Thank you, here are the 2 reports:
----
ComboFix 09-07-14.08 - Gowthan 18/07/2009 14:49.1.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.2.1033.18.3061.2029 [GMT -4:00]
Running from: c:\users\Gowthan\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1229 [VPS 081113-1] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: avast! antivirus 4.8.1229 [VPS 081113-1] *enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\users\Gowthan\Documents\My Received Files\New Sets\CD1\Desktop_.ini
c:\windows\Installer\577e59.msi
c:\windows\Installer\WMEncoder.msi
.
((((((((((((((((((((((((( Files Created from 2009-06-18 to 2009-07-18 )))))))))))))))))))))))))))))))
.
2009-07-18 18:55 . 2009-07-18 18:55 -------- d-----w- c:\users\Gowthan\AppData\Local\temp
2009-07-18 18:55 . 2009-07-18 18:55 -------- d-----w- c:\users\User\AppData\Local\temp
2009-07-18 18:37 . 2009-07-18 18:37 -------- d-----w- c:\programdata\NortonInstaller
2009-07-17 22:41 . 2009-07-17 22:41 -------- d-----w- c:\users\Guest
2009-07-17 22:41 . 2009-07-17 22:41 -------- d-----w- c:\program files\Trend Micro
2009-07-17 03:48 . 2009-07-17 03:48 -------- d-----w- c:\users\Gowthan\AppData\Roaming\Uniblue
2009-07-09 01:05 . 2009-07-18 18:33 -------- d-----w- c:\users\Gowthan\AppData\Roaming\vlc
2009-07-09 00:41 . 2009-07-12 21:24 -------- d-----w- c:\program files\RocketDock
2009-07-08 01:27 . 2009-07-08 22:55 -------- d-----w- c:\program files\CyberLink
2009-07-07 23:41 . 2009-07-07 23:41 -------- d-----w- c:\users\Gowthan\AppData\Roaming\CyberLink
2009-07-07 23:38 . 2009-07-08 01:42 -------- d-----w- c:\programdata\CyberLink
2009-07-07 23:38 . 2009-07-07 23:38 -------- d-----w- c:\program files\Common Files\CyberLink
2009-07-07 23:35 . 2009-07-07 23:55 29480 ----a-w- c:\windows\system32\msxml3a.dll
2009-07-07 23:34 . 2009-07-08 00:09 53319 ----a-w- c:\programdata\Temp\{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}\PostBuild.exe
2009-07-07 04:03 . 2009-07-07 04:03 -------- d-----w- c:\users\User\AppData\Roaming\PC Suite
2009-07-04 16:40 . 2009-04-30 12:37 428544 ----a-w- c:\windows\system32\EncDec.dll
2009-07-04 16:40 . 2009-04-30 12:37 293376 ----a-w- c:\windows\system32\psisdecd.dll
2009-07-04 16:36 . 2009-04-23 12:43 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2009-07-04 16:36 . 2009-04-23 12:42 636928 ----a-w- c:\windows\system32\localspl.dll
2009-07-04 16:34 . 2009-04-21 11:55 2033152 ----a-w- c:\windows\system32\win32k.sys
2009-06-22 19:23 . 2009-06-22 19:23 239088 ----a-w- c:\users\User\AppData\Roaming\Mozilla\plugins\npgo ogletalk.dll
2009-06-20 21:55 . 2009-06-20 21:55 -------- d-----w- c:\program files\Vodei
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2009-07-18 18:36 . 2008-10-15 02:27 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2009-07-18 17:52 . 2008-11-08 17:26 -------- d-----w- c:\programdata\VMware
2009-07-17 22:13 . 2008-10-15 02:23 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-17 22:12 . 2008-10-15 02:26 3775176 ----a-w- c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-07-15 22:51 . 2008-11-29 05:05 -------- d-----w- c:\users\Gowthan\AppData\Roaming\dvdcss
2009-07-15 01:53 . 2008-09-23 00:48 -------- d-----w- c:\program files\Messenger Plus! Live
2009-07-13 17:36 . 2008-10-15 02:23 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-13 17:36 . 2008-10-15 02:23 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-08 02:10 . 2009-02-15 01:07 -------- d-----w- c:\users\Gowthan\AppData\Roaming\Nokia
2009-07-08 01:38 . 2008-02-11 23:34 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-07 04:03 . 2009-07-07 04:03 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_ 00_00.Wdf
2009-07-04 17:06 . 2008-02-12 00:44 -------- d-----w- c:\programdata\Microsoft Help
2009-06-18 20:17 . 2008-09-17 17:55 1356 ----a-w- c:\users\Gowthan\AppData\Local\d3d9caps.dat
2009-06-18 04:47 . 2009-06-18 04:47 -------- d-----w- c:\users\User\AppData\Roaming\DivX
2009-06-06 04:12 . 2009-02-24 00:17 112800 ----a-w- c:\users\User\AppData\Local\GDIPFONTCACHEV1.DAT
2009-05-19 13:35 . 2008-09-17 17:56 112800 ----a-w- c:\users\Gowthan\AppData\Local\GDIPFONTCACHEV1.DAT
2009-05-04 18:42 . 2009-05-04 18:42 190800 ---ha-w- c:\windows\system32\mlfcache.dat
2009-04-24 16:05 . 2009-07-04 16:38 827904 ----a-w- c:\windows\system32\wininet.dll
2009-04-24 16:02 . 2009-07-04 16:38 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-04-24 13:44 . 2009-07-04 16:38 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2009-06-15 20:59 . 2008-09-22 23:53 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp. exe" [2009-02-05 81000]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416]
"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-01-22 712704]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-01-17 431456]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-01-29 4911104]
c:\users\User\AppData\Roaming\Microsoft\Windows\St art Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\aawservice]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3384229552-1554451906-1745968894-1003]
"EnableNotificationsRef"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3384229552-1554451906-1745968894-1006]
"EnableNotificationsRef"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\FirewallRules]
"{0563CB39-ADAE-48F0-95DC-091C58E4D664}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{9A40F4BE-6AF8-4958-874B-7B383836802E}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{9D27644A-9E2C-4391-B342-77E3CEB68652}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{916AAA77-CEE8-4C7B-BD20-1E5AE56D55A9}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{AE4FFA0D-7DCD-4F4F-84D3-1D048B7E500D}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{3F45D93D-A751-42D8-A38C-AC016488054B}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"UDP Query User{A803AB24-624C-4079-B789-995E57A4477C}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"TCP Query User{D6FABA26-0A33-4EE5-8ED1-D45053A954F9}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"UDP Query User{45E5E118-839F-4EC2-80D3-BB71E6D05F40}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"{DEB9369B-9A2E-448E-92E4-69EF4461B75A}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{1D0CA8FE-1D42-48B9-B166-4B1EDC1A14D6}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{C954F076-98F5-47F2-B261-3E510815E552}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{E5F867D0-89B9-40FC-A059-4F2E7E65ABD5}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{AD3B6E5A-B287-42CC-986C-97456A48F173}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{51D45AB0-7C42-4613-8004-EFBD7875C421}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{55C6FECB-9D39-4E60-8613-605E31192EF1}"= UDP:c:\program files\VMware\VMware Workstation\vmware-authd.exe:VMware Authd
"{7DF73CCE-776D-4301-98B1-2A5780E809C1}"= TCP:c:\program files\VMware\VMware Workstation\vmware-authd.exe:VMware Authd
"TCP Query User{6801EB71-9F9D-492E-B350-A7F12D567F10}c:\\program files\\packet tracer 5.0\\bin\\packettracer5.exe"= UDP:c:\program files\packet tracer 5.0\bin\packettracer5.exe:PacketTracer5
"UDP Query User{98074AF8-F936-40D3-9EE5-26C8979C3952}c:\\program files\\packet tracer 5.0\\bin\\packettracer5.exe"= TCP:c:\program files\packet tracer 5.0\bin\packettracer5.exe:PacketTracer5
"{1650ED33-8669-4F0B-9287-3B559286B32C}"= UDP:23586:BitComet 23586 TCP
"{46AE04F5-322D-4532-8224-398728314890}"= TCP:23586:BitComet 23586 UDP
"{0C83FF59-03EA-439D-ADC2-A4BA3D9CF27F}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{AE9B2D7D-0223-4E26-BB74-D723035A39CF}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{16B7AC8F-0843-4628-BF65-CBBBD79A44ED}"= UDP:c:\users\Gowthan\AppData\Local\Google\Google Talk Plugin\googletalkplugin.dll:Google Talk Plugin
"{7CF6F414-0BFB-48F9-89A1-806352B3AA32}"= TCP:c:\users\Gowthan\AppData\Local\Google\Google Talk Plugin\googletalkplugin.dll:Google Talk Plugin
"{5C002B0F-BE9B-492E-8A97-E6C301DD6BA3}"= UDP:c:\users\Gowthan\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe:Google Talk Plugin
"{F4CDDCFF-F4E3-4252-9F8F-E3BEA69E8A43}"= TCP:c:\users\Gowthan\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe:Google Talk Plugin
"{4B8945F2-4021-4CB9-B98E-DEAB854F7E2F}"= UDP:c:\users\Gowthan\AppData\Local\Temp\7zSD6EE.tm p\SymNRT.exe:Norton Removal Tool
"{ED5F3E7D-3DDD-4AB5-847E-DE396B7A908B}"= TCP:c:\users\Gowthan\AppData\Local\Temp\7zSD6EE.tm p\SymNRT.exe:Norton Removal Tool
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\PublicProfile]
"EnableFirewall"= 0 (0x0)
R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [22/09/2008 7:41 PM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswF sBlk.sys [22/09/2008 7:41 PM 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\as wMonFlt.sys [22/09/2008 7:41 PM 51792]
R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [03/12/2007 5:03 PM 126976]
R2 vmci;VMware vmci;c:\windows\System32\drivers\vmci.sys [19/09/2008 12:12 AM 54960]
R3 FwLnk;FwLnk Driver;c:\windows\System32\drivers\FwLnk.sys [11/02/2008 8:52 PM 7168]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\System32\drivers\NETw5v32.sys [17/11/2008 4:40 PM 3668480]
.
Contents of the 'Scheduled Tasks' folder
2009-07-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3384229552-1554451906-1745968894-1003.job
- c:\users\Gowthan\AppData\Local\Google\Update\Googl eUpdate.exe [2009-01-30 03:01]
2009-07-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3384229552-1554451906-1745968894-1006Core.job
- c:\users\User\AppData\Local\Google\Update\GoogleUp date.exe [2009-03-13 00:32]
2009-07-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3384229552-1554451906-1745968894-1006UA.job
- c:\users\User\AppData\Local\Google\Update\GoogleUp date.exe [2009-03-13 00:32]
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-Uniblue RegistryBooster 2009 - c:\program files\uniblue\registrybooster\StartRegistryBooster .exe
.
------- Supplementary Scan -------
.
uStart Page = about
:blank
mStart Page = hxxp://www.shoptoshiba.ca/welcome
uInternet Settings,ProxyOverride = *.local
IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: c:\windows\system32\wpclsp.dll
LSP: c:\program files\VMware\VMware Workstation\vsocklib.dll
FF - ProfilePath - c:\users\Gowthan\AppData\Roaming\Mozilla\Firefox\P rofiles\3x7uwsdw.default\
FF - prefs.
js: browser.search.selectedEngine - eBay
FF - prefs.
js: browser.startup.homepage - about
:blank
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - component: c:\users\Gowthan\AppData\Roaming\Mozilla\Firefox\P rofiles\3x7uwsdw.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll
FF - plugin: c:\users\Gowthan\AppData\Local\Google\Update\1.2.1 45.5\npGoogleOneClick8.dll
FF - plugin: c:\users\Gowthan\AppData\Roaming\Mozilla\plugins\n pgoogletalk.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
************************************************** ************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
GMER - Rootkit Detector and Remover
Rootkit scan 2009-07-18 14:55
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
************************************************** ************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Cl ass\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Cl ass\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Cl ass\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Cl ass\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2009-07-18 14:57
ComboFix-quarantined-files.txt 2009-07-18 18:57
Pre-Run: 50,076,413,952 bytes free
Post-Run: 50,061,447,168 bytes free
204 --- E O F --- 2009-07-04 17:06
--- HIJACK LOG
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:00:10 PM, on 18/07/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18248)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\Explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about
:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
AOL.ca - Canada's Breaking News, Entertainment, Music, Life & Style and Email
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware workstation\vsocklib.dll
O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware workstation\vsocklib.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O13 - Gopher Prefix:
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA SMART Log Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\Windows\system32\vmnetdhcp.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\Windows\system32\vmnat.exe
--
End of file - 7704 bytes
