Oidentifirerat program.

9 Maj, 2007

Hej

Jag har läst om problemen angående windows brandväggen som har ett oidentifierat program.

Själv stöt på det problemet på min dator, men det verkar inte likna dom andras problem, för att jag kommer åt brandväggs inställningarna efter ett par minuter och internet och nätverket fungerar bra.

Så att jag får då allså samma meddelanden som alla andra.

Skickar med en log i från Hijack this:

[log]

Logfile of Trend Micro HijackThis v2.0.0 (BETA)

Scan saved at 20:20:03, on 2007-05-09

Platform: Windows XP SP2 (WinNT 5.01.2600)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program\Alwil Software\Avast4\aswUpdSv.exe

C:\WINDOWS\Explorer.EXE

C:\Program\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program\Synaptics\SynTP\SynTPLpr.exe

C:\Program\Synaptics\SynTP\SynTPEnh.exe

C:\acer\epm\epm-dm.exe

C:\Acer\eManager\anbmServ.exe

C:\Program Files\Arcade\PCMService.exe

C:\Program\Launch Manager\LaunchAp.exe

C:\Program\Launch Manager\PowerKey.exe

C:\Program\Launch Manager\HotkeyApp.exe

C:\Program\Launch Manager\OSDCtrl.exe

C:\Program\Launch Manager\Wbutton.exe

C:\Acer\Empowering Technology\eRecovery\Monitor.exe

C:\Program\Multimedia Card Reader\shwicon2k.exe

C:\Program\ALWILS~1\Avast4\ashDisp.exe

C:\Program\DAEMON Tools\daemon.exe

C:\Program\MMEDIA\TV Jukebox 3.0\tvjbMonitor.exe

C:\Program\Java\jre1.5.0_11\bin\jusched.exe

C:\Program\QuickTime\qttask.exe

C:\Program\iTunes\iTunesHelper.exe

C:\Program\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program\Bonjour\mDNSResponder.exe

C:\Program\MSN Messenger\msnmsgr.exe

C:\WINDOWS\System32\svchost.exe

C:\Program\Windows Media Player\WMPNSCFG.exe

C:\WINDOWS\system32\svchost.exe

C:\Program\Delade filer\Teleca Shared\CapabilityManager.exe

C:\Program\Kodak\Kodak EasyShare software\bin\EasyShare.exe

C:\Program\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe

C:\Program\Delade filer\Teleca Shared\Generic.exe

C:\Program\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe

C:\Program\Alwil Software\Avast4\ashMaiSv.exe

C:\Program\Alwil Software\Avast4\ashWebSv.exe

C:\Program\iPod\bin\iPodService.exe

C:\Program\Huawei technologies\Huawei UMTS Data Card\HUAWEI 3G Data Card.exe

C:\Program\BitTorrent\bittorrent.exe

C:\Program\Alwil Software\Avast4\ashSimpl.exe

C:\Documents and Settings\Stoffe\Skrivbord\Nedladdat\HiJackThis_v2.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157'>http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896'>http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.5.0_11\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [preload] C:\Windows\RUNXMLPL.exe

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [synTPLpr] C:\Program\Synaptics\SynTP\SynTPLpr.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe

O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"

O4 - HKLM\..\Run: [LaunchAp] "C:\Program\Launch Manager\LaunchAp.exe"

O4 - HKLM\..\Run: [PowerKey] "C:\Program\Launch Manager\PowerKey.exe"

O4 - HKLM\..\Run: [LManager] "C:\Program\Launch Manager\HotkeyApp.exe"

O4 - HKLM\..\Run: [CtrlVol] "C:\Program\Launch Manager\CtrlVol.exe"

O4 - HKLM\..\Run: [LMgrOSD] "C:\Program\Launch Manager\OSDCtrl.exe"

O4 - HKLM\..\Run: [Wbutton] "C:\Program\Launch Manager\Wbutton.exe"

O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe

O4 - HKLM\..\Run: [sunkist2k] C:\Program\Multimedia Card Reader\shwicon2k.exe

O4 - HKLM\..\Run: [avast!] C:\Program\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [tvjbmonitor] C:\Program\MMEDIA\TV Jukebox 3.0\tvjbMonitor.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program\Java\jre1.5.0_11\bin\jusched.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [sony Ericsson PC Suite] "C:\Program\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program\Windows Media Player\WMPNSCFG.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJÄNST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Adobe Gamma.lnk = C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program\Kodak\Kodak EasyShare software\bin\EasyShare.exe

O4 - Global Startup: KODAK Software Updater.lnk = C:\Program\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe

O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNxpt135YYSE

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program\Bonjour\ExplorerPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Keep my net clean.org - {F12F48EE-7575-4a05-8957-E207557670C8} - C:\Program\Keep my Net Clean.org\kmnc.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by24fd.bay24.hotmail.msn.com/activex/HMAtchmt.ocx

O17 - HKLM\System\CCS\Services\Tcpip\..\{F2D63002-767F-4DDB-A13A-E80689133A38}: NameServer = 10.0.0.1 10.0.0.2

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program\Delade filer\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Bonjour-tjänst (Bonjour Service) - Apple Computer, Inc. - C:\Program\Bonjour\mDNSResponder.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program\iPod\bin\iPodService.exe

O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program\Delade filer\Macromedia Shared\Service\Macromedia Licensing.exe

--

End of file - 9909 bytes

[/log]

Tacksam för svar.

10 Maj, 2007

Det är viktigt att programmet HiJackThis_v2 ligger i sin egen mapp så att dess säkerhetskopior inte kommer bort. Skapa en ny mapp, t ex C:\HjT, och flytta programfilen HiJackThis_v2.exe dit från Skrivbord\Nedladdat.

Skanna med HijackThis och bocka för:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNxpt135YYSE

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/Smiley

CentralFWBInitialSetup1.0.0.15.cab

Avsluta alla andra program.

Tryck Fix checked.

Starta om datorn och kontrollera själv att ovanstående rader är borta ur en ny HijackThis-logg.

Hjälpte det mot ditt problem? Om inte så förklara bättre för jag förstod inte mycket.

14 Maj, 2007

Jag har gjort som du har skrivit, och dom objekten som du har skrivit här nu borta.

Ja det kanske blev lite hastig och lustigt. Så vi ska se om detta blir lite bättre.

Det är så att jag har kollat några forum angående de här, men som ja sa tidigare så verkar det inte stämma in på det jag har ett ex på detta forum är: //eforum.idg.se/viewmsg.asp?EntriesId=878058#878260.

Och det meddelande jag får av windows är att brandväggen är inte aktiv, men det sker endast under ett par sekunder eller en minut högst, detta sker i starten av datorn.

Är det mer information ni vill ha för att försöka lösa detta så säg gärna till.

14 Maj, 2007

Vad är det för Startmetod för tjänsten Windows Firewall/Internet Connection Sharing (ICS)?

Kommer det något fel i Loggboken i samtidigt som felmeddelandet om brandväggen kommer?

Installera ett bra antispionprogram http://www.superantispyware.com/

Skanna datorn online på dessa ställen:

http://www.ewido.net/en/onlinescan/ (antispionprogram)

http://www.kaspersky.com/virusscanner (antivirusprogram)

Spara loggar och klistra in i ditt svar.

Ladda ner ComboFix:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Kör den och följ anvisningarna som visas.

VIKTIGT! Klicka inte på Combofix-fönstret med musen när den körs annars kan den hänga upp sig.

När den är färdig så ska en logg komma upp, klistra in den här, samt en ny HijackThis-logg. Hur länge har du haft detta problem med brandväggen?

16 Maj, 2007

Ja nu ska vi se... De här me ICS där är startmetoden automatisk.

Och hur länge jag har haft prolemet är lite svårt och säga men lite över en månad i alla fall, jag orkade inte göra nåt då, men nu är det bara irriterande.

Här kommer loggarna från dom olika programmen:

[log]

"Stoffe" - 2007-05-15 20:45:06 Service Pack 2

ComboFix 07-05.13.V - Running from: "C:\Program\Mozilla Firefox\"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\autorun.inf

((((((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

-------\nm

((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-15 ))))))))))))))))))))))))))))))))))

2007-05-10 21:56 <KAT> d-------- C:\Hijack this

2007-05-08 21:55 <KAT> d-------- C:\Program\Microsoft Windows Vista Upgrade Advisor

2007-05-08 20:49 <KAT> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Corporation

