(2 days ago) with 2 variants of Virtumonde, Virtumonde.generic, Virtumonde, Smitfraud, Darksma downloader & a list of others; after running Adaware 2008, McAfee, Intelinet, CA Antispy, Spybot Search & Destroy & VundoFix.exe (which by the way completely missed the Vundo.H & Vundo Trojans. 
I then downloaded AVG Free, Malwarebytes Anti-Malware & Rogue Remover FREE: These 3 programs pretty much took care of the Virtumonde Trojan & Darksma but Spybot SD is still picking up 2-3 traces of the Virtumonde that none of the other programs for whatever reason are picking up.
It was surprising to see that all the programs pretty much recognized & "removed" the Virtumonde Trojans temporarily; but all missed the Smitfraud & Darksma. Smitfraud was picked up & taken care of by AVG Free & Darksma was picked up by CA Antispy that came with my AT&T Uverse & Yahoo service, this also "temporarilly" removed it.
AVG Free & Malwarebytes pretty much cleaned up everything else. Thanks to you guys my issues have been mostly resolved but I still need help. I think my computer is still infected when I bring up Mozilla it brings up Yahoo but when I click on either Yahoo email or visit Google, Gmail it takes me to the following link: http://www.att.net/s/s.dll?spage=search/er...l=en&tab=wm
The following is the result of the Hijackthis log, can someone please explain what I'm reading here & tell me what other steps to take.
This 1st part was my initial results after running Virtumundobegone a few times but before I ran AVG Free, Malwarebytes Anti-Malware & Rogue Remover FREE.
[12/17/2008, 1:16:06] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Carlos\Desktop\VirtumundoBeGone(2).exe" )
[12/17/2008, 2:02:34] - Detected System Information:
[12/17/2008, 2:02:34] - Windows Version: 5.1.2600, Service Pack 3
[12/17/2008, 2:02:34] - Current Username: Carlos (Admin)
[12/17/2008, 2:02:34] - Windows is in NORMAL mode.
[12/17/2008, 2:02:34] - Searching for Browser Helper Objects:
[12/17/2008, 2:02:34] - BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} ()
[12/17/2008, 2:02:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/17/2008, 2:02:34] - No filename found. Continuing.
[12/17/2008, 2:02:34] - BHO 2: {2bfa5287-38ac-45b3-aa59-c8a554615ba7} ()
[12/17/2008, 2:02:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/17/2008, 2:02:34] - Checking for HKLM\...\Winlogon\Notify\criqvv
[12/17/2008, 2:02:34] - Key not found: HKLM\...\Winlogon\Notify\criqvv, continuing.
[12/17/2008, 2:02:34] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[12/17/2008, 2:02:34] - BHO 4: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} (Yahoo! IE Services Button)
[12/17/2008, 2:02:34] - BHO 5: {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} ()
[12/17/2008, 2:02:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/17/2008, 2:02:34] - Checking for HKLM\...\Winlogon\Notify\xxyxyXRI
[12/17/2008, 2:02:34] - Found: HKLM\...\Winlogon\Notify\xxyxyXRI - This is probably Virtumundo.
[12/17/2008, 2:02:34] - Assigning {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} MSEvents Object
[12/17/2008, 2:02:34] - BHO list has been changed! Starting over...
[12/17/2008, 2:02:34] - BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} ()
[12/17/2008, 2:02:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/17/2008, 2:02:34] - No filename found. Continuing.
[12/17/2008, 2:02:34] - BHO 2: {2bfa5287-38ac-45b3-aa59-c8a554615ba7} ()
[12/17/2008, 2:02:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/17/2008, 2:02:34] - Checking for HKLM\...\Winlogon\Notify\criqvv
[12/17/2008, 2:02:34] - Key not found: HKLM\...\Winlogon\Notify\criqvv, continuing.
[12/17/2008, 2:02:34] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[12/17/2008, 2:02:34] - BHO 4: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} (Yahoo! IE Services Button)
[12/17/2008, 2:02:34] - BHO 5: {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} (MSEvents Object)
[12/17/2008, 2:02:34] - ALERT: Found MSEvents Object!
[12/17/2008, 2:02:34] - BHO 6: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[12/17/2008, 2:02:34] - BHO 7: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} (McAfee SiteAdvisor BHO)
[12/17/2008, 2:02:34] - BHO 8: {BB21F9F6-F56F-4D45-ACBF-6662FC8C0205} ()
[12/17/2008, 2:02:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/17/2008, 2:02:34] - Checking for HKLM\...\Winlogon\Notify\khfDvuts
[12/17/2008, 2:02:34] - Key not found: HKLM\...\Winlogon\Notify\khfDvuts, continuing.
[12/17/2008, 2:02:34] - BHO 9: {DBC80044-A445-435b-BC74-9C25C1C588A9} (Java™ Plug-In 2 SSV Helper)
[12/17/2008, 2:02:34] - Finished Searching Browser Helper Objects
[12/17/2008, 2:02:34] - *** Detected MSEvents Object
[12/17/2008, 2:02:34] - Trying to remove MSEvents Object...
[12/17/2008, 2:02:35] - Terminating Process: IEXPLORE.EXE
[12/17/2008, 2:02:35] - Terminating Process: RUNDLL32.EXE
[12/17/2008, 2:02:35] - Disabling Automatic Shell Restart
[12/17/2008, 2:02:35] - Terminating Process: EXPLORER.EXE
[12/17/2008, 2:02:35] - Suspending the NT Session Manager System Service
[12/17/2008, 2:02:35] - Terminating Windows NT Logon/Logoff Manager
[12/17/2008, 2:02:35] - Re-enabling Automatic Shell Restart
[12/17/2008, 2:02:35] - File to disable: C:\WINDOWS\system32\xxyxyXRI.dll
[12/17/2008, 2:02:35] - Renaming C:\WINDOWS\system32\xxyxyXRI.dll -> C:\WINDOWS\system32\xxyxyXRI.dll.vir
[12/17/2008, 2:02:35] - ! File rename was unsucessful.
[12/17/2008, 2:02:35] - Attempting to Deny Access to C:\WINDOWS\system32\xxyxyXRI.dll
[12/17/2008, 2:02:36] - *** IMPORTANT: Delete/Rename/Move on reboot (like Killbox) MAY NOT work.
[12/17/2008, 2:02:36] - processed file: C:\WINDOWS\system32\xxyxyXRI.dll
[12/17/2008, 2:02:36] - *** IMPORTANT: The file is disabled and will need to be deleted by the user.
[12/17/2008, 2:02:36] - Removing HKLM\...\Browser Helper Objects\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}
[12/17/2008, 2:02:36] - Removing HKCR\CLSID\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}
[12/17/2008, 2:02:36] - Adding Kill Bit for ActiveX for GUID: {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}
[12/17/2008, 2:02:37] - Deleting ATLEvents/MSEvents Registry entries
[12/17/2008, 2:02:37] - Removing HKLM\...\Winlogon\Notify\xxyxyXRI
[12/17/2008, 2:02:37] - Searching for Browser Helper Objects:
[12/17/2008, 2:02:37] - BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} ()
[12/17/2008, 2:02:37] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/17/2008, 2:02:37] - No filename found. Continuing.
[12/17/2008, 2:02:37] - BHO 2: {2bfa5287-38ac-45b3-aa59-c8a554615ba7} ()
[12/17/2008, 2:02:37] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/17/2008, 2:02:37] - Checking for HKLM\...\Winlogon\Notify\criqvv
[12/17/2008, 2:02:37] - Key not found: HKLM\...\Winlogon\Notify\criqvv, continuing.
[12/17/2008, 2:02:37] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[12/17/2008, 2:02:37] - BHO 4: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} (Yahoo! IE Services Button)
[12/17/2008, 2:02:37] - BHO 5: {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} ()
[12/17/2008, 2:02:37] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/17/2008, 2:02:37] - Checking for HKLM\...\Winlogon\Notify\xxyxyXRI
[12/17/2008, 2:02:37] - Key not found: HKLM\...\Winlogon\Notify\xxyxyXRI, continuing.
[12/17/2008, 2:02:37] - BHO 6: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[12/17/2008, 2:02:37] - BHO 7: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} (McAfee SiteAdvisor BHO)
[12/17/2008, 2:02:37] - BHO 8: {BB21F9F6-F56F-4D45-ACBF-6662FC8C0205} ()
[12/17/2008, 2:02:37] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/17/2008, 2:02:37] - Checking for HKLM\...\Winlogon\Notify\khfDvuts
[12/17/2008, 2:02:37] - Key not found: HKLM\...\Winlogon\Notify\khfDvuts, continuing.
[12/17/2008, 2:02:37] - BHO 9: {DBC80044-A445-435b-BC74-9C25C1C588A9} (Java™ Plug-In 2 SSV Helper)
[12/17/2008, 2:02:37] - Finished Searching Browser Helper Objects
[12/17/2008, 2:02:37] - Finishing up...
[12/17/2008, 2:02:37] - A restart is needed.
[12/17/2008, 2:02:37] - Automatic Reboot on STOP Error is not set. User will have to manually restart.
[12/17/2008, 2:02:56] - Attempting to Restart via STOP error (Blue Screen!)
[12/17/2008, 2:18:59] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Carlos\Desktop\VirtumundoBeGone(2).exe" )
[12/17/2008, 2:19:11] - Detected System Information:
[12/17/2008, 2:19:11] - Windows Version: 5.1.2600, Service Pack 3
[12/17/2008, 2:19:11] - Current Username: Carlos (Admin)
[12/17/2008, 2:19:11] - Windows is in NORMAL mode.
[12/17/2008, 2:19:11] - Searching for Browser Helper Objects:
[12/17/2008, 2:19:11] - BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} ()
[12/17/2008, 2:19:11] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/17/2008, 2:19:11] - No filename found. Continuing.
[12/17/2008, 2:19:11] - BHO 2: {2bfa5287-38ac-45b3-aa59-c8a554615ba7} ()
[12/17/2008, 2:19:11] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/17/2008, 2:19:11] - Checking for HKLM\...\Winlogon\Notify\criqvv
[12/17/2008, 2:19:11] - Key not found: HKLM\...\Winlogon\Notify\criqvv, continuing.
[12/17/2008, 2:19:11] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[12/17/2008, 2:19:11] - BHO 4: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} (Yahoo! IE Services Button)
[12/17/2008, 2:19:11] - BHO 5: {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} ()
[12/17/2008, 2:19:11] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/17/2008, 2:19:11] - Checking for HKLM\...\Winlogon\Notify\xxyxyXRI
[12/17/2008, 2:19:11] - Found: HKLM\...\Winlogon\Notify\xxyxyXRI - This is probably Virtumundo.
[12/17/2008, 2:19:11] - Assigning {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} MSEvents Object
[12/17/2008, 2:19:11] - BHO list has been changed! Starting over...
[12/17/2008, 2:19:11] - BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} ()
[12/17/2008, 2:19:11] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/17/2008, 2:19:11] - No filename found. Continuing.
[12/17/2008, 2:19:11] - BHO 2: {2bfa5287-38ac-45b3-aa59-c8a554615ba7} ()
[12/17/2008, 2:19:11] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/17/2008, 2:19:11] - Checking for HKLM\...\Winlogon\Notify\criqvv
[12/17/2008, 2:19:11] - Key not found: HKLM\...\Winlogon\Notify\criqvv, continuing.
[12/17/2008, 2:19:11] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[12/17/2008, 2:19:11] - BHO 4: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} (Yahoo! IE Services Button)
[12/17/2008, 2:19:11] - BHO 5: {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} (MSEvents Object)
[12/17/2008, 2:19:11] - ALERT: Found MSEvents Object!
[12/17/2008, 2:19:11] - BHO 6: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[12/17/2008, 2:19:11] - BHO 7: {ADDA45A2-9069-4D38-8A34-EA0252F31972} ()
[12/17/2008, 2:19:11] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/17/2008, 2:19:11] - Checking for HKLM\...\Winlogon\Notify\khfDvuts
[12/17/2008, 2:19:11] - Key not found: HKLM\...\Winlogon\Notify\khfDvuts, continuing.
[12/17/2008, 2:19:11] - BHO 8: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} (McAfee SiteAdvisor BHO)
[12/17/2008, 2:19:11] - BHO 9: {DBC80044-A445-435b-BC74-9C25C1C588A9} (Java™ Plug-In 2 SSV Helper)
[12/17/2008, 2:19:11] - Finished Searching Browser Helper Objects
[12/17/2008, 2:19:11] - *** Detected MSEvents Object
[12/17/2008, 2:19:11] - Trying to remove MSEvents Object...
[12/17/2008, 2:19:12] - Terminating Process: IEXPLORE.EXE
[12/17/2008, 2:19:13] - Terminating Process: RUNDLL32.EXE
[12/17/2008, 2:19:13] - Disabling Automatic Shell Restart
[12/17/2008, 2:19:13] - Terminating Process: EXPLORER.EXE
[12/17/2008, 2:19:13] - Suspending the NT Session Manager System Service
[12/17/2008, 2:19:13] - Terminating Windows NT Logon/Logoff Manager
[12/17/2008, 2:19:13] - Re-enabling Automatic Shell Restart
[12/17/2008, 2:19:13] - File to disable: C:\WINDOWS\system32\xxyxyXRI.dll
[12/17/2008, 2:19:13] - Renaming C:\WINDOWS\system32\xxyxyXRI.dll -> C:\WINDOWS\system32\xxyxyXRI.dll.vir
[12/17/2008, 2:19:13] - ! File rename was unsucessful.
[12/17/2008, 2:19:13] - Attempting to Deny Access to C:\WINDOWS\system32\xxyxyXRI.dll
[12/17/2008, 2:19:13] - *** IMPORTANT: Delete/Rename/Move on reboot (like Killbox) MAY NOT work.
[12/17/2008, 2:19:14] - processed file: C:\WINDOWS\system32\xxyxyXRI.dll
[12/17/2008, 2:19:14] - *** IMPORTANT: The file is disabled and will need to be deleted by the user.
[12/17/2008, 2:19:14] - Removing HKLM\...\Browser Helper Objects\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}
[12/17/2008, 2:19:14] - Removing HKCR\CLSID\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}
[12/17/2008, 2:19:14] - Adding Kill Bit for ActiveX for GUID: {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}
[12/17/2008, 2:19:14] - Deleting ATLEvents/MSEvents Registry entries
[12/17/2008, 2:19:14] - Removing HKLM\...\Winlogon\Notify\xxyxyXRI
[12/17/2008, 2:19:14] - Searching for Browser Helper Objects:
[12/17/2008, 2:19:14] - BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} ()
[12/17/2008, 2:19:14] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/17/2008, 2:19:14] - No filename found. Continuing.
[12/17/2008, 2:19:14] - BHO 2: {2bfa5287-38ac-45b3-aa59-c8a554615ba7} ()
[12/17/2008, 2:19:14] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/17/2008, 2:19:14] - Checking for HKLM\...\Winlogon\Notify\criqvv
[12/17/2008, 2:19:14] - Key not found: HKLM\...\Winlogon\Notify\criqvv, continuing.
[12/17/2008, 2:19:14] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[12/17/2008, 2:19:14] - BHO 4: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} (Yahoo! IE Services Button)
[12/17/2008, 2:19:14] - BHO 5: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[12/17/2008, 2:19:14] - BHO 6: {ADDA45A2-9069-4D38-8A34-EA0252F31972} ()
[12/17/2008, 2:19:14] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/17/2008, 2:19:14] - Checking for HKLM\...\Winlogon\Notify\khfDvuts
[12/17/2008, 2:19:14] - Key not found: HKLM\...\Winlogon\Notify\khfDvuts, continuing.
[12/17/2008, 2:19:14] - BHO 7: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} (McAfee SiteAdvisor BHO)
[12/17/2008, 2:19:14] - BHO 8: {DBC80044-A445-435b-BC74-9C25C1C588A9} (Java™ Plug-In 2 SSV Helper)
[12/17/2008, 2:19:14] - Finished Searching Browser Helper Objects
[12/17/2008, 2:19:14] - Finishing up...
[12/17/2008, 2:19:14] - A restart is needed.
[12/17/2008, 2:19:14] - Automatic Reboot on STOP Error is not set. User will have to manually restart.
[12/17/2008, 2:19:23] - Attempting to Restart via STOP error (Blue Screen!)
Here is my Hijackthis log startup: StartupList report, 12/17/2008, 5:00:17 PM
StartupList version: 1.52.2
Started from : C:\Program Files\Trend Micro\HijackThis\HijackThis.EXE
Detected: Windows XP SP3 (WinNT 5.01.2600)
Detected: Internet Explorer v7.00 (7.00.6000.16762)
* Using default options
==================================================
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Maxtor\ManagerApp\Onetouch.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\Program Files\QuickTime\qttask.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Lexar Media\USB Card Reader Driver v2.1g\Disk_Monitor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\Maxtor\Utils\SyncServices.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Protexis\License Service\PSIService.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\System32\dllhost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\notepad.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
--------------------------------------------------
Listing of startup folders:
Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
--------------------------------------------------
Checking Windows NT UserInit:
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
dla = C:\WINDOWS\system32\dla\tfswctrl.exe
iTunesHelper = "C:\Program Files\iTunes\iTunesHelper.exe"
MaxtorOneTouch = C:\Program Files\Maxtor\ManagerApp\Onetouch.exe
mxomssmenu = "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
NeroFilterCheck = C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
InCD = C:\Program Files\Nero\Nero 7\InCD\InCD.exe
Acrobat Assistant 8.0 = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
Adobe_ID0EYTHM = C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
ISUSPM Startup = C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime
mcagent_exe = C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
McENUI = C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
Kernel and Hardware Abstraction Layer = KHALMNPR.EXE
ATIPTA = C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
Disk Monitor = C:\Program Files\Lexar Media\USB Card Reader Driver v2.1g\Disk_Monitor.exe
SunJavaUpdateSched = "C:\Program Files\Java\jre6\bin\jusched.exe"
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background
BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} = "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
SpybotSD TeaTimer = C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
(Default) = C:\Program Files\Mozilla Firefox\firefox.exe http://www.symantec.com/techsupp/servlet/P...000049.000000d2
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
[AdobeUpdater]
=
--------------------------------------------------
Load/Run keys from C:\WINDOWS\WIN.INI:
load=*INI section not found*
run=*INI section not found*
Load/Run keys from Registry:
HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=jrugpg.dll,avgrsstx.dll
--------------------------------------------------
Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*
Shell & screensaver key from Registry:
Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
drivers=*Registry value not found*
Policies Shell key:
HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*
--------------------------------------------------
Enumerating Browser Helper Objects:
(no name) - (no file) - {02478D38-C3F9-4EFB-9B51-7695ECA05670}
WormRadar.com IESiteBlocker.NavFilter - C:\Program Files\AVG\AVG8\avgssie.dll - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
(no name) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
(no name) - C:\Program Files\Yahoo!\Common\yiesrvc.dll - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}
(no name) - C:\Program Files\Java\jre6\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
(no name) - (no file) - {82fd5216-c710-43a9-b8c3-a9e56fd22e13}
(no name) - C:\WINDOWS\system32\khfDvuts.dll (file missing) - {901CE412-BB4C-45F1-A9B7-5EFD60184BF1}
(no name) - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll - {B164E929-A1B6-4A06-B104-2CD0E90A88FF}
(no name) - (no file) - {BB21F9F6-F56F-4D45-ACBF-6662FC8C0205}
(no name) - C:\Program Files\Java\jre6\bin\jp2ssv.dll - {DBC80044-A445-435b-BC74-9C25C1C588A9}
--------------------------------------------------
Enumerating Task Scheduler jobs:
ejxygare.job
McDefragTask.job
McQcTask.job
--------------------------------------------------
Enumerating Download Program Files:
[Office Genuine Advantage Validation Tool]
InProcServer32 = C:\WINDOWS\system32\OGACheckControl.DLL
CODEBASE = http://download.microsoft.com/download/e/4.../OGAControl.cab
[Shockwave ActiveX Control]
CODEBASE = http://download.macromedia.com/pub/shockwa...director/sw.cab
[Windows Genuine Advantage Validation Tool]
InProcServer32 = C:\WINDOWS\system32\legitcheckcontrol.dll
CODEBASE = http://go.microsoft....k/?LinkID=39204
[MUWebControl Class]
InProcServer32 = C:\WINDOWS\system32\muweb.dll
CODEBASE = http://update.microsoft.com/microsoftupdat...b?1169404667234
[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\FlDbg9c.ocx
CODEBASE = http://download.macromedia.com/pub/shockwa...ash/swflash.cab
--------------------------------------------------
Enumerating Winsock LSP files:
NameSpace #4: C:\Program Files\Bonjour\mdnsNSP.dll
--------------------------------------------------
Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*
Windows NT checkdisk command:
BootExecute = autocheck autochk *
Windows NT 'Wininit.ini':
PendingFileRenameOperations: C:\WINDOWS\system32\WPRO_40_1340woem.tmp||C:\WINDOWS\system32\WPRO_40_1340woem_nm.tmp||C:\DOCUME~1\Carlos\LOCALS~1\Temp\~nsu.tmp\Au_.exe||C:\DOCUME~1\Carlos\LOCALS~1\Temp\~nsu.tmp||C:\Config.Msi\8f8a70.rbf||C:\Config.Msi\8f8a78.rbf||C:\Config.Msi\8f8a7a.rbf||C:\WINDOWS\system32\SET7F.tmp => C:\WINDOWS\system32\mshtml.dll||~
--------------------------------------------------
Enumerating ShellServiceObjectDelayLoad items:
PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll
WPDShServiceObj: C:\WINDOWS\system32\WPDShServiceObj.dll
UPnPMonitor: C:\WINDOWS\system32\upnpui.dll
--------------------------------------------------
End of report, 11,584 bytes
Report generated in 0.266 seconds
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
Here is the Hijackthis log after running every program known to mankind. 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:09:05 PM, on 12/17/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Maxtor\ManagerApp\Onetouch.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\Program Files\QuickTime\qttask.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Lexar Media\USB Card Reader Driver v2.1g\Disk_Monitor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\Maxtor\Utils\SyncServices.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Protexis\License Service\PSIService.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\System32\dllhost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\notepad.exe
C:\WINDOWS\system32\notepad.exe
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = About:Blank
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = About:Blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft....k/?LinkId=54843
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {82fd5216-c710-43a9-b8c3-a9e56fd22e13} - (no file)
O2 - BHO: (no name) - {901CE412-BB4C-45F1-A9B7-5EFD60184BF1} - C:\WINDOWS\system32\khfDvuts.dll (file missing)
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: (no name) - {BB21F9F6-F56F-4D45-ACBF-6662FC8C0205} - (no file)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\Program Files\Maxtor\ManagerApp\Onetouch.exe
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Disk Monitor] C:\Program Files\Lexar Media\USB Card Reader Driver v2.1g\Disk_Monitor.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [] C:\Program Files\Mozilla Firefox\firefox.exe http://www.symantec.com/techsupp/servlet/P...000049.000000d2
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?LinkID=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1169404667234
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: linkscanner - (no CLSID) - (no file)
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O20 - AppInit_DLLs: jrugpg.dll,avgrsstx.dll
O20 - Winlogon Notify: !SASWinLogon - C:\WINDOWS\
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: Inpqmc - Nero AG - (no file)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: LeapFrog Connect Device Service - Unknown owner - C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
O23 - Service: MaxBackServiceInt - Unknown owner - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: MaxSyncService (NTService1) - - C:\Program Files\Maxtor\Utils\SyncServices.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Program Files\Common Files\Protexis\License Service\PSIService.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
--
End of file - 15051 bytes
Thank you guys in advance & I look forward to your response.
