Logfile of HijackThis v1.99.1 Scan saved at 6:22:46 PM, on 18/01/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5346.0005) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Pponztv\Expe.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\LimeWire\LimeWire.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Panda Software\Panda Antivirus Platinum\AVENGINE.EXE C:\Program Files\Panda Software\Panda Antivirus Platinum\pavProxy.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\System32\sspipes.scr C:\WINDOWS\system32\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Windows\Local Settings\Temporary Internet Files\Content.IE5\P6QA8252\hijackthis[1]\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [url=http://www.msn.ca/]http://www.msn.ca/[/url] R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [url=http://go.microsoft.com/fwlink/?LinkId=54729]http://go.microsoft.com/fwlink/?LinkId=54729[/url] R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [url=http://go.microsoft.com/fwlink/?LinkId=54896]http://go.microsoft.com/fwlink/?LinkId=54896[/url] R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [url=http://go.microsoft.com/fwlink/?LinkId=54896]http://go.microsoft.com/fwlink/?LinkId=54896[/url] R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [url=http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID}]http://go.microsoft.com/fwlink/?LinkId=552...cid={SUB_CLCID}[/url] O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-ca\msntb.dll (file missing) O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Antivirus Platinum\Inicio.exe" O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE" /s O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\Corel\WordPerfect Office 2002\Programs\QFSCHD100.EXE" O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [Qtuoiovc] C:\Program Files\Pponztv\Expe.exe O4 - HKLM\..\Run: [Kargo] ERTYDF.exe O4 - HKLM\..\Run: [lpt] syspanel.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\RunOnce: [MMTWNLU_DEL_1] CMD.EXE /C DEL "C:\program files\TheWeatherNetwork\WeatherEye\MMTWNLiveUpdate.exe" O4 - HKCU\..\Run: [xsetup] SysSupport.exe O4 - HKCU\..\Run: [SAPSTR] borlandg.exe O4 - HKCU\..\Run: [br0ken] SysSupport.exe O4 - Startup: csrss.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing) O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O15 - Trusted Zone: *.searchmeup.cc (HKLM) O15 - Trusted Zone: *.skoobidoo.com (HKLM) O15 - Trusted IP range: 69.31.87.223 (HKLM) O16 - DPF: RaptisoftGameLoader - [url=http://www.miniclip.com/hamsterball/raptisoftgameloader.cab]http://www.miniclip.com/hamsterball/raptisoftgameloader.cab[/url] O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - [url=http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab]http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab[/url] O16 - DPF: {0D62A517-E7C6-4E1F-A577-07D4AC549A48} (Progetto1.int_ver32) - [url=http://advnt01.com/dialer/int_ver32n.CAB]http://advnt01.com/dialer/int_ver32n.CAB[/url] O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - [url=http://www.musicnotes.com/download/mnviewer.cab]http://www.musicnotes.com/download/mnviewer.cab[/url] O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - [url=http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab]http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab[/url] O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - [url=http://static.windupdates.com/cab/MediaAccess/ie/bridge-c420.cab]http://static.windupdates.com/cab/MediaAcc...bridge-c420.cab[/url] O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - [url=http://go.microsoft.com/fwlink/?linkid=39204]http://go.microsoft.com/fwlink/?linkid=39204[/url] O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} (CR64Loader Object) - [url=http://www.miniclip.com/inflaterball/miniclipGameLoader.dll]http://www.miniclip.com/inflaterball/miniclipGameLoader.dll[/url] O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - [url=http://www.miniclip.com/zenpuzzlegarden/miniclipGameLoader.dll]http://www.miniclip.com/zenpuzzlegarden/mi...pGameLoader.dll[/url] O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - [url=http://messenger.zone.msn.com/binary/MineSweeper.cab28578.cab]http://messenger.zone.msn.com/binary/MineS...er.cab28578.cab[/url] O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - [url=http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab]http://us.chat1.yimg.com/us.yimg.com/i/cha...v45/yacscom.cab[/url] O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - [url=http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst0401.cab]http://us.dl1.yimg.com/download.yahoo.com/...s/yinst0401.cab[/url] O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - [url=http://spaces.msn.com//PhotoUpload/MsnPUpld.cab]http://spaces.msn.com//PhotoUpload/MsnPUpld.cab[/url] O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - [url=http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab]http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab[/url] O16 - DPF: {683DFF0F-331F-44D2-B69B-46D7BFB58F32} (VacPro.canada_ver3) - [url=http://www.advnt01.com/dialer/canada_ver3.CAB]http://www.advnt01.com/dialer/canada_ver3.CAB[/url] O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - [url=http://chat.yahoo.com/cab/yacsui.cab]http://chat.yahoo.com/cab/yacsui.cab[/url] O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - [url=http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28578.cab]http://messenger.zone.msn.com/binary/Messe...nt.cab28578.cab[/url] O16 - DPF: {A1426AC5-8CE5-4A00-B71E-011D35709AC6} - [url=http://advnt01.com/dialer/int_ver34.CAB]http://advnt01.com/dialer/int_ver34.CAB[/url] O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - [url=http://www.sibelius.com/download/software/win/ActiveXPlugin.cab]http://www.sibelius.com/download/software/...tiveXPlugin.cab[/url] O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - [url=http://install.wildtangent.com/bgn/partners/shockwave/stx/install.cab]http://install.wildtangent.com/bgn/partner...stx/install.cab[/url] O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - [url=http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab]http://messenger.msn.com/download/MsnMesse...pDownloader.cab[/url] O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - [url=http://messenger.zone.msn.com/binary/ZIntro.cab53083.cab]http://messenger.zone.msn.com/binary/ZIntro.cab53083.cab[/url] O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - [url=https://roxypalace.microgaming.com/freeplay/FlashAX.cab]https://roxypalace.microgaming.com/freeplay/FlashAX.cab[/url] O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - [url=http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab]http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab[/url] O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - [url=http://messenger.zone.msn.com/binary/SolitaireShowdown.cab28578.cab]http://messenger.zone.msn.com/binary/Solit...wn.cab28578.cab[/url] O17 - HKLM\System\CCS\Services\Tcpip\..\{590AC113-BAA5-4706-A406-96096EA1D495}: NameServer = 85.255.114.85,85.255.112.213 O17 - HKLM\System\CCS\Services\Tcpip\..\{659486F5-49C3-417A-936A-C637EE928598}: NameServer = 85.255.114.85,85.255.112.213 O17 - HKLM\System\CCS\Services\Tcpip\..\{D0747A0C-0B37-4F00-9B76-0A1D8A943FEE}: NameServer = 85.255.114.85,85.255.112.213 O18 - Protocol: bt2 - {1730B77B-F429-498F-9B15-4514D83C8294} - C:\PROGRA~1\BT2Net\BT2PLU~1.DLL (file missing) O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Filter: application/x-bt2 - {6E1DDCE8-76BC-4390-9488-806E8FB1AD77} - C:\PROGRA~1\BT2Net\BT2PLU~1.DLL O20 - AppInit_DLLs: pushow27.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Pacsptisvr.exe O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe