HiJackthis logg

5 januari, 2009

Hej,

Vill någon vara snäll och hjölpa mig att kolla den här loggfilen

Jag upplever att det skickas trafik över nätet även när det inte borde.

Likaså är där program som inte är avslutade när jag försöker stänga datorn, fast jag stängt ner så mycket det går.

Mycket tacksam för hjälp-

//Ola

[log]Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program\Delade filer\Symantec Shared\ccSvcHst.exe

C:\Program\Delade filer\Symantec Shared\ccProxy.exe

C:\Program\Lavasoft\Ad-Aware\aawservice.exe

C:\WINDOWS\Explorer.EXE

C:\Program\Delade filer\Symantec Shared\ccSvcHst.exe

C:\Program\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program\Messenger\msmsgs.exe

C:\Program\DNA\btdna.exe

C:\Program\Uniblue\SpyEraser\SpyEraser.exe

C:\Program\Uniblue\RegistryBooster 2\RegistryBooster.exe

C:\Program\Intuwave\Shared\mRouterRuntime\mRouterConfig.exe

C:\Program\Personal\bin\Personal.exe

C:\Program\Intuwave\Shared\mRouterRuntime\mRouterRuntime.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\devldr32.exe

C:\Program\Symantec\LiveUpdate\AluSchedulerSvc.exe

C:\Program\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program\Internet Explorer\iexplore.exe

C:\Program\Java\jre6\bin\jucheck.exe

C:\Program\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.kristianstadik.se/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157'>http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896'>http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar

O2 - BHO: Länkhjälp till Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Delade filer\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)

O2 - BHO: BHO - {3BEE072B-16F2-4DD4-B576-2C46D2C48B50} - C:\WINDOWS\system32\6to4svc32.dll

O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program\Delade filer\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll

O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program\DELADE~1\SYMANT~1\IDS\IPSBHO.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre6\bin\ssv.dll

O2 - BHO: (no name) - {D032570A-5F63-4812-A094-87D007C23012} - (no file)

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program\Java\jre6\bin\jp2ssv.dll

O2 - BHO: (no name) - {DE5F80FD-8A16-4E53-A670-25EDD1152274} - (no file)

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: (no name) - {edbf1bc8-39ab-48eb-a0a9-c75078eb7c8e} - (no file)

O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program\Delade filer\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program\Canon\Easy-WebPrint\Toolband.dll

O4 - HKLM\..\Run: [ccApp] "C:\Program\Delade filer\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [osCheck] "C:\Program\Norton 360\osCheck.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [PC Suite for Smartphones] "C:\Program\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe" /startoptions

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [bitTorrent DNA] "C:\Program\DNA\btdna.exe"

O4 - HKCU\..\Run: [uniblue SpyEraser] "C:\Program\Uniblue\SpyEraser\SpyEraser.exe" -m

O4 - HKCU\..\Run: [uniblue RegistryBooster2] C:\Program\Uniblue\RegistryBooster 2\RegistryBooster.exe /S

O4 - HKCU\..\Run: [NBJ] "C:\Program\Ahead\NEROBA~1\NBJ.exe"

O4 - HKCU\..\Run: [mRouterConfig] "C:\Program\Intuwave\Shared\mRouterRuntime\mRouterConfig.exe"

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJÄNST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: Personal.lnk = C:\Program\Personal\bin\Personal.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program\MICROS~2\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~2\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

O16 - DPF: {E505599B-F37A-4849-A7B0-E0AAB5CB054C} (ScriptPlayerRuntime Class) - https://gfs.nb.se/privat/bank/scripts/eid/NordeaSmartCard.cab

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program\Lavasoft\Ad-Aware\aawservice.exe

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program\Symantec\LiveUpdate\AluSchedulerSvc.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\ccProxy.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\ccSvcHst.exe

O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\VAScanner\comHost.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program\Java\jre6\bin\jqs.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\Program\Symantec\LiveUpdate\LuComServer_3_4.EXE

O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Core LC - Unknown owner - C:\Program\DELADE~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--

End of file - 8486 bytes

[/log]

5 januari, 2009

Surfa till http://www.virustotal.com (fungerar bäst med Internet Explorer) klistra in ett av följande filnamn i rutan, tryck på Skicka Fil och vänta tills resultatet är klart (Närvarande status blir genomförd). Klistra in resultatet från de olika antivirusprogrammen (inte Övrig information) här. Upprepa med nästa filnamn.

