[andrew1185uk]

hi, im having a few problems with this.


1353BEC5-B8CE-6C31-8307-BD8425801A55
5BF72D60-2E30-2CAF-916A-DA031CE59D84
67D5B9C4-6D8F-AA9A-E936-A3A4CB7A5E81

I deleted these fine.


however, for the next part i exported and saved as CLSID key as you said but i only get HKEY_CLASSES_ROOT\CLSID on the left pane and below it the following.

HKEY_CLASSES_ROOT\CLSID\{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}
HKEY_CLASSES_ROOT\CLSID\{3DA165B6-CC41-11d2-BDC6-00C04F79EC6B}
HKEY_CLASSES_ROOT\CLSID\{436F4AD7-C95B-4d2f-B0F8-8DC643F7A200}
HKEY_CLASSES_ROOT\CLSID\{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}
HKEY_CLASSES_ROOT\CLSID\{8D8763AB-E93B-4812-964E-F04E0008FD50}




there seems to be no sign of the ones you said. when i put the other ones in the adress bar such as HKEY_CLASSES_ROOT\CLSID\{5BF72D60-2E30-2CAF-916A-DA031CE59D84}

all i get is back to the CLSID folder with the folders underneath it or in it being the ones above.

[Advertisements]

hi, im having a few problems with this.


1353BEC5-B8CE-6C31-8307-BD8425801A55
5BF72D60-2E30-2CAF-916A-DA031CE59D84
67D5B9C4-6D8F-AA9A-E936-A3A4CB7A5E81

I deleted these fine.


however, for the next part i exported and saved as CLSID key as you said but i only get HKEY_CLASSES_ROOT\CLSID on the left pane and below it the following.

HKEY_CLASSES_ROOT\CLSID\{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}
HKEY_CLASSES_ROOT\CLSID\{3DA165B6-CC41-11d2-BDC6-00C04F79EC6B}
HKEY_CLASSES_ROOT\CLSID\{436F4AD7-C95B-4d2f-B0F8-8DC643F7A200}
HKEY_CLASSES_ROOT\CLSID\{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}
HKEY_CLASSES_ROOT\CLSID\{8D8763AB-E93B-4812-964E-F04E0008FD50}




there seems to be no sign of the ones you said. when i put the other ones in the adress bar such as HKEY_CLASSES_ROOT\CLSID\{5BF72D60-2E30-2CAF-916A-DA031CE59D84}

all i get is back to the CLSID folder with the folders underneath it or in it being the ones above.

[andrew1185uk]

hi, im having a few problems with this.


1353BEC5-B8CE-6C31-8307-BD8425801A55
5BF72D60-2E30-2CAF-916A-DA031CE59D84
67D5B9C4-6D8F-AA9A-E936-A3A4CB7A5E81

I deleted these fine.


however, for the next part i exported and saved as CLSID key as you said but i only get HKEY_CLASSES_ROOT\CLSID on the left pane and below it the following.

HKEY_CLASSES_ROOT\CLSID\{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}
HKEY_CLASSES_ROOT\CLSID\{3DA165B6-CC41-11d2-BDC6-00C04F79EC6B}
HKEY_CLASSES_ROOT\CLSID\{436F4AD7-C95B-4d2f-B0F8-8DC643F7A200}
HKEY_CLASSES_ROOT\CLSID\{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}
HKEY_CLASSES_ROOT\CLSID\{8D8763AB-E93B-4812-964E-F04E0008FD50}




there seems to be no sign of the ones you said. when i put the other ones in the adress bar such as HKEY_CLASSES_ROOT\CLSID\{5BF72D60-2E30-2CAF-916A-DA031CE59D84}

all i get is back to the CLSID folder with the folders underneath it or in it being the ones above.

[tampabelle]

Hi andrew,

I have a atleast a thousand entries under CLSID !!!!! Dont worry about not finding those entries.

Can you post a fresh HJT log??

[andrew1185uk]

ahhhhh!!, i cant get my pc to come on now. after deleting the first ones i replied to your post, then turned pc off. Since then ive attempted to get onto the pc, however the pc seems to stop after the black windows loading screen at a blue windows xp screen usually where the log in box appears. ive tried restarting in safe mode and tats the same as well as last known good configuraion.

hope i havent done something wrong with the registry keys .

im on another pc at the moment, but if i can get on will post the log as soon as possible.

cheers.

[tampabelle]

Hi Andrew,

It is sad that you are having this problem now !!!!

While we do have another option, it requires extensive knowledge of Windows and the use of recovery console, I would prefer you to do the repair install for Windows XP.

For this you need the Windows XP CD !!!!!

Please visit the page - http://www.windowsreinstall.com/.

Scroll right down to the bottom of the page. There different versions of Windows are listed. Choose Windows XP (Home or Pro whichever is appropriate for you).

Please read the instructions on Repair Install.

I want you to make a special note of the Part 3. Please do not press any key when the PC prompts you -"Press any key to boot from CD...". It will automatically copy the system files from the CD onto the hard disk and then boot from the Hard disk !!!


If you have any questions, then please ask me before you proceed.

[andrew1185uk]

hi again, ive tried repairing from cd as you said, but all i seem to get is a "CHECKING CD TO BOOT" or similar message and then windows loads as normal and crashes at that stage again.

ive also tried F2 to go into the system part and changed boot options to attempt to boot from CD first as well as try all other devices, but im having no success with this.

[tampabelle]

Hi Andrew,

Two Questions -

1. Do you have XP Home edition or the XP Pro edition ???

2. The CD that you tried is the Windows XP CD or a CD given by the PC manufacturer ??

[andrew1185uk]

hi again, the cd is xp pro, however its a copy of the original of my dad, as the original was lost. this could be the problem i think. ive left the computer on for a good few hours in hope of it just loading extremely slow, but its still stuck at that point.

[tampabelle]

Hi,

With all the stress on copyrights and protection against copying CDs, it is possible that the CD you have is not being recognized as original Windows CD !!!!!!

Can you lay your hands on another "Original" Windows XP Pro ???

For repair install, we wont need the Windows Key !!!!

[andrew1185uk]

yes, i think a friend has an original. ill see what i can do and get back to you, see if we can get this sorted!!!, then hopefully the spyware!.

[tampabelle]

Thats great news.

Please try that and let me know how it goes !!

Make sure that it is Windows XP Pro and not XP Home edition

Edited by tampabelle, 19 July 2005 - 08:39 AM.

[andrew1185uk]

right, ive repaired it finally!!, took a while but got there. heres my hijack this log.

Logfile of HijackThis v1.99.1
Scan saved at 00:23:31, on 20/07/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\gearsec.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
C:\WINDOWS\System32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe
C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe
C:\Program Files\Trust\460LR MOUSE WIRELESS OPTICALOFFICE\1.1\moffice.exe
C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\Program Files\Trust\460LR MOUSE WIRELESS OPTICALOFFICE\1.1\MOUSE32A.DAT
C:\Program Files\Netropa\Multimedia Keyboard\TrayMon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Netropa\Onscreen Display\OSD.exe
C:\PROGRA~1\Sygate\SPF\smc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\802.11 Wireless LAN\802.11b Wireless CardBus & PCI Adapter HW.11 V1.10\WlanCU.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\WINDOWS\System32\msiexec.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Desktop\HijackThis.exe

F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe"
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe"
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe"
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Trust\460LR MOUSE WIRELESS OPTICALOFFICE\1.1\moffice.exe
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [EPSON Stylus C64 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C64 Series" /O6 "USB001" /M "Stylus C64"
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Wireless Configuration Utility.lnk = C:\Program Files\802.11 Wireless LAN\802.11b Wireless CardBus & PCI Adapter HW.11 V1.10\WlanCU.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} - http://go.microsoft....467&clcid=0x409
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} - http://us.dl1.yimg.c...nst20040510.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} - http://www3.ca.com/s...nfo/webscan.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - http://www.tynebridg...sCamControl.ocx
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - http://messenger.msn...pdownloader.cab
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: gearsec - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: PC-cillin PersonalFirewall (PCCPFW) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe

[tampabelle]

Hi Andrew,


Thats wonderful !!!!

There are a couple of minor things to fix -

Run Hijack This and click on scan. The following items need to be fixed -

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

Close all windows other than Hijack This. Check the boxes next to above items and click on Fix checked.

Reboot the PC in Safe Mode.

Delete the file - C:\WINDOWS\web\related.htm

Reboot the PC in Normal Mode.

Please visit - Windows security and critical updates

and install all updates. Do an express install !!!!!!

Reboot the PC in Normal Mode and post a fresh HJT log here.

[andrew1185uk]

hi again all updated and the files checked and deleted.


Logfile of HijackThis v1.99.1
Scan saved at 01:45:25, on 20/07/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\gearsec.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe
C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe
C:\Program Files\Trust\460LR MOUSE WIRELESS OPTICALOFFICE\1.1\moffice.exe
C:\Program Files\Trust\460LR MOUSE WIRELESS OPTICALOFFICE\1.1\MOUSE32A.DAT
C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Netropa\Multimedia Keyboard\TrayMon.exe
C:\Program Files\Netropa\Onscreen Display\OSD.exe
C:\PROGRA~1\Sygate\SPF\smc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\802.11 Wireless LAN\802.11b Wireless CardBus & PCI Adapter HW.11 V1.10\WlanCU.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Desktop\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe

F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe"
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe"
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe"
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Trust\460LR MOUSE WIRELESS OPTICALOFFICE\1.1\moffice.exe
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [EPSON Stylus C64 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C64 Series" /O6 "USB001" /M "Stylus C64"
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Wireless Configuration Utility.lnk = C:\Program Files\802.11 Wireless LAN\802.11b Wireless CardBus & PCI Adapter HW.11 V1.10\WlanCU.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} - http://go.microsoft....467&clcid=0x409
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} - http://us.dl1.yimg.c...nst20040510.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1121818960732
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1121819161186
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} - http://www3.ca.com/s...nfo/webscan.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - http://www.tynebridg...sCamControl.ocx
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - http://messenger.msn...pdownloader.cab
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: gearsec - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: PC-cillin PersonalFirewall (PCCPFW) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe

[tampabelle]

Hi Andrew,

Your HJT log is clean.

However, the log indicates that Service Pack 1 and Service Pack 2 havent been installed yet. This will expose you to infections and you may be back here before long !!!!!

Please get them at the earliest (before you download anything on Shareaza) !!!!