2007-04-29 22:25 <KAT> d-------- C:\Program\ReflexiveArcade

2007-04-29 22:25 <KAT> d-------- C:\Program\Gutterball 2

2007-04-28 13:01 <KAT> d-------- C:\Program\18 WoS Pedal to the Metal

2007-04-24 23:04 <KAT> d-------- C:\Program\Keep my Net Clean.org

2007-04-21 15:18 <KAT> d-------- C:\Program\mIRC

2007-04-19 22:23 <KAT> d-a------ C:\aircrack-ng-0.6.2-win

2007-04-15 20:23 23,600 --a------ C:\WINDOWS\system32\drivers\TVICHW32.SYS

2007-04-15 12:53 90,800 -ra------ C:\WINDOWS\system32\drivers\se2Eunic.sys

2007-04-15 12:53 4,128 -ra------ C:\WINDOWS\system32\drivers\se2Ecr.sys

2007-04-15 12:52 88,688 -ra------ C:\WINDOWS\system32\drivers\SE2Emgmt.sys

2007-04-15 12:51 86,560 -ra------ C:\WINDOWS\system32\drivers\SE2Eobex.sys

2007-04-15 12:49 97,184 -ra------ C:\WINDOWS\system32\drivers\SE2Emdm.sys

2007-04-15 12:49 9,360 -ra------ C:\WINDOWS\system32\drivers\SE2Emdfl.sys

2007-04-15 12:49 6,240 -ra------ C:\WINDOWS\system32\drivers\SE2Ecmnt.sys

2007-04-15 12:49 6,240 -ra------ C:\WINDOWS\system32\drivers\SE2Ecm.sys

2007-04-15 12:48 61,600 -ra------ C:\WINDOWS\system32\drivers\SE2Ebus.sys

2007-04-15 12:48 5,872 -ra------ C:\WINDOWS\system32\drivers\SE2Ewhnt.sys

2007-04-15 12:48 5,872 -ra------ C:\WINDOWS\system32\drivers\se2Ewh.sys

2007-04-15 12:42 <KAT> d-------- C:\DOCUME~1\ALLUSE~1\Documents

2007-04-15 12:41 <KAT> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Teleca

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-04-30 15:46:10 745,600 ----a-w C:\WINDOWS\system32\aswBoot.exe

2007-04-30 15:41:55 85,952 -c--a-w C:\WINDOWS\system32\drivers\aswmon.sys

2007-04-30 15:41:42 94,552 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys

2007-04-30 15:39:41 23,416 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys

2007-04-30 15:38:51 43,176 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys

2007-04-30 15:37:23 26,888 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys

2007-04-30 15:35:28 95,872 ----a-w C:\WINDOWS\system32\AVASTSS.scr

2007-04-26 20:13:20 85,724 ----a-w C:\WINDOWS\system32\perfc01D.dat

2007-04-26 20:13:20 465,842 ----a-w C:\WINDOWS\system32\perfh01D.dat

2007-04-25 01:03:41 -------- d-----w C:\DOCUME~1\Stoffe\APPLIC~1\BitTorrent

2007-04-15 18:22:58 5,099 ----a-w C:\WINDOWS\mozver.dat

2007-04-15 10:42:33 -------- d-----w C:\Program\Delade filer\Teleca Shared

2007-04-15 10:41:56 -------- d-----w C:\Program\Sony Ericsson

2007-04-01 12:15:32 -------- d-----w C:\DOCUME~1\Stoffe\APPLIC~1\SecondLife

2007-03-29 20:41:54 -------- d-----w C:\Program\Ashampoo

2007-03-24 18:10:21 -------- d-----w C:\DOCUME~1\Stoffe\APPLIC~1\Sierra

2007-03-24 17:48:17 -------- d--h--w C:\Program\InstallShield Installation Information

2007-03-24 12:19:49 18,275 ----a-w C:\WINDOWS\War3Unin.dat

2007-03-24 12:19:46 2,829 ----a-w C:\WINDOWS\War3Unin.pif

2007-03-24 12:19:45 126,976 ----a-w C:\WINDOWS\War3Unin.exe

2007-03-21 21:52:00 -------- d-----w C:\Program\iTunes

2007-03-21 21:51:47 -------- d-----w C:\Program\iPod

2007-03-21 21:50:11 -------- d-----w C:\Program\QuickTime

2007-03-21 21:48:32 -------- d-----w C:\Program\Apple Software Update

2007-03-18 14:46:25 -------- d-----w C:\Program\Bonjour

2007-03-18 14:45:41 -------- d-----w C:\Program\Kodak

2007-03-18 14:44:22 -------- d-----w C:\Program\Delade filer\Kodak

2007-03-17 13:45:59 292,864 ----a-w C:\WINDOWS\system32\winsrv.dll

2007-03-13 19:20:50 -------- d-----w C:\Program\BitTorrent

2007-03-10 16:46:21 -------- d-----w C:\Program\Windows Media Connect 2

2007-03-08 20:25:40 -------- d-----w C:\DOCUME~1\Stoffe\APPLIC~1\AVSMedia

2007-03-08 20:25:25 -------- d-----w C:\Program\Delade filer\AVSMedia

2007-03-08 20:23:41 -------- d-----w C:\Program\AVSMedia

2007-03-08 15:39:13 577,536 ----a-w C:\WINDOWS\system32\user32.dll

2007-03-08 15:39:13 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll

2007-03-08 15:39:13 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll

2007-03-08 15:38:05 1,843,584 ----a-w C:\WINDOWS\system32\win32k.sys

2007-02-05 20:20:15 185,344 ----a-w C:\WINDOWS\system32\upnphost.dll

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program\Java\jre1.5.0_11\bin\ssv.dll [2006-12-15 04:23]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]