C:\WINDOWS\system32\6to4svc32.dll

Vad är det för årsmodell på Norton/Symantec?

7 januari, 2009

så här blev det med den filen du bad mig kolla, jag har Norton 360.

[log]

a-squared 4.0.0.73 2009.01.06 -

AhnLab-V3 2009.1.6.3 2009.01.07 -

AntiVir 7.9.0.45 2009.01.06 -

Authentium 5.1.0.4 2009.01.06 -

Avast 4.8.1281.0 2009.01.06 -

AVG 8.0.0.199 2009.01.06 -

BitDefender 7.2 2009.01.07 -

CAT-QuickHeal 10.00 2009.01.06 -

ClamAV 0.94.1 2009.01.06 -

Comodo 884 2009.01.06 -

DrWeb 4.44.0.09170 2009.01.07 -

eTrust-Vet 31.6.6294 2009.01.06 -

Ewido 4.0 2008.12.31 -

F-Prot 4.4.4.56 2009.01.06 W32/Virtumonde.Y2.gen!Eldorado

F-Secure 8.0.14470.0 2009.01.07 -

Fortinet 3.117.0.0 2009.01.07 -

GData 19 2009.01.07 -

Ikarus T3.1.1.45.0 2009.01.06 -

K7AntiVirus 7.10.578 2009.01.06 -

Kaspersky 7.0.0.125 2009.01.07 -

McAfee 5487 2009.01.07 -

McAfee+Artemis 5487 2009.01.06 -

Microsoft 1.4205 2009.01.07 -

NOD32 3744 2009.01.06 -

Norman 5.80.02 2009.01.06 -

Panda 9.0.0.4 2009.01.06 -

PCTools 4.4.2.0 2009.01.06 -

Prevx1 V2 2009.01.07 Fraudulent Security Program

Rising 21.11.20.00 2009.01.07 -

SecureWeb-Gateway 6.7.6 2009.01.06 -

Sophos 4.37.0 2009.01.07 -

Sunbelt 3.2.1809.2 2008.12.22 -

Symantec 10 2009.01.07 -

TheHacker 6.3.1.4.210 2009.01.07 -

TrendMicro 8.700.0.1004 2009.01.07 -

VBA32 3.12.8.10 2009.01.06 -

ViRobot 2009.1.7.1547 2009.01.07 -

VirusBuster 4.5.11.0 2009.01.06 -

[/log]

[inlägget ändrat 2009-01-07 22:02:11 av olak]

[inlägget ändrat 2009-01-07 22:05:09 av olak]

7 januari, 2009

Okej, med Norton 360 så är det versionsnummer som gäller. Kolla att det är senaste versionen:

http://www.symantec.com/home_homeoffice/support/special/upgrade2007/vista/migration_start.jsp?site=nuc

Men bäst att vänta med eventuell uppgradering tills datorn är frisk.

Eftersom det var så få program som kände igen filen så skulle jag vilja skicka den till antivirusföretagen så att de kan uppdatera sina program. Ladda upp filen och som e-postadress så anger du min som du ser när du trycker på Anv.info under det här inlägget.

9 januari, 2009

Hur går det?

11 januari, 2009

Tack för filen!

Ladda hem och installera gratisversionen SUPERAntiSpyware Free Edition:

http://www.superantispyware.com/download.html

Starta programmet, klicka på Check for updates.

Avsluta programmet när uppdateringen är klar.

Starta om datorn i felsäkert läge (tryck F8 upprepade gånger under uppstarten och välj felsäkert läge i menyn).

[log]Starta SUPERAntiSpyware och klicka på Scan your Computer.

Bocka för alla hårddiskar (fixed drive/disk).

Välj Perform complete scan

Nästa/Next

När skanningen är klar som kommer det upp en sammanfattning, tryck på OK

Nästa/Next

Utför eller liknande

Ett fönster med Quarantine and removal Complete kommer upp

OK

Utför eller liknande

Avsluta programmet.

Starta om i normalt läge.

Starta SUPERAntiSpyware, tryck på Preferences, välj fliken Statistics/Logs.

Dubbelklicka på den nyaste SUPERAntiSpyware Scan Log så att loggen kommer upp i Anteckningar.

Klistra in loggen i ditt svar samt en ny HijackThis-logg. [/log]

12 januari, 2009

här kommer AntiSpywarelogg samt en ny Hijack logg.

[log]Scan type : Quick Scan

Total Scan Time : 00:27:00

Memory items scanned : 166

Memory threats detected : 0

Registry items scanned : 345

Registry threats detected : 4

File items scanned : 9243

File threats detected : 62

Adware.Vundo Variant

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D032570A-5F63-4812-A094-87D007C23012}

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DE5F80FD-8A16-4E53-A670-25EDD1152274}

Trojan.Homepage

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{edbf1bc8-39ab-48eb-a0a9-c75078eb7c8e}

Rogue.SecureExpertCleaner

HKCR\CLSID\{D4CDC21D-43BE-4101-A1EF-E379F134771E}

Adware.Tracking Cookie

C:\Documents and Settings\Alex\Cookies\alex@ad.adtoma[2].txt

C:\Documents and Settings\Alex\Cookies\alex@server.cpmstar[1].txt

C:\Documents and Settings\Alex\Cookies\alex@media.svt[1].txt

C:\Documents and Settings\Alex\Cookies\alex@banner.prestigecasino[2].txt

C:\Documents and Settings\Alex\Cookies\alex@sifomedia.fz[2].txt

C:\Documents and Settings\Alex\Cookies\alex@ads.gamesbannernet[1].txt

C:\Documents and Settings\Alex\Cookies\alex@ads.familjeliv[2].txt

C:\Documents and Settings\Alex\Cookies\alex@eas4.emediate[2].txt

C:\Documents and Settings\Alex\Cookies\alex@acronymfinder[1].txt

C:\Documents and Settings\Alex\Cookies\alex@ad.adnet[1].txt

C:\Documents and Settings\Alex\Cookies\alex@media6degrees[2].txt

C:\Documents and Settings\Alex\Cookies\alex@adserver2.spele[2].txt

C:\Documents and Settings\Alex\Cookies\alex@ads.cronaweb[2].txt

C:\Documents and Settings\Alex\Cookies\alex@ads.createreach[1].txt

C:\Documents and Settings\Alex\Cookies\alex@adsby.webtraffic[1].txt

C:\Documents and Settings\Alex\Cookies\alex@eas.apm.emediate[2].txt

C:\Documents and Settings\Camilla\Cookies\camilla@adsby.webtraffic[1].txt

C:\Documents and Settings\Camilla\Cookies\camilla@atdmt[2].txt

C:\Documents and Settings\Camilla\Cookies\camilla@2o7[1].txt

C:\Documents and Settings\Camilla\Cookies\camilla@kuoniscandinavia.122.2o7[1].txt

C:\Documents and Settings\Camilla\Cookies\camilla@doubleclick[1].txt

C:\Documents and Settings\Camilla\Cookies\camilla@stat.bytbil[1].txt

C:\Documents and Settings\Camilla\Cookies\camilla@tradedoubler[2].txt

C:\Documents and Settings\Camilla\Cookies\camilla@www.googleadservices[3].txt

C:\Documents and Settings\Camilla\Cookies\camilla@ad.adtoma[1].txt

C:\Documents and Settings\Camilla\Cookies\camilla@track.adform[2].txt

C:\Documents and Settings\Camilla\Cookies\camilla@postclicktracking[2].txt

C:\Documents and Settings\Camilla\Cookies\camilla@www.medianow[2].txt

C:\Documents and Settings\Camilla\Cookies\camilla@ads.dalademokraten[2].txt

C:\Documents and Settings\Camilla\Cookies\camilla@ad1.emediate[1].txt

C:\Documents and Settings\Camilla\Cookies\camilla@adserver.eniro[2].txt

C:\Documents and Settings\Camilla\Cookies\camilla@ads.mjoelkbar[2].txt

C:\Documents and Settings\Camilla\Cookies\camilla@imrworldwide[1].txt

C:\Documents and Settings\Camilla\Cookies\camilla@stat.vv[1].txt

C:\Documents and Settings\Ola\Cookies\ola@ad.adtoma[2].txt

C:\Documents and Settings\Ola\Cookies\ola@ads.gtsads[1].txt

C:\Documents and Settings\Ola\Cookies\ola@ads.sportsverige[2].txt

C:\Documents and Settings\Ola\Cookies\ola@ad1.emediate[3].txt

C:\Documents and Settings\Ola\Cookies\ola@indexstats[2].txt

C:\Documents and Settings\Ola\Cookies\ola@ad2.doublepimp[1].txt

C:\Documents and Settings\Ola\Cookies\ola@stats.xicon[1].txt

C:\Documents and Settings\Ola\Cookies\ola@1.sharkadnetwork[2].txt

C:\Documents and Settings\Ola\Cookies\ola@2o7[1].txt

C:\Documents and Settings\Ola\Cookies\ola@ad1.emediate[2].txt

C:\Documents and Settings\Ola\Cookies\ola@ads.ads.netlog[2].txt

C:\Documents and Settings\Ola\Cookies\ola@adsby.webtraffic[1].txt

C:\Documents and Settings\Ola\Cookies\ola@adserve.sportnik[2].txt

C:\Documents and Settings\Ola\Cookies\ola@clicktorrent[2].txt

C:\Documents and Settings\Ola\Cookies\ola@doubleclick[1].txt

C:\Documents and Settings\Ola\Cookies\ola@e-2dj6wgmyqmdpaaq.stats.esomniture[2].txt

C:\Documents and Settings\Ola\Cookies\ola@e2.emediate[1].txt

C:\Documents and Settings\Ola\Cookies\ola@eliteprospects[1].txt

C:\Documents and Settings\Ola\Cookies\ola@www.googleadservices[2].txt

C:\Documents and Settings\Ola\Cookies\ola@www.googleadservices[10].txt

C:\Documents and Settings\Ola\Cookies\ola@www.googleadservices[1].txt

C:\Documents and Settings\Ola\Cookies\ola@www.googleadservices[3].txt

C:\Documents and Settings\Ola\Cookies\ola@www.googleadservices[4].txt

C:\Documents and Settings\Ola\Cookies\ola@www.googleadservices[5].txt

C:\Documents and Settings\Ola\Cookies\ola@www.googleadservices[6].txt

C:\Documents and Settings\Ola\Cookies\ola@www.googleadservices[7].txt

C:\Documents and Settings\Ola\Cookies\ola@www.googleadservices[8].txt

C:\Documents and Settings\Ola\Cookies\ola@www.googleadservices[9].txt

[/log]

[log]

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:22:19, on 2009-01-12

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program\Delade filer\Symantec Shared\ccSvcHst.exe

C:\Program\Delade filer\Symantec Shared\ccProxy.exe

C:\Program\Lavasoft\Ad-Aware\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program\Symantec\LiveUpdate\AluSchedulerSvc.exe

C:\Program\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program\Delade filer\Symantec Shared\ccSvcHst.exe

C:\Program\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\devldr32.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program\Messenger\msmsgs.exe

C:\Program\DNA\btdna.exe

C:\Program\Uniblue\SpyEraser\SpyEraser.exe

C:\Program\Uniblue\RegistryBooster 2\RegistryBooster.exe

C:\Program\Intuwave\Shared\mRouterRuntime\mRouterConfig.exe

C:\Program\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program\Intuwave\Shared\mRouterRuntime\mRouterRuntime.exe

C:\Program\Personal\bin\Personal.exe

C:\Program\DELADE~1\SYMANT~1\CCPD-LC\symlcsvc.exe

C:\WINDOWS\System32\svchost.exe

C:\Program\Outlook Express\msimn.exe