PCAnswers logo

hi jack this and start up list--think i have a bad trojan

<p>StartupList report, 26/02/2008, 23:50:20<br />
StartupList version: 1.52.2<br />
Started from : C:\Users\Stuart\Downloads\HiJackThis_v2.EXE<br />
Detected: Windows Vista (WinNT 6.00.1904)<br />
Detected: Internet Explorer v7.00 (7.00.6000.16609)<br />
* Using default options<br />
==================================================</p>

<p>Running processes:</p>

<p>C:\Windows\system32\Dwm.exe<br />
C:\Windows\system32\taskeng.exe<br />
C:\Windows\Explorer.EXE<br />
C:\Windows\RtHDVCpl.exe<br />
C:\Windows\WindowsMobile\wmdc.exe<br />
C:\Program Files\Java\jre1.6.0\bin\jusched.exe<br />
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe<br />
C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe<br />
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE<br />
C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe<br />
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe<br />
C:\Program Files\McAfee.com\Agent\mcagent.exe<br />
C:\Program Files\Common Files\logishrd\LComMgr\Communications_Helper.exe<br />
C:\Program Files\Common Files\logishrd\LComMgr\LVComSX.exe<br />
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe<br />
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe<br />
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe<br />
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe<br />
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe<br />
C:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exe<br />
C:\Windows\ehome\ehtray.exe<br />
C:\Program Files\Dell Support Center\bin\sprtcmd.exe<br />
C:\Program Files\Windows Media Player\wmpnscfg.exe<br />
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe<br />
C:\Windows\ehome\ehmsas.exe<br />
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe<br />
C:\Windows\System32\mobsync.exe<br />
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe<br />
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe<br />
C:\Program Files\Internet Explorer\IEUser.exe<br />
C:\Program Files\McAfee\MSC\mcshell.exe<br />
C:\PROGRA~1\McAfee\VIRUSS~1\mcvsshld.exe<br />
C:\Program Files\Internet Explorer\iexplore.exe<br />
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe<br />
C:\Users\Stuart\Downloads\HiJackThis_v2.exe<br />
C:\Program Files\Windows Live Toolbar\msn_sl.exe</p>

<p>--------------------------------------------------</p>

<p>Checking Windows NT UserInit:</p>

<p>[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]<br />
UserInit = C:\Windows\system32\userinit.exe,</p>

<p>--------------------------------------------------</p>

<p>Autorun entries from Registry:<br />
HKLM\Software\Microsoft\Windows\CurrentVersion\Run</p>

<p>ECenter = C:\Dell\E-Center\EULALauncher.exe<br />
RtHDVCpl = RtHDVCpl.exe<br />
SunJavaUpdateSched = "c:\Program Files\Java\jre1.6.0\bin\jusched.exe"<br />
StartCCC = "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"<br />
ISUSScheduler = "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start<br />
(Default) = <br />
RoxWatchTray = "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"<br />
Adobe Reader Speed Launcher = "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"<br />
NMSSupport = "C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" /startup<br />
CCUTRAYICON = "C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe"<br />
Google Desktop Search = "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup<br />
mcagent_exe = C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey<br />
dscactivate = "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"<br />
LogitechCommunicationsManager = "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"<br />
LVCOMSX = "C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe"<br />
LogitechQuickCamRibbon = "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide<br />
GrooveMonitor = "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"<br />
CreateCD50 = "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r<br />
AdaptecDirectCD = "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"<br />
EPSON Stylus Photo RX520 Series = C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIAGE.EXE /F "C:\Windows\TEMP\E_SF0B4.tmp" /EF "HKLM"<br />
Acrobat Assistant 8.0 = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"<br />
Adobe_ID0EYTHM = C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE</p>

<p>--------------------------------------------------</p>

<p>Autorun entries from Registry:<br />
HKCU\Software\Microsoft\Windows\CurrentVersion\Run</p>

<p>ehTray.exe = C:\Windows\ehome\ehTray.exe<br />
DellSupportCenter = "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter<br />
WMPNSCFG = C:\Program Files\Windows Media Player\WMPNSCFG.exe</p>