"preload"="C:\\Windows\\RUNXMLPL.exe"

"IgfxTray"="C:\\WINDOWS\\system32\\igfxtray.exe"

"HotKeysCmds"="C:\\WINDOWS\\system32\\hkcmd.exe"

"SoundMan"="SOUNDMAN.EXE"

"SynTPLpr"="C:\\Program\\Synaptics\\SynTP\\SynTPLpr.exe"

"SynTPEnh"="C:\\Program\\Synaptics\\SynTP\\SynTPEnh.exe"

"EPM-DM"="c:\\acer\\epm\\epm-dm.exe"

"ePowerManagement"="C:\\Acer\\ePM\\ePM.exe boot"

"IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32"

"MSPY2002"="C:\\WINDOWS\\system32\\IME\\PINTLGNT\\ImScInst.exe /SYNC"

"PHIME2002ASync"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC"

"PHIME2002A"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName"

"PCMService"="\"C:\\Program Files\\Arcade\\PCMService.exe\""

"LaunchAp"="\"C:\\Program\\Launch Manager\\LaunchAp.exe\""

"PowerKey"="\"C:\\Program\\Launch Manager\\PowerKey.exe\""

"LManager"="\"C:\\Program\\Launch Manager\\HotkeyApp.exe\""

"CtrlVol"="\"C:\\Program\\Launch Manager\\CtrlVol.exe\""

"LMgrOSD"="\"C:\\Program\\Launch Manager\\OSDCtrl.exe\""

"Wbutton"="\"C:\\Program\\Launch Manager\\Wbutton.exe\""

"eRecoveryService"="C:\\Acer\\Empowering Technology\\eRecovery\\Monitor.exe"

"Sunkist2k"="C:\\Program\\Multimedia Card Reader\\shwicon2k.exe"

"avast!"="C:\\Program\\ALWILS~1\\Avast4\\ashDisp.exe"

"NeroCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"

"DAEMON Tools"="\"C:\\Program\\DAEMON Tools\\daemon.exe\" -lang 1033"

"tvjbmonitor"="C:\\Program\\MMEDIA\\TV Jukebox 3.0\\tvjbMonitor.exe"

"SunJavaUpdateSched"="C:\\Program\\Java\\jre1.5.0_11\\bin\\jusched.exe"

"QuickTime Task"="\"C:\\Program\\QuickTime\\qttask.exe\" -atboottime"

"iTunesHelper"="\"C:\\Program\\iTunes\\iTunesHelper.exe\""

"Sony Ericsson PC Suite"="\"C:\\Program\\Sony Ericsson\\Mobile2\\Application Launcher\\Application Launcher.exe\" /startoptions"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"preload"="C:\Windows\RUNXMLPL.exe" [2005-05-19 18:09]

"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-01-23 11:36]

"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-01-23 11:31]

"SoundMan"="SOUNDMAN.EXE" [])

"SynTPLpr"="C:\Program\Synaptics\SynTP\SynTPLpr.exe" [2005-02-04 12:12]

"SynTPEnh"="C:\Program\Synaptics\SynTP\SynTPEnh.exe" [2005-02-04 12:11]

"EPM-DM"="c:\acer\epm\epm-dm.exe" [2005-10-26 17:18]

"ePowerManagement"="C:\Acer\ePM\ePM.exe" [2005-10-26 17:11]

"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 06:00]

"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 06:00]

"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 06:00]

"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 06:00]

"PCMService"="C:\Program Files\Arcade\PCMService.exe" [2005-03-09 19:59]

"LaunchAp"="C:\Program\Launch Manager\LaunchAp.exe" [2005-07-25 14:36]

"PowerKey"="C:\Program\Launch Manager\PowerKey.exe" [2002-08-30 16:02]

"LManager"="C:\Program\Launch Manager\HotkeyApp.exe" [2005-06-06 12:52]

"CtrlVol"="C:\Program\Launch Manager\CtrlVol.exe" [2003-09-16 15:28]

"LMgrOSD"="C:\Program\Launch Manager\OSDCtrl.exe" [2005-07-25 11:45]

"Wbutton"="C:\Program\Launch Manager\Wbutton.exe" [2005-07-25 14:34]

