[wannamar]

Hi I'm very new at this but I got problem with my laptop. First of all, we have 2 pc's and 1 laptop and they are all networked by a wireless router Netgear (WPA and password requied) with a cable connection modem/router. We use EZArmor Security with e-Trust PestPatrol and EZ Firewall all provided by RoadRunner. About a week or 2 weeks ago, my laptop (with wireless connection) start having this EZ firewall access popups and said :

Window NT Logon Application is trying to use
CA Antivirus Real Time Messaging Service to access the Internet

Application: winlogon.exe
Destination: 127.0.0.1: Port 1025

I hit the "Deny" button and then another one popped up and said:

Window NT Logon Application is trying to use Telnet to act as a server
Application: winlogon.exe
Source Ip: 0.0.0.0: Telnet

Some of this warnings popped up before and I think I might have allowed them before in order for my laptop to have access to the internet. But this time I've tried to fix my connection problem on the laptop and checked around of what could cause the connection to be in and out and 'no activity' even though my Netgear is running fine. It was from this forum that I found one post similar to my problem and very alarming. So yesterday I ran a Pestpatrol on my laptop and it said I have "Password_Finder 2.0" program and so I have the eTrust Pest Patol quaranteen and removed it. Though my laptop hasn't been working for a couple of days now. I assume because I didn't allow the WindowNT logon to have an access to the internet. Now my problem is my window starts up and has my preferred wallpaper on and I can see all my programs on the desktop, but when I place my mouse to the start button and task bar and startup bar, the running icons (cursor/ hourglass) keep going and going. To me this indicates that the loading of the window is still going and not finished ( I waited over 2 hours or more). I also can't access my programs from shortcuts on desktop. Also, I can't access my programs or system tools at all. I can't access the internet neither. I have been trying to fix the laptop via safemode but it won't let me restore to the earlier point.

Right now, I'm running the AVG and SuperAntiSpyware from the downloaded files that I saved (from my other pc which can still access the internet) in my USB memory sticks and run it in my safemode laptop.
My question is how to get my laptop running normally again and this Window NT Logon trying to access the internet has anything to do with my laptop that hasn't loaded properly. How do i go about fixing this? Right now I am running SuperAntiSpyware on my laptop then I will do the HiJackThis and post my logs on to the later posts. Thank you.

Here are all the logs:

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 11:48:08 25/2/2550

+ Scan result:



