Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\eubct\hrflurs.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\securitysuite.exe
C:\Documents and Settings\Andrew\Local Settings\Temp\Rar$EX01.484\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drs...esearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drs...esearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drs...esearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = 192.168.0.100
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [xvkbmi] C:\WINDOWS\system32\mlcpwweo\xvkbmi.exe
O4 - HKLM\..\Run: [xjcxlie] C:\WINDOWS\system32\jhqxngb\xjcxlie.exe
O4 - HKLM\..\Run: [xinjnddj] C:\WINDOWS\system32\lxfl\xinjnddj.exe
O4 - HKLM\..\Run: [woigkg] C:\WINDOWS\system32\nhqw\woigkg.exe
O4 - HKLM\..\Run: [wbcadm] C:\WINDOWS\system32\axtfljqr\wbcadm.exe
O4 - HKLM\..\Run: [vrui] C:\WINDOWS\system32\dkugh\vrui.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [Uninstall_WinTools] C:\WINDOWS\Temp\WTuninst.exe /remove
O4 - HKLM\..\Run: [SystemCheck] C:\WINDOWS\SysCheckBop32
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [sudefwfl] C:\WINDOWS\system32\kbmekjrx\sudefwfl.exe
O4 - HKLM\..\Run: [SkyH2] C:\DOCUME~1\Andrew\LOCALS~1\Temp\qrree.exe
O4 - HKLM\..\Run: [sjypijr] C:\WINDOWS\system32\yfgwqy\sjypijr.exe
O4 - HKLM\..\Run: [ruqme] C:\WINDOWS\system32\aogngjq\ruqme.exe
O4 - HKLM\..\Run: [rinnj] C:\WINDOWS\system32\aearpyde\rinnj.exe
O4 - HKLM\..\Run: [ricgimej] C:\WINDOWS\system32\pufhvit\ricgimej.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [qtkauc] C:\WINDOWS\system32\exeblk\qtkauc.exe
O4 - HKLM\..\Run: [qbpqsko] C:\WINDOWS\system32\uanw\qbpqsko.exe
O4 - HKLM\..\Run: [pbuq] C:\WINDOWS\system32\gnwsu\pbuq.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [mmiv] C:\WINDOWS\system32\fgumdu\mmiv.exe
O4 - HKLM\..\Run: [lvfaxqvq] C:\WINDOWS\system32\wfihkg\lvfaxqvq.exe
O4 - HKLM\..\Run: [lphn] C:\WINDOWS\system32\cjtn\lphn.exe
O4 - HKLM\..\Run: [lmuaxx] C:\WINDOWS\system32\miukshx\lmuaxx.exe
O4 - HKLM\..\Run: [lglja] C:\WINDOWS\system32\bymjvjrb\lglja.exe
O4 - HKLM\..\Run: [khlugi] C:\WINDOWS\system32\hqxiomoe\khlugi.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [kdx] C:\WINDOWS\kdx\KHost.exe
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\iipall.exe
O4 - HKLM\..\Run: [iyhgl] C:\WINDOWS\system32\obxq\iyhgl.exe
O4 - HKLM\..\Run: [ijrbbpd] C:\WINDOWS\ptcore.exe
O4 - HKLM\..\Run: [iiafjxcr] C:\WINDOWS\system32\wakfs\iiafjxcr.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [gxfs] C:\WINDOWS\system32\kukf\gxfs.exe
O4 - HKLM\..\Run: [Gwnilgi] C:\Program Files\Mtgwki\Iwqb.exe
O4 - HKLM\..\Run: [gsfqhlus] C:\WINDOWS\system32\eunl\gsfqhlus.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [fqatl] C:\WINDOWS\system32\cosykjd\fqatl.exe
O4 - HKLM\..\Run: [etkfwlmh] C:\WINDOWS\system32\cdmmckll\etkfwlmh.exe
O4 - HKLM\..\Run: [eqruyp] C:\WINDOWS\system32\vwtgvmp\eqruyp.exe
O4 - HKLM\..\Run: [eqqqpe] C:\WINDOWS\system32\iuopmwbw\eqqqpe.exe
O4 - HKLM\..\Run: [DI2] "C:\DOCUME~1\Andrew\LOCALS~1\Temp\27.exe\27.exe"
O4 - HKLM\..\Run: [Daudi] C:\WINDOWS\system32\daudi.exe
O4 - HKLM\..\Run: [cid] C:\Program Files\Easy Messenger\cid.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [cbdbqhaw] C:\WINDOWS\system32\hcabkij\cbdbqhaw.exe
O4 - HKLM\..\Run: [bvbufyo] C:\WINDOWS\system32\klonaep\bvbufyo.exe
O4 - HKLM\..\Run: [Bles] c:\windows\system\bles.exe
O4 - HKLM\..\Run: [bhktq] C:\WINDOWS\system32\ribvrofr\bhktq.exe
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [0041qgi4] C:\Program Files\0041qgi4\0041qgi4.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [tsvcin] C:\WINDOWS\system32\n20050308.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [vkfqx] C:\WINDOWS\system32\ewxdh\vkfqx.exe
O4 - HKLM\..\Run: [hrflurs] C:\WINDOWS\system32\eubct\hrflurs.exe
O4 - HKLM\..\Run: [vpckhoti] C:\WINDOWS\system32\oaedhmcy\vpckhoti.exe
O4 - HKLM\..\Run: [vokw] C:\WINDOWS\system32\yoahfw\vokw.exe
O4 - HKLM\..\Run: [SpySpotter] C:\Program Files\SpySpotter\SpySpotter.exe -onreboot
O4 - HKLM\..\Run: [oykqknj] c:\windows\system32\kabnuid.exe
O4 - HKLM\..\Run: [checkrun] c:\windows\system32\elitewvj32.exe
O4 - HKLM\..\Run: [dxeugx] c:\windows\system32\irrocf.exe r
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Cfewbv] C:\WINDOWS\system32\l?[bleep].exe
O4 - HKCU\..\Run: [Usrr] C:\Program Files\etea\rpen.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'xfire_lsp_10908.dll' missing
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O20 - Winlogon Notify: RunOnce - C:\WINDOWS\system32\jtl0073me.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: hrflurseubct - Unknown owner - C:\WINDOWS\system32\eubct\hrflurs.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: npkcsvc - INCA Internet Co., Ltd. - C:\WINDOWS\system32\npkcsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - c:\windows\SvcProc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: xvkbmimlcpwweo - Unknown owner - C:\WINDOWS\system32\mlcpwweo\xvkbmi.exe