"eRecoveryService"="C:\Acer\Empowering Technology\eRecovery\Monitor.exe" [2005-10-31 20:05]

"Sunkist2k"="C:\Program\Multimedia Card Reader\shwicon2k.exe" [2004-09-03 18:16]

"avast!"="C:\Program\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 17:42]

"NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2003-07-13 03:49]

"DAEMON Tools"="C:\Program\DAEMON Tools\daemon.exe" [2006-09-14 22:09]

"tvjbmonitor"="C:\Program\MMEDIA\TV Jukebox 3.0\tvjbMonitor.exe" [2006-08-08 11:54]

"SunJavaUpdateSched"="C:\Program\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 04:23]

"QuickTime Task"="C:\Program\QuickTime\qttask.exe" [2007-02-16 11:54]

"iTunesHelper"="C:\Program\iTunes\iTunesHelper.exe" [2007-03-14 20:05]

"Sony Ericsson PC Suite"="C:\Program\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 17:17]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00]

"WMPNSCFG"="C:\Program\Windows Media Player\WMPNSCFG.exe" [2006-11-15 11:49]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]

"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"

"WMPNSCFG"="C:\\Program\\Windows Media Player\\WMPNSCFG.exe"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa

Authentication Packages msv1_0\0\0

Security Packages kerberos\0msv1_0\0schannel\0wdigest\0\0

Notification Packages scecli\0\0

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\c:^documents and settings^all users^start-meny^program^autostart^kodak easyshare software.lnk

C:\Program\Kodak\KODAKE~1\bin\EASYSH~1.EXE -hx

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr

"C:\Program\MSN Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost]

HTTPFilter HTTPFilter\0\0

LocalService Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0

NetworkService DnsCache\0\0

DcomLaunch DcomLaunch\0TermService\0\0

rpcss RpcSs\0\0

imgsvc StiSvc\0\0

termsvcs TermService\0\0

WudfServiceGroup WUDFSvc\0\0

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F]

Shell\AutoRun\command F:\launcher.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G]

Shell\AutoRun\command G:\autorun.exe

~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

backup-20070510-220555-249

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.cab

backup-20070510-220555-958

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

backup-20070510-220555-469

O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNxpt135YYSE

Contents of the 'Scheduled Tasks' folder

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net

Rootkit scan 2007-05-15 20:51:40

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden processes: 0

hidden services: 0

hidden files: 0

********************************************************************

Completion time: 2007-05-15 20:53:15 - machine was rebooted

C:\ComboFix-quarantined-files.txt ... 2007-05-15 20:53

[/log]

[log]

SUPERAntiSpyware Scan Log

http://www.superantispyware.com

Generated 05/15/2007 at 09:54 PM

Application Version : 3.7.1018

Core Rules Database Version : 3238

Trace Rules Database Version: 1249

Scan type : Quick Scan

Total Scan Time : 00:27:56

Memory items scanned : 604

Memory threats detected : 0

Registry items scanned : 1187

Registry threats detected : 40

File items scanned : 20736

File threats detected : 3

Unclassified.Oreans32

HKLM\System\ControlSet001\Services\oreans32

C:\WINDOWS\SYSTEM32\DRIVERS\OREANS32.SYS

HKLM\System\ControlSet002\Services\oreans32

HKLM\System\CurrentControlSet\Services\oreans32

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32#NextInstance

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#Service

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#Legacy

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#ConfigFlags

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#Class

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#ClassGUID

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#DeviceDesc

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#Capabilities

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#Driver

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000\LogConf

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000\Control

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000\Control#ActiveService

HKLM\SYSTEM\CurrentControlSet\Services\oreans32#Type

HKLM\SYSTEM\CurrentControlSet\Services\oreans32#Start

HKLM\SYSTEM\CurrentControlSet\Services\oreans32#ErrorControl

HKLM\SYSTEM\CurrentControlSet\Services\oreans32#ImagePath

HKLM\SYSTEM\CurrentControlSet\Services\oreans32#DisplayName

HKLM\SYSTEM\CurrentControlSet\Services\oreans32\Security

HKLM\SYSTEM\CurrentControlSet\Services\oreans32\Security#Security

HKLM\SYSTEM\CurrentControlSet\Services\oreans32\Enum

HKLM\SYSTEM\CurrentControlSet\Services\oreans32\Enum#0

HKLM\SYSTEM\CurrentControlSet\Services\oreans32\Enum#Count

HKLM\SYSTEM\CurrentControlSet\Services\oreans32\Enum#NextInstance

Adware.Tracking Cookie

C:\Documents and Settings\Stoffe\Cookies\stoffe@imrworldwide[1].txt

C:\Documents and Settings\Stoffe\Cookies\stoffe@atdmt[2].txt

Trojan.IEObject/Win

HKCR\CLSID\{CA13D72F-2DAC-4D99-B08D-C5EA1C920E89}

HKCR\CLSID\{CA13D72F-2DAC-4D99-B08D-C5EA1C920E89}#AppID

HKCR\CLSID\{CA13D72F-2DAC-4D99-B08D-C5EA1C920E89}\Control

HKCR\CLSID\{CA13D72F-2DAC-4D99-B08D-C5EA1C920E89}\InprocServer32

HKCR\CLSID\{CA13D72F-2DAC-4D99-B08D-C5EA1C920E89}\InprocServer32#ThreadingModel

HKCR\CLSID\{CA13D72F-2DAC-4D99-B08D-C5EA1C920E89}\MiscStatus

HKCR\CLSID\{CA13D72F-2DAC-4D99-B08D-C5EA1C920E89}\MiscStatus\1

HKCR\CLSID\{CA13D72F-2DAC-4D99-B08D-C5EA1C920E89}\ProgID

HKCR\CLSID\{CA13D72F-2DAC-4D99-B08D-C5EA1C920E89}\ToolboxBitmap32

HKCR\CLSID\{CA13D72F-2DAC-4D99-B08D-C5EA1C920E89}\TypeLib

HKCR\CLSID\{CA13D72F-2DAC-4D99-B08D-C5EA1C920E89}\Version

HKCR\CLSID\{CA13D72F-2DAC-4D99-B08D-C5EA1C920E89}\VersionIndependentProgID

[/log]

[log]

-------------------------------------------------------------------------------

KASPERSKY ONLINE SCANNER REPORT

Wednesday, May 16, 2007 6:12:21 AM

Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)

Kaspersky Online Scanner version: 5.0.83.0

Kaspersky Anti-Virus database last update: 15/05/2007

Kaspersky Anti-Virus database records: 301408

-------------------------------------------------------------------------------

Scan Settings:

Scan using the following antivirus database: standard

Scan Archives: true

Scan Mail Bases: true

Scan Target - Folders:

C: D:

Scan Statistics:

Total number of scanned objects: 97627

Number of viruses found: 1

Number of infected objects: 4 / 0

Number of suspicious objects: 0

Duration of the scan process: 01:53:46

Infected Object Name / Virus Name / Last Action

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

C:\Documents and Settings\All Users\DRM\drmstore.hds Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Lokala inställningar\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Lokala inställningar\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Lokala inställningar\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Lokala inställningar\Tidigare\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Lokala inställningar\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Lokala inställningar\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\Stoffe\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\crtdcghcn.jar-768b7f6-1779db3e.zip/BaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped

C:\Documents and Settings\Stoffe\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\crtdcghcn.jar-768b7f6-1779db3e.zip/VaaaaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped

C:\Documents and Settings\Stoffe\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\crtdcghcn.jar-768b7f6-1779db3e.zip/Baaaaa.class Infected: Trojan.Java.ClassLoader.ao skipped

C:\Documents and Settings\Stoffe\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\crtdcghcn.jar-768b7f6-1779db3e.zip ZIP: infected - 3 skipped

C:\Documents and Settings\Stoffe\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SUPERANTISPYWARE.LOG Object is locked skipped

C:\Documents and Settings\Stoffe\Application Data\Teleca\Telecalib\Logging\Application logs\SpecificUSB_log.txt Object is locked skipped

C:\Documents and Settings\Stoffe\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\Stoffe\Lokala inställningar\Application Data\Microsoft\Media Player\CurrentDatabase_360.wmdb Object is locked skipped

C:\Documents and Settings\Stoffe\Lokala inställningar\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\Stoffe\Lokala inställningar\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\Stoffe\Lokala inställningar\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Stoffe\Lokala inställningar\Tidigare\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Stoffe\ntuser.dat Object is locked skipped

C:\Documents and Settings\Stoffe\ntuser.dat.LOG Object is locked skipped

C:\Program\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped

C:\Program\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped

C:\Program\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped

C:\Program\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped

C:\Program\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped

C:\Program\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped

C:\Program\Huawei technologies\Huawei UMTS Data Card\Data\AddressBookRec.DTC Object is locked skipped

C:\Program\Huawei technologies\Huawei UMTS Data Card\Data\CallRecord.DTC Object is locked skipped

C:\Program\Huawei technologies\Huawei UMTS Data Card\Data\GroupInfo.DTC Object is locked skipped

C:\Program\Huawei technologies\Huawei UMTS Data Card\Data\TrafficInfo.DTC Object is locked skipped

C:\Program\Huawei technologies\Huawei UMTS Data Card\Log\trace_3.txt Object is locked skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{B5645957-700C-4BB8-9F9B-0D47998845F0}\RP292\change.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\ModemLog_HUAWEI Mobile Connect - 3G Modem.txt Object is locked skipped

C:\WINDOWS\pfirewall.log Object is locked skipped

C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{DA62B411-D599-4516-BFB6-3F6E391D065F}.crmlog Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\DEFAULT Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\Internet.evt Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SYSTEM Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped

C:\WINDOWS\system32\drivers\sptddrv1.sys Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\LogFiles\HTTPERR\httperr1.log Object is locked skipped

C:\WINDOWS\system32\MsDtc\MSDTC.LOG Object is locked skipped

C:\WINDOWS\system32\MsDtc\Trace\dtctrace.log Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\Temp\Perflib_Perfdata_698.dat Object is locked skipped

C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

Scan process completed.

[/log]

[log]

__________________________________________________

ewido anti-spyware online scanner

http://www.ewido.net

__________________________________________________

Name: TrackingCookie.Netflame

Path: C:\Documents and Settings\Stoffe\Cookies\stoffe@ssl-hints.netflame[1].txt

Risk: Medium

Name: Adware.WebDir

Path: HKU\S-1-5-21-1390570283-3332796590-3896541955-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CA13D72F-2DAC-4D99-B08D-C5EA1C920E89}

Risk: Medium

Name: TrackingCookie.Netflame

Path: :mozilla.30:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\tkkaaxlk.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Toplist

Path: :mozilla.37:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\tkkaaxlk.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Com

Path: :mozilla.40:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\tkkaaxlk.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Webtrends

Path: :mozilla.80:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\tkkaaxlk.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Statcounter

Path: :mozilla.102:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\tkkaaxlk.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Statcounter

Path: :mozilla.103:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\tkkaaxlk.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Statcounter

Path: :mozilla.104:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\tkkaaxlk.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Statcounter

Path: :mozilla.105:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\tkkaaxlk.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Statcounter

Path: :mozilla.106:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\tkkaaxlk.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Doubleclick

Path: :mozilla.114:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\tkkaaxlk.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Atdmt

Path: :mozilla.143:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\tkkaaxlk.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Hitslink

Path: :mozilla.152:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\tkkaaxlk.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Googleadservices

Path: :mozilla.180:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\tkkaaxlk.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Googleadservices

Path: :mozilla.184:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\tkkaaxlk.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Emerite

Path: :mozilla.225:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\tkkaaxlk.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Emerite

Path: :mozilla.226:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\tkkaaxlk.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Hitbox

Path: :mozilla.242:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\tkkaaxlk.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Hitbox

Path: :mozilla.243:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\tkkaaxlk.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Fastclick

Path: :mozilla.262:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\tkkaaxlk.default\cookies.txt

Risk: Medium

Name: TrackingCookie.2o7

Path: :mozilla.290:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\tkkaaxlk.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Hotlog

Path: :mozilla.306:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\tkkaaxlk.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Spylog

Path: :mozilla.307:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\tkkaaxlk.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Sitestat

Path: :mozilla.317:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\tkkaaxlk.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Paypal

Path: :mozilla.325:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\tkkaaxlk.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Webtrendslive

Path: :mozilla.336:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\tkkaaxlk.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Adtech

Path: :mozilla.340:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\tkkaaxlk.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Adtech

Path: :mozilla.341:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\tkkaaxlk.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Information

Path: :mozilla.354:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\tkkaaxlk.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Hitbox

Path: :mozilla.394:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\tkkaaxlk.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Googleadservices

Path: :mozilla.6:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Casalemedia

Path: :mozilla.10:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Casalemedia

Path: :mozilla.11:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Casalemedia

Path: :mozilla.12:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Casalemedia

Path: :mozilla.13:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Casalemedia

Path: :mozilla.14:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Casalemedia

Path: :mozilla.15:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Casalemedia

Path: :mozilla.16:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Casalemedia

Path: :mozilla.17:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Casalemedia

Path: :mozilla.18:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Advertising

Path: :mozilla.20:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Advertising

Path: :mozilla.21:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Advertising

Path: :mozilla.22:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Advertising

Path: :mozilla.23:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Fastclick

Path: :mozilla.24:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Fastclick

Path: :mozilla.25:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Fastclick

Path: :mozilla.26:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Fastclick

Path: :mozilla.30:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Fastclick

Path: :mozilla.32:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Com

Path: :mozilla.35:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Tribalfusion

Path: :mozilla.36:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Tribalfusion

Path: :mozilla.37:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Tribalfusion

Path: :mozilla.39:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Zedo

Path: :mozilla.42:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Zedo

Path: :mozilla.43:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Zedo

Path: :mozilla.44:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Zedo

Path: :mozilla.45:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Zedo

Path: :mozilla.46:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Overture

Path: :mozilla.52:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Overture

Path: :mozilla.54:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Overture

Path: :mozilla.55:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Overture

Path: :mozilla.56:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Atdmt

Path: :mozilla.57:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Tradedoubler

Path: :mozilla.61:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Tradedoubler

Path: :mozilla.62:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Tradedoubler

Path: :mozilla.63:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Hotlog

Path: :mozilla.69:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Spylog

Path: :mozilla.70:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Revsci

Path: :mozilla.92:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Revsci

Path: :mozilla.93:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Imrworldwide

Path: :mozilla.102:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Imrworldwide

Path: :mozilla.103:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Statistik-gallup

Path: :mozilla.125:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Fortunecity

Path: :mozilla.143:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Fortunecity

Path: :mozilla.144:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Statcounter

Path: :mozilla.149:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Statcounter

Path: :mozilla.150:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Statcounter

Path: :mozilla.151:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Statcounter

Path: :mozilla.152:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Statcounter

Path: :mozilla.153:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Reliablestats

Path: :mozilla.156:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Reliablestats

Path: :mozilla.157:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Reliablestats

Path: :mozilla.158:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Reliablestats

Path: :mozilla.159:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Reliablestats

Path: :mozilla.160:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.2o7

Path: :mozilla.163:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.2o7

Path: :mozilla.164:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.2o7

Path: :mozilla.165:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.2o7

Path: :mozilla.166:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Doubleclick

Path: :mozilla.182:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Adtech

Path: :mozilla.184:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Adtech

Path: :mozilla.185:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Webtrends

Path: :mozilla.196:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Webtrends

Path: :mozilla.198:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Adobe

Path: :mozilla.203:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Googleadservices

Path: :mozilla.228:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Connextra

Path: :mozilla.252:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Yieldmanager

Path: :mozilla.253:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Yieldmanager

Path: :mozilla.254:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Toplist

Path: :mozilla.258:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Googleadservices

Path: :mozilla.259:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Information

Path: :mozilla.272:C:\Documents and Settings\Stoffe\Application Data\Mozilla\Firefox\Profiles\uwqwvjzj.default\cookies.txt

Risk: Medium

[/log]

[log]

Logfile of Trend Micro HijackThis v2.0.0 (BETA)

Scan saved at 21:44:00, on 2007-05-16

Platform: Windows XP SP2 (WinNT 5.01.2600)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program\Alwil Software\Avast4\aswUpdSv.exe

C:\Program\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program\Synaptics\SynTP\SynTPLpr.exe

C:\Program\Synaptics\SynTP\SynTPEnh.exe

C:\acer\epm\epm-dm.exe

C:\Acer\eManager\anbmServ.exe

C:\Program Files\Arcade\PCMService.exe

C:\Program\Launch Manager\LaunchAp.exe

C:\Program\Launch Manager\PowerKey.exe

C:\Program\Launch Manager\HotkeyApp.exe

C:\Program\Launch Manager\OSDCtrl.exe

C:\Program\Launch Manager\Wbutton.exe

C:\Acer\Empowering Technology\eRecovery\Monitor.exe

C:\Program\Multimedia Card Reader\shwicon2k.exe

C:\Program\ALWILS~1\Avast4\ashDisp.exe

C:\Program\DAEMON Tools\daemon.exe

C:\Program\MMEDIA\TV Jukebox 3.0\tvjbMonitor.exe

C:\Program\Java\jre1.5.0_11\bin\jusched.exe

C:\Program\QuickTime\qttask.exe

C:\Program\iTunes\iTunesHelper.exe

C:\Program\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program\Windows Media Player\WMPNSCFG.exe

C:\Program\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program\Bonjour\mDNSResponder.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program\Delade filer\Teleca Shared\CapabilityManager.exe

C:\Program\Kodak\Kodak EasyShare software\bin\EasyShare.exe

C:\Program\Delade filer\Teleca Shared\Generic.exe

C:\Program\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe

C:\Program\Alwil Software\Avast4\ashMaiSv.exe

C:\Program\Alwil Software\Avast4\ashWebSv.exe

C:\Program\iPod\bin\iPodService.exe

C:\Program\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe

C:\Program\Huawei technologies\Huawei UMTS Data Card\HUAWEI 3G Data Card.exe

C:\Program\Mozilla Firefox\firefox.exe

C:\Hijack this\HiJackThis_v2.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896'>http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank