads\Utilitários\akl.exe Infected: not-a-virus:Monitor.Win32.ActiveKeyLogger.24 1
E:\Downloads\Utilitários\SmitfraudFix.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1
E:\Downloads\Utilitários\SmitfraudFix.zip Infected: not-a-virus:RiskTool.Win32.Reboot.f 1
The selected area was scanned.
///////////////////////////////////////////////////////////////////////////////////////
ComboFix 08-10-29.07 - Antonio 2008-10-29 20:32:51.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.160 [GMT 0:00]
Running from: C:\Documents and Settings\Antonio\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Antonio\Desktop\CFScript.txt
* Created a new restore point
FILE ::
C:\WINDOWS\system32\abmxrted.dll
C:\WINDOWS\system32\av.dat
C:\WINDOWS\system32\ercpvwsj.dll
C:\WINDOWS\system32\irlkma.dll
C:\WINDOWS\system32\staipb.dll
C:\WINDOWS\system32\TDSSosvd.dat
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\av.dat
C:\WINDOWS\system32\TDSSosvd.dat
.
((((((((((((((((((((((((( Files Created from 2008-09-28 to 2008-10-29 )))))))))))))))))))))))))))))))
.
2008-10-28 22:29 . 2008-10-28 22:29 42 --a------ C:\WINDOWS\system32\RegistryEasy.lie
2008-10-28 22:28 . 2008-10-28 22:36 <DIR> d-------- C:\Program Files\Registry Easy
2008-10-28 21:28 . 2008-10-28 21:28 <DIR> d-------- C:\Program Files\Alwil Software
2008-10-28 20:46 . 2008-10-28 20:46 <DIR> d-------- C:\Documents and Settings\Antonio\Application Data\Uniblue
2008-10-27 22:18 . 2008-10-27 22:18 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-27 22:18 . 2008-10-27 22:18 <DIR> d-------- C:\Documents and Settings\Antonio\Application Data\Malwarebytes
2008-10-27 22:18 . 2008-10-27 22:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-27 22:18 . 2008-10-22 16:10 38,496 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-27 22:18 . 2008-10-22 16:10 15,504 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-26 15:48 . 2008-10-26 21:05 2,872 --a------ C:\WINDOWS\system32\tmp.reg
2008-10-26 15:47 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-10-26 15:47 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-10-26 15:47 . 2008-09-08 22:38 88,576 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe
2008-10-26 15:47 . 2008-10-01 14:51 87,552 --a------ C:\WINDOWS\system32\VACFix.exe
2008-10-26 15:47 . 2008-10-10 07:58 82,944 --a------ C:\WINDOWS\system32\o4Patch.exe
2008-10-26 15:47 . 2008-05-18 20:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-10-26 15:47 . 2008-10-10 07:58 82,944 --a------ C:\WINDOWS\system32\IEDFix.C.exe
2008-10-26 15:47 . 2008-08-18 11:19 82,432 --a------ C:\WINDOWS\system32\404Fix.exe
2008-10-26 15:47 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-10-26 15:47 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-10-26 15:47 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-10-26 15:27 . 2008-10-26 15:27 <DIR> d-------- C:\Program Files\Windows Live Safety Center
2008-10-26 11:41 . 2008-10-26 11:41 <DIR> d-------- C:\Program Files\Lavasoft
2008-10-26 11:19 . 2008-10-26 11:19 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-10-25 22:12 . 2008-10-25 22:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-10-25 21:58 . 2008-10-25 21:58 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Lavasoft
2008-10-25 21:54 . 2008-10-26 11:20 <DIR> d-------- C:\Documents and Settings\Antonio\Application Data\Lavasoft
2008-10-25 21:44 . 2008-10-28 21:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-10-25 20:22 . 2008-10-25 20:22 <DIR> d-------- C:\WINDOWS\McAfee.com
2008-10-25 20:01 . 2008-10-25 20:01 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy
2008-10-25 18:50 . 2008-10-25 18:50 <DIR> d-------- C:\Program Files\Webroot
2008-10-25 18:50 . 2008-10-25 18:50 <DIR> d-------- C:\Documents and Settings\Antonio\Application Data\Webroot
2008-10-25 18:50 . 2008-10-25 18:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Webroot
2008-10-25 18:50 . 2008-10-12 12:18 1,553,272 --a------ C:\WINDOWS\WRSetup.dll
2008-10-25 18:43 . 2008-10-25 19:12 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2008-10-25 18:42 . 2008-10-25 19:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Norton
2008-10-25 18:37 . 2008-10-25 19:08 164 --a------ C:\install.dat
2008-10-25 18:35 . 2008-10-25 18:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\NortonInstaller
2008-10-25 17:53 . 2008-10-28 21:24 <DIR> d-------- C:\Documents and Settings\Administrator
2008-10-12 11:47 . 2008-10-12 11:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
2008-10-12 11:46 . 2008-10-12 11:46 <DIR> d-------- C:\Program Files\NCH Swift Sound
2008-10-02 03:15 . 2008-10-02 03:15 170,608 --a------ C:\WINDOWS\system32\drivers\ssidrv.sys
2008-10-02 03:15 . 2008-10-02 03:15 29,808 --a------ C:\WINDOWS\system32\drivers\ssfs0bbc.sys
2008-10-02 03:15 . 2008-10-02 03:15 23,152 --a------ C:\WINDOWS\system32\drivers\sshrmd.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-27 22:13 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-10-27 22:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-25 18:41 347,136 ----a-w C:\Documents and Settings\Antonio\legion.dll
2008-10-24 20:41 347,136 ----a-w C:\Documents and Settings\Teresa\legion.dll
2008-09-21 14:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\22a1f82
2008-09-21 11:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\377494c
2008-09-21 11:18 --------- d-----w C:\Program Files\Java
2008-09-19 00:06 --------- d-----w C:\Program Files\Common Files\Java
2007-11-18 18:31 32,768 -csha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012007111820071119\index.dat
.
((((((((((((((((((((((((((((( snapshot@2008-10-28_ 0.04.14.48 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-07-19 15:43:08 1,163,960 ----a-w C:\WINDOWS\system32\aswBoot.exe
+ 2008-07-19 15:30:53 94,392 ----a-w C:\WINDOWS\system32\AvastSS.scr
+ 2008-07-19 15:32:15 26,944 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
+ 2008-07-19 15:37:42 20,560 ----a-w C:\WINDOWS\system32\drivers\aswFsBlk.sys
+ 2008-01-17 17:34:01 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
+ 2008-07-19 15:37:21 94,416 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
+ 2008-07-19 15:33:42 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
+ 2008-07-19 15:35:18 78,416 ----a-w C:\WINDOWS\system32\drivers\aswSP.sys
+ 2008-07-19 15:32:36 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
+ 2003-03-18 21:20:00 1,060,864 ----a-w C:\WINDOWS\system32\MFC71.dll
+ 2003-03-18 20:14:52 499,712 ----a-w C:\WINDOWS\system32\MSVCP71.dll
+ 2003-02-21 04:42:22 348,160 ----a-w C:\WINDOWS\system32\MSVCR71.dll
+ 2008-10-29 20:19:20 16,384 ----atw C:\WINDOWS\temp\Perflib_Perfdata_6b8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\BackupIconOverlayId]
@="{2EE61E5C-8F94-4AAB-8A80-D2A8CD1FEDAD}"
[HKEY_CLASSES_ROOT\CLSID\{2EE61E5C-8F94-4AAB-8A80-D2A8CD1FEDAD}]
2008-10-12 12:11 238968 --a------ C:\Program Files\Webroot\WebrootSecurity\Backup\CtxMenu_1_0_0_9.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 15360]
"Google Update"="C:\Documents and Settings\Antonio\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-04 133104]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-02 13529088]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 81920]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"CloneCDElbyCDFL"="C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" [2002-11-02 45056]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-02 86016]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
"Mouse Suite 98 Daemon"="ICO.EXE" [2001-08-23 C:\WINDOWS\system32\ico.exe]
"nwiz"="nwiz.exe" [2008-05-02 C:\WINDOWS\system32\nwiz.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]
C:\Documents and Settings\Teresa\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"= ctwdm32.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\EA GAMES\\MOHAA\\MOHAA.exe"=
"C:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"=
"C:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 2009\\english\\setup.exe"=
"C:\\Program Files\\Steam\\steamapps\\toocoolgarcia\\half-life 2 deathmatch\\hl2.exe"=
"E:\\gAMES\\cs16\\hl.exe"=
R0 ElbyVCD;ElbyVCD;C:\WINDOWS\system32\DRIVERS\ElbyVCD.sys [2002-11-28 22016]
R0 ssfs0bbc;ssfs0bbc;C:\WINDOWS\system32\DRIVERS\ssfs0bbc.sys [2008-10-02 29808]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 WRConsumerService;Webroot Client Service;C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe [2008-10-12 1066360]
R3 DLKRTS;D-Link DFE-538TX 10/100 Adapter;C:\WINDOWS\system32\DRIVERS\DLKRTS.SYS [2002-06-24 45568]
R3 pelmouse;Mouse Suite Driver;C:\WINDOWS\system32\DRIVERS\pelmouse.sys [2003-01-10 16384]
R3 pelusblf;USB Mouse Low Filter Driver;C:\WINDOWS\system32\DRIVERS\pelusblf.sys [2003-01-28 9216]
.
Contents of the 'Scheduled Tasks' folder
2008-10-29 C:\WINDOWS\Tasks\GoogleUpdateTaskUser.job
- C:\Documents and Settings\Antonio\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-04 00:25]
2008-10-28 C:\WINDOWS\Tasks\Schedule Task Weekly.job
- C:\Program Files\Registry Easy\RE.exe [2008-10-28 22:32]
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-Uniblue RegistryBooster 2009 - C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-10-29 20:35:12
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-10-29 20:37:33
ComboFix-quarantined-files.txt 2008-10-29 20:37:12
ComboFix2.txt 2008-10-28 00:05:24
Pre-Run: 4.186.402.816 bytes free
Post-Run: 4,212,789,248 bytes free
174
////////////////////////////////////////////////////////////////////////////////////
Logfile of HijackThis v1.99.1
Scan saved at 0:37:30, on 30-10-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20815)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\ICO.EXE
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Documents and Settings\Antonio\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\Pelmiced.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
http://www.sapo.pt/
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\RunOnce: [Uninstall getPlus(R) for Adobe] "C:\Program Files\NOS\bin\getPlus_HelperSvc.exe" /UninstallGet1noarp
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Antonio\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O11 - Options group: [TABS] Tabbed Browsing
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) -
http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5036.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) -
http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -
http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5415/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{638AE9D4-0E69-491B-8B9F-BD78B583127B}: NameServer = 212.55.154.174
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (
www.webroot.com) - C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe
