ComboFix 08-01-18.4 - p0713160 2008-01-20 1:01:52.5 -
NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2415
[GMT 8:00]
Running from: C:\Documents and
Settings\p0713160\Desktop\ComboFix.exe
Command switches used :: C:\Documents and
Settings\p0713160\Desktop\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT
HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2007-12-19 to
2008-01-19 )))))))))))))))))))))))))))))))
.
2008-01-17 18:24 . 2008-01-17 18:24 54,156 --ah-----
C:\WINDOWS\QTFont.qfn
2008-01-17 18:24 . 2008-01-17 18:24 1,409 --a------
C:\WINDOWS\QTFont.for
2008-01-11 20:12 . 2002-06-21 15:09 160,217 --a------
C:\WINDOWS\system32\PowerToysLicense.rtf
2008-01-07 20:58 . 2008-01-07 20:58 d--------
C:\WINDOWS\system32\Kaspersky Lab
2008-01-07 20:58 . 2008-01-07 20:58 d-------- C:\Documents and
Settings\All Users\Application Data\Kaspersky Lab
2008-01-06 21:24 . 2000-08-31 08:00 51,200 --a------
C:\WINDOWS\NirCmd.exe
2008-01-06 21:03 . 2008-01-06 21:03 d-------- C:\Program
Files\Trend Micro
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report
))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-19 06:03 --------- d-----w C:\Documents and
Settings\p0713160\Application Data\AVG7
2008-01-18 13:40 --------- d-----w C:\Documents and Settings\All
Users\Application Data\Lavasoft
2008-01-18 13:15 12,632 ----a-w
C:\WINDOWS\system32\lsdelete.exe
2008-01-18 12:44 --------- d-----w C:\Documents and
Settings\p0713160\Application Data\Azureus
2008-01-18 12:44 --------- d-----w C:\Documents and
Settings\Administrator\Application Data\Azureus
2008-01-18 12:31 --------- d-----w C:\Documents and Settings\All
Users\Application Data\Spybot - Search & Destroy
2008-01-18 11:44 --------- d-----w C:\Documents and
Settings\p0713160\Application Data\MyPhoneExplorer
2008-01-11 15:06 --------- d-----w C:\Program Files\Wavosaur
2007-12-31 16:48 --------- d-----w C:\Program Files\Azureus
2007-12-30 10:36 --------- d-----w C:\Program Files\Warcraft
III
2007-12-22 11:03 --------- d-----w C:\Program Files\softnyx
2007-12-20 10:00 --------- d-----w C:\Program Files\mIRC
2007-12-14 12:49 --------- d-----w C:\Program Files\Windows Media
Connect 2
2007-12-14 12:40 --------- d-----w C:\Documents and
Settings\Administrator\Application Data\Grisoft
2007-12-14 12:40 --------- d-----w C:\Documents and
Settings\Administrator\Application Data\AVG7
2007-12-13 17:11 --------- d-----w C:\Documents and Settings\All
Users\Application Data\Avg7
2007-12-13 17:07 --------- d-----w C:\Documents and
Settings\LocalService\Application Data\AVG7
2007-12-13 17:06 --------- d-----w C:\Documents and Settings\All
Users\Application Data\Grisoft
2007-12-13 16:53 --------- d-----w C:\Documents and
Settings\p0713160\Application Data\Grisoft
2007-12-13 15:59 --------- d-----w C:\Program Files\Microsoft
Bootvis
2007-12-13 13:46 --------- d-----w C:\Program Files\Lavasoft
2007-12-13 13:45 --------- d-----w C:\Program Files\Common
Files\Wise Installation Wizard
2007-12-13 13:44 --------- d-----w C:\Documents and
Settings\p0713160\Application Data\Lavasoft
2007-12-12 23:38 4,407,684 ----a-w C:\Documents and
Settings\p0713160\TRACE_BOOT+DRIVERS_1_1.BIN
2007-12-12 23:38 4,407,684 ----a-w C:\Documents and
Settings\Default User\TRACE_BOOT+DRIVERS_1_1.BIN
2007-12-10 16:57 --------- d-----w C:\Program Files\Launch
Manager
2007-12-09 01:33 --------- d--h--w C:\Program Files\InstallShield
Installation Information
2007-12-07 11:07 --------- d-----w C:\Program Files\EClea2_0
2007-12-07 11:06 --------- d-----w C:\Program Files\CCleaner
2007-12-06 15:01 --------- d-----w C:\Program Files\Reference
Assemblies
2007-12-04 07:32 --------- d-----w C:\Documents and
Settings\p0713160\Application Data\U3
2007-11-19 15:51 --------- d-----w C:\Program Files\DivX
2007-11-07 09:26 721,920 ----a-w
C:\WINDOWS\system32\lsasrv.dll
2007-10-29 22:43 1,287,680 ----a-w
C:\WINDOWS\system32\quartz.dll
2007-10-27 09:40 222,720 ----a-w
C:\WINDOWS\system32\wmasf.dll
2007-10-23 17:47 96,760 ----a-w
C:\WINDOWS\system32\dfshim.dll
2007-10-23 17:47 84,480 ----a-w
C:\WINDOWS\system32\mscories.dll
2007-10-23 17:47 282,112 ----a-w
C:\WINDOWS\system32\mscoree.dll
2007-10-23 17:47 158,720 ----a-w
C:\WINDOWS\system32\mscorier.dll
.
((((((((((((((((((((((((((((( [email protected]_ 0.04.46.29
)))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-18 12:16:53 1,409,024 ----a-w
C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-19 17:01:28 1,409,024 ----a-w
C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-18 12:16:53 8,192 ----a-w
C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-19 17:01:29 8,192 ----a-w
C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-18 12:16:53 1,413,120 ----a-w
C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\ntuser.dat
+ 2008-01-19 17:01:29 1,413,120 ----a-w
C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\ntuser.dat
- 2008-01-18 12:16:54 8,192 ----a-w
C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-19 17:01:29 8,192 ----a-w
C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-18 12:16:55 7,323,648 ----a-w
C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
+ 2008-01-19 17:01:30 7,331,840 ----a-w
C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
- 2008-01-18 12:16:55 262,144 ----a-w
C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-19 17:01:31 262,144 ----a-w
C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-19 16:39:00 16,384 ----atw
C:\WINDOWS\Temp\Perflib_Perfdata_824.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points
))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not
shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19
12:54 5674352]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00
15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common
Framework\UpdaterUI.exe" [2004-08-06 03:50 139320]
"ePower_DMC"="C:\Acer\Empowering Technology\ePower\ePower_DMC.exe"
[2006-11-27 16:28 458752]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
[2006-04-29 06:13 766041]
"ShStatEXE"="C:\Program Files\Network
Associates\VirusScan\SHSTAT.exe" [2004-09-22 20:00 94208]
"RTHDCPL"="RTHDCPL.EXE" [2006-12-19 11:12 16062464
C:\WINDOWS\RTHDCPL.exe]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe"
[2007-02-06 10:45 155648]
"Network Associates Error Reporting Service"="C:\Program
Files\Common Files\Network Associates\TalkBack\TBMon.exe"
[2003-10-07 09:48 147514]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
[2006-11-08 10:28 802816]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe"
[2006-11-08 10:22 696320]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-01-13 09:47
163840]
"Boot"="C:\Acer\Empowering Technology\ePower\Boot.exe" [2006-03-15
22:12 579584]
"AGRSMMSG"="AGRSMMSG.exe" [2005-12-13 21:50 88204
C:\WINDOWS\AGRSMMSG.exe]
"Acer ePresentation HPD"="C:\Acer\Empowering
Technology\ePresentation\ePresentation.exe" [2006-06-07 20:18
208896]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware
7.5\avgas.exe" [2007-06-11 17:25 6731312]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-21 08:57
579072]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00
15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-12-14 01:07
219136]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start
Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start
Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon
Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start
Menu^Programs^Startup^MapToPDriveLoopLaunch.bat]
path=C:\Documents and Settings\All Users\Start
Menu\Programs\Startup\MapToPDriveLoopLaunch.bat
backup=C:\WINDOWS\pss\MapToPDriveLoopLaunch.batCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^p0713160^Start
Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\Documents and Settings\p0713160\Start
Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\AWMON]
C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-04 20:00 15360
C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\eRecoveryService]
--a------ 2006-06-01 14:40 413696 C:\Acer\Empowering
Technology\eRecovery\eRAgent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\IgfxTray]
--a------ 2007-01-13 09:47 131072
C:\WINDOWS\system32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\IMJPMIG8.1]
--a------ 2004-08-04 20:00 208952
C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\iTunesHelper]
--a------ 2005-12-20 20:54 278528 C:\Program
Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\LManager]
--a------ 2006-07-14 12:13 471040
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\LVCOMSX]
--a------ 2006-11-28 18:38 244512 C:\Program Files\Common
Files\Logitech\LComMgr\LVComSX.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\MSPY2002]
--a------ 2004-08-04 20:00 59392
C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\ntiMUI]
--a------ 2006-05-15 11:15 45056 C:\Program Files\NewTech
Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\NvCplDaemon]
--a------ 2006-06-12 16:11 7577600
C:\WINDOWS\system32\NvCpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\NvMediaCenter]
--a------ 2006-06-12 16:11 86016
C:\WINDOWS\system32\NvMcTray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\nwiz]
--a------ 2006-06-12 16:11 1519616
C:\WINDOWS\system32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\Persistence]
--a------ 2007-01-13 09:46 135168
C:\WINDOWS\system32\igfxpers.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\PHIME2002A]
--a------ 2004-08-04 20:00 455168
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\PHIME2002ASync]
--a------ 2004-08-04 20:00 455168
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\RemoteControl]
--a------ 2004-11-02 20:24 32768 C:\Program
Files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\SkyTel]
--a------ 2006-05-16 18:04 2879488 C:\WINDOWS\SkyTel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-03-14 03:43 83608 C:\Program
Files\Java\jre1.6.0_01\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"WLANKEEPER"=2 (0x2)
"S24EventMonitor"=2 (0x2)
"RPCSE"=2 (0x2)
"RegSrvc"=2 (0x2)
"RaySat_3dsmax8Server"=2 (0x2)
"ose"=3 (0x3)
"NVSvc"=2 (0x2)
"MDM"=2 (0x2)
"LVSrvLauncher"=2 (0x2)
"LightScribeService"=2 (0x2)
"iPodService"=3 (0x3)
"idsvc"=3 (0x3)
"IDriverT"=3 (0x3)
"EvtEng"=2 (0x2)
"Autodesk Licensing Service"=2 (0x2)
"Adobe LM Service"=3 (0x3)
R0 UBHelper;UBHelper;C:\WINDOWS\system32\drivers\UBHelper.sys
[2004-12-17 17:14]
R2 CcmExec;SMS Agent Host;C:\WINDOWS\system32\CCM\CcmExec.exe
[2006-02-09 02:50]
R2 int15;int15;C:\WINDOWS\system32\drivers\int15.sys [2006-06-02
13:59]
R2 tvicport;tvicport;C:\WINDOWS\system32\drivers\tvicport.sys
[2006-06-02 13:59]
R3 prepdrvr;SMS Process Event
Driver;C:\WINDOWS\system32\CCM\prepdrv.sys [2006-02-09 02:50]
R3 SNP2UVC;USB2.0 PC Camera
(SNP2UVC);C:\WINDOWS\system32\DRIVERS\snp2uvc.sys [2007-01-12
17:34]
S3 lv321av;Logitech USB PC Camera
(VC0321);C:\WINDOWS\system32\DRIVERS\lv321av.sys [2006-11-28
18:36]
S3 se44bus;Sony Ericsson Device 068 driver
(WDM);C:\WINDOWS\system32\DRIVERS\se44bus.sys [2006-11-30
14:58]
S3 se44mdfl;Sony Ericsson Device 068 USB WMC Modem
Filter;C:\WINDOWS\system32\DRIVERS\se44mdfl.sys [2006-11-30
14:58]
S3 se44mdm;Sony Ericsson Device 068 USB WMC Modem
Driver;C:\WINDOWS\system32\DRIVERS\se44mdm.sys [2006-11-30
14:58]
S3 se44mgmt;Sony Ericsson Device 068 USB WMC Device Management
Drivers (WDM);C:\WINDOWS\system32\DRIVERS\se44mgmt.sys [2006-11-30
14:58]
S3 se44nd5;Sony Ericsson Device 068 USB Ethernet Emulation SEMC44
(NDIS);C:\WINDOWS\system32\DRIVERS\se44nd5.sys [2006-11-30
14:58]
S3 se44obex;Sony Ericsson Device 068 USB WMC OBEX
Interface;C:\WINDOWS\system32\DRIVERS\se44obex.sys [2006-11-30
14:58]
S3 se44unic;Sony Ericsson Device 068 USB Ethernet Emulation SEMC44
(WDM);C:\WINDOWS\system32\DRIVERS\se44unic.sys [2006-11-30
14:58]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;"C:\Program
Files\Microsoft Visual Studio 8\Common7\IDE\Remote
Debugger\x86\msvsmon.exe" [2005-09-23 07:01]
S4 RaySat_3dsmax8Server;RaySat_3dsmax8 Server;C:\Program
Files\Autodesk\VIZ2007\mentalray\satellite\raysat_3dsmax8server.exe
[]
S4 RPCSE;Remote Procedure Call (RPC) MO;C:\Program
Files\Intel\Intel []
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2eb475a8-2aab-11dc-8ce3-0019d203273b}]
\Shell\AutoRun\command - G:\Launch.exe
*Newly Created Service* - ENTDRV51
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by
Gmer, http://www.gmer.net
Rootkit scan 2008-01-20 01:03:40
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-01-20 1:04:10
ComboFix-quarantined-files.txt 2008-01-19 17:04:08
ComboFix2.txt 2008-01-18 16:05:06
ComboFix3.txt 2008-01-18 11:17:53
.
2008-01-09 12:14:14 --- E O F ---
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:06:01 AM, on 20/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Network Associates\Common
Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\CCM\CcmExec.exe
C:\Program Files\Network Associates\Common
Framework\UpdaterUI.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Network
Associates\TalkBack\TBMon.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\DOCUME~1\p0713160\LOCALS~1\Temp\RtkBtMnt.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.sp.edu.sg/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page
=
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
http://www.lavasoft.de/help/aw/evhelp/0.htm
O2 - BHO: Adobe PDF Reader Link Helper -
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program
Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - (no
file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
- C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no
file)
O2 - BHO: Windows Live Sign-in Helper -
{9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common
Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network
Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering
Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program
Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network
Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program
Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Network Associates Error Reporting Service]
"C:\Program Files\Common Files\Network
Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program
Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program
Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel
PROSet/Wireless
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering
Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering
Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG
Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
/STARTUP
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN
Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run]
C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL
SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run]
C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK
SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research -
{92780B25-18CC-41C8-B9BE-3C9C571A8263} -
C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 -
{CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program
Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 -
{CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program
Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} (Java Plug-in
1.5.0_10) -
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} (Java Plug-in
1.5.0_11) -
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Plug-in
1.6.0_03) -
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain =
sd.sp.edu.sg
O17 - HKLM\Software\..\Telephony: DomainName = sd.sp.edu.sg
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain =
sd.sp.edu.sg
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain =
sd.sp.edu.sg
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D}
- C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft -
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program
Files\Common Files\Adobe Systems
Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program
Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT,
s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation.
- C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program
Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network
Associates, Inc. - C:\Program Files\Network Associates\Common
Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network
Associates, Inc. - C:\Program Files\Network
Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) -
Network Associates, Inc. - C:\Program Files\Network
Associates\VirusScan\VsTskMgr.exe
--
End of file - 7930 bytes