D:\Program Files\ShutterflyStudioInstaller.exe -> Adware.MediaTicket : Ignored.
D:\Program Files\Studio\SFlyStudioUninstall.exe -> Adware.MediaTicket : Ignored.
:mozilla.63:C:\Documents and Settings\wanna\Application Data\Mozilla\Firefox\Profiles\avhib5et.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.99:C:\Documents and Settings\wanna\Application Data\Mozilla\Firefox\Profiles\avhib5et.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\13a4aea650ba4ae8fd5ac8a63c9246d9 -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\169113198dc38339562f6543baf00bef -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\5df1dd070a706f430f76361fc92cf36f -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\71d5775d3da3fba1e01775cc8d4630b8 -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\7de1743fca6161a9e261969fc6e6cb37 -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\7fed0a9db5c3db60b74feb42f8a47314 -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\a393ed6b3f57e317d5739b4101028028 -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\ebdff4ee0960dde45b2a44222654b704 -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\wanna\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\wanna\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\5be7dca8187139486125bcadb54b4a10 -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\0fa8cac42c90cce3578ed629638e3dcd -> TrackingCookie.Adrevolver : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\ec8bccc73b7309c53eeb3851a1058b82 -> TrackingCookie.Burstbeacon : Cleaned.
:mozilla.93:C:\Documents and Settings\wanna\Application Data\Mozilla\Firefox\Profiles\avhib5et.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\c5e685d86d1072521d569137644f1f81 -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\4395771a415248942293520a9c07dba8 -> TrackingCookie.Clickbank : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\9cfe0397a778a0db56846e8437285afc -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\ba1f4e5dbbb35599f3ff312eda5e0bca -> TrackingCookie.Directnetadvertising : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\a61512d972ba8adbc2902affff569068 -> TrackingCookie.Euroclick : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\a6092e1efea00f4cea75a1c4329b7785 -> TrackingCookie.Falkag : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\1f5484c8e0b61cc426dc71b4f4d473b5 -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\2a2f74d1c91eacaedfcdd054d6467c99 -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\50c988fdb8706412a99da3c46542268a -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\99d94eec9bcbba6afa4c977383479f1e -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\9b44c3b604d582a34db0a58aabb71620 -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\279097490afcfc91280ef83d31cb3beb -> TrackingCookie.Linksynergy : Cleaned.
:mozilla.34:C:\Documents and Settings\wanna\Application Data\Mozilla\Firefox\Profiles\avhib5et.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.35:C:\Documents and Settings\wanna\Application Data\Mozilla\Firefox\Profiles\avhib5et.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.36:C:\Documents and Settings\wanna\Application Data\Mozilla\Firefox\Profiles\avhib5et.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\3418565b57794ba1cc7b5ffe63686c76 -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\bb139a85154346a0c07480531ad6722c -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\d42361947724f52386ef36de409b16ff -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\d08ef3fc333e3ff55dd02330a82c9c75 -> TrackingCookie.Myaffiliateprogram : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\150636061e7921d28d7cf6fb6e31bcf0 -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\wanna\Cookies\[email protected][1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\6c621b69bb7cee2c3ce5170e69dee8eb -> TrackingCookie.Pointroll : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\96b6aeb1edea95d2d797abc36c8743de -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\df85475bf3e571727888d129ba76bcbd -> TrackingCookie.Specificclick : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\f60b5836e988ccfdfe41188d04c3d52d -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\wanna\Application Data\RTP\cache\0b53eb9e9f78495e51f6b8e8bb506a5b -> TrackingCookie.Tracking101 : Cleaned.


::Report end

SUPERAntiSpyware Scan Log
Generated 02/25/2007 at 02:35 PM

Application Version : 3.5.1016

Core Rules Database Version : 3165
Trace Rules Database Version: 1176

Scan type : Complete Scan
Total Scan Time : 02:34:34

Memory items scanned : 184
Memory threats detected : 0
Registry items scanned : 6263
Registry threats detected : 0
File items scanned : 78516
File threats detected : 6

Adware.Tracking Cookie
C:\Documents and Settings\wanna\Cookies\wanna@directtrack[2].txt
C:\Documents and Settings\wanna\Cookies\[email protected][2].txt
C:\Documents and Settings\wanna\Cookies\[email protected][1].txt
C:\Documents and Settings\wanna\Cookies\[email protected][1].txt
C:\Documents and Settings\wanna\Cookies\wanna@nextag[2].txt
C:\Documents and Settings\wanna\Cookies\wanna@partner2profit[1].txt


Logfile of HijackThis v1.99.1
Scan saved at 3:18:10 PM, on 2/25/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\dmadmin.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
F:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Road Runner High Speed Online
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (file missing)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: MyPointsToolbarHelper Class - {5C2073DD-2ED6-4FF9-80D1-543F720043A9} - C:\Program Files\MyPoints Visual Search\snapbar.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: ShopAtHomeIEHelper Class - {E8DAAA30-6CAA-4b58-9603-8E54238219E2} - C:\Program Files\SelectRebates\Toolbar\ShopAtHomeToolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (file missing)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: ShopAtHome Toolbar - {98279C38-DE4B-4bcf-93C9-8EC26069D6F4} - C:\Program Files\SelectRebates\Toolbar\ShopAtHomeToolbar.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [acerWireless] C:\Program Files\acer\Wireless\Utility\WlanUtil.exe
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MEDIC] "C:\Program Files\MEDIC\bin\sprtcmd.exe" /P MEDIC
O4 - HKLM\..\Run: [CaAvTray] "D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Firewall\ca.exe"
O4 - HKLM\..\Run: [eTrustPPAP] "D:\Program Files\CA\eTrust EZ Armor\eTrust PestPatrol\PPActiveDetection.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\PROGRA~1\MESSEN~1\Msmsgs.exe" /background
O4 - HKCU\..\Run: [Road Runner PhotoShow Media Manager] D:\PROGRA~1\ROADRU~1\ROADRU~1\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?9bcf9e09dcc443cea18f5e2bde4b8f72
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?9bcf9e09dcc443cea18f5e2bde4b8f72
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: www.amazon.com
O15 - Trusted Zone: www.buy.com
O15 - Trusted Zone: http://www.cfmc.com
O15 - Trusted Zone: http://www.greenfieldonline.com
O15 - Trusted Zone: *.msn.com
O15 - Trusted Zone: *.mypoints.com
O15 - Trusted Zone: *.myview.com
O15 - Trusted Zone: *.passport.com
O15 - Trusted Zone: *.passport.net
O15 - Trusted Zone: http://www.sendearnings.com
O15 - Trusted Zone: sms.surveyrouter.com
O15 - Trusted Zone: http://www.surveyspot.com
O15 - Trusted Zone: *.testspin.com
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr...ads/tgctlcm.cab
O16 - DPF: {0713E8D2-850A-101B-AFC0-4210102A8DA7} - http://download.mcaf...22/ComCtl32.cab
O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} (Controller Class) - https://www.windowso...nSSWebAgent.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zone...cm/ICSCM_ca.cab
O16 - DPF: {2DFF31F9-7893-4922-AF66-C9A1EB4EBB31} (Rhapsody Player Engine) - http://forms.real.co...ne_Inst_Win.cab
O16 - DPF: {317153FE-B7FB-419B-AC87-0B2EC97D7A04} (VB2S ActiveX Control) - http://www.subdo.com/activex/vb2s.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish...fishActivia.cab
O16 - DPF: {427273CC-764E-11D3-823D-006097F90453} (Pixami Image Editor Control) - http://www.photowork...ImageEditor.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcaf...99/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by103fd.bay10...es/MsnPUpld.cab
O16 - DPF: {50647AB5-18FD-4142-82B0-5852478DD0D5} (Keynote Connector Launcher 2) - http://webeffective....torLauncher.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www3.ca.com/s...an/pestscan.cab
O16 - DPF: {5CB1506E-1DEA-4E63-89A7-E40E52AEA1FD} (OnagerCtrl Class) - http://staging.usful....com/onager.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safe...wlscbase969.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1125540231378
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.w...ler/install.cab
O16 - DPF: {7A7BA269-2D21-4B33-B60A-8510A1865D5F} (IWS Photo Upload Tool) - http://public2.uploa...eX/MsnPUpld.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://messenger.zon...mjolauncher.cab
O16 - DPF: {87056D28-9730-4A47-B9F9-7E890B62C58A} (WildfireActiveXHost Class) - http://real.gamehous...bugs/axhost.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterf...ds/Uploader.cab
O16 - DPF: {A48D0309-8DA3-41AA-98E4-89194D471890} (Pulse V5 ActiveX Control) - http://www.pulse3d.c...yer5.2AxWin.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineco...loadcontrol.cab
O16 - DPF: {AECD14A8-F662-11D1-A395-00805F535788} (Plotwon Control) - http://www.investors...ocx/plotwon.ocx
O16 - DPF: {B991DA79-51F7-4011-98D2-1F2592E82A56} (ACNPlayer2 Class) - http://drm1.reelsurv.../ACNePlayer.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcaf...,26/mcgdmgr.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai...0/Installer.exe
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://www.verizon.n...tivePreQual.cab
O16 - DPF: {C915801D-6F00-49CD-8A9A-8DE5C11ADDC1} (Pixami Drag/Drop Upload UI Control) - http://www.photowork...ropUploader.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai...5/installer.exe
O16 - DPF: {D8AA889B-2C65-47C3-8C16-3DCD4EF76A47} (Invoke Solutions Participant Control(MR)) - http://online.invoke...7207/MILive.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://album.sanook....bum/XUpload.ocx
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Pervasive.SQL Workgroup Engine - Unknown owner - C:\WINDOWS\system32\srvany.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Edited by wannamar, 25 February 2007 - 03:54 PM.