<p>--------------------------------------------------</p>

<p>Autorun entries in Registry subkeys of:<br />
HKLM\Software\Microsoft\Windows\CurrentVersion\Run</p>

<p>[OptionalComponents]<br />
= </p>

<p>--------------------------------------------------</p>

<p>Autorun entries in Registry subkeys of:<br />
HKCU\Software\Microsoft\Windows\CurrentVersion\Run</p>

<p>[AdobeUpdater]<br />
= </p>

<p>--------------------------------------------------</p>

<p>Load/Run keys from C:\Windows\WIN.INI:</p>

<p>load=*INI section not found*<br />
run=*INI section not found*</p>

<p>Load/Run keys from Registry:</p>

<p>HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*<br />
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*<br />
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*<br />
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*<br />
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*<br />
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*<br />
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*<br />
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*<br />
HKCU\..\Windows NT\CurrentVersion\Windows: load=<br />
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*<br />
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*<br />
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*<br />
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL</p>

<p>--------------------------------------------------</p>

<p>Shell & screensaver key from C:\Windows\SYSTEM.INI:</p>

<p>Shell=*INI section not found*<br />
SCRNSAVE.EXE=*INI section not found*<br />
drivers=*INI section not found*</p>

<p>Shell & screensaver key from Registry:</p>

<p>Shell=explorer.exe<br />
SCRNSAVE.EXE=C:\Windows\system32\logon.scr<br />
drivers=*Registry value not found*</p>

<p>Policies Shell key:</p>

<p>HKCU\..\Policies: Shell=*Registry key not found*<br />
HKLM\..\Policies: Shell=*Registry value not found*</p>

<p>--------------------------------------------------</p>

<p>Enumerating Browser Helper Objects:</p>

<p>(no name) - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}<br />
(no name) - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll - {074C1DC5-9320-4A9A-947D-C042949C6216}<br />
McAntiPhishingBHO - C:\Program Files\McAfee\MSK\mcapbho.dll - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4}<br />
(no name) - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll - {72853161-30C5-4D22-B7F9-0BBC1D38A37E}<br />
(no name) - c:\Program Files\Java\jre1.6.0\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}<br />
scriptproxy - C:\Program Files\McAfee\VirusScan\scriptsn.dll - {7DB2D5A0-7241-4E79-B68D-6309F01C5231}<br />
(no name) - (no file) - {7E853D72-626A-48EC-A868-BA8D5E23E045}<br />
(no name) - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll - {9030D464-4C02-4ABF-8ECC-5164760863C6}<br />
(no name) - c:\program files\google\googletoolbar1.dll - {AA58ED58-01DD-4d91-8333-CF10577473F7}<br />
(no name) - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll - {AE7CD045-E861-484f-8273-0445EE161910}<br />
(no name) - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}<br />
(no name) - C:\Program Files\Windows Live Toolbar\msntb.dll - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}<br />
Browser Address Error Redirector - C:\Program Files\Dell\BAE\BAE.dll - {CA6319C0-31B7-401E-A518-A07C3DB8F777}<br />
(no name) - C:\Windows\msvidc32.dll - {E9601C0B-FA98-4E6D-A015-AE5B43F47962}</p>

<p>--------------------------------------------------</p>

<p>Enumerating Task Scheduler jobs:</p>

<p>Check Updates for Windows Live Toolbar.job<br />
McDefragTask.job<br />
McQcTask.job</p>

<p>--------------------------------------------------</p>

<p>Enumerating Winsock LSP files:</p>

<p>NameSpace #1: C:\Windows\system32\NLAapi.dll<br />
NameSpace #4: C:\Windows\system32\napinsp.dll<br />
NameSpace #5: C:\Windows\system32\pnrpnsp.dll<br />
NameSpace #6: C:\Windows\system32\pnrpnsp.dll<br />
NameSpace #7: C:\Program Files\Bonjour\mdnsNSP.dll</p>

<p>--------------------------------------------------</p>

<p>Enumerating Windows NT logon/logoff scripts:<br />
*No scripts set to run*</p>

<p>Windows NT checkdisk command:<br />
BootExecute = autocheck autochk *</p>

<p>Windows NT 'Wininit.ini':<br />
PendingFileRenameOperations: C:\PROGRA~2\McAfee\MSC\Updates\Installs\1\msk\mcinst.exe</p>

<p>--------------------------------------------------</p>

<p>Enumerating ShellServiceObjectDelayLoad items:</p>

<p>WebCheck: C:\Windows\system32\webcheck.dll</p>

<p>--------------------------------------------------<br />
End of report, 9,959 bytes<br />
Report generated in 0.047 seconds</p>

<p>Command line options:<br />
/verbose - to add additional info on each section<br />
/complete - to include empty sections and unsuspicious data<br />
/full - to include several rarely-important sections<br />
/force9x - to include Win9x-only startups even if running on WinNT<br />
/forcent - to include WinNT-only startups even if running on Win9x<br />
/forceall - to include all Win9x and WinNT startups, regardless of platform<br />
/history - to list version history only<br />
Logfile of Trend Micro HijackThis v2.0.0 (BETA)<br />
Scan saved at 15:36:01, on 27/02/2008<br />
Platform: Windows Vista (WinNT 6.00.1904)<br />
Boot mode: Normal</p>

<p>Running processes:<br />
C:\Windows\system32\Dwm.exe<br />
C:\Windows\system32\taskeng.exe<br />
C:\Windows\Explorer.EXE<br />
C:\Windows\RtHDVCpl.exe<br />
C:\Windows\WindowsMobile\wmdc.exe<br />
C:\Program Files\Java\jre1.6.0\bin\jusched.exe<br />
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe<br />
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE<br />
C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe<br />
C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe<br />
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe<br />
C:\Program Files\McAfee.com\Agent\mcagent.exe<br />
C:\Program Files\Common Files\logishrd\LComMgr\Communications_Helper.exe<br />
C:\Program Files\Common Files\logishrd\LComMgr\LVComSX.exe<br />
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe<br />
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe<br />
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe<br />
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe<br />
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe<br />
C:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exe<br />
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe<br />
C:\Program Files\Spyware Doctor\SDTrayApp.exe<br />
C:\Windows\ehome\ehtray.exe<br />
C:\Program Files\Dell Support Center\bin\sprtcmd.exe<br />
C:\Program Files\Windows Media Player\wmpnscfg.exe<br />
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe<br />
C:\Windows\ehome\ehmsas.exe<br />
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe<br />
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe<br />
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe<br />
C:\Program Files\Internet Explorer\ieuser.exe<br />
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe<br />
C:\Program Files\Internet Explorer\iexplore.exe<br />
C:\Windows\system32\Macromed\Flash\FlashUtil9d.exe<br />
C:\Users\Stuart\Downloads\HiJackThis_v2.exe<br />
C:\Program Files\Windows Live Toolbar\msn_sl.exe</p>

<p>R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = <a href="http://go.microsoft.com/fwlink/?LinkId=54896">http://go.microsoft.com/fwlink/?LinkId=54896</a><br />
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = <a href="http://go.microsoft.com/fwlink/?LinkId=69157">http://go.microsoft.com/fwlink/?LinkId=69157</a><br />
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = <a href="http://www.google.co.uk/ig/dell?hl=en&client=dell-usuk&channel=uk&ibd=5080127">http://www.google.co.uk/ig/dell?hl=en&client=dell-usuk&channel=uk&ibd=5080127</a><br />
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = <a href="http://go.microsoft.com/fwlink/?LinkId=54896">http://go.microsoft.com/fwlink/?LinkId=54896</a><br />
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = <a href="http://go.microsoft.com/fwlink/?LinkId=54896">http://go.microsoft.com/fwlink/?LinkId=54896</a><br />
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = <a href="http://go.microsoft.com/fwlink/?LinkId=69157">http://go.microsoft.com/fwlink/?LinkId=69157</a><br />
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = <br />
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = <br />
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell<br />
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local<br />
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = <br />
O1 - Hosts: ::1 localhost<br />
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll<br />
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll<br />
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - C:\Program Files\McAfee\MSK\mcapbho.dll<br />
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll<br />
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll<br />
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll<br />
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll<br />
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)<br />
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll<br />
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll<br />
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll<br />
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll<br />
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll<br />
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll<br />
O2 - BHO: MS Video Control 1.0 - {E9601C0B-FA98-4E6D-A015-AE5B43F47962} - C:\Windows\msvidc32.dll<br />
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll<br />
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll<br />
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll<br />
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll<br />
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide<br />
O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe<br />
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe<br />
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe<br />
O4 - HKLM\..\Run: [SunJavaUpdateSched] "c:\Program Files\Java\jre1.6.0\bin\jusched.exe"<br />
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"<br />
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start<br />
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"<br />
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"<br />
O4 - HKLM\..\Run: [NMSSupport] "C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" /startup<br />
O4 - HKLM\..\Run: [CCUTRAYICON] "C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe"<br />
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup<br />
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey<br />
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"<br />
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"<br />
O4 - HKLM\..\Run: [LVCOMSX] "C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe"<br />
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide<br />
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"<br />
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r<br />
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"<br />
O4 - HKLM\..\Run: [EPSON Stylus Photo RX520 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIAGE.EXE /F "C:\Windows\TEMP\E_SF0B4.tmp" /EF "HKLM"<br />
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"<br />
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE<br />
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"<br />
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe<br />
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter<br />
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe<br />
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe<br />
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm<br />
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html<br />
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html<br />
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html<br />
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html<br />
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html<br />
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html<br />
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html<br />
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html<br />
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000<br />
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll<br />
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll<br />
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll<br />
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll<br />
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll<br />
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll<br />
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll<br />
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL<br />
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll<br />
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll<br />
O13 - Gopher Prefix: <br />
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll<br />
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL<br />
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll<br />
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe<br />
O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe<br />
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe<br />
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe<br />
O23 - Service: Intel(R) DHTrace Controller (DHTRACE) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\IntelDH\bin\DHTraceController.exe<br />
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe<br />
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe<br />
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe<br />
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe<br />
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe<br />
O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe<br />
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe<br />
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe<br />
O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe<br />
O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe<br />
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe<br />
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe<br />
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe<br />
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe<br />
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe<br />
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe<br />
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe<br />
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe<br />
O23 - Service: Intel(R) NMSCore (NMSCore) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe<br />
O23 - Service: Intel(R) Quality Manager (QualityManager) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exe<br />
O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe<br />
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe<br />
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe<br />
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe<br />
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\svcntaux.exe<br />
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe<br />
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe<br />
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe</p>

<p>--<br />
End of file - 15949 bytes</p>

<p>hope i have done this correctly --please advise accordingly -many thanks</p>

hi jack this and start up list--think i have a bad trojan

<p>You've got a heck of a lot of things running, there, but none of them seem to be a bad.</p>

<p>Do you really need all those things to be running all the time?</p>

how do you shut them off

<p>you are probably right but i do not know how to close them down. i shut them on the taskbar at bottom of screen but they just start up again next time i turn on the computer</p>

hi jack this and start up list--think i have a bad trojan

<p>Services can be stopped in the Services tab when you Run MSCONFIG from the Run box in the start button.</p>

<p>Alternatively, you can change them to run manually, or not at all, in Control Panel/Administration Tools/Component Services/Services.</p>

<p>Don't turn off any Microsoft services before you find out what they do!</p>

Log in to PCAnswers

Please note: Old PCAnswers accounts are
still active as pca_YOURUSERNAME.


Join here | Forgotten your password?.

  • PCAnswers 193

    Check out the all-new PCAnswers!

    Every issue is packed with tips and tutorials, and now comes with a fantastic Video disc, with over an hour of watch-and-learn "How to..." tutorials.

    Not convinced? Take a test drive online for free

How to...

Nick Veitch's picture

Reduce XP startup times

Reduce XP startup times

Nick Veitch shows you how to reduce startup times in Windows XP using the free startup customisation program, AutoRuns. Remove pointless helper applications and get into Windows faster. ... read more »